0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 375.835439] binder: 2670:2672 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.003831] binder: 2682:2687 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:51 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:51 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:51 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:51 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 376.004878] binder: 2682:2687 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.095629] binder: 2700:2705 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 376.096444] binder: 2700:2705 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:51 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:51 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:51 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 376.159989] binder: 2718:2720 Acquire 1 refcount change on invalid ref 0 ret -22 [ 376.160359] binder: 2718:2720 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.222755] binder: 2724:2731 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:51 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:51 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 376.226461] binder: 2724:2731 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:51 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:51 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 376.301759] binder: 2737:2742 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:51 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 376.302794] binder: 2737:2742 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.395632] binder: 2755:2756 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:51 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:51 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:51 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:51 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 376.396606] binder: 2755:2756 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.459636] binder: 2763:2768 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:51 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:51 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 376.460004] binder: 2763:2768 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.584484] binder: 2782:2787 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 376.584967] binder: 2782:2787 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.683824] binder: 2793:2795 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:52 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 376.689836] binder: 2793:2795 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.777664] binder: 2810:2816 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:52 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 376.778284] binder: 2810:2816 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.855850] binder: 2825:2829 Acquire 1 refcount change on invalid ref 0 ret -22 [ 376.857053] binder: 2825:2829 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 376.921591] binder: 2838:2839 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:52 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:52 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 376.935515] binder: 2838:2839 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 376.983040] binder: 2847:2848 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 376.983863] binder: 2847:2848 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:52 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 377.045978] binder: 2857:2862 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:52 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:52 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:52 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 377.046377] binder: 2857:2862 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:52 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 377.117390] binder: 2867:2876 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 377.117705] binder: 2867:2876 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:52 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:52 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 377.214995] binder: 2888:2892 Acquire 1 refcount change on invalid ref 0 ret -22 [ 377.215530] binder: 2888:2892 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:52 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:52 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 377.320915] binder: 2902:2908 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:52 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 377.321909] binder: 2902:2908 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 377.446185] binder: 2923:2927 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:52 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 377.446654] binder: 2923:2927 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 377.546234] binder: 2938:2944 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:52 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 377.546506] binder: 2938:2944 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 377.633714] binder: 2955:2961 Acquire 1 refcount change on invalid ref 0 ret -22 [ 377.633987] binder: 2955:2961 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:53 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 377.739285] binder: 2972:2976 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 377.740636] binder: 2972:2976 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:53 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:53 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 377.837905] binder: 2983:2989 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 377.853270] binder: 2983:2989 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:53 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:53 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 377.958935] binder: 3000:3012 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:53 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 377.959781] binder: 3000:3012 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 378.070711] binder: 3018:3028 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:53 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 378.071152] binder: 3018:3028 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 378.147495] binder: 3039:3042 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:53 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 378.148009] binder: 3039:3042 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 378.221705] binder: 3052:3056 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:53 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 378.221953] binder: 3052:3056 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:53 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 378.343703] binder: 3064:3074 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 378.344915] binder: 3064:3074 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 378.426345] binder: 3084:3086 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:53 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:53 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 378.426598] binder: 3084:3086 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:53 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 378.513130] binder: 3096:3102 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:53 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:54 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 378.516617] binder: 3096:3102 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 378.608319] binder: 3107:3111 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:54 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 378.615578] binder: 3107:3111 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 378.713490] binder: 3124:3129 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:54 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 378.714017] binder: 3124:3129 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 378.812739] binder: 3138:3147 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:54 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:54 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 378.820318] binder: 3138:3147 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 378.985254] binder: 3162:3174 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 378.986821] binder: 3162:3174 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 379.117661] binder: 3190:3191 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:54 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 379.117995] binder: 3190:3191 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:54 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 379.196078] binder: 3201:3205 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:54 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 379.196519] binder: 3201:3205 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 379.264913] nla_parse: 30 callbacks suppressed 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 379.264919] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:54 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:54 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 379.356328] binder: 3217:3220 Acquire 1 refcount change on invalid ref 0 ret -22 [ 379.356636] binder: 3217:3220 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:54 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:54 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 379.400430] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:54 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:54 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:54 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 379.498477] binder: 3245:3250 Acquire 1 refcount change on invalid ref 0 ret -22 [ 379.498850] binder: 3245:3250 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 379.511369] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:54 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 379.598029] binder: 3259:3264 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:55 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 379.600975] binder: 3259:3264 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:55 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 379.669605] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 379.672700] binder: 3277:3281 Acquire 1 refcount change on invalid ref 0 ret -22 [ 379.673157] binder: 3277:3281 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 379.791256] binder: 3287:3300 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:55 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 379.799662] binder: 3287:3300 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 379.804849] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:55 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 379.896587] binder: 3312:3322 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:55 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 379.897450] binder: 3312:3322 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 379.953978] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:55 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 380.017530] binder: 3335:3338 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 380.017995] binder: 3335:3338 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:55 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:55 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 380.119891] binder: 3353:3354 Acquire 1 refcount change on invalid ref 0 ret -22 [ 380.120432] binder: 3353:3354 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 380.135269] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:55 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 380.238657] binder: 3366:3367 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:55 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 380.240411] binder: 3366:3367 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:55 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:55 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 380.278488] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:55 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 380.353622] binder: 3386:3392 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:55 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:56 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:56 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 380.354717] binder: 3386:3392 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 380.373336] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 380.411060] binder: 3403:3407 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:56 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 380.411588] binder: 3403:3407 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:56 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 380.492927] binder: 3417:3421 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:56 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 380.494047] binder: 3417:3421 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:56 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 380.508856] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:56 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 380.588561] binder: 3430:3434 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 380.588940] binder: 3430:3434 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:56 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:56 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 380.678442] binder: 3447:3451 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 380.679967] binder: 3447:3451 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:56 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 380.755564] binder: 3472:3475 Acquire 1 refcount change on invalid ref 0 ret -22 [ 380.757048] binder: 3472:3475 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:56 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:56 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 380.857898] binder: 3480:3485 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:56 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:56 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:56 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 380.858717] binder: 3480:3485 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:56 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 380.948343] binder: 3500:3505 Acquire 1 refcount change on invalid ref 0 ret -22 [ 380.948687] binder: 3500:3505 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:57 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 381.055438] binder: 3516:3520 Acquire 1 refcount change on invalid ref 0 ret -22 [ 381.059094] binder: 3516:3520 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:57 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 381.121719] binder: 3532:3536 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:57 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 381.123186] binder: 3532:3536 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 381.191184] binder: 3546:3550 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:57 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 381.192165] binder: 3546:3550 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 381.293101] binder: 3559:3563 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 381.293847] binder: 3559:3563 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 381.348000] binder: 3572:3574 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:57 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 381.348393] binder: 3572:3574 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 381.448790] binder: 3586:3593 Acquire 1 refcount change on invalid ref 0 ret -22 [ 381.449087] binder: 3586:3593 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:57 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 381.539231] binder: 3599:3607 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:57 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 381.539651] binder: 3599:3607 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 381.622278] binder: 3617:3619 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 381.622600] binder: 3617:3619 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:57 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:57 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:57 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 381.705291] binder: 3635:3636 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:57 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:57 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 381.705668] binder: 3635:3636 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:58 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 381.805395] binder: 3647:3658 Acquire 1 refcount change on invalid ref 0 ret -22 [ 381.814070] binder: 3647:3658 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 381.917827] binder: 3664:3667 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 381.918151] binder: 3664:3667 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 381.978972] binder: 3675:3680 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 381.984769] binder: 3675:3680 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 382.073926] binder: 3691:3700 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 382.078213] binder: 3691:3700 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 382.216728] binder: 3718:3723 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 382.217083] binder: 3718:3723 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 382.299220] binder: 3731:3733 Acquire 1 refcount change on invalid ref 0 ret -22 [ 382.299616] binder: 3731:3733 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 382.400271] binder: 3745:3747 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 382.402962] binder: 3745:3747 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:58 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 382.458652] binder: 3762:3764 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 382.458983] binder: 3762:3764 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 382.586495] binder: 3768:3779 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 382.587554] binder: 3768:3779 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:58 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 382.642842] binder: 3784:3788 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 382.643658] binder: 3784:3788 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 382.753992] binder: 3798:3806 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:58 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:58 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 382.778183] binder: 3798:3806 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 382.839561] binder: 3812:3813 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:58 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:58 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 382.839954] binder: 3812:3813 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:59 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 382.928793] binder: 3826:3829 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:59 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:59 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 382.929357] binder: 3826:3829 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 383.028912] binder: 3841:3846 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:59 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:59 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 383.029781] binder: 3841:3846 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:59 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 383.114116] binder: 3860:3862 Acquire 1 refcount change on invalid ref 0 ret -22 [ 383.114691] binder: 3860:3862 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:59 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:59 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:59 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 383.215822] binder: 3870:3872 Acquire 1 refcount change on invalid ref 0 ret -22 [ 383.216209] binder: 3870:3872 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 383.334466] binder: 3891:3892 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:59 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:59 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:59 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 383.334853] binder: 3891:3892 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:59 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 383.403145] binder: 3904:3907 Acquire 1 refcount change on invalid ref 0 ret -22 [ 383.403511] binder: 3904:3907 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:59 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:59 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 383.606285] binder: 3918:3926 Acquire 1 refcount change on invalid ref 0 ret -22 [ 383.616486] binder: 3918:3926 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 383.756703] binder: 3930:3935 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:59 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:59 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 383.757906] binder: 3930:3935 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 383.833119] binder: 3945:3950 Acquire 1 refcount change on invalid ref 0 ret -22 [ 383.833405] binder: 3945:3950 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 383.936840] binder: 3959:3968 Acquire 1 refcount change on invalid ref 0 ret -22 [ 383.937216] binder: 3959:3968 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:59 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:59 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:59 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 383.996133] binder: 3978:3979 Acquire 1 refcount change on invalid ref 0 ret -22 [ 383.996549] binder: 3978:3979 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:59 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:59 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 384.092763] binder: 3996:3997 Acquire 1 refcount change on invalid ref 0 ret -22 [ 384.099897] binder: 3996:3997 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 384.229120] binder: 4007:4014 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:59 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:56:59 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 384.232383] binder: 4007:4014 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 384.349823] binder: 4030:4039 Acquire 1 refcount change on invalid ref 0 ret -22 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:56:59 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:59 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:56:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:56:59 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:56:59 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:56:59 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 384.350179] binder: 4030:4039 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:56:59 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:00 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:00 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 384.434213] binder: 4043:4045 Acquire 1 refcount change on invalid ref 0 ret -22 [ 384.442403] binder: 4043:4045 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:00 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:00 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:00 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 384.479214] nla_parse: 30 callbacks suppressed 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:00 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:00 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 384.479220] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:00 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:00 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 384.493980] binder: 4057:4059 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:00 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:00 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:00 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:00 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 384.494252] binder: 4057:4059 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:00 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:00 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:00 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 384.573366] binder: 4070:4071 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:00 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:00 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:00 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:00 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 384.574194] binder: 4070:4071 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:00 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:00 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:00 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 384.610077] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:00 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:00 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:00 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:00 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 384.652114] binder: 4081:4083 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:00 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:00 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:00 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 384.653766] binder: 4081:4083 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:00 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 384.767544] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:00 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:00 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 384.814132] binder: 4102:4107 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:00 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 384.815617] binder: 4102:4107 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 384.897152] binder: 4117:4121 Acquire 1 refcount change on invalid ref 0 ret -22 [ 384.898012] binder: 4117:4121 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 384.900695] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:01 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 384.945240] binder: 4127:4128 Acquire 1 refcount change on invalid ref 0 ret -22 [ 384.945486] binder: 4127:4128 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 385.029134] binder: 4133:4142 Acquire 1 refcount change on invalid ref 0 ret -22 [ 385.029697] binder: 4133:4142 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:01 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:01 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:01 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 385.041082] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:01 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 385.156668] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:01 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:01 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 385.178358] binder: 4157:4166 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 385.178714] binder: 4157:4166 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 385.253819] binder: 4174:4178 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:01 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:01 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:01 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 385.254085] binder: 4174:4178 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:01 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:01 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:01 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 385.293888] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 385.340092] binder: 4189:4191 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 385.341213] binder: 4189:4191 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:01 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:01 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 385.455594] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 385.457491] binder: 4204:4209 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:01 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 385.458590] binder: 4204:4209 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:01 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:01 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 385.537287] binder: 4215:4220 Acquire 1 refcount change on invalid ref 0 ret -22 [ 385.538085] binder: 4215:4220 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:01 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:01 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 385.542581] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:01 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:01 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:01 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 385.641791] binder: 4231:4238 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:02 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 385.643100] binder: 4231:4238 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 385.659252] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:02 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 385.742523] binder: 4244:4257 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:02 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 385.742987] binder: 4244:4257 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 385.840063] binder: 4261:4263 Acquire 1 refcount change on invalid ref 0 ret -22 [ 385.840435] binder: 4261:4263 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 385.950594] binder: 4278:4284 Acquire 1 refcount change on invalid ref 0 ret -22 [ 385.950924] binder: 4278:4284 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:02 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:02 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 386.016091] binder: 4297:4299 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:02 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 386.016612] binder: 4297:4299 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 386.116164] binder: 4312:4316 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:02 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 386.118278] binder: 4312:4316 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 386.193661] binder: 4323:4326 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 386.198278] binder: 4323:4326 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:02 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:02 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 386.312955] binder: 4337:4345 Acquire 1 refcount change on invalid ref 0 ret -22 [ 386.313718] binder: 4337:4345 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 386.371005] binder: 4355:4357 Acquire 1 refcount change on invalid ref 0 ret -22 [ 386.371255] binder: 4355:4357 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:02 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:02 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 386.440761] binder: 4364:4366 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 386.441210] binder: 4364:4366 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 386.491998] binder: 4370:4374 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:02 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:02 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 386.493221] binder: 4370:4374 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:02 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:02 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:03 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 386.582534] binder: 4383:4384 Acquire 1 refcount change on invalid ref 0 ret -22 [ 386.583206] binder: 4383:4384 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 386.683823] binder: 4398:4400 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:03 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 386.685512] binder: 4398:4400 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 386.782666] binder: 4413:4417 Acquire 1 refcount change on invalid ref 0 ret -22 [ 386.783691] binder: 4413:4417 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 386.886677] binder: 4429:4437 Acquire 1 refcount change on invalid ref 0 ret -22 [ 386.894606] binder: 4429:4437 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 386.992045] binder: 4449:4451 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:03 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 386.992961] binder: 4449:4451 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 387.136123] binder: 4468:4472 Acquire 1 refcount change on invalid ref 0 ret -22 [ 387.136599] binder: 4468:4472 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 387.218808] binder: 4482:4486 Acquire 1 refcount change on invalid ref 0 ret -22 [ 387.219272] binder: 4482:4486 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 387.352819] binder: 4496:4501 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:03 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 387.353167] binder: 4496:4501 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 387.422529] binder: 4511:4516 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:03 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 387.425400] binder: 4511:4516 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 387.480456] binder: 4522:4525 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:03 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 387.480984] binder: 4522:4525 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:03 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:03 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 387.563802] binder: 4537:4540 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:04 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 387.564760] binder: 4537:4540 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:04 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:04 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 387.682182] binder: 4556:4560 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:04 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 387.682596] binder: 4556:4560 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 387.770612] binder: 4564:4567 Acquire 1 refcount change on invalid ref 0 ret -22 [ 387.770988] binder: 4564:4567 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:04 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:04 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 387.868107] binder: 4584:4586 Acquire 1 refcount change on invalid ref 0 ret -22 [ 387.868575] binder: 4584:4586 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 387.927904] binder: 4590:4594 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:04 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 387.928774] binder: 4590:4594 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:04 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 388.051137] binder: 4609:4611 Acquire 1 refcount change on invalid ref 0 ret -22 [ 388.057633] binder: 4609:4611 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 388.114043] binder: 4625:4628 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:04 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:04 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 388.114403] binder: 4625:4628 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 388.202144] binder: 4637:4642 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:04 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 388.202489] binder: 4637:4642 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:04 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 388.305492] binder: 4649:4656 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:04 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 388.306589] binder: 4649:4656 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 388.355379] binder: 4664:4665 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:04 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:04 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 388.358146] binder: 4664:4665 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:04 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 388.456012] binder: 4672:4681 Acquire 1 refcount change on invalid ref 0 ret -22 [ 388.456423] binder: 4672:4681 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 388.557880] binder: 4691:4696 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 388.558348] binder: 4691:4696 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 388.665371] binder: 4705:4709 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:05 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 388.666192] binder: 4705:4709 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 388.749553] binder: 4726:4727 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 388.750005] binder: 4726:4727 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 388.863835] binder: 4737:4745 Acquire 1 refcount change on invalid ref 0 ret -22 [ 388.866892] binder: 4737:4745 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 388.949441] binder: 4756:4763 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:05 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 388.950337] binder: 4756:4763 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 389.032416] binder: 4770:4774 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 389.033133] binder: 4770:4774 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 389.181081] binder: 4789:4797 Acquire 1 refcount change on invalid ref 0 ret -22 [ 389.194391] binder: 4789:4797 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 389.364169] binder: 4812:4820 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 389.365231] binder: 4812:4820 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:05 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 389.439858] binder: 4831:4839 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:05 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 389.452008] binder: 4831:4839 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:05 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:05 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:05 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 389.497946] binder: 4844:4845 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 389.498521] binder: 4844:4845 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:06 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 389.584606] binder: 4855:4860 Acquire 1 refcount change on invalid ref 0 ret -22 [ 389.585557] binder: 4855:4860 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 389.660505] binder: 4867:4868 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 389.660933] binder: 4867:4868 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 389.717277] binder: 4874:4878 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:06 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 389.719755] binder: 4874:4878 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:06 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 389.748121] nla_parse: 30 callbacks suppressed [ 389.748127] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 389.792250] binder: 4889:4892 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:06 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 389.792889] binder: 4889:4892 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 389.908587] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:06 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 389.923310] binder: 4903:4907 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:06 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 389.923570] binder: 4903:4907 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 390.028026] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 390.031377] binder: 4921:4926 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:06 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:06 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 390.031666] binder: 4921:4926 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:06 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:06 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:06 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 390.119886] binder: 4935:4940 Acquire 1 refcount change on invalid ref 0 ret -22 [ 390.145945] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 390.147423] binder: 4935:4940 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 390.239969] binder: 4953:4957 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:07 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:07 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 390.240470] binder: 4953:4957 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 390.267615] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:07 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:07 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 390.307169] binder: 4969:4972 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 390.307554] binder: 4969:4972 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:07 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 390.406096] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 390.416239] binder: 4981:4986 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:07 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 390.416582] binder: 4981:4986 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:07 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 390.515457] binder: 4995:5004 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:07 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 390.515797] binder: 4995:5004 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 390.529776] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:07 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 390.640104] binder: 5017:5021 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:07 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 390.641275] binder: 5017:5021 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:07 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 390.652776] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:07 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:07 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 390.738017] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:07 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:07 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:07 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 390.791529] binder: 5036:5043 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 390.793296] binder: 5036:5043 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:08 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:08 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 390.872373] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 390.917043] binder: 5064:5067 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:08 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 390.919291] binder: 5064:5067 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:08 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:08 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:08 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 391.007981] binder: 5080:5082 Acquire 1 refcount change on invalid ref 0 ret -22 [ 391.008543] binder: 5080:5082 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:08 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 391.071710] binder: 5090:5095 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:08 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:08 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 391.072404] binder: 5090:5095 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 391.185891] binder: 5102:5110 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:08 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:08 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 391.187757] binder: 5102:5110 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 391.275981] binder: 5121:5125 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:08 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 391.276498] binder: 5121:5125 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 391.501774] binder: 5142:5143 Acquire 1 refcount change on invalid ref 0 ret -22 [ 391.513638] binder: 5142:5143 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 391.708724] binder: 5158:5163 Acquire 1 refcount change on invalid ref 0 ret -22 [ 391.709582] binder: 5158:5163 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 391.850741] binder: 5180:5190 Acquire 1 refcount change on invalid ref 0 ret -22 [ 391.851123] binder: 5180:5190 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:08 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:08 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:08 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 391.945133] binder: 5200:5206 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 391.946506] binder: 5200:5206 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:08 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:08 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:08 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 392.105603] binder: 5221:5226 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:08 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:08 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 392.105917] binder: 5221:5226 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:09 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 392.175128] binder: 5235:5238 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 392.176652] binder: 5235:5238 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 392.267080] binder: 5248:5251 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:09 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 392.267404] binder: 5248:5251 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 392.332974] binder: 5260:5265 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:09 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 392.334107] binder: 5260:5265 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 392.428838] binder: 5272:5276 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:09 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 392.429354] binder: 5272:5276 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 392.629221] binder: 5305:5311 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 392.631636] binder: 5305:5311 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 392.746703] binder: 5322:5329 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:09 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:09 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 392.747033] binder: 5322:5329 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:09 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 392.820772] binder: 5336:5340 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:09 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:09 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 392.821545] binder: 5336:5340 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:09 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 392.899998] binder: 5352:5355 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:10 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:10 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:10 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 392.900817] binder: 5352:5355 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 392.989927] binder: 5367:5371 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 392.992138] binder: 5367:5371 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:10 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 393.100938] binder: 5379:5382 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:10 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:10 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 393.101184] binder: 5379:5382 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:10 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 393.209724] binder: 5398:5400 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:10 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:10 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 393.210009] binder: 5398:5400 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:10 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 393.340591] binder: 5421:5422 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:10 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:10 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 393.340923] binder: 5421:5422 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 393.410123] binder: 5434:5437 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 393.410487] binder: 5434:5437 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:10 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:10 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 393.498149] binder: 5444:5451 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 393.499401] binder: 5444:5451 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:10 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:10 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 393.596957] binder: 5459:5469 Acquire 1 refcount change on invalid ref 0 ret -22 [ 393.597715] binder: 5459:5469 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 393.687742] binder: 5474:5481 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:11 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:11 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 393.688418] binder: 5474:5481 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:11 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 393.783143] binder: 5491:5499 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 393.783533] binder: 5491:5499 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 393.864013] binder: 5508:5514 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:11 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 393.864357] binder: 5508:5514 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 393.970123] binder: 5521:5526 Acquire 1 refcount change on invalid ref 0 ret -22 [ 393.982354] binder: 5521:5526 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 394.070761] binder: 5533:5540 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:11 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 394.071108] binder: 5533:5540 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 394.168155] binder: 5550:5553 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:11 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 394.168415] binder: 5550:5553 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 394.297166] binder: 5566:5574 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 394.297980] binder: 5566:5574 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 394.423092] binder: 5593:5594 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:11 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 394.424033] binder: 5593:5594 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 394.554903] binder: 5610:5618 Acquire 1 refcount change on invalid ref 0 ret -22 [ 394.556021] binder: 5610:5618 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:11 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 394.679406] binder: 5627:5636 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:11 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:11 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 394.683625] binder: 5627:5636 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 394.791465] binder: 5647:5649 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:11 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:11 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 394.792607] binder: 5647:5649 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:12 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:12 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 394.858596] binder: 5659:5665 Acquire 1 refcount change on invalid ref 0 ret -22 [ 394.859431] binder: 5659:5665 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 394.913927] binder: 5674:5675 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:12 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:12 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 394.914169] binder: 5674:5675 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:12 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 395.006501] binder: 5687:5689 Acquire 1 refcount change on invalid ref 0 ret -22 [ 395.008384] binder: 5687:5689 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:12 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 395.010716] nla_parse: 32 callbacks suppressed [ 395.010722] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 395.120416] binder: 5698:5702 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 395.120658] binder: 5698:5702 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:12 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 395.176116] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 395.199190] binder: 5714:5716 Acquire 1 refcount change on invalid ref 0 ret -22 [ 395.199437] binder: 5714:5716 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:12 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 395.288685] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:12 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:12 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 395.330316] binder: 5730:5734 Acquire 1 refcount change on invalid ref 0 ret -22 [ 395.330634] binder: 5730:5734 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 395.408717] binder: 5744:5748 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:12 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:12 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 395.409052] binder: 5744:5748 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 395.460914] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:12 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:12 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 395.528503] binder: 5762:5768 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:12 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:12 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:12 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 395.529832] binder: 5762:5768 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 395.673782] binder: 5788:5790 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:13 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:13 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:13 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 395.674155] binder: 5788:5790 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 395.747923] binder: 5805:5810 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:13 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:13 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 395.748384] binder: 5805:5810 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 395.755383] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 395.873035] binder: 5822:5827 Acquire 1 refcount change on invalid ref 0 ret -22 [ 395.874417] binder: 5822:5827 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:13 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:13 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:13 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 395.886262] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 396.021824] binder: 5844:5852 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 396.023001] binder: 5844:5852 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:13 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:13 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:13 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 396.039221] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:13 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 396.087296] binder: 5863:5865 Acquire 1 refcount change on invalid ref 0 ret -22 [ 396.087884] binder: 5863:5865 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:13 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:13 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 396.122420] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:13 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:13 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 396.208071] binder: 5877:5880 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:13 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:13 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 396.208362] binder: 5877:5880 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 396.228124] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:13 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:13 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:13 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:13 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 396.273629] binder: 5891:5895 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 396.274009] binder: 5891:5895 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:14 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 396.332576] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:14 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 396.335330] binder: 5904:5907 Acquire 1 refcount change on invalid ref 0 ret -22 [ 396.336345] binder: 5904:5907 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 396.466733] binder: 5921:5930 Acquire 1 refcount change on invalid ref 0 ret -22 [ 396.467046] binder: 5921:5930 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:14 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 396.552983] binder: 5934:5942 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 396.555209] binder: 5934:5942 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 396.623842] binder: 5950:5952 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:14 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:14 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:14 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 396.624102] binder: 5950:5952 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 396.752935] binder: 5964:5970 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:14 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:14 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 396.753260] binder: 5964:5970 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:14 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) [ 396.867562] binder: 5986:5988 Acquire 1 refcount change on invalid ref 0 ret -22 [ 396.867913] binder: 5986:5988 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:14 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 396.955355] binder: 5994:5995 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:14 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:14 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 396.955707] binder: 5994:5995 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 397.076503] binder: 6017:6026 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:14 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:14 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 397.077685] binder: 6017:6026 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 397.204279] binder: 6041:6045 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:14 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:14 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) [ 397.206486] binder: 6041:6045 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:14 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) 09:57:14 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:14 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 397.251869] binder: 6052:6058 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:15 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:15 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:15 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:15 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 397.252263] binder: 6052:6058 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 397.344264] binder: 6067:6072 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:15 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:15 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:15 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) [ 397.346558] binder: 6067:6072 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:15 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:15 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) 09:57:15 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:15 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 397.464864] binder: 6082:6087 Acquire 1 refcount change on invalid ref 0 ret -22 09:57:15 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 09:57:15 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xdd268825a90130a2, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0x80404509, &(0x7f0000000100)=""/16) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="11dca5055e0bcfec7be070") clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() r4 = socket(0x10, 0x2, 0x0) write(r4, &(0x7f0000000080)="fc0000001c00358a9bae2506090007000aab087a0200000001006093210001c0000000000000000000000000d2f34d3b19194100039815fa2c1ec28656aaa79bb9d95662070000bc000c00f0036c7c256f0a272fdf0d11512fd633d44000000000008934d09402ade81720d3d5bbc91a3e2e80772c05dafd5a32ff070000ab82d718f70cec18444ef90d475ef8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f395ed94e0ad91bd0734babc7c3f2eeb57d43dffff00aa1dd18900000000411f46a60467b4d57155870258a10000c880ac801fe4af3d0041f0d402000000080548deac270e33429fd3110175e63fb8d38a", 0xfc) ptrace$setopts(0x4206, r3, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'veth0\x00', 0x1022}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'veth0\x00', 0x0}) r6 = socket$inet6(0xa, 0x1000000000002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x14, &(0x7f0000000080)={@mcast2, r5}, 0x14) close(r1) close(r6) [ 397.465245] binder: 6082:6087 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:15 executing program 0: setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @rand_addr="0bcbe0ea70221dbb37f271264ecb9b95"}}, 0x5c) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000002000)={0x0, 0x4c066c43}, 0x14) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000001fde), 0x4) 09:57:15 executing program 2: write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x77359400}, 0x1, 0x4}], 0x18) syz_open_dev$evdev(&(0x7f0000000000)='/dev/input/event#\x00', 0x2, 0x28001) write$evdev(0xffffffffffffffff, &(0x7f0000000040)=[{}, {}], 0x52a) 09:57:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000140)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) [ 397.535102] binder: 6098:6100 Acquire 1 refcount change on invalid ref 0 ret -22 [ 397.535363] binder: 6098:6100 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 09:57:15 executing program 5: openat$uhid(0xffffffffffffff9c, &(0x7f0000000dc0)='/dev/uhid\x00', 0x802, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) accept(0xffffffffffffffff, 0x0, &(0x7f0000000d80)) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) getresuid(&(0x7f0000000900), &(0x7f0000000940), &(0x7f0000000980)) fstat(0xffffffffffffffff, &(0x7f00000009c0)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000a40)) getresuid(&(0x7f0000000a80), &(0x7f0000000ac0), &(0x7f0000000b00)) getgid() getpid() stat(&(0x7f0000000b40)='./file0\x00', &(0x7f0000000b80)) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000300)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xe0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00y\b\x8c\xfa3\x90\xc8\xde\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00K\xf7\xa42\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xde}, 0x29816a0c) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f0000000200), 0x1a7) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000600)={0x0, 'syz1\x00', 'syz1\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x80\xff\x7f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x11\x00', 'syz1\x00', 0x0}, 0x120) r0 = gettid() timer_create(0x0, &(0x7f00000002c0)={0x0, 0x12}, &(0x7f0000000040)) timer_settime(0x0, 0x0, &(0x7f0000000140)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) tkill(r0, 0x1000000000016) 09:57:15 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x8000000003, 0x12, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r0, 0x6, 0xb, 0x0, &(0x7f0000000040)) [ 397.620761] binder: 6110:6112 Acquire 1 refcount change on invalid ref 0 ret -22 [ 397.623872] binder: 6110:6112 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 397.753871] binder: 6126:6134 Acquire 1 refcount change on invalid ref 0 ret -22 [ 397.757384] binder: 6126:6134 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 397.859145] binder: 6147:6148 Acquire 1 refcount change on invalid ref 0 ret -22 [ 397.859601] binder: 6147:6148 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 397.957385] binder: 6161:6164 Acquire 1 refcount change on invalid ref 0 ret -22 [ 397.957685] binder: 6161:6164 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.038302] binder: 6173:6175 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.038654] binder: 6173:6175 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.140605] binder: 6188:6195 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.140968] binder: 6188:6195 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.218240] binder: 6203:6211 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.218483] binder: 6203:6211 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.279466] binder: 6218:6220 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.279829] binder: 6218:6220 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.352645] binder: 6230:6234 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.353057] binder: 6230:6234 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.449234] binder: 6247:6252 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.449560] binder: 6247:6252 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.586524] binder: 6265:6270 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.586843] binder: 6265:6270 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.669702] binder: 6280:6283 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.669991] binder: 6280:6283 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.771882] binder: 6291:6299 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.776410] binder: 6291:6299 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.860546] binder: 6308:6312 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.860984] binder: 6308:6312 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 398.929649] binder: 6323:6326 Acquire 1 refcount change on invalid ref 0 ret -22 [ 398.929915] binder: 6323:6326 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.013584] binder: 6334:6338 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.014696] binder: 6334:6338 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.114454] binder: 6350:6355 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.117986] binder: 6350:6355 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.177645] binder: 6360:6364 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.178097] binder: 6360:6364 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.263013] binder: 6369:6378 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.263610] binder: 6369:6378 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.507301] binder: 6394:6396 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.508151] binder: 6394:6396 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.590902] binder: 6404:6410 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.594214] binder: 6404:6410 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.671740] binder: 6418:6423 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.672223] binder: 6418:6423 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.829474] binder: 6439:6444 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.829796] binder: 6439:6444 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 399.918869] binder: 6456:6461 Acquire 1 refcount change on invalid ref 0 ret -22 [ 399.919154] binder: 6456:6461 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.014255] binder: 6473:6477 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.017163] binder: 6473:6477 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.119355] binder: 6488:6493 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.119779] binder: 6488:6493 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.265421] binder: 6507:6513 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.265678] binder: 6507:6513 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.268543] nla_parse: 28 callbacks suppressed [ 400.268548] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 400.321543] binder: 6524:6527 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.322534] binder: 6524:6527 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.367005] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 400.390484] binder: 6535:6539 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.390782] binder: 6535:6539 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.458237] binder: 6546:6549 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.458486] binder: 6546:6549 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.548699] binder: 6555:6562 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.551406] binder: 6555:6562 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.556953] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 400.653225] binder: 6573:6578 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.662911] binder: 6573:6578 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.676167] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 400.766969] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 400.785631] binder: 6591:6596 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.785993] binder: 6591:6596 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.836975] binder: 6605:6606 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.839571] binder: 6605:6606 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.935337] binder: 6615:6618 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.935594] binder: 6615:6618 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 400.942200] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 400.991630] binder: 6627:6633 Acquire 1 refcount change on invalid ref 0 ret -22 [ 400.995344] binder: 6627:6633 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.029277] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 401.071889] binder: 6641:6645 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.077464] binder: 6641:6645 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.171530] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 401.175704] binder: 6656:6660 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.182007] binder: 6656:6660 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.269325] binder: 6669:6674 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.270134] binder: 6669:6674 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.310002] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 401.335046] binder: 6683:6685 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.335285] binder: 6683:6685 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.455257] binder: 6694:6703 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.456461] binder: 6694:6703 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.482382] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 401.570033] binder: 6718:6721 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.570370] binder: 6718:6721 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.714256] binder: 6737:6742 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.715499] binder: 6737:6742 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.757231] binder: 6749:6751 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.757721] binder: 6749:6751 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 401.878100] binder: 6767:6770 Acquire 1 refcount change on invalid ref 0 ret -22 [ 401.878460] binder: 6767:6770 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.013644] binder: 6784:6789 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.014014] binder: 6784:6789 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.077977] binder: 6794:6797 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.078275] binder: 6794:6797 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.147167] binder: 6803:6805 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.147497] binder: 6803:6805 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.263690] binder: 6821:6828 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.263968] binder: 6821:6828 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.317214] binder: 6838:6840 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.317476] binder: 6838:6840 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.405649] binder: 6848:6851 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.406960] binder: 6848:6851 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.508749] binder: 6860:6866 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.519157] binder: 6860:6866 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.575522] binder: 6877:6879 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.576611] binder: 6877:6879 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.686016] binder: 6890:6897 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.702788] binder: 6890:6897 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.816888] binder: 6909:6912 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.817716] binder: 6909:6912 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.897519] binder: 6925:6927 Acquire 1 refcount change on invalid ref 0 ret -22 [ 402.900428] binder: 6925:6927 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 402.999708] binder: 6938:6941 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.000277] binder: 6938:6941 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.080098] binder: 6954:6960 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.080486] binder: 6954:6960 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.173649] binder: 6968:6971 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.175543] binder: 6968:6971 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.253752] binder: 6984:6989 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.257177] binder: 6984:6989 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.359421] binder: 6996:7002 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.360249] binder: 6996:7002 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.440040] binder: 7012:7016 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.440313] binder: 7012:7016 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.580440] binder: 7031:7034 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.586705] binder: 7031:7034 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.707020] binder: 7049:7060 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.707684] binder: 7049:7060 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.857733] binder: 7075:7080 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.858135] binder: 7075:7080 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 403.982597] binder: 7096:7098 Acquire 1 refcount change on invalid ref 0 ret -22 [ 403.983479] binder: 7096:7098 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 404.104016] binder: 7111:7118 Acquire 1 refcount change on invalid ref 0 ret -22 [ 404.104682] binder: 7111:7118 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 404.269563] binder: 7143:7148 Acquire 1 refcount change on invalid ref 0 ret -22 [ 404.270422] binder: 7143:7148 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 404.400355] binder: 7158:7168 Acquire 1 refcount change on invalid ref 0 ret -22 [ 404.400744] binder: 7158:7168 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 404.473096] binder: 7174:7176 Acquire 1 refcount change on invalid ref 0 ret -22 [ 404.473515] binder: 7174:7176 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 404.576907] binder: 7192:7194 Acquire 1 refcount change on invalid ref 0 ret -22 [ 404.577182] binder: 7192:7194 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 404.719334] binder: 7207:7220 Acquire 1 refcount change on invalid ref 0 ret -22 [ 404.719800] binder: 7207:7220 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 404.816630] binder: 7225:7232 Acquire 1 refcount change on invalid ref 0 ret -22 [ 404.816962] binder: 7225:7232 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 404.955457] binder: 7252:7257 Acquire 1 refcount change on invalid ref 0 ret -22 [ 404.971949] binder: 7252:7257 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.075296] binder: 7274:7276 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.076004] binder: 7274:7276 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.180267] binder: 7287:7294 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.182198] binder: 7287:7294 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.259043] binder: 7302:7304 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.259907] binder: 7302:7304 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.379284] binder: 7316:7324 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.380740] binder: 7316:7324 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.433777] nla_parse: 30 callbacks suppressed [ 405.433782] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 405.455154] binder: 7336:7341 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.455558] binder: 7336:7341 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.507443] binder: 7344:7345 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.507827] binder: 7344:7345 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.601390] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 405.617969] binder: 7360:7363 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.619297] binder: 7360:7363 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.716542] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 405.743542] binder: 7378:7383 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.750278] binder: 7378:7383 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.812805] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 405.813052] binder: 7388:7391 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.813562] binder: 7388:7391 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.976094] binder: 7409:7411 Acquire 1 refcount change on invalid ref 0 ret -22 [ 405.976366] binder: 7409:7411 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 405.987986] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 406.120068] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 406.154221] binder: 7437:7441 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.154968] binder: 7437:7441 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 406.240958] binder: 7456:7459 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.241225] binder: 7456:7459 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 406.247131] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 406.369414] binder: 7470:7479 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.370110] binder: 7470:7479 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 406.373541] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 406.477855] binder: 7488:7496 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.478209] binder: 7488:7496 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 406.490241] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 406.549791] binder: 7506:7507 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.550939] binder: 7506:7507 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 406.606919] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 406.615950] binder: 7517:7521 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.616876] binder: 7517:7521 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 406.732681] binder: 7533:7540 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.733032] binder: 7533:7540 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 406.835811] binder: 7547:7551 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.836128] binder: 7547:7551 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 406.925741] binder: 7563:7568 Acquire 1 refcount change on invalid ref 0 ret -22 [ 406.926152] binder: 7563:7568 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 407.020582] binder: 7574:7579 Acquire 1 refcount change on invalid ref 0 ret -22 [ 407.022518] binder: 7574:7579 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 407.255877] binder: 7592:7600 Acquire 1 refcount change on invalid ref 0 ret -22 [ 407.261608] binder: 7592:7600 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 407.429334] binder: 7609:7611 Acquire 1 refcount change on invalid ref 0 ret -22 [ 407.430768] binder: 7609:7611 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 407.505278] binder: 7620:7622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 407.507204] binder: 7620:7622 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 407.595795] binder: 7631:7633 Acquire 1 refcount change on invalid ref 0 ret -22 [ 407.596108] binder: 7631:7633 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 407.688134] binder: 7646:7651 Acquire 1 refcount change on invalid ref 0 ret -22 [ 407.688546] binder: 7646:7651 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 407.808652] binder: 7664:7671 Acquire 1 refcount change on invalid ref 0 ret -22 [ 407.809824] binder: 7664:7671 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 407.915097] binder: 7678:7685 Acquire 1 refcount change on invalid ref 0 ret -22 [ 407.926558] binder: 7678:7685 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.043563] binder: 7706:7708 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.048707] binder: 7706:7708 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.129286] binder: 7718:7719 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.131007] binder: 7718:7719 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.207577] binder: 7730:7735 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.207905] binder: 7730:7735 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.292203] binder: 7741:7746 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.292475] binder: 7741:7746 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.377702] binder: 7756:7758 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.377977] binder: 7756:7758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.488379] binder: 7772:7776 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.488635] binder: 7772:7776 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.585355] binder: 7788:7794 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.586456] binder: 7788:7794 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.647613] binder: 7802:7804 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.662715] binder: 7802:7804 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.725200] binder: 7815:7817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.725527] binder: 7815:7817 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.830700] binder: 7826:7835 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.831460] binder: 7826:7835 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.963453] binder: 7843:7852 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.963797] binder: 7843:7852 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 408.998551] binder: 7857:7861 Acquire 1 refcount change on invalid ref 0 ret -22 [ 408.999056] binder: 7857:7861 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.108854] binder: 7867:7875 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.110220] binder: 7867:7875 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.235328] binder: 7886:7895 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.235836] binder: 7886:7895 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.374503] binder: 7907:7912 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.375008] binder: 7907:7912 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.499239] binder: 7926:7927 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.499628] binder: 7926:7927 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.557759] binder: 7945:7947 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.573319] binder: 7945:7947 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.664456] binder: 7957:7962 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.664714] binder: 7957:7962 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.782521] binder: 7970:7977 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.782938] binder: 7970:7977 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.891259] binder: 7991:7994 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.891593] binder: 7991:7994 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 409.997165] binder: 8014:8015 Acquire 1 refcount change on invalid ref 0 ret -22 [ 409.998826] binder: 8014:8015 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.063718] binder: 8024:8029 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.064065] binder: 8024:8029 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.214575] binder: 8045:8048 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.215687] binder: 8045:8048 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.291718] binder: 8059:8062 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.293326] binder: 8059:8062 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.403859] binder: 8081:8084 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.404157] binder: 8081:8084 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.488134] binder: 8096:8099 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.488651] binder: 8096:8099 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.611672] binder: 8105:8115 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.612539] binder: 8105:8115 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.661711] nla_parse: 28 callbacks suppressed [ 410.661716] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 410.742565] binder: 8127:8131 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.742883] binder: 8127:8131 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.796789] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 410.807453] binder: 8149:8152 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.808558] binder: 8149:8152 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 410.948014] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 410.950568] binder: 8167:8173 Acquire 1 refcount change on invalid ref 0 ret -22 [ 410.950925] binder: 8167:8173 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.045616] binder: 8175:8186 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.049263] binder: 8175:8186 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.072334] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 411.121495] binder: 8195:8197 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.121873] binder: 8195:8197 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.208247] binder: 8206:8212 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.209570] binder: 8206:8212 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.227939] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 411.353489] binder: 8222:8235 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.361537] binder: 8222:8235 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.376971] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 411.477425] binder: 8246:8255 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.477684] binder: 8246:8255 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.507259] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 411.510137] binder: 8259:8261 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.510649] binder: 8259:8261 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.648888] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 411.682397] binder: 8281:8286 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.682768] binder: 8281:8286 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.748090] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 411.846879] binder: 8295:8306 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.847177] binder: 8295:8306 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 411.890636] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 411.897921] binder: 8319:8323 Acquire 1 refcount change on invalid ref 0 ret -22 [ 411.898567] binder: 8319:8323 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.031953] binder: 8337:8340 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.032218] binder: 8337:8340 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.089580] binder: 8350:8353 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.089860] binder: 8350:8353 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.187107] binder: 8362:8363 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.188363] binder: 8362:8363 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.275501] binder: 8377:8381 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.276370] binder: 8377:8381 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.334201] binder: 8388:8390 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.338852] binder: 8388:8390 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.421641] binder: 8401:8404 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.422370] binder: 8401:8404 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.570920] binder: 8426:8430 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.572511] binder: 8426:8430 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.649322] binder: 8438:8442 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.649771] binder: 8438:8442 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.734279] binder: 8451:8457 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.735497] binder: 8451:8457 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 412.920973] binder: 8476:8481 Acquire 1 refcount change on invalid ref 0 ret -22 [ 412.922153] binder: 8476:8481 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.023597] binder: 8494:8500 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.024230] binder: 8494:8500 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.122841] binder: 8508:8509 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.123101] binder: 8508:8509 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.170967] binder: 8526:8528 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.175264] binder: 8526:8528 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.306335] binder: 8538:8545 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.306739] binder: 8538:8545 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.384961] binder: 8555:8557 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.386277] binder: 8555:8557 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.494126] binder: 8568:8573 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.494675] binder: 8568:8573 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.581803] binder: 8583:8585 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.582165] binder: 8583:8585 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.690804] binder: 8603:8607 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.692367] binder: 8603:8607 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.773981] binder: 8615:8620 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.774389] binder: 8615:8620 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.877197] binder: 8626:8634 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.877676] binder: 8626:8634 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 413.955400] binder: 8647:8650 Acquire 1 refcount change on invalid ref 0 ret -22 [ 413.955720] binder: 8647:8650 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.043568] binder: 8659:8660 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.043902] binder: 8659:8660 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.108571] binder: 8670:8673 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.122759] binder: 8670:8673 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.235259] binder: 8687:8693 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.235588] binder: 8687:8693 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.361465] binder: 8707:8715 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.362060] binder: 8707:8715 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.453913] binder: 8726:8730 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.454245] binder: 8726:8730 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.562711] binder: 8744:8748 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.566096] binder: 8744:8748 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.653999] binder: 8754:8755 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.655906] binder: 8754:8755 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.752696] binder: 8775:8777 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.754038] binder: 8775:8777 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 414.854196] binder: 8787:8793 Acquire 1 refcount change on invalid ref 0 ret -22 [ 414.856124] binder: 8787:8793 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.060831] binder: 8805:8813 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.063139] binder: 8805:8813 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.245519] binder: 8827:8829 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.246465] binder: 8827:8829 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.317661] binder: 8842:8845 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.317916] binder: 8842:8845 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.417996] binder: 8850:8859 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.418876] binder: 8850:8859 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.538629] binder: 8869:8878 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.538951] binder: 8869:8878 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.607051] binder: 8879:8891 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.607732] binder: 8879:8891 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.652653] binder: 8897:8898 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.652903] binder: 8897:8898 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.743688] binder: 8907:8912 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.744147] binder: 8907:8912 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.824850] binder: 8921:8925 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.825267] binder: 8921:8925 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.902835] nla_parse: 31 callbacks suppressed [ 415.902841] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 415.910251] binder: 8932:8936 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.910513] binder: 8932:8936 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 415.981971] binder: 8945:8951 Acquire 1 refcount change on invalid ref 0 ret -22 [ 415.982920] binder: 8945:8951 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.016418] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 416.077074] binder: 8963:8965 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.080514] binder: 8963:8965 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.149240] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 416.168356] binder: 8972:8979 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.168711] binder: 8972:8979 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.256954] binder: 8993:8995 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.257209] binder: 8993:8995 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.307414] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 416.330326] binder: 9004:9007 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.331506] binder: 9004:9007 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.398617] binder: 9013:9014 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.399176] binder: 9013:9014 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.413609] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 416.538032] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 416.593779] binder: 9041:9049 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.594071] binder: 9041:9049 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.675067] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 416.684741] binder: 9060:9066 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.685617] binder: 9060:9066 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.792291] binder: 9078:9082 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.814760] binder: 9078:9082 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.820507] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 416.857275] binder: 9089:9090 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.863853] binder: 9089:9090 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.936046] binder: 9102:9106 Acquire 1 refcount change on invalid ref 0 ret -22 [ 416.936674] binder: 9102:9106 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 416.956780] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 417.012604] binder: 9114:9116 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.013604] binder: 9114:9116 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.067738] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 417.102024] binder: 9133:9136 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.102357] binder: 9133:9136 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.186047] binder: 9143:9147 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.187902] binder: 9143:9147 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.243387] binder: 9157:9159 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.245373] binder: 9157:9159 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.313768] binder: 9165:9169 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.315058] binder: 9165:9169 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.375346] binder: 9177:9180 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.375939] binder: 9177:9180 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.484137] binder: 9193:9197 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.485247] binder: 9193:9197 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.580852] binder: 9209:9211 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.581654] binder: 9209:9211 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.654645] binder: 9222:9225 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.654923] binder: 9222:9225 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.811267] binder: 9234:9246 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.811602] binder: 9234:9246 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.875667] binder: 9256:9259 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.876016] binder: 9256:9259 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 417.935718] binder: 9263:9270 Acquire 1 refcount change on invalid ref 0 ret -22 [ 417.936806] binder: 9263:9270 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.073512] binder: 9279:9287 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.073839] binder: 9279:9287 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.130133] binder: 9292:9296 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.130451] binder: 9292:9296 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.206278] binder: 9306:9311 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.207598] binder: 9306:9311 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.278352] binder: 9319:9321 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.278765] binder: 9319:9321 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.381730] binder: 9338:9341 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.382415] binder: 9338:9341 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.492605] binder: 9346:9351 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.496049] binder: 9346:9351 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.605681] binder: 9364:9368 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.606232] binder: 9364:9368 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.648433] binder: 9378:9383 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.648861] binder: 9378:9383 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.770563] binder: 9389:9392 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.772409] binder: 9389:9392 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.848090] binder: 9402:9404 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.849018] binder: 9402:9404 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.940583] binder: 9419:9423 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.940993] binder: 9419:9423 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 418.996723] binder: 9430:9434 Acquire 1 refcount change on invalid ref 0 ret -22 [ 418.997032] binder: 9430:9434 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.136706] binder: 9442:9453 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.137605] binder: 9442:9453 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.219532] binder: 9459:9464 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.219959] binder: 9459:9464 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.320202] binder: 9479:9485 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.320491] binder: 9479:9485 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.435029] binder: 9491:9500 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.436055] binder: 9491:9500 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.540383] binder: 9511:9516 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.540914] binder: 9511:9516 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.597550] binder: 9525:9527 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.598320] binder: 9525:9527 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.704797] binder: 9541:9543 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.705049] binder: 9541:9543 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.794731] binder: 9548:9554 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.795020] binder: 9548:9554 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.915661] binder: 9566:9571 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.917711] binder: 9566:9571 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 419.985872] binder: 9582:9589 Acquire 1 refcount change on invalid ref 0 ret -22 [ 419.986207] binder: 9582:9589 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.039846] binder: 9596:9597 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.040076] binder: 9596:9597 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.135443] binder: 9605:9612 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.136571] binder: 9605:9612 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.201342] binder: 9618:9622 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.201787] binder: 9618:9622 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.324278] binder: 9638:9639 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.335728] binder: 9638:9639 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.434221] binder: 9655:9659 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.435510] binder: 9655:9659 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.493910] binder: 9666:9670 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.495286] binder: 9666:9670 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.575643] binder: 9678:9681 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.576254] binder: 9678:9681 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.673569] binder: 9689:9694 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.676238] binder: 9689:9694 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.750859] binder: 9707:9709 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.751493] binder: 9707:9709 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.822234] binder: 9716:9718 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.822573] binder: 9716:9718 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.909221] binder: 9732:9734 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.909485] binder: 9732:9734 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 420.960581] binder: 9746:9748 Acquire 1 refcount change on invalid ref 0 ret -22 [ 420.961094] binder: 9746:9748 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.048527] binder: 9752:9758 Acquire 1 refcount change on invalid ref 0 ret -22 [ 421.049104] binder: 9752:9758 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.066014] nla_parse: 29 callbacks suppressed [ 421.066019] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 421.194993] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 421.224530] binder: 9787:9788 Acquire 1 refcount change on invalid ref 0 ret -22 [ 421.224845] binder: 9787:9788 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.298741] binder: 9796:9800 Acquire 1 refcount change on invalid ref 0 ret -22 [ 421.302751] binder: 9796:9800 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.315703] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 421.430703] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 421.451590] binder: 9813:9821 Acquire 1 refcount change on invalid ref 0 ret -22 [ 421.451903] binder: 9813:9821 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.531485] binder: 9829:9834 Acquire 1 refcount change on invalid ref 0 ret -22 [ 421.531738] binder: 9829:9834 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.540774] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 421.616987] binder: 9849:9852 Acquire 1 refcount change on invalid ref 0 ret -22 [ 421.617860] binder: 9849:9852 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.643754] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 421.711907] binder: 9863:9866 Acquire 1 refcount change on invalid ref 0 ret -22 [ 421.712179] binder: 9863:9866 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.763303] netlink: 188 bytes leftover after parsing attributes in process `syz-executor.4'. [ 421.815567] binder: 9879:9885 Acquire 1 refcount change on invalid ref 0 ret -22 [ 421.816748] binder: 9879:9885 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 421.834404] INFO: task init:6205 blocked for more than 140 seconds. [ 421.834410] Not tainted 4.4.174+ #4 [ 421.834412] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 421.834434] init D ffff8800b6537718 28560 6205 1 0x00000000 [ 421.834447] ffff8800b6537718 ffff8800b8b817c0 13e3a6d4097ebf42 ffff8800b8b817c0 [ 421.834455] 0000000000000000 ffff8800b8b82000 ffff8801db61f180 ffff8801db61f1a8 [ 421.834464] ffff8801db61e898 ffffffff82e151c0 ffff8800b8b817c0 ffffed0016ca6001 [ 421.834466] Call Trace: [ 421.834480] [] schedule+0x99/0x1d0 [ 421.834487] [] schedule_preempt_disabled+0x13/0x20 [ 421.834495] [] mutex_lock_nested+0x3c2/0xb80 [ 421.834504] [] ? tty_open+0x56a/0xf50 [ 421.834511] [] ? assoc_array_gc+0x1233/0x12e0 [ 421.834519] [] ? mutex_trylock+0x500/0x500 [ 421.834527] [] ? kmem_cache_alloc_trace+0x123/0x2d0 [ 421.834535] [] tty_open+0x56a/0xf50 [ 421.834541] [] ? tty_init_dev+0x420/0x420 [ 421.834548] [] ? chrdev_open+0xca/0x630 [ 421.834554] [] ? tty_init_dev+0x420/0x420 [ 421.834560] [] chrdev_open+0x230/0x630 [ 421.834566] [] ? cdev_put.part.0+0x50/0x50 [ 421.834574] [] do_dentry_open+0x38f/0xbd0 [ 421.834580] [] ? __inode_permission2+0x9e/0x250 [ 421.834585] [] ? cdev_put.part.0+0x50/0x50 [ 421.834590] [] vfs_open+0x10b/0x210 [ 421.834596] [] ? may_open.isra.0+0xe7/0x210 [ 421.834601] [] path_openat+0x136f/0x4470 [ 421.834607] [] ? kasan_kmalloc.part.0+0xc6/0xf0 [ 421.834612] [] ? may_open.isra.0+0x210/0x210 [ 421.834620] [] ? trace_hardirqs_on+0x10/0x10 [ 421.834626] [] do_filp_open+0x1a1/0x270 [ 421.834632] [] ? user_path_mountpoint_at+0x50/0x50 [ 421.834639] [] ? __alloc_fd+0x1ea/0x490 [ 421.834644] [] ? _raw_spin_unlock+0x2d/0x50 [ 421.834650] [] do_sys_open+0x2f8/0x600 [ 421.834655] [] ? filp_open+0x70/0x70 [ 421.834660] [] ? trace_hardirqs_on_caller+0x385/0x5a0 [ 421.834666] [] SyS_open+0x2d/0x40 [ 421.834672] [] entry_SYSCALL_64_fastpath+0x1e/0x9a [ 421.834677] 1 lock held by init/6205: [ 421.834690] #0: (tty_mutex){+.+.+.}, at: [] tty_open+0x56a/0xf50 [ 421.834695] Sending NMI to all CPUs: [ 421.834944] NMI backtrace for cpu 0 [ 421.834946] CPU: 0 PID: 2079 Comm: syz-fuzzer Not tainted 4.4.174+ #4 [ 421.834949] task: ffff8801d4ce4740 task.stack: ffff8800b9d18000 [ 421.834951] RIP: 0033:[<000000000040b54d>] [<000000000040b54d>] 0x40b54d [ 421.834953] RSP: 002b:000000c42ad7d708 EFLAGS: 00000293 [ 421.834956] RAX: 000000c421be7810 RBX: 00000000e48f3d93 RCX: 0000000000000000 [ 421.834959] RDX: 000000c421be7810 RSI: 000000000000ffff RDI: 0000000000000000 [ 421.834961] RBP: 000000c42ad7d720 R08: 0000000000000000 R09: 0000000000000000 [ 421.834964] R10: 00000000009bfb76 R11: 0000000000000004 R12: 0000000000000000 [ 421.834967] R13: 0000000000000020 R14: 0000000000000013 R15: 0000000000000000 [ 421.834970] FS: 000000c4200871e8(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 [ 421.834972] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 421.834975] CR2: 0000000002a37978 CR3: 00000000b9d25000 CR4: 00000000001606b0 [ 421.834977] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 421.834980] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 421.834981] [ 421.834983] NMI backtrace for cpu 1 [ 421.834985] CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4 [ 421.834988] task: ffff8801da6f4740 task.stack: ffff8800001d0000 [ 421.834991] RIP: 0010:[] [] flat_send_IPI_mask+0xf7/0x1b0 [ 421.834993] RSP: 0018:ffff8800001d7c88 EFLAGS: 00000046 [ 421.834995] RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000 [ 421.834998] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300 [ 421.835001] RBP: ffff8800001d7cb8 R08: 0000000000000018 R09: 0000000000000000 [ 421.835003] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246 [ 421.835006] R13: 0000000003000000 R14: ffffffff82e5f2e0 R15: 0000000000000002 [ 421.835009] FS: 0000000000000000(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 [ 421.835011] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 421.835014] CR2: 0000000000a6ec88 CR3: 00000001c1555000 CR4: 00000000001606b0 [ 421.835016] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 421.835019] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 421.835020] Stack: [ 421.835023] 0000000000000001 ffffffff82e5f2e0 ffffffff831a6ac0 fffffbfff0634c34 [ 421.835026] 000000000001b6c0 0000000000000008 ffff8800001d7cd8 ffffffff81092bee [ 421.835028] 0000000000000008 ffffffff82924260 ffff8800001d7d30 ffffffff81ab8252 [ 421.835030] Call Trace: [ 421.835032] [] nmi_raise_cpu_backtrace+0x5e/0x80 [ 421.835035] [] nmi_trigger_all_cpu_backtrace.cold+0xa1/0xae [ 421.835037] [] ? print_lock+0xa8/0xab [ 421.835039] [] ? irq_force_complete_move+0x330/0x330 [ 421.835042] [] arch_trigger_all_cpu_backtrace+0x14/0x20 [ 421.835044] [] watchdog.cold+0xd3/0xee [ 421.835046] [] ? watchdog+0xac/0xa00 [ 421.835048] [] ? reset_hung_task_detector+0x20/0x20 [ 421.835050] [] kthread+0x273/0x310 [ 421.835053] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 421.835055] [] ? _raw_spin_unlock_irq+0x39/0x60 [ 421.835057] [] ? finish_task_switch+0x1e1/0x660 [ 421.835060] [] ? finish_task_switch+0x1b3/0x660 [ 421.835062] [] ? __schedule+0x7af/0x1ee0 [ 421.835064] [] ? __schedule+0x7a3/0x1ee0 [ 421.835066] [] ? __schedule+0x7af/0x1ee0 [ 421.835069] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 421.835071] [] ret_from_fork+0x55/0x80 [ 421.835073] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 421.835079] Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1e 4c 89 e7 57 9d 0f 1f 44 00 00 e8 f1 [ 421.835184] Kernel panic - not syncing: hung_task: blocked tasks [ 421.835191] CPU: 1 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #4 [ 421.835199] 0000000000000000 e80fa4ddba2d9578 ffff8800001d7c60 ffffffff81aad1a1 [ 421.835206] ffff8800b8b817c0 ffffffff82872120 dffffc0000000000 0000000000000002 [ 421.835213] 00000000003fff61 ffff8800001d7d40 ffffffff813a48c2 0000000041b58ab3 [ 421.835214] Call Trace: [ 421.835222] [] dump_stack+0xc1/0x120 [ 421.835230] [] panic+0x1b9/0x37b [ 421.835236] [] ? add_taint.cold+0x16/0x16 [ 421.835243] [] ? find_next_bit+0x44/0x50 [ 421.835250] [] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490 [ 421.835257] [] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490 [ 421.835263] [] watchdog.cold+0xe4/0xee [ 421.835269] [] ? watchdog+0xac/0xa00 [ 421.835276] [] ? reset_hung_task_detector+0x20/0x20 [ 421.835284] [] kthread+0x273/0x310 [ 421.835291] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 421.835297] [] ? _raw_spin_unlock_irq+0x39/0x60 [ 421.835303] [] ? finish_task_switch+0x1e1/0x660 [ 421.835309] [] ? finish_task_switch+0x1b3/0x660 [ 421.835327] [] ? __schedule+0x7af/0x1ee0 [ 421.835334] [] ? __schedule+0x7a3/0x1ee0 [ 421.835341] [] ? __schedule+0x7af/0x1ee0 [ 421.835349] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 421.835356] [] ret_from_fork+0x55/0x80 [ 421.835363] [] ? kthread_create_on_node+0x4c0/0x4c0 [ 421.835761] Kernel Offset: disabled [ 426.556078] Rebooting in 86400 seconds..