E_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:31 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 18:00:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ec11d4174db2094e8232ba93914899a0d949d94207f871d9eb3b87"], 0x0, 0x0, 0x0}) 18:00:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) recvfrom$inet6(r1, &(0x7f0000000200)=""/135, 0x87, 0x2041, &(0x7f0000000000)={0xa, 0x4e21, 0xb4c, @local, 0x2}, 0x1c) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:31 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) r1 = dup(r0) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)={0x6, 0x1, 0x308, 0x400, 0x15, 0xc, 0xb24, 0x4, 0x9a, 0x7, 0x20000, 0x6}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000100)={0x1, {{0xa, 0x4e24, 0x8, @local, 0xd911d50}}, {{0xa, 0x4e21, 0x2, @ipv4={[], [], @empty}, 0x1}}}, 0x108) [ 403.632328] binder: 11577:11581 unknown command -1020052571 [ 403.646936] binder: 11576:11586 transaction failed 29189/-22, size 0-0 line 3117 18:00:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") getegid() r1 = socket$inet6(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x406, r1) r3 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000140)={@dev, 0x0}, &(0x7f0000000180)=0x14) sendmsg$TEAM_CMD_OPTIONS_GET(r2, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x58, r3, 0x400, 0x70bd25, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x3c, 0x2, [{0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x9}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x24000810}, 0x800) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0xfffffe7c) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 403.726161] binder_alloc: 11577: binder_alloc_buf, no vma [ 403.752465] binder: 11577:11588 transaction failed 29189/-3, size 24-8 line 3254 [ 403.753326] binder_alloc: 11577: binder_alloc_buf, no vma [ 403.762556] binder: 11577:11588 BC_INCREFS_DONE u0000000000000000 no match [ 403.778684] binder: 11577:11588 Release 1 refcount change on invalid ref 1 ret -22 18:00:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) writev(r1, &(0x7f0000000480)=[{&(0x7f0000000200)="cbb5b9a5a83e5a3f99f48a6c7c3c2c4296153c9042eeea23c092e3cb39584fb8c94267fb2df162ab2cb1b6a0ddb929a27d79908ebca1a70e2fcaabee08880a2414f477bf816c1a74b4771db9f8ccbb7f40ecd6f70d458195583b5085cc1901123c8ccf9373cd55", 0x67}, {&(0x7f0000000180)="95a164", 0x3}, {&(0x7f0000000280)="f9ce4d1f29fc22f2a57a8a358b57127be4bcc5f9e93eb957731b4c6cbb82e8ab64acc5ff26d876160e8e09ba7b80dd0bd5540381680720900a6be35d956e4c8b45ead6a51ba806e9fee0eb8a636361e71f2e0f97a3a5eb7d2b7396df5f63d40789e923b957db411b4ce4fe253af63c3ad9628f9bc14a6fc583495bd878cd7e424500588861744061ab7a573d39e3792bf2702168f194965216a5b27a684dd11333c96d84db81ca40329fa94fcaab2583d28260d837f304fbe6b044f42a5354e57ba79c770ac69c1edb91eed8f3c6454e7a6dd193bf245585ba", 0xd9}, {&(0x7f0000000380)="698a7172b455f82c0b36fb735d7417f07e3c31b933de5508cb3681ea18583a447a4ee3731595aaf370f5c08ea2e2fe55e9b06fcd5386b1d12ef73a97b847954a97367c8d7ee2912098b779f5c8e2231903188af58e69f9b607bb3d4d800ff415cba6039e92d2a55902c23bd864b49f3e9781fe2c6e84538fe31690b91c467eefa83e9c7db1714b06e73229af5ab5ac052f130a0047623a472341b5f574172a37e68d9706fe102b4a65350cc9af900ae6e9c2d254ed29672dd5e905c3040225b2f178d9f3f588bacf6231847de98df65b45a31d703c91160d0274639b72cf8b67fe", 0xe1}], 0x4) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:31 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f31883070") getsockopt$IPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x43, &(0x7f0000000000)={'ipvs\x00'}, &(0x7f00000000c0)=0x1e) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$UI_SET_PHYS(r2, 0x4008556c, &(0x7f0000000180)='syz1\x00') sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:31 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xff, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="a53b33c388c4888af872221aa828eb31320993e27340e5905b29a665ed310cacd291ad9bdefc8651f6df03376854908fca597185e4d9306d56042c57dc245996d2d39077657e32a3da71eaa7a44bb8e8d77344c83487415b5fb3143eeb22e4ffeda49e7569e3bb8ba49f062ffcc1dbe1a9b4664d05219de6f5d8ef68038e210a3ee78c3badd1f63342bbe9aa0f716f1c8affd8ae8f8c2d9acbd8e43c94ea9c6b62d7bc5faa95016677ea78e55ed22c5318bdefeadef9beff7f17b22f9379e4054578ee1618106c63667d656bee1715d98a4805be6b17d720d46d955c32459f38edae5048cbb4c6a2e2a2a5cc8b6921a0a9d6b20d9f8532adb34bf3717a0c58"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000080)={{{@in6, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@local}}, &(0x7f0000000180)=0xe8) setxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f00000001c0)=@v3={0x3000000, [{0x4, 0x425b}, {0xfffffffffffffffb, 0x4}], r2}, 0x18, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:31 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000000)=0x7f, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffffffffffe6d, 0xfffffeff7ffffffa, &(0x7f0000000080)={0xa, 0x4e24, 0x200000000, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 403.790932] binder: 11576:11594 transaction failed 29189/-3, size 0-0 line 3254 [ 403.802088] binder: undelivered TRANSACTION_ERROR: 29189 [ 403.811307] binder: 11577:11581 ioctl c0306201 20000140 returned -22 [ 403.822610] binder: undelivered TRANSACTION_ERROR: 29189 18:00:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@multicast2}}, &(0x7f0000000380)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000003c0)={{{@in6=@empty, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f00000004c0)=0xe8) getresuid(&(0x7f0000000500), &(0x7f0000000540)=0x0, &(0x7f0000000580)) lstat(&(0x7f00000005c0)='./file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r8 = getgid() lstat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000000880), &(0x7f00000008c0)=0x0, &(0x7f0000000900)) lstat(&(0x7f0000000940)='./file0\x00', &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000a80)='./file0\x00', &(0x7f0000000ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0xa, &(0x7f0000000b40)=[0xee00, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xee00]) lstat(&(0x7f0000000b80)='./file0\x00', &(0x7f0000000bc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r17 = getgid() setxattr$system_posix_acl(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='system.posix_acl_access\x00', &(0x7f0000000c40)={{}, {0x1, 0x2}, [{0x2, 0x3, r3}, {0x2, 0x4, r4}, {0x2, 0x1, r5}, {0x2, 0x2, r6}, {0x2, 0x7, r7}], {0x4, 0x2}, [{0x8, 0x75aef84754150244, r8}, {0x8, 0x6, r9}, {0x8, 0x4, r10}, {0x8, 0x1, r11}, {0x8, 0x1, r12}, {0x8, 0x5, r13}, {0x8, 0x2, r14}, {0x8, 0x4, r15}, {0x8, 0x1, r16}, {0x8, 0x2, r17}], {0x10, 0x4}, {0x20, 0x4}}, 0x9c, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x40000, &(0x7f0000000100)={0xa, 0x4e20, 0x400000000, @dev={0xfe, 0x80, [], 0x13}}, 0x178) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz0\x00', 0x200002, 0x0) [ 403.869082] binder_alloc: 11614: binder_alloc_buf, no vma [ 403.880867] binder: 11614:11618 transaction failed 29189/-3, size 0-0 line 3254 [ 403.891432] binder: 11611:11616 unknown command -1020052571 [ 403.898052] binder: 11611:11616 ioctl c0306201 20000140 returned -22 [ 403.900150] binder: BINDER_SET_CONTEXT_MGR already set [ 403.911506] binder: 11614:11626 ioctl 40046207 0 returned -16 [ 403.911541] binder: BINDER_SET_CONTEXT_MGR already set [ 403.926899] binder: 11611:11616 ioctl 40046207 0 returned -16 [ 403.927322] binder_alloc: 11614: binder_alloc_buf, no vma [ 403.938607] binder: undelivered TRANSACTION_ERROR: 29189 [ 403.949054] binder: 11614:11618 transaction failed 29189/-3, size 0-0 line 3254 [ 403.949070] binder_alloc: 11614: binder_alloc_buf, no vma [ 403.957227] binder: undelivered TRANSACTION_ERROR: 29189 18:00:31 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000180)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 403.967261] binder: 11611:11616 transaction failed 29189/-3, size 24-8 line 3254 [ 403.990557] binder: 11611:11636 BC_INCREFS_DONE u0000000000000000 no match [ 403.999663] binder: 11611:11616 Release 1 refcount change on invalid ref 1 ret -22 18:00:34 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) rt_sigaction(0x3d, &(0x7f0000000100)={&(0x7f0000000040)="c4a34d7c6efae536430fda2e660fe0151200000040d8df660f38043d02000000c4417e6f3fc481b1edad07000000440f0f9707000000b0d0fdc4617d5ac0", {0xb2}, 0x0, &(0x7f0000000080)="c442b9bd1041e1012ed9b965566666c4e10c5ea808000000c4023d96f0c462e5ae5f0c410f1a5300c401b35e2e66470f55213e2e65f30fbdc6"}, &(0x7f00000001c0)={&(0x7f0000000140)="c4c17f700aa7c40209f74709f26cc4c15d15e7360f0bc44291a621c4a1ca5148fef04683a6feeffffff5c4027dbcc4c401d1fbb365566666", {}, 0x0, &(0x7f0000000180)="45df5d00470f8d00008020263e3ef2d87429f44008d9c4827935c1d0f8f08017582ee06566400f38157e35670f79fe"}, 0x8, &(0x7f0000000200)) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:34 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 18:00:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") socket$inet_udplite(0x2, 0x2, 0x88) r1 = getpid() ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f00000000c0)={'veth0_to_hsr\x00', 0x4}) ptrace$getenv(0x4201, r1, 0x8, &(0x7f0000000000)) r2 = socket$inet6(0xa, 0xa, 0xa76) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r2, 0x0, 0x35, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0xfffffffffffffffb}, 0xfffffffffffffdac) setsockopt$IP_VS_SO_SET_ADD(r2, 0x0, 0x482, &(0x7f0000000140)={0x5c, @multicast1, 0x4e21, 0x1, 'wrr\x00', 0x4, 0x4, 0x5d}, 0x2c) 18:00:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000288d6610cd377890aa7b172f2f4c44fdf9df58934ae051aacbd7f922ce1dad6b08a5e1a685552d48c8fec7947719c143f744daf415ae8cf1930680ee06661c986872439303d643cc82eb4b016279d056f7d5b5454b55772e1ff9b137bedee7b62d425e5abf8ee797e8e19d2b8825179d64b47aa78c6c328fee3f9401fe8a5128c6a834672e67dab1e74adb695ce4f7f8eeabbdf1d202d4daaa2aeba706d6175f2696d596f56d17bf9a06fb26dfa70a0902e4f654cfd8ac6e3927229fb2265c8bc5dbd13a"], 0x0, 0x0, 0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140)={0x0}) r3 = mmap$binder(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x2000000, 0xd010, r0, 0x5c) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000280)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x60, 0x0, &(0x7f00000002c0)=[@transaction_sg={0x40486311, {{0x4, 0x0, 0x1, 0x0, 0x10, 0x0, 0x0, 0x58, 0x20, &(0x7f00000001c0)=[@flat={0x776a2a85, 0x1, r2}, @ptr={0x70742a85, 0x0, &(0x7f0000000180), 0x1, 0x1, 0x28}, @flat={0x73682a85, 0xb, r3, 0x4}], &(0x7f0000000240)=[0x28, 0x18, 0x0, 0x78]}, 0x108cc668}}, @acquire_done={0x40106309, r4, 0x3}], 0x11, 0x0, &(0x7f0000000340)="35d0411c1604fb59ce9d79ade1646f7971"}) 18:00:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) r2 = socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) setsockopt$inet6_group_source_req(r2, 0x29, 0x2f, &(0x7f0000000200)={0x2, {{0xa, 0x4e21, 0x9, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}}, {{0xa, 0x4e23, 0x4, @rand_addr="ab8cd274c59ec27ec9f11340c4493864", 0x8}}}, 0x108) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0xff, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="a53b33c388c4888af872221aa828eb31320993e27340e5905b29a665ed310cacd291ad9bdefc8651f6df03376854908fca597185e4d9306d56042c57dc245996d2d39077657e32a3da71eaa7a44bb8e8d77344c83487415b5fb3143eeb22e4ffeda49e7569e3bb8ba49f062ffcc1dbe1a9b4664d05219de6f5d8ef68038e210a3ee78c3badd1f63342bbe9aa0f716f1c8affd8ae8f8c2d9acbd8e43c94ea9c6b62d7bc5faa95016677ea78e55ed22c5318bdefeadef9beff7f17b22f9379e4054578ee1618106c63667d656bee1715d98a4805be6b17d720d46d955c32459f38edae5048cbb4c6a2e2a2a5cc8b6921a0a9d6b20d9f8532adb34bf3717a0c58"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:34 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000000180)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000000c0)={0x0, @loopback}, &(0x7f0000000380)=0xc) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f00000003c0)={@mcast1, 0x35, r2}) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0xffffffffffffffff, 0x2) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20, 0x7}, 0x1c) recvfrom(r0, &(0x7f0000000200)=""/216, 0xd8, 0x1, &(0x7f0000000300)=@pppoe={0x18, 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 'bridge_slave_0\x00'}}, 0x80) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 406.654361] binder_alloc: 11641: binder_alloc_buf, no vma [ 406.661833] binder: BINDER_SET_CONTEXT_MGR already set [ 406.677882] binder: 11641:11645 transaction failed 29189/-3, size 0-0 line 3254 [ 406.686848] binder: 11643:11647 ioctl 40046207 0 returned -16 [ 406.697028] binder: 11641:11645 got transaction to invalid handle 18:00:34 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000001180)=0x102, 0xffffffffffffffaf) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) pipe(&(0x7f0000001140)={0xffffffffffffffff, 0xffffffffffffffff}) sync_file_range(r1, 0x0, 0x7ff, 0x0) write$P9_RVERSION(r2, &(0x7f0000000040)={0x13, 0x65, 0xffff, 0x6d, 0x6, '9P2000'}, 0x13) ioctl$PERF_EVENT_IOC_RESET(r2, 0x2403, 0x7f) bind$inet6(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0x6e, @ipv4={[], [], @loopback}}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000200), &(0x7f0000000240)=0x40) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000140)={'filter\x00'}, &(0x7f0000000000)=0x54) ioctl$sock_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000280)) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f00000000c0)={'ifb0\x00', {0x2, 0x4e21, @broadcast}}) [ 406.713217] binder: 11641:11645 transaction failed 29201/-22, size 88-32 line 3117 [ 406.730767] binder: BINDER_SET_CONTEXT_MGR already set [ 406.744742] binder: 11641:11669 ioctl 40046207 0 returned -16 18:00:34 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0xffffffffffffffff, r0, 0x0, 0x0) 18:00:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 406.745315] binder_alloc: 11641: binder_alloc_buf, no vma [ 406.757000] binder: 11643:11647 BC_INCREFS_DONE u0000000000000000 no match [ 406.799762] binder: 11643:11665 transaction failed 29189/-3, size 24-8 line 3254 [ 406.800517] binder_alloc: 11641: binder_alloc_buf, no vma [ 406.824141] binder: undelivered TRANSACTION_ERROR: 29201 18:00:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000140)={0xff, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="a53b33c388c4888af872221aa828eb31320993e27340e5905b29a665ed310cacd291ad9bdefc8651f6df03376854908fca597185e4d9306d56042c57dc245996d2d39077657e32a3da71eaa7a44bb8e8d77344c83487415b5fb3143eeb22e4ffeda49e7569e3bb8ba49f062ffcc1dbe1a9b4664d05219de6f5d8ef68038e210a3ee78c3badd1f63342bbe9aa0f716f1c8affd8ae8f8c2d9acbd8e43c94ea9c6b62d7bc5faa95016677ea78e55ed22c5318bdefeadef9beff7f17b22f9379e4054578ee1618106c63667d656bee1715d98a4805be6b17d720d46d955c32459f38edae5048cbb4c6a2e2a2a5cc8b6921a0a9d6b20d9f8532adb34bf3717a0c58"], 0x0, 0x0, 0x0}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:34 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000040)=0xffffffffffffffff, 0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000080)={0x0, r1, 0xa, 0x2}, 0x14) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty, 0x9}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000000040), 0x4) close(r0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 406.827249] binder: 11643:11647 Release 1 refcount change on invalid ref 1 ret -22 [ 406.855981] binder: undelivered TRANSACTION_ERROR: 29189 [ 406.880852] binder: 11641:11645 transaction failed 29189/-3, size 0-0 line 3254 18:00:34 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000140)="00b1bacf13c571db506842a6d80c77bc332ac5dee759d6233c6d9edbcdf77957a40df6437a88a7d0599c72f6e66c5b9039e4db7aa9b30151df696bfaa9acc3ac34a09302e122075a202fb134609c4b57a2826bd9d2763f2208d7bab1b041a4013cca6db521b27586c99d") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000006, &(0x7f0000000000)=0xffffffffffffff80, 0xfffffffffffffeb6) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = accept4(r1, 0x0, &(0x7f0000000040), 0x0) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f00000000c0)={0x9, 0x1f, 0xffffffffffffff00, 0x75d}, 0x10) 18:00:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x10) r1 = syz_open_dev$binder(0x0, 0x0, 0x2) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KDSIGACCEPT(r2, 0x4b4e, 0xe) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f00000000c0)={0x6, &(0x7f0000000000)=[{}, {}, {}, {}, {}, {}]}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00637606000000000000000000000000000000000000000000000000000000000000000000000000000000000020dd4a3c00000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 406.917644] binder: undelivered TRANSACTION_ERROR: 29189 [ 406.931759] binder: release 11692:11696 transaction 494 out, still active [ 406.955781] binder: send failed reply for transaction 494, target dead 18:00:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:34 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='rdma.current\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) r2 = add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="b5c53c2c1b0d2cea59a9973760c7eb5ce6814f6a9a7e2fe34909", 0x1a, 0x0) write$binfmt_aout(r0, &(0x7f0000001700)=ANY=[@ANYBLOB="000000049001000046000000050000004a020000020000000000000000000000abeff1b9ed443b1b07f92128c218c401f27c3def773980ed17cebd37f3d2276c23281aa01bdd1891ceb1a8c8f6c2c611194cd10117f2f6820b86e22214de9fba30467eacbb8b7c7422bda9e1314551ca997b399233fcd2896fb6618547280b4c7339ad0dfadadd3018c1b7ffe7035d213bb4e01b624bd348b3e1d25c382a95c8a2d2bf7060f6fa0d73cd6e224c1258f81cd41ca0e86b09f301580d34b959c1cb695263d49fc95de24a2fbd342f86b4b51592ac3f11913f6506b2e444dfe29d625bd607318a0b76c12ca322ab79d18ae1b499fd52b657471abfd5a38a1664447036f48f88a0132e8ba04bb9297b29766215edd9da916c03d1420b3ee103b0695bcb589396934251c187615c77f38af208e1863f59fb931d4893c42d4ceda0ff1dd816b9aa8e520678666f73cb2e364daf14f481b61212c485ed5eea8da4706b7a136b2c3b6c119ba346b7ba83b517bfc2c18a67ae5defec19bf7a602b4c0b17c70abb84104ce4ac142d71f32bf2fd4abdc2fa024ac8fe7a93fa8f3fbea9c5b4f173f1b9bcf77bfeb8f95e341b04eafd2cfde39bac08457d41c34c66f8e29cee0cf984fb2744ef6227443606ed0eb3d619ffb38459de8e18235212aad3c37098003a8637872712c93d1a20b4366ad2574d0b2d2a51b2c14e37b6a781a80c81d5971de6df0ac799ca8cf0f9d093fd728bd4ebd04c610343fc53b7689244d995df3c9e4209e6077cc6ad687a6c06cc6096ebaa36f212c5768b5a99b3526ef4f0623ac0812e0afb2a3fad55bd20ceedcadb7c8bc03a3d5a8474ed71fc780ec1546e3b0d2f2c78ecc0337f1fb4a9b65e03b779f2fe0a548d00d52f020cf07561f8866ab1b24454f3990af413e1a22243110d094347abfb49cdd2c4e3eba8e6fe1a6a6de6dc9a1e27e1904844a358358070d7cd3e44f3d0aeeefd893edc8048f9a3a42d737c8f563885b9a0fe6c2d983d3367878732172e241778d1dea5bc4d151aff4a52acc07f33bbbf30e40a1192d62192d4b41aa19ad2fa5a7c1fed7ced60ff9bf91fcb9d8a48accfc10525c9cdbb647af26c3a86c875d08dcce5fd2d89ecbf3ef5274ea5ec2b60264783749cc1cb8e4bf4ce4b821a7747e1cc5f4cbe4be869c3f2c1b2687d1d3b38b7febc5ecb407ed117d4bdd3e5624344ff83f8473633323a11701a49da50881014392a25f43837b68329e70abee4f091758b5e95ad66c75f83d186949d96dec15c905f83e300530068f0f10c40e810e19eb8402e90c3432fe620fdf13a4e4f46393456b7d61d4bca7e616893ac30eb667da72f30fca6eceaea386a7f5fe24a924441f85f365fb96665b8da2aed46259e791a5e987aa455fa71430b436413d12ba643d2d0af4b5fd7c24454f7887dae4fbabf24c8ba588b1305c56ed6991650b254da530880d75d2c98ddbb78a6cfc5ed920d6c1dac6aa97074766861cbb8d8f8d102eceb3c3cc3d83da8aca8847b438479592d476032638e857b06d2a92c4185fced1483291e3fb7ce1feb041a3e6b73ef5e7f646a4c1516eefdb4c89b7f2dd034f8538b45a9bf0626e2bd7b4d1e4ddcc77ccb6ffe8a177455c632cd113aaa9ef9eff764620efdb309bac498591422395b0fe2cd77d3628dc1ea1ffc086a28bd375bd80f1b5a9ebfbaa75a3a4cbec23db735ad65782b8b87d7ad8ee0806d636b863251e58e005e66dde843bf0c60b7799450326ec02fe6231718fc2e1e875119b15bbc81db8bb25f3eb8ef068d31e5960f92ebb9cfc9b5ccbe9ede731f690df7945d1859492a2f595149b83f858814daf0305b9c02247c8b9f146d11b12b8965ebff3b045be0d131f8a78e9786e230aad776bf3900563c0d2bea682bdc403b7368836ac01e82c437439f1da1a4a487bea4e96901e329b939d69abd764cc70d2c7814284c1fcfc7088228847d3e6c0cf9b63226dd7805e7b42e7488a9a6ad4495603c198c3a8cd50c43a0484d45591b77fd46ae424dccd1ef74bc2341b5954cda37176ead0ef5a579627fbe055e4baf274130a20f434e95b030d5f0358ad4ced776e25aa19db0e10fb0beb74cc471fed9f7e4c8fe4c565fe237637de056ea22140af4d3166f14304e1409243d172e69efd2f1894c441fbb987f3ba92955dd781eca654ac2d61b93332e26328ba30bd08b9ec38e140035141992bcc91821d01a581ce98f92fcbb8ae143793f5a58d6c902804a98b5a9b0da427503eaf2aa580ed7eda9476e85602efe5180e1f1a98a8ff5328c4c2518a995c9fdb176b7b7f456db99f8f2e9d9415551169112644612b4a03ae432d5b7c9403b7feb8a4f351664defca21d621a3bdd255cdb1d0c24ea31beee8d8379bf9e1b5b874a72f27987de186411c9d8608d839f0f60c03d7f20083b39b67bd9fa240c9477164759848b1ce31f94bbe8b80254bb92ee513d53d8b195544152592bb52537d5e38cc9876f0ff8c9ee492b0c490a699cfcfbd7f579237d23ecc24be9d1a2f13834052ca83feca04baa00a5a7e2df753fd975f6e7171a2f5477cbc3ed62a26be1bc06b3f9077656beefa91d155e9cf202d57bd679d84aafa84e5850c1e3dea2fa40a85de1aaf07a5e3ccb74415b1019fa640a782490ee1d69d86217373a2cec9d30f3005bb68123534ae695504703e713b6f0fc40cbcf470cf594f40e55ccf46683a3c38fcf78a09f75e98db588fa38e30d82113266c03c55bbdc1eb856480810c506f94c605d9a41594ea2fb83d65efaa5eb169601458301ce13ad011ac65a3acdd70d058c4d815062039ba8c22c8fbdfb9485c59185d316467134eda0b683301b97f8eb986d11d16dce8de601c168d71d30d222a2e70d3f773096f7dd397e25bf3db06c41535a94929ad0418f4b0470f639647857662dd0eeba43f33d93104a300e00cab6ef9112af186973cf7153299909ca24f7e06d3b86eef5747440d3557fb6d2c19bec54a37c64c865f232f3ac1f7dbf8b4a99c26ce7890f93fcf48f54a48d5f569cafb883b39b3932ca6e5b12d0bc970c2b4220e6e25fe6cb646195a3ddcf11cc5a24eb319c8791af98370f6ea5defc9a59d2f8eb382b933e90cb703bceff2c69413dade69d2a617ee6559a88f2b6af84db558f278e7f664c914dd310715ca20beddddf7bf4b8ecee566bddec4c321d20ba2d87668237ba65e8feab7a484bc99c2a70817534a88c70cbc6135e4e27bce21d565c9f55e78e2b025c49b24a0faa5900bb4b1f094f91247b7d49dfe6fdbcd1757d8c11106b95f44d23c21bb850bef0953b86c28cd6734648f926fe9b6e62d97c4c43d36408441e99074737b662903a33f0a95c84b1fb3f7eddddcf5057ab4be518104166c84e9a07e36b27b14b25fe78ebe46d6d8d31f272723369ca9a757770cc03304e76899bd43550171883b59e838100108fff74446756636a1fb348ea170acc398aed49748e3b31501602c0a68bd43035b6ac6def4ea9c6d4464623bd585ea78649b4619cabd2f3cb7cf3126606ffa9da0d23cfae4f786189006e9c6eda34e9d410e8c642bb4bd1619010c1ed995acdfd4f10ed436020e1b8fc597d305c66c53d525260e3b9d4d6d96547741c3fb798b6eef7e312016057ee9d61a6ac9f84bc1a32b651abead6b717b6f302491ef6cdef14ac145821dce0beaf3d154f756851cc34c0c413fccc2a41959359fa478e1db0a1f2ef45e001de646788853321402f218d1ba9d979fd039d0d01c3ed9e40aca2dc3609dde50b54626116c47d65a6bbd227b1816f8582bd6377cb652b6702deb349b7ea590d285fe921e3a7ad7ef0bc87ff8574e9853bace321f274e3d66bae499e52523ba682e750cdd68e0b404e4018bfc63f6ae3defe6b62a59cbf6d10e25b2282e62c0a06e5c38813ff3da926e68b3af4ef340fe41c3e59123bf792c666865ba1975f79cbba77408cab1bc092450529e34f7d0ed05cafb829c3bf6d0a4c6267b3d14738535dc98f15cb5072cfdf26355444745fd571c84a406c93897effb0d21fa5a817c8c20449d314bd77a65c4f26ce11fd56cd56290979da40c0f6de8675c0308fda102a786852767651a32d73982f1df1a129b3287412e286ee6d6038711f3f2557c3dcea9acad3386a2b51bd0e722b5701a8270cb21f0659b8eb6847a99bf7c968ab8159d2d9a4e277aad543bc8dd68360545f164cb11edb9d284d4139fac5f3c7620bfd3acc3d59fbe6ad1411ecec591e11aa999cf3d407f624bbaea6f0b9b2dc1647c906d71d0d8c714031d2ab1ebb625a1efe463db182beaa36768baf39568a724f3cf2a1fc52025ffff073a415269aab1bd179003336eff0c7fcb197d29d27d5a4a2f5dbe61b1e14909617c84f7c192c1fd9bca27cd14f1ca9ed4a040393edc15f7137e7af47c873521099986160f3e92953140bc1ad1744a4ac5f1412711e3786528287a936a7853330d9d5a3e963b0e98fbfdc6fb52eea5a1b6b7b411f52f81851891bbe810aab8792efc2cb2afb0eda93de9d13f22f371b656923ca4d33e266d74ac86f7bc10ab89d086daef49692ed16ed2bd4eb70955b7735abd3b6853fb9c69ed1e53f1ccc49da5de2d43ef0cbff18fefeb9dc99a8898a4b1bc9d26573730bb060703aadb2f7e35f27603f359a7abf946c03840f6b2489e9bc042ce3c1433fe1eeeb30737b3136fb0098be913755702e6784d2beb0a89d43c5dfbca882fbe8a7080c7384300987c2f101b57c26400748929b532c006fb218fef55a83ffefa7ecbbdf25f835a7e4e1393812770900b88472de410d2ef9adb131f7db2bae6069e0c026813f5d49cd8fae9221417be63e7b46461740f4e89be4aa1cdc3dc07979a58b2de1840e108f70afefa1f4c3c16392f6ae48ff0a5c59b2946ae2f2bd132467f25a8a998b8742347a21201a8a0b6f50240830729f902d5d39fc8904c00a566963a2258f9e09f3a7539d75e039672ed98158d4ac7c05bbf99d072b01cdb59ae2d2362408eb6698fc7772cb7a8c80252bb6b9292615faa07e56f1c8eab6f34c98394e7b2fe5aee017bf40658042d890f100c98859c0bd6a30c1f35f219d34903c6cc180b96cc5ba8a301ffecd521b98dc7c0f029840deaf787ca3deccc3f046de669f27c46c31425e37b957b4a1fd36e59e3e9ecf2fab33931a90c385c646f25980c4e0a10d1f6d52c7579286467fda6a13f61672075afa64614cb9f6e51edc196261642cd18a0063342736085d99361b215d7cfd2efb5b947443dd635435f84a413e76bc521af5f114f45ecb1c112830289f72cf3d37e75646eb3f57a0dd8ef7fa5bb0b5a6cf690301236039ee50ca33d818d10fe9ba746fe972ef6df88af1499802627f330ff47dc4c7033adc609338f6c4655b2350cfbcc6c4a6ade063cbee9b327b33dfb3020e2d4b875bd8cde0786d25bf108a5ce48beb76c5a43a097662d73fe655a39a1a4d05ffe32a21b5338ef6485b2943f610d554028472415ecbf84cb6bdb590243ed7d8bbd978478284b3e2eaaf92e9f61bfe63639d19f8e0df24d0cfb1190165a7332cd922fbdb377459de5383914aab623332840014812f27e276877b477c8e1ceb6617c9e037ec666eb4b68d659c84a2fe588eaa35f70486f1fa4656b2a512dc94cd87bae6630cb96a29834ca5b6ffcc27e9ef200d2b86f1e857a9dfd0180bc696e8672dba3ede59d43d129ca49e41b41420dd6120b367f55660ba9cdf20792b245f8b67b32f5b1de8f8e0026cdc8cc188e8a6bac14d01c88593815df1e365844adde6df31b84fb4f0f7cba51bc40c103c0bb64f47662e37431b93b45d197e0437296057fe0c68e3000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000481f7c10f267"], 0x1420) r3 = add_key(&(0x7f0000000240)='rxrpc\x00', &(0x7f0000000280)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$instantiate_iov(0x14, r2, &(0x7f0000000200), 0x0, r3) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r4, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 406.957167] binder: 11704:11705 unknown command 108421888 [ 406.974966] binder: 11704:11705 ioctl c0306201 20000440 returned -22 [ 406.984737] binder: BINDER_SET_CONTEXT_MGR already set [ 406.995413] binder: BINDER_SET_CONTEXT_MGR already set [ 407.001396] binder: 11706:11711 ioctl 40046207 0 returned -16 [ 407.007758] binder: 11704:11705 ioctl 40046207 0 returned -16 [ 407.015318] binder: 11706:11711 transaction failed 29189/-22, size 24-8 line 3117 [ 407.027678] binder: 11706:11711 BC_INCREFS_DONE u0000000000000000 no match [ 407.065417] binder: 11706:11711 Release 1 refcount change on invalid ref 1 ret -22 18:00:35 executing program 1: r0 = socket$inet6(0xa, 0x3, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x2, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) fsetxattr$security_smack_transmute(r0, &(0x7f0000000080)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000100)='TRUE', 0x4, 0x3) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='clear_refs\x00') epoll_pwait(r2, &(0x7f0000000180)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x2, &(0x7f0000000200)={0x4}, 0x8) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000040)=@generic={0x0, 0xfa, 0x3f}) 18:00:35 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = dup2(r0, r0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000004c0)=0x0) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e22, @loopback}, 0x10) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in=@multicast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@local}}, &(0x7f0000000180)=0xe8) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000300)=0x0) sendmsg$nl_netfilter(r1, &(0x7f0000001700)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1004048}, 0xc, &(0x7f00000016c0)={&(0x7f0000003fc0)={0x14bc, 0x4, 0xb, 0x205, 0x70bd26, 0x25dfdbff, {0xc, 0x0, 0x1}, [@nested={0x14, 0x91, [@typed={0x8, 0x1a, @pid=r2}, @typed={0x8, 0x27, @u32=0x9}]}, @typed={0x8, 0x7f, @pid=r2}, @generic="2cfd954835e49c99b0fe5a57fbe155268866adc34f696801372c389d0e990be842ea9571addb0041860dfbcb6f8f450a704ad5231cc000f0579f469f99b23c2135d306c2c7f3bd4a35b13372a15878091cb8c51284a9c0f6a4d7643aade1fc0c929e2898f1723f45", @nested={0xf8, 0x8b, [@typed={0x4, 0x86}, @typed={0x8, 0x59, @fd=r1}, @typed={0xc, 0x43, @u64=0x101}, @generic="dbf6673152af5270101fdb3744bd428449192854168c12c4713a625a84e2ced83e9d3e2954c80f67d0f0381a0f4d3634678e9cbe9fd7025bc5796c722a661268fb7fa08056968af2a3efed4b105e33ea25f538fb9b0bbd310c0dd0ee2648183d83c86cc955ece5655bb769094f5ccbd391fa6162a7201ab1a75b0339defe0c0796dbbd691c3e01dde3c56581b2fe9aee17ca9c21c040692b741cb13451331b4ea90bec56dcf52559190efdee785b045e21fb9c49e1f35b4da8d77529042407b118a36b0d657dcd2aab76546cf590dc8ddbc7d5", @typed={0x8, 0xcf25, @uid=r3}]}, @nested={0x12a0, 0x62, [@typed={0x14, 0x88, @ipv6=@remote}, @generic="4772d6d27531f02505509b28cabbca351c3e7f0e4647ae4ba7814ceb2e10125f6bf03e983061105beda39e188eededaa19ce4f89feb27bfa1d2a1f714edb587f586ade1273f58eca2a7674965e98b94ceecc5c74bd5524b52eaabc86b13fd0e04ffb7e5d4b0d89e3c06da4f12555f951056d1fea68eba91ed4adcb0cf1b99b6809b71d7462fa6929758851e567da8a95d6a393b1fc12585aaf2eb0df6402de5468bd2c0f5531aeb8bd6f64f1b2dd463e55c93c2c1252baf4e1b217eb060cd3d1478ce8b9a1b0448eb29c6f06275684177f90f796b3e8668c59b4987547fed740ab8295003f89ad72c307daf2d19dfe76e58ddec240db7e5d0a8f5edeb711dc26222352c8a393cfe37313525453f968c59e549e5cc35d889a04d668a7ef60a43262d77c5e681b84c1e84b1f8e9f4231f0c08ca4a58d87c1caf8ccc41743b24c7912ccfdaba7e6aa5bfc8a07ac33d7c4ff391ab7dfdaf8880f271b59d91ba875a02c1f85ac28ae4cef5b496ec996ed4a87309761ac948e281c971e8722f65d7e59a8047988cd60a5540a360829a1a90fcb6abb97da0c67bf847abc172dd8f022a911e795fa3a7fc5cf3782dde182facb7ffaf828c02b13320bd252b02dff8d1c0f2235bac5fef140121c538983816f325fcd06bc542c82caa49ca2f2743cb9a8b669d2c011a257dbdfac15dac47be08e1b25385213cb0c9789edbd9eb9d6ab54aeba30c00bac650b167390ed3784af366d33a450a82edec3da08cdd776a6e778e33a05e1a34cc93cf6b7eb007b171843469075b09756245127ff5679be33877d89d67e468e29a43c9e83c3a74026e21a8867ceb62651060d19f85011d92a08540b7210ec2d10cb1e8e5fc3442395e6de92deac2eccf3d7f9f470a7349dd9a84db6786e2f920ea4ea15c036361610e4089728f88e773a485ac37f29a85605f928683548cd0acf9a31e9faee5276c6913d11756e5b53505f34f379f3088f2153da1a7b785574ceb4f7f3797644d683f9de217c411f22b0a81014c0e7607a3d1cd73c16ea7b1e4e96ab402ced875a4fc64e7f59fd83bd24fbb18b0e5df43fc65a34f7d95148a84479c455f852af50961ce9aa77f65dd35e665aedc98a7bf34357807dfa1b5df158736c767678d3ffcc2bfef874329c948cb35595ab4f60477aee59efc82575f0200396142fda494b5b32fe6316b4418769a701462de1a25f5102083cabba9659b921ea802c4ba464d392cef360106cb08a99662264c86a33843918416a5b0a96e77898e23f9035d3df0b980d421c14bd1ad06fe2e2844d79c95c5d1b6425a3355de5a4574d87d5db2dc9f96282ed27a70257aa590553c86e1f3c316931fb1a84019d4f8f3de8bc9f7c6cdb0bb1dd25ea02f6d18f1101993a3402538725f5caec8256fd1a4bc81101244de741f7adc587860d1a25fc441a604b726f6066eff8be3ce9cae80eeb3f773992da2eef011174bc778596a7a880afdeb32c0cdf32bb5cc49e797640520efc6275b74d83b66f89742317081869ed0fb875e168ca35433feb679302ab8613db28090a7e281b3841fdb88d84d2cd931ff7b0e1b893d7c0eeed75bd75d71a19270e87703ce0fb62c5377cfbf34d04c14b4b4b7608f841b3b979c6901d0d6444824cc780a8b71bf361bb389f9838b94f695b5d946f8c88aa3d62566ef2a68ac4745ce3e5c5e91a4bf53c6bfe9da85f6000e482d56b726e1a387220e6091d4a775e55fecf10155fc70e5bfb91c03771859648ca22537ae170338fed0c91c54817a91f3d9a7b7fb46d0435dd197d44f31f16fb4cb51d89c4b79422b8f715144fbbe1f18883e5cec143491d71dd43dc177a60cb14ac56a64575e029b36bfe0dec7f03a8bcd4a84eff546b04d5b3395ea1cd4b193ab2cd38ffd5be20206444f5a0c43cd607f43a664df2683a9df2a15fa0c5da365c00e3cf70c47dbbc20d85d7811e2a3ce15a58aff1aa1e54476287ff520e5c7f8f056a573dedbb38a4f2726b21038d764a43ea3b95d6406dce5c3c6c6dacbe71a5b648ce2d0b1365524ccf728104ab9b5ac1aa23ce0f14e4649d9cd449ea1676651f907f8074051626eb2be84cc43393b276367bdf1fa5d2d8434ad2877efb986d40396c20f6ae87f4ddd1506c4565a1e1d7646f8e9f8a03fed0ef1613c1e0067c58ffa123e9caead93467041ace4de0f4ae380bb16cbaeccc12fd68dcbedb1d23f1b4e0e94545e66c011a2b98b6f7cda61f5e33cc2f78d6fa427dffa727b305fc43fa9e18ecd7c202effe0270a2f198017baa7afd875bcb3b45618910000fae46685a2a5e0b2f510586008d9e17ff6c118befe5e1e580f54059b52e5730fcdd68ed3a8b6a4d6ebdcdbea3d90e4f70d236dd8821c7c762df50ac0adb5830bc0357b30e207fd4c2a700d107c28049d5c87c23df64066f08cbf2d61e9c06a1fb5b7c135482e3bcfd8aa2d974b6ed70f99ee6a1008ce245ab8112193830a998107f09bb6f772f99986c62f551af1609cac31816f7545f81b1e7278c168aa0d5a0c2365164ed1acc01e072f1767ada871dc3eb424219ed182635e876dcc7651ab2d0b66021a726e9dedbd2d62f47e03a13daec330714a8f7a140782c388bb12fffc1eff99940a3ffbe65e38c07c5175046f0a077c3ae0b1d21b4dc7f33f121879e3e4e1e056e3292a913c2505ab144f1f197322b361b6da729a02f49621707ffe213196732345bc10e33603f66a1ad5ad8b9b2113c3adfd6514370071c45a75968aa84031688f686e8824394a2aa9f9507c4f792195b12e70f5f9aa231a7885b8032c85ff34f28832acbd977ada0bb30dddcb6d5c2462c021044ec29d8c7c54aef88a351f93d7a9e7e4f7484855934370e5ac3f4f6044d6f0667c89e62be5cd57b707a60e4256072e60334f6ff988e4b70fb83e17432fd2eb1657d0ec5bf64f1fd82e37cc2c28ef22e4c21145f298b99ad6546ecdc00c6cbbcb71e1ca8b6c5dbd3811a269f270a577f951e497da4d116d1e199546928df2e03bd35d3a21b87f757c3499f18e698d607fbe843844ec06e6893ed862ab7dbec7e7626c0b9376f1f0f1589e70c1f61b28e95a14975fbceffcc8932779afe64d4980876dd3e0dc96160d4fdacb05526b69954336e098ce798f269262f7e130f515123c8a41db3abae444d2c51bd7867423915e59b2fd0bf87c891bdb745d434a8786b248ea605d0b80e46caf1602d939bbfde029003e616351c25662c72c105dc7dcefc7f5fdd8af13a660ed11475d910170738d061e308319df79459c5eb94693ed8da539306398aa7ed0ed86358eefab8543ef2c5b3305e8fe424e309a408397440665a4408c19b18b720b5640b9a5e371fad6fccbfc0909feb97127bfea8bb3ea62234d31d7972d90732fe4283f4e00f75aeac4e7da2a4bb42058bb806febe0cf072c50ae968733e1ef30e2d50a1b9c8514d5507997282fafb4890fcb41703f306c1dad5262acec1bc82ccb73efd23397c947ea2555e0f52004cc15bbb72476b75d467602a1486d640882c9db0a6b9651473225561a59d467678636d2a1f90e2685e47b237cfa29ae1f8efeca09642dcd9aa8b30545fa872c058072b4004e5df30e51fd5aa407ee0a1297cb46847ed5ec0629e2aff7392b531f9282d275de96fb2a96978e93f8863655787a8ed6fbf34175088f34e3717675dc2d01e8f5aff3fa57e17b98afd1fe732351d2183438689e9c5ebb47940d0f6dcac17bab27ba1c600be102e28943b00194c7c37db718fbe729c22cc6268ea6d5ce8a63040b2a5468d83746cb36ea0279ebfc74d47f92d0b2d04d1ef968216d8840bcf0ff31b5d71e66ef60ccd7545041421e8b8060b9798114f3e7ea63cfbaf5b11ebf4976d01e06f503799294db5d39b9f65a7f4927a4354b958b521997c19c3c7b2e3799d24308bd42c59c581b4b2cf5e8583cfddad2584b1d34281369c2bcd5993ed51752f4b52b6e999f9b5c07d6f6d085c51f79d39129fefacbd4333e807d0a890c3b9991027658052d5aeb7dfe283b6a0946996fe544dd93a38710719211d9c5cdd96e82b59a6f68dc307455e314f23feb22a1add423681fecfc01a454d5ea7de2660c054866824c93e6a7a3705adc18c94c293a8ffd11ff3375a323294721167cc45b06899c6302806ec10d77b354cff1f3a6bfa857f49289d11fe844c82c86c56816d6e728749dab0319bcef93a70dba952537c1e563ab5cc5d14309c269ce761c14a3dbb46225cf8181503e159546fe9787c768f1c9eb43cce08f8d926586ba6b29e6ab519c3421e95d89a0dd2f502853265757de0dcc6cb487bb0fa605a399ad2d1b4e75e87fa6d4ff859ae9911d1eb74afabe0d0593ef70908c1ca31c8c4cf9962120d7aff1ac043197470346e58367c1fae8449bbe2f772f42e5845f0e1bf254cff5d9c001009da0be912100a3df32073c1d6e4d64aed6c7905b6397a630297094ac3610b2c3f4ea0bb6fc913102614be81b72493233cd020ac302ddae8ea7d324652694a0933c0bd97891c1affd78c7ac8b821b97f601e536e9a4c54db5a1e7a10789d39d325bcf830ba69a34cb0dc0a57335e3bc21a8128777a10f422574b19543a2e85624a085e2d7c185e7859f080bcdade1385c5e28672eb888994218ebe0afa04895123dcf6a7b8a0749f64d3becb6e860859c5346d5ca6dce2e91ee2a44ce374eca93b104c90d2e3186045326be30326dd2d3668ff536b9a8ea83eec551ffb176a828caddca3612fd8bd5649dcb6cb663021b33c5ddd3b2318e7f65aacaa83b1a38064ab24c48cddc8bfbf6d4bd1b031df8247a606d942a5fe5bb2226cc577bf7dcf00adeae972bf95cc5a9fd11ce9b20dc96f7237a88b175ad6c9bf25e6e6377668d1f4b0022fe7cd6f52807c86932ca3827a3adadeb52678f895bfb7d36eafae7c86a57c85bdbd4a060674fbbc46fa9b08933f02468f6248caac703190bf57277a2c95b82d243b9d88e5eaf418255a22bdbc7c3bf29f8d802bbd095819830a071a71d5ba01a83888a8cf8c894489432c26622161422a800dca20d2413053b860b98b6002669716b88c3b715fc2a31e2ab9064f41e8b76fca79228f6f26292682d5464c6ce0acbf097721bb63e53b99cca65195a5b5cab99a7e70f5b492d08fa84eb68bd66ab030269d1a5bd02a8b5f776fc8e05c1f25e71663919021332f382b4cd13fffb5725477ead061cd4c96d1fe75d9086fb41b3b836565bdb1de96e9cccd0d89e7a7dcf9709053e96ea92fa1196edbc622084820c98d959e7fda23943cac5d8523ecefbf636b1908808db844f99ce900aa33be38214c9e10bfbe1d5226db5734fb7110a3726ede6bf1e8b5527b644b4c41e95aff248706173047816f63557d7a14c40eba8c57b738d1113b3c8a6738c543544dfd13e2c7499d01e1c21652e35b521caccecdbda72b2a748e8e7a7b3bb3d87d778c390fd755c59af1288074c1647cbd0015e7236aa34c4a053dab48b8ccbf586936532b06e0c55de9c5ebef82483d5d563f59ff522ec12319d9e96d8324e87d4792194480bea8b49f7809b38014702e023d485b96fd7325590d6562b5d0926b4f00fdb6d72680c96400548a22b6acd0e3f3f8daae42747d44c60b7f0a6a6722cbf5e066eb0094f15bd3217d19008baee511e088fbe06f300b03168353635f6691ed1a168d85cef84d3514fa49d3ea1df254047beb6f2ca8712b1c964d8edd86886a7a3c2e0351d81f2cbb4d58fb4f71d1276f7608839ec47324f1dd905759c9eb87b222176f0b3fc0e9b9100cb44b011298031a", @typed={0x8, 0x17, @ipv4=@multicast2}, @generic="792ed8bce9ccb609a610f3e1fcb814151efacb6debf414e63df1fc571c4b8141a52dc2bdcf550c571d1d73ce6790f1df22b88f244fa115ec4d11e48a67de640a7ad2945f14db799275ce858b7f94ff1e55b6df814bd2c9311003c1fc279dccb76beb05249d4bdce2acae21b13f2a59781e713a0bbc6331a6a51fc86c76897e7269cf63d5440ded15c10be1d41753f192fbc2bb2b1f51d342", @generic="1fb095fc7572181c149f68364fe7c35318d1bb08d8eb785bd265ca4babed02b987055976b96a399d4ec3923df9291f3536ba80f9facd259cad8179399a96137a0397929ab50414885dc158b0d14f63b44348884ff3cc2b98fdc484ba86a211b7e80a3933e4a22a16812337215823df8d57b185f06377", @generic="723c471b54f352dd3bfcdc9b1b352b12ee5a586a63b805c166d6d7d9f9defed4f90bdf738fe261c81c64a3d4a66b55900512b867d0a963003735ab22b1a6fc08eea355f5cd29a603020ccd0ff5aa7b7a7374533ef3757f7efd3d85f0210e375029daf6249b796e791b767d847efe3798f5824e2129ed5c26c3b5e37ec5979086ee1ef65b98e5f45e1caa6d3512b96a70ca975a86c3fecea421eedd580b6f8c426dacce9805b855be68d2b8beaf11f92537651ed6cda3ae896af9515068adad1b", @generic="bd0393875701af615fe5ceb98e08549bb6b4969f29e9a87222b0e584b868c56f3324b3c21bd536a2658151fa914af998b4cf76fcd4da5e3eafd01156bff24e53b7a6b1bc13e01bff2c927b36f8e09ef894745042c3ae636b53a49fd4f085134c36fbba11ceacee89faf069e93e94e3c5f080442d63dab468bd2b69713a8b82dd62f9b64a457e2bcd25508962e6d4a4acfc05c10aa3bc1621eb0ac11867", @typed={0x14, 0x61, @ipv6=@empty}]}, @nested={0x8c, 0x73, [@typed={0x8, 0x28, @pid=r4}, @generic="c40427c05d5059f7a46268b06b291e7173f21bc9c3ebf23bb54294c96a8984fbf541eea648431193298d4a8f7b47276a95e8c14ad630ea1db688680cc3f696102513e96cbb1fcb82f228809f5ec8e4689fabf3415c22a1fad9dfdc9785142ab64fbfe51ee43bcdf924219f1556f778cc94d6de0f8ddedc24", @typed={0x8, 0x6f, @fd=r0}]}]}, 0x14bc}, 0x1, 0x0, 0x0, 0x4800}, 0x44001) r5 = socket$inet6(0xa, 0x1, 0x0) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, r6, 0x100, 0x70bd27, 0x25dfdbfc, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x10) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) ioctl$sock_SIOCGSKNS(r0, 0x894c, &(0x7f0000000000)=0x1) getrusage(0x0, &(0x7f0000000500)) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000140)=0xff) 18:00:35 executing program 3: syz_read_part_table(0x3f, 0x6, &(0x7f0000000540)=[{&(0x7f0000000080)="bc15c0b38f1d079b9a33686a7f46c0e71776d0f06f906a45d479e8a9c27e298e2f5d764567d8ca475ade59fbaae5c0307f2ed06ad5960a57d8dd4e73a6ee79205ec14466131320d1368f057b868f33244e124794f489d244f6d098dedf5ec228b9823c53a24344dbe7a1a1e75ff3bf075c7fa95a32fa9c6fcb86f53146cdc8bd30cc22f2f0d7ddcb70f9bc20a417844c40f0b7e582b728e6328eaa2ca633c7d79e42e6fb5bca99819a8e5825081db54377ac8bbda792cf9a70cb36602589a243f16c47856eb6bc64493a19cf5fceee29e9bf51fa1cffffe7a82b", 0xda, 0x80000001}, {&(0x7f0000000180)="589c12fb0a144f1442f8ed08cd98bd1d66decd3f3d274f343df0011fdadd462496ba95f6d2d430ea292ad125415e631610d053a896e3", 0x36}, {&(0x7f00000001c0), 0x0, 0x4000000}, {&(0x7f0000000200)="764b4d106007263a3cc5f01b61844e9109d8bd62b67fc8512311f1c0d7f1a7e397b5b372165067d44a3d7f610e3ca62ff3a723c7594a73aadfdb6a409ec197ec", 0x40, 0xe12}, {&(0x7f0000000240)="728561f1eb9dfbb6fc6c6ce9c0ef23cc2160362a3b569fdee53f3dff346765bcca37b78b9f2ad526a86be55c16065901996b992451df2156e60cace769bf11a2d2fdc07cf4811954213ba0ecd35333324fb5212973aa2877fa6f94fc8778276a4c7bf83097dc5c7a01e4f239c76bf2c2db9bb7fbdf64670e4d2d9722079bf5e81bc7930f6b7e868803", 0x89, 0x1}, {&(0x7f0000000480)="b4623a399d010a6eef18960c6875a66b4f4081530e846319d11f222cc2786223a59186d6b67c676ec439e0ea80cbd858977e15c837a4e4ed9eb43983b14885d6fdf0eb64a648bdf4d7b9cb041d9f56ea0ab2fc86f49f7647088d2e2c111a6467451bfc42a511af39670aded01b641a7045af1518aa41afb48b77684fcd7b532653bae03f4be748e0762deb9ab92bc4b9d679381379affd8d58059dff439b7b78dd9b6e47911ab1655acc", 0xaa, 0x1}]) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f0000000040)={0x9, 0x3}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 407.656026] binder: 11724:11728 transaction failed 29189/-22, size 0-0 line 3117 [ 407.713180] binder: 11724:11747 transaction failed 29189/-22, size 0-0 line 3117 [ 407.721747] binder: undelivered TRANSACTION_ERROR: 29189 [ 407.727877] binder: undelivered TRANSACTION_ERROR: 29189 18:00:37 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 18:00:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:37 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') ioctl$TUNSETVNETBE(r1, 0x400454de, &(0x7f0000000040)) sendmsg$TIPC_NL_BEARER_ADD(r1, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)={0x144, r2, 0x500, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffffffff76f0}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8001}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6fd1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xa44}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffffffffffffa}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x4}, @TIPC_NLA_BEARER={0x88, 0x1, [@TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf8f6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xb8c}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}]}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7b0d}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2f9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}]}, @TIPC_NLA_MEDIA={0x2c, 0x5, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffffffff0000}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffffffffffc}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x4}, 0x400c010) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2d, &(0x7f0000000180)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x4e20}, 0xfffffffffffffd48) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:37 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x131f64) setsockopt$inet6_tcp_int(r3, 0x6, 0x1, &(0x7f0000000140)=0x9, 0x4) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r2, 0x6, 0x3, &(0x7f0000000100), 0x4) setsockopt$inet6_opts(r2, 0x29, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0xfffffd82) r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x4000, 0x0) ioctl$KDSKBSENT(r4, 0x4b49, &(0x7f0000000100)="00aa9b535a1c9d043ad64066ea40df5e26f345319ad55ecfda683e53c1dd683daf5892f121909a4217352e609542d15c5a78b26de831965d20d9ff49be6bab5359330f29e6d351f6e7006907d56fdee75e43ca98af5ff898748bb34a058a4523b02da56db0b831fb4538abfc3405e70c8e1c02a0e66e196b78735935e0f085e378873ee34ec20740267b33a7eca0a27b") syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 409.830862] binder_alloc: 11753: binder_alloc_buf, no vma [ 409.846084] binder: 11753:11757 transaction failed 29189/-3, size 0-0 line 3254 [ 409.862240] binder: BINDER_SET_CONTEXT_MGR already set [ 409.870253] binder: 11754:11761 ioctl 40046207 0 returned -16 18:00:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") socketpair(0x1b, 0xf, 0x400, &(0x7f0000000180)={0xffffffffffffffff}) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x8000000000102, 0x1e6) recvfrom$inet6(r1, &(0x7f0000000200)=""/240, 0xf0, 0x2000, &(0x7f0000000300)={0xa, 0x4e21, 0x8000, @rand_addr="06b10e91941affa77a300126b466c3b5", 0x87}, 0x1c) bind$inet6(r2, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:37 executing program 5: r0 = accept(0xffffffffffffffff, &(0x7f0000000300)=@vsock={0x28, 0x0, 0x0, @reserved}, &(0x7f0000000140)=0x80) ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f00000003c0)={0x0, {0x2, 0x4e24, @empty}, {0x2, 0x4e23, @rand_addr=0x9}, {0x2, 0x4e20, @broadcast}, 0xca, 0x0, 0x0, 0x0, 0x10000, &(0x7f0000000380)='ip6gretap0\x00', 0x1, 0x9, 0x2}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$BLKPG(r1, 0x1269, &(0x7f00000000c0)={0x1f, 0x3ff, 0xe3, &(0x7f0000000200)="06ea6142684262becd9790d64509951b08e3a5ccec182b18c846acfb9563f4b97bb4c615e13f90b1a6cb996f6102765bc7c9dfa928a97bfbb4ae3a130632e7ab2221516f445734598815e50cfbe8ddfba4c4646242955c5b0dfa75a790a10423f447eba43c22457a64c308bcb8d10987dbb51850b65d1e5fa3ece648c5529ab617934efe3da44b39b7308496150365cdee548f934fa4ac77262b0f03836b1819d214a32176517397efe0d7d6de1fe427ec4ffb90760487c65460a358caf12f6d6ca75ddc34613385630010b21dc6e8c5bbbd4b122f341e4729d73d87e806ac9ed3c550"}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/access\x00', 0x2, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r3 = socket$inet6(0xa, 0xa, 0x3b97) r4 = getpgid(0x0) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000180)=r4) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000480)=0x4, 0x4) [ 409.871537] binder: BINDER_SET_CONTEXT_MGR already set [ 409.898663] binder_alloc: 11753: binder_alloc_buf, no vma [ 409.904862] binder: 11753:11767 ioctl 40046207 0 returned -16 [ 409.905711] binder: undelivered TRANSACTION_ERROR: 29189 [ 409.912365] binder: 11754:11761 transaction failed 29189/-3, size 24-8 line 3254 [ 409.916568] binder_alloc: 11753: binder_alloc_buf, no vma 18:00:37 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffff9c, 0x0, 0x7, &(0x7f0000000000)='&em1-.\x00', 0xffffffffffffffff}, 0x30) ptrace$cont(0x9, r1, 0x0, 0x4) r2 = syz_open_dev$binder(0x0, 0x0, 0x40000000000003) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00634040000000000000000000000100000000000000000000000000000000008000000000000000000000000000000000000000000000d7000000000000000000000000d4379b688f77ae0ba645904996b2b509c6c7ee03449387c69221f4b8a2e9882d3c0d2cb1feef2fd70fe03e342d19e5778e4997bf0e32cb5342c7486877345f400000003d2f9b671f38f51e15d62e7e2626bd29df0b8404000000ca14398a4b3a05a71d1e215a34786d979b8fba87eab748f9080b651acb84d373d121c518626cdbd37dfb7043fd14cea44635a6cd2739f599dd4fe5e32c816678eea450e4487c026db12ff3fb708b76a2a33832858ff9d177fdc9b819a462f51c4497eca08eb5da091a8f6b0740e6c4c769531bd93d2a8a56e3b26336625be1ae12ed6a2c475db61d9d7495053e967171f56ba008681c8348d47396c48516280db5612e7c74974c07c602ca0d0398fff51047fe63f6784c67b1c8b14e5d4957205b7fad2fa8"], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x2, 0x80012, r0, 0x0) [ 409.927100] binder: 11754:11761 BC_INCREFS_DONE u0000000000000000 no match [ 409.939622] binder: 11754:11761 Release 1 refcount change on invalid ref 1 ret -22 [ 409.946066] binder: 11753:11757 transaction failed 29189/-3, size 0-0 line 3254 [ 409.966083] binder: undelivered TRANSACTION_ERROR: 29189 18:00:37 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x2, 0x7) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:37 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = accept4(r0, 0x0, &(0x7f0000000240), 0x800) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x4e24, 0xea1b, @rand_addr="fe6cf6c6080762bc82995162a0ed629c", 0x7}}, 0x0, 0x5, 0x0, "4b28125e6b0e43873fef709ec9d556bcca4d52cce8443c6ab3f7d822ec97e53b5d43d7cb0cb0008c8c37da37518a6e86d670dcd4479e5340d513a690f0757b7edc23c71a29cd765c047afa82229e5239"}, 0xd8) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r2, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_REVISION_TARGET(r2, 0x29, 0x45, &(0x7f0000000180)={'IDLETIMER\x00'}, &(0x7f0000000200)=0x1e) prctl$PR_CAPBSET_READ(0x17, 0x12) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) getpid() r4 = gettid() syz_open_procfs(r4, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 410.037928] binder: release 11780:11785 transaction 506 out, still active [ 410.053932] binder: BINDER_SET_CONTEXT_MGR already set [ 410.073877] binder: 11784:11788 ioctl 40046207 0 returned -16 [ 410.073925] binder: send failed reply for transaction 506, target dead [ 410.096734] binder: 11784:11788 transaction failed 29189/-22, size 0-0 line 3117 [ 410.111860] binder: binder_mmap: 11784 20ffe000-21000000 bad vm_flags failed -1 [ 410.122409] binder_alloc: 11784: binder_alloc_buf, no vma [ 410.128267] binder: 11784:11788 transaction failed 29189/-3, size 0-0 line 3254 [ 410.137121] binder: binder_mmap: 11784 20ffe000-21000000 bad vm_flags failed -1 [ 410.145633] binder: undelivered TRANSACTION_ERROR: 29189 [ 410.160544] binder: undelivered TRANSACTION_ERROR: 29189 18:00:40 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 18:00:40 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) faccessat(r3, &(0x7f0000000180)='./file0\x00', 0x44, 0x500) 18:00:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000080000000002, &(0x7f0000000040)=0x80000000008, 0xfffffffffffffdfd) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @rand_addr, 0x1}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) ioctl$TCSETAF(r2, 0x5408, &(0x7f0000000180)={0x800, 0x10000, 0x0, 0x0, 0x12, 0xd7, 0x8, 0x58, 0x5, 0x8000}) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo\x00') write$9p(r3, &(0x7f0000000040)="6cc8026c0a9cafe33eb9b1d950cee9583e774d3c36b81906a8c289ee808ba50f73d1ac4c4b32d85088493ed701a7b9bdb968a253ed0cc67fd36b4850f406714598e28b0087686acba13ad04bd21573a351c5620979e3d00c83b3c03268ded844556f76c3349178ced24217b09dec4f2e93b8401c3ddd77c56e2bc231ee19ec45f68915cc250a2dc86fd22395843b69ae9c7513e61d1a4e5ae1e85175d9a2d1077b288539068b73298e449b046841d7b567cd7b1b38cb42bf66ea110643a49d5f5d3f70efdb605370cc22b22e5c494beb29056a1c8cbdf12b030ada1947ec01a4541a", 0xe2) write$9p(r2, &(0x7f00000001c0)="897e52ac4a3f00a921e19de33839d55f055aff2aeb4acd6d6e93af55dff685e1f880414540a14b5297b18ce911d057e654e321f5fcbaf236b51a2d5da99bad28a9ddbe3c2a3e05173ad63a21c3df5d993828739c332c6ee55d1ae306", 0x5c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) 18:00:40 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) gettid() fcntl$getown(r0, 0x9) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)=0x0) syz_open_procfs(r1, 0x0) 18:00:40 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = accept(r0, &(0x7f0000000140)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, &(0x7f0000000000)=0x80) sendto$inet6(r1, &(0x7f00000000c0)="a73c6b7fefe249f189030b2a31eb6f07699ac5bff95f4627801d5c945fb53f28cde73ed5ff731b", 0x27, 0x20000000, &(0x7f00000001c0)={0xa, 0x4e22, 0x575, @empty, 0x80000000}, 0x1c) r2 = socket$inet6(0xa, 0x1, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000380)='notify_on_release\x00', 0x2, 0x0) setsockopt$packet_buf(r1, 0x107, 0x5, &(0x7f00000002c0)="c7ad9f3bf2d4a96a73008d49ef178c5a8f345a122e76b4c9cd0d23153d906d6a4bfcc5623af4a388247a2a97c87ebc6a2ebe6034398b4c52fe876660b2780921da26ba8573538510e39d7d7ffb92a8c70f311ed734d1152cf6d14843c3c0822ba91f44098b1d6109c65a83d1d7da6c1a2e6813b26260c79a671b68843eabc57ca8487edec66419d7aad7274dbf7d52bc886e2a429e8dcd5260807c4572765b9f65866b9c3d272f7985129b501eb11a2f97a10f26", 0xb4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x4e22, 0x3f, @empty, 0x6}, 0x1c) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f00000003c0)) r3 = openat$cgroup_ro(r2, &(0x7f0000000240)='hugetlb.2MB.usage_in_bytes\x00', 0x0, 0x0) ioctl$BLKSECTGET(r3, 0x1267, &(0x7f0000000280)) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) vmsplice(r2, &(0x7f0000000540)=[{&(0x7f0000000400)="cba3b6839b24e212e497deaa033bf521d2d86c66938753c8e09c0d572b91cb12643757392a9512927047", 0x2a}, {&(0x7f0000000440)='K{<', 0x3}, {&(0x7f0000000480)="c8657d569a6ead9774bf4f6cc0fccee0f310bf8e88c3d4c7de03d39b7e746885d1e07eb0b5560245b3a8d71a44488e7f6f377eeb440212dc0689fcf51c637cdb1e4fb520c8540c3c5298a320a37e8aa7ac961cd0b071f695b3a80b0e1ee8ec737ec66bfc8ec5b75ae5e62eaad7724bae7d29304126494b47740d113d919fc0dad47c513b53cca9db0de75465b6af46", 0x8f}], 0x3, 0x9) 18:00:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x5, 0x6) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x6, 0x1ff) signalfd4(r0, &(0x7f0000000180)={0x100}, 0x8, 0x800) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$TUNSETSNDBUF(r3, 0x400454d4, &(0x7f0000000200)=0xfffffffffffffffb) [ 412.854581] binder: 11804:11807 transaction failed 29189/-22, size 24-8 line 3117 [ 412.863717] binder: 11808:11811 transaction failed 29189/-22, size 0-0 line 3117 [ 412.877623] binder: 11804:11807 BC_INCREFS_DONE u0000000000000000 no match [ 412.893547] binder: 11804:11807 Release 1 refcount change on invalid ref 1 ret -22 18:00:40 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:40 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$UI_END_FF_UPLOAD(r2, 0x406855c9, &(0x7f0000000240)={0xc, 0x5, {0x57, 0x3, 0x2a, {0x101, 0xc0d1}, {0x3ff, 0xffffffffffffa73d}, @period={0x5b, 0xffffffff, 0x9, 0x8, 0xd075, {0x10001, 0x9, 0xffffffff, 0x2}, 0x1, &(0x7f0000000200)=[0x56e]}}, {0x57, 0x6, 0x101, {0x17d, 0x2}, {0x9, 0x8}, @cond=[{0x9965, 0x1857, 0x88d, 0x81, 0x80000001, 0x1}, {0x7, 0x6, 0x5, 0x3, 0x7, 0x6b}]}}) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:40 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) [ 412.907007] binder: 11808:11825 transaction failed 29189/-22, size 0-0 line 3117 [ 412.926046] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.934488] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.945265] binder: 11834:11838 transaction failed 29189/-22, size 24-8 line 3117 18:00:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_ENABLE_VERITY(r1, 0x6685) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006b404000000000000000000000000000000000009e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000025ae5715f0c0fa815444d264d2c48282e26fe70bb481caa464d3416664db56304550e153274547dd4704a39ecfb4078b7c3608b61a431258e6b312"], 0x0, 0x0, 0x0}) [ 412.959913] binder: 11834:11838 BC_INCREFS_DONE u0000000000000000 no match [ 412.983330] binder: 11834:11838 Release 1 refcount change on invalid ref 1 ret -22 [ 412.984487] binder: 11843:11847 ioctl 6685 0 returned -22 [ 412.998669] binder: 11843:11847 unknown command 1077963520 [ 413.006714] binder: 11843:11847 ioctl c0306201 20000440 returned -22 [ 413.015487] binder: 11843:11851 ioctl 6685 0 returned -22 [ 413.025521] binder: BINDER_SET_CONTEXT_MGR already set [ 413.031390] binder: 11843:11847 ioctl 40046207 0 returned -16 [ 413.037538] binder: 11843:11851 unknown command 1077963520 [ 413.046090] binder: 11843:11851 ioctl c0306201 20000440 returned -22 18:00:43 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:43 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) 18:00:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e24}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback, 0x1f}, 0x1c) 18:00:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x410040, 0x0) accept(r0, &(0x7f0000000200)=@xdp={0x2c, 0x0, 0x0}, &(0x7f0000000280)=0x80) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f00000002c0)={@remote, 0x8, r2}) r3 = gettid() ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000300)=r3) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") listen(r1, 0xffffffff7fffffff) r4 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(r4, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r4, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r4, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:43 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x40000000004) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fallocate(r1, 0x8, 0xe1f1, 0xd92) r2 = socket$inet(0x2, 0x80000, 0x3) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f0000000000)={'bond_slave_0\x00', 0xcc}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x128, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) r2 = dup(r0) ioctl$RNDADDENTROPY(r2, 0x40085203, &(0x7f0000000200)={0x718e, 0x9f, "aae35a69a1a22a9f3affe85753cb79be60517fdef3335cd4b543974b6909d71692cc069428d0c4b5015b0e87f873eedde3165d88a9280cd4a5f320db1d982f8a699640254cb799a7e9820b98e083f0bbd7a8f1c1c0fcac3d78a5289e9565f517527d72580a95e00230469f0cb0b117f85ea56090630a250e67427a5789674e810e58ea708caebcea278a3bfb6dbbf8ed9caf964362170a47452766bd84188e"}) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:43 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20, 0x400000}, 0x1c) sendto$inet6(r0, 0x0, 0xffffffffffffff51, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @mcast2, 0x400}, 0x2a4) r1 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff9) request_key(&(0x7f0000000040)='id_legacy\x00', &(0x7f0000000080)={'syz', 0x1}, &(0x7f0000000100)='-userppp1cpusetem1&[-vboxnet0#@cgroup\x00', r1) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000780)='/selinux/enforce\x00', 0x87dcc4bd7da62bec, 0x0) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000002c0)='nbd\x00') sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000480)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x20, r3, 0x608, 0x70bd2c, 0x25dfdbfb, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x20}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x1) ioctl$RTC_ALM_READ(r2, 0x80247008, &(0x7f0000000200)) ioctl$LOOP_SET_FD(r2, 0x4c00, r0) ioctl$VT_GETSTATE(r2, 0x5603, &(0x7f0000000500)={0x3f, 0x576, 0x6}) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000680)={{{@in=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in6=@loopback}}, &(0x7f0000000380)=0xe8) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000600)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000540)={0x54, r6, 0x300, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100000001}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x51d8f590}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0xa7}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x1}]}, 0x54}}, 0x8000) lstat(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchown(r0, r5, r7) connect$inet6(r2, &(0x7f0000000640)={0xa, 0x4e23, 0x4, @loopback, 0x7a41}, 0x1c) ioctl$RTC_IRQP_SET(r4, 0x4008700c, 0xbc2) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000007c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r0, &(0x7f0000000880)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x1c, r8, 0x300, 0x70bd2c, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x20008000}, 0x4004) [ 415.934721] binder_alloc: 11861: binder_alloc_buf, no vma [ 415.964068] binder: 11858:11869 transaction failed 29189/-3, size 24-8 line 3254 18:00:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) r2 = fcntl$dupfd(r1, 0x406, r1) write$P9_RLOPEN(r2, &(0x7f0000000000)={0x18, 0xd, 0x1, {{0x0, 0x2, 0x1}, 0x1ff}}, 0x18) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x1, 0x0) ioctl$BLKREPORTZONE(r2, 0xc0101282, &(0x7f0000000200)=ANY=[@ANYBLOB="0800000000000000050000000000000000000100000000003f0000000000000007000000000000000000ff08000000000000000000000000000000000000000000000000000000000000000000000000010000000000000003000000000000004e03d17d00000000010102010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0f00000000000000fcffffffffffff000802070000000000000000000000000000000000000000000000000000000000000000000000009e0b000000000000ffff000000000000f2ef000000000000080006040000000000000000000000000000000000000000000000000000000000000000000000007e0000000000000001000080ffffffff05000000000000003f060008000000000000000000000000000000000000000024c318ed65761b400000000000000000"]) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 415.965205] binder_alloc: 11861: binder_alloc_buf, no vma [ 416.011955] binder: 11858:11886 BC_INCREFS_DONE u0000000000000000 no match [ 416.021105] binder: 11861:11882 transaction failed 29189/-3, size 0-0 line 3254 [ 416.022879] binder: 11858:11869 Release 1 refcount change on invalid ref 1 ret -22 18:00:43 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f00000002c0)={0x0, {0x2, 0x4e23, @local}, {0x2, 0x4e21, @multicast1}, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x29}}, 0x1, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000280)='hwsim0\x00', 0x7, 0x40, 0xa7d9}) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0xfffffeff7ffffffe, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f0000000200)={{0xa, 0x4e24, 0x217, @empty, 0x8}, {0xa, 0x4e23, 0x8, @mcast1, 0x5}, 0x100000001, [0xb, 0x7b, 0x0, 0x0, 0xa67, 0x5, 0x1, 0x1]}, 0x5c) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet6_buf(r1, 0x29, 0x23, &(0x7f0000006b80)=""/247, &(0x7f0000006c80)=0xf7) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) r3 = socket(0x13, 0x80004, 0xbee) recvmmsg(r3, &(0x7f0000006a00)=[{{&(0x7f0000000140)=@nl, 0x80, &(0x7f0000001540)=[{&(0x7f0000000200)=""/164, 0xa4}, {&(0x7f00000002c0)=""/66, 0x42}, {&(0x7f0000000000)=""/15, 0xf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/156, 0x9c}, {&(0x7f0000001400)=""/224, 0xe0}, {&(0x7f00000000c0)=""/59, 0x3b}, {&(0x7f0000001500)=""/19, 0x13}], 0x8, &(0x7f00000015c0)=""/146, 0x92}, 0xffffffffffffff81}, {{&(0x7f0000001680)=@caif, 0x80, &(0x7f0000003a40)=[{&(0x7f0000001700)=""/232, 0xe8}, {&(0x7f0000001800)=""/101, 0x65}, {&(0x7f0000001880)=""/61, 0x3d}, {&(0x7f00000018c0)=""/4096, 0x1000}, {&(0x7f00000028c0)=""/17, 0x11}, {&(0x7f0000002900)=""/90, 0x5a}, {&(0x7f0000002980)=""/9, 0x9}, {&(0x7f00000029c0)=""/81, 0x51}, {&(0x7f0000002a40)=""/4096, 0x1000}], 0x9, &(0x7f0000003b00)=""/70, 0x46}, 0x2}, {{&(0x7f0000003b80)=@ax25={{0x3, @rose}, [@bcast, @rose, @remote, @remote, @default, @remote, @default]}, 0x80, &(0x7f0000003e80)=[{&(0x7f0000003c00)=""/19, 0x13}, {&(0x7f0000003c40)=""/82, 0x52}, {&(0x7f0000003cc0)=""/240, 0xf0}, {&(0x7f0000003dc0)=""/160, 0xa0}], 0x4}, 0x8}, {{&(0x7f0000003ec0)=@x25={0x9, @remote}, 0x80, &(0x7f0000004000)=[{&(0x7f0000003f40)=""/63, 0x3f}, {&(0x7f0000003f80)=""/76, 0x4c}], 0x2}, 0x5}, {{&(0x7f0000004040)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000004640)=[{&(0x7f00000040c0)=""/6, 0x6}, {&(0x7f0000004100)=""/189, 0xbd}, {&(0x7f00000041c0)=""/187, 0xbb}, {&(0x7f0000004280)=""/74, 0x4a}, {&(0x7f0000004300)=""/47, 0x2f}, {&(0x7f0000004340)=""/253, 0xfd}, {&(0x7f0000004440)=""/68, 0x44}, {&(0x7f00000044c0)=""/139, 0x8b}, {&(0x7f0000004580)=""/131, 0x83}], 0x9, &(0x7f0000004700)=""/4096, 0x1000}, 0x3}, {{0x0, 0x0, &(0x7f00000059c0)=[{&(0x7f0000005700)=""/175, 0xaf}, {&(0x7f00000057c0)=""/214, 0xd6}, {&(0x7f00000058c0)=""/209, 0xd1}], 0x3, &(0x7f0000005a00)=""/4096, 0x1000}, 0x81}], 0x6, 0x100, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000280)={'\x00\x00\x00\xe6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00', 0x5002}) r6 = socket$nl_route(0x10, 0x3, 0x0) getresgid(0x0, &(0x7f00000000c0), &(0x7f0000000180)) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ptrace$getregs(0xffffffffffffffff, 0x0, 0x93b, &(0x7f0000000140)=""/56) ftruncate(r7, 0x2007fff) write$P9_RSETATTR(r7, &(0x7f0000000040)={0x7}, 0x7) sendfile(r4, r7, 0x0, 0x800000000024) creat(&(0x7f0000000200)='./bus\x00', 0x0) r8 = socket$key(0xf, 0x3, 0x2) uname(&(0x7f0000000280)) fcntl$addseals(r8, 0x409, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 416.036950] binder: BINDER_SET_CONTEXT_MGR already set [ 416.046239] binder: 11861:11882 ioctl 40046207 0 returned -16 [ 416.079544] binder: BINDER_SET_CONTEXT_MGR already set [ 416.086186] binder: 11900:11906 ioctl 40046207 0 returned -16 [ 416.094483] binder: 11900:11906 BC_INCREFS_DONE u0000000000000000 no match [ 416.100231] binder_alloc: 11861: binder_alloc_buf, no vma [ 416.102845] binder: 11900:11906 Release 1 refcount change on invalid ref 1 ret -22 [ 416.107666] binder: 11861:11882 transaction failed 29189/-3, size 0-0 line 3254 [ 416.126035] device lo left promiscuous mode [ 416.146487] binder: undelivered TRANSACTION_ERROR: 29189 [ 416.153529] binder: undelivered TRANSACTION_ERROR: 29189 [ 416.201777] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.215808] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.228670] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.241619] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.254265] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.266788] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.279325] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.291880] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.304768] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 [ 416.317251] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=11921 comm=syz-executor.5 18:00:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) r2 = dup3(r0, r1, 0x80000) write$P9_RLINK(r2, &(0x7f0000000200)={0x7, 0x47, 0x2}, 0x7) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x200000000004e20, 0x0, @mcast1}, 0xf3) r3 = dup3(r0, r0, 0x80000) ioctl$TUNSETVNETBE(r3, 0x400454de, &(0x7f00000000c0)) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r1) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000240)='bbr\x00', 0x4) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r1) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000280)) getsockopt$inet_tcp_buf(r3, 0x6, 0x1c, &(0x7f0000000140)=""/76, &(0x7f0000000000)=0x4c) 18:00:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cpuset.effective_mems\x00', 0x0, 0x0) ioctl$KDSKBMETA(r3, 0x4b63, &(0x7f0000000200)=0x6) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:46 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) write$input_event(r2, &(0x7f0000000040)={{0x77359400}, 0x16, 0x5, 0x100000000}, 0x18) 18:00:46 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x4a, 0xfffffeff7ffffffe, &(0x7f0000000040)={0xa, 0x4e22, 0x9, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, 0x1c) socket$inet6(0xa, 0x200000006, 0x20000000000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = getpgid(0x0) syz_open_procfs(r1, 0x0) 18:00:46 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet6_buf(r1, 0x29, 0x23, &(0x7f0000006b80)=""/247, &(0x7f0000006c80)=0xf7) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) r3 = socket(0x13, 0x80004, 0xbee) recvmmsg(r3, &(0x7f0000006a00)=[{{&(0x7f0000000140)=@nl, 0x80, &(0x7f0000001540)=[{&(0x7f0000000200)=""/164, 0xa4}, {&(0x7f00000002c0)=""/66, 0x42}, {&(0x7f0000000000)=""/15, 0xf}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/156, 0x9c}, {&(0x7f0000001400)=""/224, 0xe0}, {&(0x7f00000000c0)=""/59, 0x3b}, {&(0x7f0000001500)=""/19, 0x13}], 0x8, &(0x7f00000015c0)=""/146, 0x92}, 0xffffffffffffff81}, {{&(0x7f0000001680)=@caif, 0x80, &(0x7f0000003a40)=[{&(0x7f0000001700)=""/232, 0xe8}, {&(0x7f0000001800)=""/101, 0x65}, {&(0x7f0000001880)=""/61, 0x3d}, {&(0x7f00000018c0)=""/4096, 0x1000}, {&(0x7f00000028c0)=""/17, 0x11}, {&(0x7f0000002900)=""/90, 0x5a}, {&(0x7f0000002980)=""/9, 0x9}, {&(0x7f00000029c0)=""/81, 0x51}, {&(0x7f0000002a40)=""/4096, 0x1000}], 0x9, &(0x7f0000003b00)=""/70, 0x46}, 0x2}, {{&(0x7f0000003b80)=@ax25={{0x3, @rose}, [@bcast, @rose, @remote, @remote, @default, @remote, @default]}, 0x80, &(0x7f0000003e80)=[{&(0x7f0000003c00)=""/19, 0x13}, {&(0x7f0000003c40)=""/82, 0x52}, {&(0x7f0000003cc0)=""/240, 0xf0}, {&(0x7f0000003dc0)=""/160, 0xa0}], 0x4}, 0x8}, {{&(0x7f0000003ec0)=@x25={0x9, @remote}, 0x80, &(0x7f0000004000)=[{&(0x7f0000003f40)=""/63, 0x3f}, {&(0x7f0000003f80)=""/76, 0x4c}], 0x2}, 0x5}, {{&(0x7f0000004040)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000004640)=[{&(0x7f00000040c0)=""/6, 0x6}, {&(0x7f0000004100)=""/189, 0xbd}, {&(0x7f00000041c0)=""/187, 0xbb}, {&(0x7f0000004280)=""/74, 0x4a}, {&(0x7f0000004300)=""/47, 0x2f}, {&(0x7f0000004340)=""/253, 0xfd}, {&(0x7f0000004440)=""/68, 0x44}, {&(0x7f00000044c0)=""/139, 0x8b}, {&(0x7f0000004580)=""/131, 0x83}], 0x9, &(0x7f0000004700)=""/4096, 0x1000}, 0x3}, {{0x0, 0x0, &(0x7f00000059c0)=[{&(0x7f0000005700)=""/175, 0xaf}, {&(0x7f00000057c0)=""/214, 0xd6}, {&(0x7f00000058c0)=""/209, 0xd1}], 0x3, &(0x7f0000005a00)=""/4096, 0x1000}, 0x81}], 0x6, 0x100, 0x0) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x400000000001, 0x0) close(r4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/net/tun\x00', 0x2, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000280)={'\x00\x00\x00\xe6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00', 0x5002}) r6 = socket$nl_route(0x10, 0x3, 0x0) getresgid(0x0, &(0x7f00000000c0), &(0x7f0000000180)) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r7 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ptrace$getregs(0xffffffffffffffff, 0x0, 0x93b, &(0x7f0000000140)=""/56) ftruncate(r7, 0x2007fff) write$P9_RSETATTR(r7, &(0x7f0000000040)={0x7}, 0x7) sendfile(r4, r7, 0x0, 0x800000000024) creat(&(0x7f0000000200)='./bus\x00', 0x0) r8 = socket$key(0xf, 0x3, 0x2) uname(&(0x7f0000000280)) fcntl$addseals(r8, 0x409, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e24, 0xfffffffffffffffc, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffffd}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 418.947937] binder: 11939:11944 BC_INCREFS_DONE u0000000000000000 no match [ 418.960471] binder: BINDER_SET_CONTEXT_MGR already set 18:00:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:46 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:46 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x2) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000040)={{0xa, 0x4e23, 0x9, @loopback, 0x8}, {0xa, 0x4e24, 0x8, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4}, 0x6, [0x4, 0x4, 0x5, 0x80000000, 0x9, 0x6, 0x8, 0x3]}, 0x5c) setsockopt$inet6_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000100)={0x4}, 0x4) [ 418.991630] binder: 11939:11944 Release 1 refcount change on invalid ref 1 ret -22 [ 419.012127] binder: 11940:11959 transaction failed 29189/-22, size 0-0 line 3117 [ 419.025201] binder: 11940:11949 ioctl 40046207 0 returned -16 18:00:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000252eefb33da23987042687000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) write$P9_RLERRORu(r2, &(0x7f0000000040)={0x1a, 0x7, 0x1, {{0xd, '/dev/binder#\x00'}, 0x100}}, 0x1a) [ 419.059139] binder_alloc: 11940: binder_alloc_buf, no vma [ 419.065221] binder: 11940:11959 transaction failed 29189/-3, size 0-0 line 3254 [ 419.065502] binder: undelivered TRANSACTION_ERROR: 29189 [ 419.074267] binder: 11960:11965 BC_INCREFS_DONE u0000000000000000 no match [ 419.086322] binder: undelivered TRANSACTION_ERROR: 29189 18:00:46 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 419.101839] binder: 11960:11965 Release 1 refcount change on invalid ref 1 ret -22 18:00:46 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x5802fb8c, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000140)={0x0, {0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x10}}, {0x2, 0x4e22, @loopback}, {0x2, 0x4e21, @loopback}, 0x20c, 0x0, 0x0, 0x0, 0x100, &(0x7f0000000000)='veth0_to_hsr\x00', 0x6938, 0xffffffff, 0x7}) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r2 = request_key(&(0x7f00000000c0)='pkcs7_test\x00', &(0x7f0000000200)={'syz', 0x0}, &(0x7f0000000240)='\x00', 0xfffffffffffffff8) request_key(&(0x7f00000002c0)='cifs.idmap\x00', &(0x7f0000000300)={'syz', 0x3}, 0x0, 0x0) keyctl$instantiate(0xc, r2, &(0x7f0000000280)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'user:', 'veth0_to_hsr\x00'}, 0x23, r2) [ 419.130817] binder: 11973:11976 got transaction to invalid handle [ 419.145140] binder: BINDER_SET_CONTEXT_MGR already set [ 419.154449] binder: 11973:11976 transaction failed 29201/-22, size 0-0 line 3117 [ 419.159404] binder: 11980:11984 ioctl 40046207 0 returned -16 [ 419.171592] binder: 11980:11984 ioctl c0306201 0 returned -14 18:00:46 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 419.185616] binder: 11980:11984 BC_INCREFS_DONE u0000000000000000 no match [ 419.194280] binder: BINDER_SET_CONTEXT_MGR already set [ 419.200678] binder: 11973:11986 ioctl 40046207 0 returned -16 [ 419.214329] binder: 11980:11984 Release 1 refcount change on invalid ref 1 ret -22 [ 419.227688] binder: 11973:11976 got transaction to invalid handle 18:00:46 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x800, 0x20000000001) setsockopt$sock_int(r0, 0x1, 0x4000000000000000, &(0x7f0000000040)=0x10000, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) pipe2(&(0x7f0000000180), 0x800) 18:00:46 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 419.228382] binder: undelivered TRANSACTION_ERROR: 29201 [ 419.253923] binder: 11973:11976 transaction failed 29201/-22, size 0-0 line 3117 [ 419.262539] binder: 11997:12000 ioctl c0306201 0 returned -14 [ 419.265852] binder: undelivered TRANSACTION_ERROR: 29201 [ 419.277531] binder: 11997:12000 BC_INCREFS_DONE u0000000000000000 no match [ 419.296870] binder: 11997:12000 Release 1 refcount change on invalid ref 1 ret -22 18:00:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000000180)={0xa, 0x4e24, 0xfffffffffffffffc, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xfffffffffffffffd}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="006340400000690114841359b8fb94d0198ee2509bc50000000000000000b146e777ae4536e100000000000400000000000000290000000000000000000000000000000000000000000000000000000000000000619535e7c92d2767b934b8b3256a628f2d1ecd12f155daacc225b980d017a9a56a0ec0638ccedb5fecbcb2435dbfaac94d974f077915d32444ed39e80fab1401506a16636b2fae082d985221a274a54adc8dc483c17be0a988ad5d4ef4eadc5bc5669b2c46d1848b2d7e94795b5b44de7d730800b56f49094aa48a8e1e60705c5d33126f96ec5ced60bb12f0a170d42286645ed61d5050e327ec0b4cf09db31f0f337e119b6ec800cad82f8258000000000000000000000000f01f6c5083d5d7c7fd4e762180c76d961f5f606e1d88da1430f3308aadd6b70f2f03a37b7882065e3e16b03467afa331787164c37e3fec7d190b0e64f10ca55f5c44767db92b84fb9ae45b201cfcd40753ae8adeb4369703b08772108248472dbf50747e4f36228e78dfe33fe0324d54bbeda1909bfbeeb26b9125c9079ba9"], 0x0, 0x0, 0x0}) 18:00:47 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) setxattr$security_evm(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.evm\x00', &(0x7f0000000100)=ANY=[@ANYBLOB="04ff7f0000b8f600000bac2c"], 0xc, 0x2) 18:00:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x44e20, 0x0, @mcast1, 0x6}, 0xcc) sendto$inet6(r1, 0x0, 0xc0, 0x1000020040000, &(0x7f0000000100)={0xa, 0x4e20, 0x9, @remote}, 0x1c) r2 = getpid() sched_rr_get_interval(r2, &(0x7f0000000000)) 18:00:47 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000000200)={0x1c8, {{0xa, 0x4e20, 0x8, @remote, 0x1}}}, 0x88) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_MATCH(r2, 0x29, 0x44, &(0x7f0000000180)={'icmp6\x00'}, &(0x7f00000002c0)=0x1e) 18:00:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000180)={0x98, 0x8, 0x10000, 0x1000}, 0x10) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$VT_GETMODE(r3, 0x5601, &(0x7f0000000180)) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 419.395743] binder: 12014:12026 got transaction to invalid handle [ 419.402385] binder: 12014:12026 transaction failed 29201/-22, size 288230376151769398-2954361355555045376 line 3117 [ 419.413190] binder: BINDER_SET_CONTEXT_MGR already set [ 419.418466] binder: 12018:12024 ioctl 40046207 0 returned -16 [ 419.426102] binder: BINDER_SET_CONTEXT_MGR already set [ 419.430332] binder: 12018:12024 ioctl c0306201 0 returned -14 18:00:47 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000000200)={0x501, {{0xa, 0x4e24, 0x3, @rand_addr="c6109fb3d108983720a749f938abbcde", 0x6644}}}, 0x88) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x2, 'ip6gretap0\x00', 0x2}, 0x18) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) setsockopt$inet_int(r0, 0x0, 0x13, &(0x7f0000000140)=0x3, 0xfffffffffffffd4f) 18:00:47 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="240000002e0007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(0xffffffffffffffff, 0x40086607, 0x0) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) prctl$PR_SET_THP_DISABLE(0x29, 0x1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r4 = geteuid() setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@local, @in=@local, 0x4e22, 0xfffffffffffffe01, 0x4e20, 0x0, 0x2, 0xa0, 0x80, 0xc, 0x0, r4}, {0x6, 0x83a0000000000000, 0xfffffffffffffbff, 0x227d, 0x5, 0x0, 0xffffffff}, {0xffffffffffffca12, 0x4, 0x8, 0x7}, 0x9, 0x0, 0x0, 0x0, 0x2}, {{@in6=@remote, 0x4d5, 0x6c}, 0xa, @in6=@mcast2, 0x3500, 0x3, 0x0, 0x6344, 0x6, 0x2131, 0x3}}, 0xe8) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000180)={0x0, r0, 0x2a09, 0x800, 0xfffffffffffffffc, 0x1ff}) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 419.452510] binder: 12018:12024 BC_INCREFS_DONE u0000000000000000 no match [ 419.455030] binder: 12014:12034 ioctl 40046207 0 returned -16 [ 419.469617] binder: 12018:12024 Release 1 refcount change on invalid ref 1 ret -22 [ 419.471166] binder: 12014:12026 got transaction to invalid handle [ 419.484472] binder: undelivered TRANSACTION_ERROR: 29201 18:00:47 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:47 executing program 0: ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000200)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x243) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @remote}, 0xfffffea3) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:47 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfd72, 0x8040, &(0x7f0000000000)={0xa, 0x4e1c, 0x0, @rand_addr="cbcfdeea4974d997ee610bfdf4ce36bf"}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000080), 0x4) sendto$inet6(r1, &(0x7f0000000240)="e37e4b7a161b04b6a8fdc6cbb4ba9c16cf06254524876750f0ab6b48100c7fe4af2627c5649a21a21873fe94d857055acb339d6c6168161b54ae37e54321bbfcf819fef8a27dd893ba805b12d74754022eb76a231bb3588bf2590336b85a1b9d0a5b16e75870b5e5e723d106a4863bfcb0063e72c7684997b5963e603c96103c408d0e0256e351cb07cace5aaea5374813a70f91a2054ff3400c0a3e6e152ec3fb161a0ee7da8c8c2b4dea24cbc835157ddd077654b652a9", 0xb8, 0x8000, &(0x7f0000000040)={0xa, 0x4e21, 0x4, @mcast1, 0x4}, 0x1c) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000100)={0xdd62, {{0xa, 0x4e22, 0xd92, @mcast2, 0x100000000}}, 0x0, 0x1, [{{0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, [], 0xe}, 0x8}}]}, 0x110) 18:00:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000580)='/selinux/status\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000240)={&(0x7f00000000c0), 0xc, &(0x7f0000000200)={&(0x7f0000000140)={0xbc, r3, 0x200, 0x70bd2d, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x58, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}]}, 0xbc}, 0x1, 0x0, 0x0, 0x2004c045}, 0x94) pwritev(r0, &(0x7f0000000600)=[{&(0x7f0000000280)="2b054ea26f5f6b21cddff76a48bd136beb613d73ac06b7c04da1c11d967d3bbec5202687f86c5eb1685c05df8e449dc5408e6a682b73d80b9fe05a0b7a176bbe860b889f77c4a8", 0x47}, {&(0x7f0000000300)="e0842487d2a6d719d125d621aff23e12b02ed75df76fa0b0cb496feff531bf785458cd9bd54ed86b27ad539a1bf5be405a009e453f7f6d62359b19f4502d996b6550204e7f3003d99fb2edde7f91f374d8b3913108b8360d40e7574b8d21ec1f6100841648ee7b13c2ff0276a5bc58afb98becf5ba9440e40470d9b12b37699fd320f999bccb8e00dc10d39d1b688a8e153b51280ee17afb4c0b891f5a63da8c0ac8ee82f1c35d5d943cb0083ae8a74d4cb85aa4c21f5f6be3f49357d8e006229224ac142e6cf85f6cfd46a0d8dd85915e3757c5d71f7a4f524a180c63fc36cb5beda19117", 0xe5}, {&(0x7f0000000480)="3d225b00bf0c3b46103c7792f424385011b2af5833297f1e2f902d098f4aa2c6ecbaeccb8096602580db72d7f364cca0206dced50bc5e5804941ade3dfbad77ddfeb10d14fd721cae2450859f2540d2c944a1b48d791201cb144d30aaba492688f1db5140773913de6647569d7a3174c54fbfb43ef4c719dc1082c6d585d283b9eb268800a5006600509295500eece12a265f6ae2c9b72cebee06afb06c096c88e62d3aa5c35e1a7d0802f557a0f06e2179d3f14ad685433d356a6563f0cefe341fc29e20bafecab8ec9e5f9920fd420dfd3796b4b658eda8146de1ecb18417fa9ce6e84ef0c", 0xe6}, {&(0x7f0000000580)}, {&(0x7f00000005c0)="5773f0462489c3d6c0e8d45957f2a995ea4ab897551fb45c799f8429", 0x1c}], 0x5, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000e71afa122364a37bff244900000000000000000000000000000000000000000000798c9098000000007f0c82c367dd2e1fc66160e2ef0b6af0af8b57"], 0x0, 0x0, 0x0}) [ 419.493906] binder: 12014:12026 transaction failed 29201/-22, size 288230376151769398-2954361355555045376 line 3117 [ 419.505402] binder: undelivered TRANSACTION_ERROR: 29201 18:00:47 executing program 4: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1, 0x60) faccessat(r0, &(0x7f0000000040)='./file0\x00', 0x0, 0x100) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x28) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r1, 0x80, &(0x7f0000000080)) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PPPIOCATTCHAN(r2, 0x40047438, &(0x7f0000000140)=0x4) ptrace$cont(0x1f, r1, 0x0, 0x0) 18:00:47 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000040)=0xad) 18:00:47 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000200)={{{@in=@loopback, @in6=@local}}, {{@in6=@local}, 0x0, @in=@empty}}, &(0x7f0000000180)=0xe8) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x23, &(0x7f0000000040)=0x100009, 0xff18) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) recvmmsg(r1, &(0x7f0000004d80)=[{{&(0x7f0000000300)=@pppol2tpin6, 0x80, &(0x7f0000000940)=[{&(0x7f0000000380)=""/175, 0xaf}, {&(0x7f0000000440)=""/216, 0xd8}, {&(0x7f0000000540)=""/13, 0xd}, {&(0x7f0000000580)=""/166, 0xa6}, {&(0x7f0000000640)}, {&(0x7f0000000680)=""/27, 0x1b}, {&(0x7f00000006c0)=""/105, 0x69}, {&(0x7f0000000740)=""/206, 0xce}, {&(0x7f0000000840)=""/146, 0x92}, {&(0x7f0000000900)=""/32, 0x20}], 0xa, &(0x7f0000000a00)=""/13, 0xd}, 0x6}, {{0x0, 0x0, &(0x7f0000002a80)=[{&(0x7f0000000a40)=""/13, 0xd}, {&(0x7f0000000a80)=""/4096, 0x1000}, {&(0x7f0000001a80)=""/4096, 0x1000}], 0x3, &(0x7f0000002ac0)=""/165, 0xa5}, 0xbcc}, {{&(0x7f0000002b80)=@ax25={{0x3, @netrom}, [@null, @default, @null, @null, @default, @remote, @bcast]}, 0x80, &(0x7f0000003d40)=[{&(0x7f0000002c00)=""/18, 0x12}, {&(0x7f0000002c40)=""/4096, 0x1000}, {&(0x7f0000003c40)=""/232, 0xe8}], 0x3, &(0x7f0000003d80)=""/75, 0x4b}, 0x7}, {{&(0x7f0000003e00)=@sco, 0x80, &(0x7f0000004400)=[{&(0x7f0000003e80)=""/52, 0x34}, {&(0x7f0000003ec0)=""/134, 0x86}, {&(0x7f0000003f80)=""/214, 0xd6}, {&(0x7f0000004080)=""/146, 0x92}, {&(0x7f0000004140)=""/114, 0x72}, {&(0x7f00000041c0)=""/7, 0x7}, {&(0x7f0000004200)=""/255, 0xff}, {&(0x7f0000004300)=""/117, 0x75}, {&(0x7f0000004380)=""/80, 0x50}], 0x9}, 0xc6}, {{&(0x7f00000044c0)=@xdp, 0x80, &(0x7f0000004940)=[{&(0x7f0000004540)=""/204, 0xcc}, {&(0x7f0000004640)=""/175, 0xaf}, {&(0x7f0000004700)=""/25, 0x19}, {&(0x7f0000004740)=""/137, 0x89}, {&(0x7f0000004800)=""/61, 0x3d}, {&(0x7f0000004840)=""/219, 0xdb}], 0x6, &(0x7f00000049c0)=""/210, 0xd2}, 0xffffffff}, {{&(0x7f0000004ac0)=@caif=@rfm, 0x80, &(0x7f0000004c40)=[{&(0x7f0000004b40)=""/129, 0x81}, {&(0x7f0000004c00)=""/10, 0xa}], 0x2, &(0x7f0000004c80)=""/227, 0xe3}, 0x101}], 0x6, 0x100, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) fcntl$dupfd(r2, 0x0, r3) 18:00:47 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 419.549030] binder: 12047:12051 BC_INCREFS_DONE u0000000000000000 no match [ 419.568568] binder: 12047:12051 Release 1 refcount change on invalid ref 1 ret -22 [ 419.581172] binder: BINDER_SET_CONTEXT_MGR already set 18:00:47 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, &(0x7f0000000080)=0x80, 0x800) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40400}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r2, 0x100, 0x70bd26, 0x25dfdbfb, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz1\x00'}}, [""]}, 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x4000000) [ 419.604045] binder: 12055:12060 ioctl 40046207 0 returned -16 [ 419.622014] binder: 12069:12072 BC_INCREFS_DONE u0000000000000000 no match [ 419.631177] binder_alloc: 12069: binder_alloc_buf size 7215632207533472680 failed, no address space [ 419.631486] binder: 12069:12072 Release 1 refcount change on invalid ref 1 ret -22 18:00:47 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) recvfrom$inet6(r0, &(0x7f0000000100)=""/189, 0xbd, 0x20, 0x0, 0x0) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 419.651193] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 419.667271] binder: 12055:12060 transaction failed 29201/-28, size 7215631893380136960-314153335715 line 3254 [ 419.690895] binder_alloc: 12055: binder_alloc_buf, no vma [ 419.694627] binder: undelivered TRANSACTION_ERROR: 29201 [ 419.696474] binder: 12055:12060 transaction failed 29189/-3, size 7215631893380136960-314153335715 line 3254 [ 419.717688] binder: undelivered TRANSACTION_ERROR: 29189 18:00:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) lookup_dcookie(0x20, &(0x7f0000000640)=""/236, 0xec) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000040)=0x8, 0x4) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x80, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000000c0)={r2, 0x50, &(0x7f0000000d80)}, 0x10) clock_gettime(0x7, &(0x7f0000000940)={0x0, 0x0}) pselect6(0x40, &(0x7f00000002c0)={0x401a, 0x8, 0x3, 0x800, 0xcc2, 0x8, 0xbf2, 0x5b7f}, &(0x7f00000008c0)={0x2, 0x1f, 0x10000, 0x0, 0xffff, 0x7, 0x1, 0x3}, &(0x7f0000000900)={0x662, 0xfffffffffffffbff, 0x7fffffff, 0x3, 0x0, 0x0, 0xffffffffffffff04, 0x2}, &(0x7f0000000980)={r3, r4+10000000}, &(0x7f0000000a00)={&(0x7f00000009c0), 0x8}) r5 = add_key$user(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)="b96a070f52cc474f365d666c5777ad43d9c8c34ff4ee642c25ca5f87bc7ef6a58052d30cc41c7c68a7ca7f54662ddcc286d96dafcb299b23a72e31ff4ae13f693a13755b3b245c5856f0026b006fbb751c5ba2370bbe89ce2824249f9e994704decd362045169e802ffbe35456fe1079b618ba1f2a0c6c4ac7d9ab21c18f7e31dbf3060d07c6293c3ff0f37e16cd68fe9ac78c7e1db0a436da74", 0x9a, 0xfffffffffffffffa) r6 = request_key(&(0x7f0000000500)='cifs.spnego\x00', &(0x7f0000000540)={'syz', 0x2}, &(0x7f0000000580)='o[em0$^]:\x00', 0xfffffffffffffffe) keyctl$search(0xa, r5, &(0x7f0000000480)='ceph\x00', &(0x7f00000004c0)={'syz', 0x2}, r6) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000740)={{{@in6=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@remote}}, &(0x7f0000000840)=0xe8) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000600)={r6, 0x6, 0x1ff}, 0x0, &(0x7f0000000b00)="821c264a76b38834fe801621dabf18ad205c33820550f8c680d967adedd4c327e09e3c3ab1740efed36656bf2c1340d6eaf8595904765a264d8e21ccac5530e15f3e5a8fd21ae00869137d55c3814178a119f86374d9fc66dc1efb33579c213f7919b39fde133b939b01159b10568ee41070a81b3c0adde61c019190d638f5f448b0ed2bb2aa7890ade4d582742591759e999f462236da289fab7680fb3156871af712d4a25f1f980af04beca599e274eb5ba694badef92348e3cb8af63e1fa03c51f74d3c1286503993301a8f2367a0da2e41262f1664b9082ea2a63278b5f7e1f0579343a9b4f793d13655a966258fde558533700ac62011991e29", &(0x7f0000000c00)=""/183) setsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000880)={@loopback, r7}, 0x14) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @loopback}, 0x1c) llistxattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=""/78, 0x4e) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000d40)=0x0) perf_event_open(&(0x7f0000000cc0)={0x2, 0x70, 0x4, 0x1ff, 0xc8f9, 0xcc0, 0x0, 0x4, 0x400, 0x0, 0x0, 0x3, 0x1c9042a8, 0x80000001, 0x4c3c, 0x0, 0x5, 0x7fffffff, 0x9, 0x21d9, 0x4, 0x15, 0x400, 0x401, 0x3, 0x401, 0x8, 0x31c2, 0x8000, 0x99b, 0x6, 0x2, 0x3, 0x8, 0x0, 0xfff, 0x7, 0x2, 0x0, 0x10001, 0x1, @perf_config_ext={0x1f, 0x27e}, 0x40, 0x1, 0x6, 0x1, 0x8157, 0x9, 0x3}, r8, 0xb, r1, 0x1) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f0000000a40)=ANY=[@ANYBLOB="6e6100007e00d64cc8000d000000d1b2265706000000000000000000000000000004c7a5e3db94005b05996a98a85d3725439ec63fa5f5b53393d93f0801b35643b388fee02656cabff351f6ff7b8aeb0e64d72b0a93c600008000e984a77c30c25b51f6cde61e22c6da4169565a23264b11736568d37257a3493d1727beffe3d1b90f8616b19a70b33470f3"], &(0x7f0000000300)=0x31) ioctl$PERF_EVENT_IOC_REFRESH(r2, 0x2402, 0x4) ioctl$sock_SIOCSIFBR(r1, 0x8941, &(0x7f00000005c0)=@generic={0x0, 0xfffffffffffffffc}) 18:00:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) r3 = gettid() fcntl$lock(r1, 0x26, &(0x7f0000000040)={0x1, 0x4, 0x401, 0x4, r3}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000000000e833382e58000000000000000000000000000000000000000000008450bb50f0691000000000000000000000000000a15eb2cac95bb9d2a5fea3d859f5c0f6ff12a4eadbcccf5c26aa7a7423cc64a75724d7f5a147f7f0cfae867d09a695047bbfa6a1dd2de76588af0e751a2fca9948b604f7cf4dab12e02de80e22961fe24a1e28a31447656d3c99b30cfd45f0828099bb58abdd5331fc7be7e673cc57f826de3f4b76e995a91ab876654605a2de3e0fbf542b8ff2d197d2d9d6b1c7ccdab879cdefed8823204491c221403e4bc1b1346dc2fcd5456ffaaef1481bbceeaffcf23673dfd38fe88f71a5bd2e18532cd8d782cc24c2933e71d708bb"], 0x0, 0x0, 0x0}) 18:00:48 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) r1 = open(&(0x7f0000000180)='./file0\x00', 0x100, 0x100) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000200)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000240)={{{@in=@empty, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000340)=0xe8) r4 = accept(r0, &(0x7f0000000440)=@can={0x1d, 0x0}, &(0x7f00000004c0)=0x80) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000005c0)={@dev, @dev, 0x0}, &(0x7f0000000600)=0xc) accept$packet(r0, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000680)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000006c0)={{{@in=@remote, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast2}}, &(0x7f00000007c0)=0xe8) openat(r1, &(0x7f0000000000)='./file0\x00', 0x80, 0x8) accept4$packet(r0, &(0x7f0000000800)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000840)=0x14, 0x800) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000b00)={{{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000c00)=0xe8) getsockname$packet(0xffffffffffffff9c, &(0x7f0000001380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000013c0)=0x14) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000014c0)={0x0, @initdev, @dev}, &(0x7f0000001500)=0xc) recvmmsg(r0, &(0x7f00000030c0)=[{{&(0x7f0000001540)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @remote}, 0x80, &(0x7f0000001800)=[{&(0x7f00000015c0)=""/161, 0xa1}, {&(0x7f0000001680)=""/109, 0x6d}, {&(0x7f0000001700)=""/253, 0xfd}], 0x3, &(0x7f0000001840)=""/160, 0xa0}, 0x10000}, {{&(0x7f0000001900)=@ethernet={0x0, @random}, 0x80, &(0x7f0000002b00)=[{&(0x7f0000001980)=""/22, 0x16}, {&(0x7f00000019c0)=""/122, 0x7a}, {&(0x7f0000001a40)=""/83, 0x53}, {&(0x7f0000001ac0)=""/43, 0x2b}, {&(0x7f0000001b00)=""/4096, 0x1000}], 0x5, &(0x7f0000002b80)=""/189, 0xbd}, 0x4}, {{0x0, 0x0, &(0x7f0000002c80)=[{&(0x7f0000002c40)=""/34, 0x22}], 0x1, &(0x7f0000002cc0)=""/23, 0x17}, 0xfffffffffffffffb}, {{&(0x7f0000002d00)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x80, &(0x7f0000003000)=[{&(0x7f0000002d80)=""/188, 0xbc}, {&(0x7f0000002e40)=""/102, 0x66}, {&(0x7f0000002ec0)=""/75, 0x4b}, {&(0x7f0000002f40)=""/67, 0x43}, {&(0x7f0000002fc0)=""/51, 0x33}], 0x5, &(0x7f0000003080)}, 0x8}], 0x4, 0x40, &(0x7f00000031c0)={0x77359400}) accept$packet(0xffffffffffffffff, &(0x7f0000003200)={0x11, 0x0, 0x0}, &(0x7f0000003240)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000003280)={{{@in6=@empty, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000003380)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000033c0)={{{@in6=@mcast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@initdev}}, &(0x7f00000034c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000003500)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000003b40)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80892006}, 0xc, &(0x7f0000003b00)={&(0x7f0000003540)={0x598, r2, 0x102, 0x70bd25, 0x25dfdbfe, {}, [{{0x8, 0x1, r3}, {0x1dc, 0x2, [{0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x84, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x54, 0x4, [{0x1, 0x9, 0x7a, 0xc09}, {0x100, 0x0, 0x8001, 0x2}, {0x0, 0x0, 0x7, 0x2b2e}, {0xffffffffffffffff, 0x2, 0x6, 0x7fff}, {0x7, 0x3, 0xff, 0x3f}, {0xd74, 0xbd8, 0x4e9, 0x3}, {0x6, 0x80, 0x4, 0x807a}, {0x4, 0xfff, 0x9, 0x1f8000000000}, {0x4, 0x1, 0x67, 0x100000001}, {0x980f, 0x3, 0x3, 0x400}]}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r6}}}, {0x64, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x34, 0x4, [{0x517, 0x8, 0x2, 0x8}, {0x696fbd40, 0x80000001, 0x401, 0x1000}, {0xa4, 0x40, 0x0, 0xffffffffffffffff}, {0x7, 0x200, 0x80000001, 0x4}, {0x36, 0x66a, 0x5, 0x8000}, {0x0, 0x0, 0x3, 0x10001}]}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r7}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x9a4}}}]}}, {{0x8, 0x1, r8}, {0x3c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r9}}}]}}, {{0x8, 0x1, r10}, {0x164, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x16d4}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8}}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}]}}, {{0x8, 0x1, r12}, {0x1e8, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r15}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r16}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r17}}}]}}]}, 0x598}, 0x1, 0x0, 0x0, 0x40800}, 0x10) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r4, 0x0, 0xffffffffffffff65, 0xfffffeff7ffffffe, &(0x7f0000000380)={0xa, 0x4e20, 0x200000, @empty}, 0xfffffffffffffeab) r18 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$sock_int(r18, 0x1, 0x13, &(0x7f0000000040)=0x1, 0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r19 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) write$ppp(r19, &(0x7f0000000100)="9e3db91d61ab298133f35a9dbc6c074a57add9200c8381214e116bfbe1414de30793702754c93f173648773cf0ed7cfbab34387f42bae4f4b14b10dacffe13c7ce111c10357f1f86c261c8a8e72a5b1c911b7f23a4741423442766", 0x5b) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:48 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x188, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) getpid() tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 420.303532] binder_alloc: 12108: binder_alloc_buf, no vma [ 420.303588] binder: BINDER_SET_CONTEXT_MGR already set [ 420.314215] binder: 12108:12112 transaction failed 29189/-3, size 4620080494891140-0 line 3254 [ 420.322389] binder: 12106:12110 ioctl 40046207 0 returned -16 [ 420.335322] binder: 12106:12110 BC_INCREFS_DONE u0000000000000000 no match [ 420.343052] binder: BINDER_SET_CONTEXT_MGR already set 18:00:48 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0xfffffffffffffc8d) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000180)=0xdff, 0x4) sendmmsg(r1, &(0x7f00000002c0), 0x4000000000000d7, 0x0) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = accept4(0xffffffffffffff9c, 0x0, &(0x7f0000000140), 0x800) setsockopt$inet_mreqsrc(r2, 0x0, 0x2d, &(0x7f00000001c0)={@rand_addr=0x3c9, @initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast}, 0xc) syz_open_procfs(0xffffffffffffffff, 0x0) [ 420.343630] binder: 12106:12110 Release 1 refcount change on invalid ref 1 ret -22 [ 420.348465] binder: 12108:12112 ioctl 40046207 0 returned -16 [ 420.356673] binder_alloc: 12108: binder_alloc_buf, no vma [ 420.373958] binder: 12108:12126 transaction failed 29189/-3, size 4620080494891140-0 line 3254 [ 420.389553] binder: undelivered TRANSACTION_ERROR: 29189 18:00:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:48 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$cont(0x20, r0, 0x38, 0x200) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 420.401962] binder: undelivered TRANSACTION_ERROR: 29189 18:00:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x6) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000af1461a3f458a104000000"], 0x0, 0x0, 0x0}) 18:00:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000006, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x0, 0x1}) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 420.440975] binder: 12140:12148 BC_INCREFS_DONE u0000000000000000 no match [ 420.448641] binder: 12140:12148 Release 1 refcount change on invalid ref 1 ret -22 18:00:48 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$setregs(0xd, r1, 0x100000001, &(0x7f0000000140)="b5cbc525e2c01764178ad91214665153da771b3c1eb146c5a4e73d5009ca15fb2f13abf30da1cb882eadf202cc0697376c119d9d48e9020130bf6a61985ad624d80eee5879f77901c95a6ccf160be6626046607bd5a88c35d89a86a254a09df7965dc21c87d1fc387bb16adcbe25fb29b41a5b3a0ef49cf7084ce4c05785c63b8df20dd4c526b587b2e5cf95e2ad774f12e4b11114469dfce601566c33477861bc4b249c713bd4db0876f4aef5d70b937f6ad23ae618e940f150e99177c82eea038250530ebf984356191404a16c44aea7e7b0ebac916c0c563bc2f3144ef18968261e40982bce9cfa14c1240fee5dbd3fae52d56b0dedff7c15eba8a87db439b236daebb0d9accbb4f7c35011de11c6466cfcba9eb6b52ab4ab39ee197cdcdd93e96a763cbf9eefc73d508b9953d065234377b7cdc05e34614485fb4b6451b89c9a915fc914af6d2fbd3d21ad56620d4287ed6307c023eaf8e0e0945f3a01f4804f8aab687f256daa2f46e7fbec733822937bc1a400a6b59a96b58e1d05486e2b2ea76b447aacc5fdf30caee1e5baeca883ab8eed9e2da868e1dcfbcccf4b89db161123de6c320e0751e433042b63663cda7618e0f4fa03bac7de0c3efdf77d92e0dc46175a6de6f32459f38b562acb0f51576b336d8529e014928ade7d8b31489080943133a2dd8c6952896cc3083adfade3df1e8b63bfaa87ed49cae38bb9f51b9e0edfb6fcacb25a6e11450ad5ae7bcf20d623e791e752577b28d59fb0b497dfdb6f5d5db37e471120ddfba0f16a21c979e4e582c046c761b0f274f4b13d9768c3955b8218e53ab99b4cfffa98bf8bef3efd49de389e55fa7ec568c98518d807accf231f243a75d2f2f4fab08ddb6c9b8ca85caf45c955e87f4fb111e8a34bcd8789636f89d4638d988295b43cb480c9ccf055467cdc846754a409b70a92fb97dc258567a0f702d4b0f206b231acd03b92e7cb6ba10ba98df338d3a222fac4fef6fee9dd2c76b524a39d313a27ab97ee1beb3bb4517533d7e5b1785291b8be1d261c92e9f4370fb0aa743755cd9d15faa194dbcf3089dee2d586d1e525c5860449551bf2676b369e35e320d6770a24c7568527c9f6edfc9cebe6d973f5d831cb232e96bb2ae700665b1c94194d589c48cb8700ca6909ba0904342bed2a5a913f091110b31fba5a8986c0e0d2b1f0ebe93e2fa2488294fb266144cab4344bf565daefd7f5aaec96194b90a47a8fcb84d4c24b86d949d9e6aec00c71d78e20c5d612c868fb9e0c06a67418a381770be6c3855449c1a4ea18e888e3e6e76cd94f1228950404b4ab9ac28802fb6bc44c1ae8fae4e5a95199d7e269102c07a7b2fc5ae6fb66f1d84c3aef74ef2547da458d40bf9aff8f93c70c6bb3c1a37aa952da3f5a5f65e8794e683f85c696333e3a3c6aac13bbbf915c19ebab764483dfa8b4271d80010ddd37dac216dab1354c619ffd1c2a4a16f6213315ab73e117530aeb000d6ddf94afea12568f773c033f042a8837579b1ce40afc93f13a9a204b96e81cdcfcbba2a7f6720d9370f734270a08741f289d7373ca4148d250a36c8ba60c8af81de69ef534ef6a37a64e9f62af1b163cfed668ddfc441141212f542e27ab604320a83a5790ea068cbcac6242afe93ebbf74b2841656eb798e80d55bf0f73aa59e1d762a7dea3b43588de7fa6f8c98d1071743da30aa61887f0cb80849c54c7b81e030ae4c66bcad664c1b9e3134d880343aaabba2e34ba3e26010dea261315c9220a8864f655a5ed4975e02e291ba62fafa6e1c5fdb6bde48f7ea1c63ad1188f327b5cb79431caddb129762fb0e3460ee9eba31986c5cefbe97cd430105f96fc0608778cac46d7b2ddad08c3ebf806eb49213109e3c1f70708cacebcfe2150a4c9418f54f3bba707289067bd60908ab1b7ccec2b86d8489365551df9ae0e51ca3a1a05dfaa69762bf3271b77b06e620f1fe6dc8cf1d1db50101a4378947a3f44d3b90050de639f2ed63b7daccb6f76e743ea1243129aee3ab8a9d7bcd3eef350cbab6be39ceff47778babf46aaf8b2dafb2a59f6a20505f8003c13cb9c5ea47ce7671e293a23f1a92b6b5a4c087116123ef84de3ca752bd6473b4fdaa9ea60506c3e48b8c1d4a8d3e2a87818d1ea986912e4ae737ddfde89d430e1ba7e3b443c33b45b8d5fbf3fbfdffa43ede022ccfc74dcccf58e769bda09b9d1282c0bca4274dac3ef537539bd2130571abd501f30fb969b3e9818fa985557565b9d2a536651319a80722247be9e3c0909f868cd646089d2ec6edf661d4bac6f107287ad0ab3c5a9230649ee23459aa17e99ab2b7c1450112612bf14ea0c0a7a2562b07bcfeeb396c79e4761538d145948a21cb296e0f09e0b4d7154dac9f6861395e74c73a3e69208b61f2d5f32ecd1e1c4480d1bee3e1f3524e4c2451be446655235f1cfc09a1f8ee60d3cab479f9fc2e6b29ba35350441b6d4b6413d8809981f868b537bb7950deced102e883aa7dffc4e8a5579c9580ad27786c91e03767878c7b437941758c8d173114666853d6da840b4bb5b0705865337847308a607ee041a7daeb007ec09360594dff9cc39de576b40e0dec1f95f2240eb460bf2e1b7d2dd31a423b83fa91943e05430d358680774359030d33f698362f07d63c3f0243da11f800dfbc40671e38bc1847c1dc1ff3b99596f557df30e8d544d89f1acab2dd2fa732858bddbd6ce971f19714cd651e699cc5f11fbd7a89954f6a1d5cd0586af3c17bd76f4592c7f4797d6a31b4e6a31f9904408f1219e1ffb392b54fe67ff016124836f31dc99f9b0fb56c365bf6d3b44410b69d26105fc25d4dc58b17333d26f76f5c54a1227e0d7a3b4e552c65f16f50f822cdbc6278bd0bba915a6750edb839700307781c9d1cf0e54c9f7d12803e553fa39a6c2f931c2a15a37b1e73382888331dcf9a92882421729be5ad875158ba19e34e628b098c30953aeb9e46cfd6057b4c34d856c6cde197083747ec68c53d2d26eaf6787072c7da73eff004bbbb808db768c0565775efe6d1802de365a70d6cdcacb2ceddb913c6d218ea082abdfb0a71b94732a522936609f6348803fd60a3c820ca76d56681c749ee6f6b9071cfedf78c9f2f9cd054eea62665c9c138572204aa5cb3712d12c529d941266e51294dc9e9b31862d022f92d57cd7f2b1c932799481a2f88b3851cc0e75cbea74f8432c34d64c458c015eb621fd3ba50efbcd75ffb5fef94d3e84331d469c24c3de3f3dfb4d67382a61c3ea7623c2c99fbd427af223d9d015f610bca9305cf47710e15d9c229523cd0c872b5423d0525d3cbdb8461ea08deed38faf23566a6f006907592332c315c0b74b33fb8eb622e742ea110cce2ffcf335ec2ce6fbfd467ab3f7ea2b2780eaa85d82f2e4ac97410077030fe0fcdf3cf9fa57a4750606f8b40930eeb9d4013282bb9af8970fd60bc39cbe72a06ab6b415a8252952474615b1d3f9c26c2b15eb4dbaa8efdcf6ee6aee974dd21ee24d65ea4a7912da96940dab93837de44117beb2d46598706f934e004e71fa4a9199ceda7a9c213f809abaed34e18b376058719faa51d308e4d7b274415755280c7ed5aa82a334733783ead116b9447a48d26e30d505274e6bb0ce1e6412383f1ceb8723538d18d8de22d42ab440b1bcdebdc381014ce422589d9848b82c4b3ffd388159a1d8efdcd767b2b1c42283025846816582886501f9a571541ffb2424f96a5ee68c6060ea609d81b67e531a988e97f1bc018aa624c824013bdeae3190ee10b2ad49a7baa4dbd019c983a8eff99a25618f011415ff5d8b2c84559765c4e28499f58c0f39b28b6cc36c1b5171b025d723823f18a8adc11dd27984a66861d3b22d17cb51d7dedd32aa12e772c45e1447c4b4d8a79115a8ccfe7e82514e49013ef35fef31972710e24f2db0f59d8ebdbbfbe810db3b847810ca90f7617397decdbee9ac1ef0ba0f9ddecf7320c01f2b064beae96d159adfc39760533703ea457fe54f6d27a2cb60d2a5d0b330b0d360a3088942e66285b0d0e49d6d2dd5336fd7390be2cd5b69ee4312908be461217c42c492a8580aed187c76be8f4a2238f14183bfe9b5a5ab9e1e694f935de6719c2184b0ba66d694bd2a2d4ef8f9554e625eade7dcbe33d681cc9b221d3c4a542611edbf2464fbee852e2d56874bfefeaa1804350eb0476c59bc9b958baebaa897f8555140cffac868ae5416563c5e4fd012da697e5c0fa49b179886717ed18ff2be5a8a9abe4674661e331125f763c13d4131bf1c7d2ca72c9170f7bf611b124a43c1aeeae7d896fd1cb5ebdc3396084561d1a41d3a2d82da9dd2ae8ab9ddaeadca1b79829bebe7a87a8c761d453fa25c80e086640c47ac3edd7f2ae3c12b4501f432c9b50598026eaed2f452bd7b427d2f8d83256425e3207bce198ef855358be166e36db5d6303190b753e7e11c7d9051fd4745dcdb4260f34d8d77c3b46b1b6f8258c51104016c6c3cdd61cb8cf35d1354d84dc34fb4b78154d18faab623fc35efbf34c0d08c741a05534e686c379ca76b8f980441d35647eff1791a4e47352b8d86bd63b24101db10ab90afd3a402f6eee1c1a1aa6b55fa64d27960c4ecd7c1dedbf41480c7c8ac436734a30fbfa0a56ba432556312448fe7c6ca05f0fde6aed042d3227c7a225925d69f15360da6e4394dae249a5403c088d13d5de3bbdf78f400bcc5d7fe90ad176754e32ba150dae1d6cb6a6ab92a429d73f8e1a343fa2145c93e0511f0693d5bf18c320a3c83f554120b5c2cb8f4bddc93e9e04c290e69179e6e50f89e03fb0cb58af28034034acb02f25e7fd5ce10603a74b7f03773dc4ce6b45b77ab05f853a0c47bbdf9eb00beef8067dc64d4023cf00e129efd9665ac97cea058f0859c2ec20f54de15fb3541c28c802acedf96ba9147bf89e88a514a03d7a2e15a4fccf66f3b9b534f88c8eb674c531f505f7b2aa3f987217fd597a79958a836579573495ddbceaf374b85b9ab9a27fb028463de60a37f0725c18e6480093e43f83071d66f12b9049b15fad3df031a8ed636bdeea17549cdde060c458a0da8ed030267e6df1d9b9dc3deb9d2625cbc7a7306293388d626731e6fab558c9501ded0d76d53b36b5ca2e0953bd052465aac4e91ea250b62a744547045a43f09e3e329d5ba99b8c77ff8919ad01d34c88bd3d33bd699876f58913e0e1eb45d9eee4618405a868d7fa45a5cc86452a0e2fc07b68885234771ffc0cffe1dda73e5286a3b13b6f69fad79651c1d13e8c20be493797c43b5bdca649a69f76218bf7862b06c5f86fa9272542d2a4a77a89fe0a2e5525d9d5a6e32f0066ebf1b11b07850647bbc9c489c7f768a8e832a7fe56c986cfde8fa44c90891f2ab7d2b44ee6c7ab47f1c99b72cd91fb693dd3d1e0c945b01aa3020635f7960f049c693819142c55b90a147598f5158fdd0c4e4ee072bb81432fd674a504fd2787595ad95c686dd84331f5990782bd5e623c3cb4f87d208242360bf242dc95c4a998f658ea384b2d4de97b7b0c420a8a4fb38b9935263a447f6fa5e8bd706bb3bd80a8ed0ca0a908a6480433dee7a9b09f218eff58fb809a7605addce7f6f22f8547e0e2d80a5f4ec60e3d476bf797c2c54c5423fd5c011d16ee8f04ad08ff9a2638534a2471304829764790930b04aa89db4c2651b1df8488e7ccfb16f5a629b90f6875e5ceb685dfb5ab13e2ee9f0f9e17f7dfa921854c5488df98c46af1e6410e42fc23e95c598e29a17bc542de6a7fdd0befdc16e97398415c72b0") perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1000000000000191, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000180)='comm\x00') preadv(r2, &(0x7f0000000480), 0x10000000000002a1, 0x0) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/keycreate\x00', 0x2, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) prctl$PR_MCE_KILL(0x35, 0x3, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x1023, &(0x7f0000000180)=0x8, 0xffffffffffffffed) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f00000000c0)={0x9, {0x7, 0x81, 0x3f, 0x10000, 0x1, 0x7fffffff}}) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) restart_syscall() sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 420.495261] binder_alloc: 12153: binder_alloc_buf, no vma [ 420.501511] binder: BINDER_SET_CONTEXT_MGR already set [ 420.512739] binder: 12154:12159 ioctl 40046207 0 returned -16 [ 420.529449] binder: 12153:12160 transaction failed 29189/-3, size 0-0 line 3254 18:00:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_int(r0, 0x0, 0x1f, &(0x7f0000000000)=0x3163, 0x4) ioctl(r0, 0x1000008915, &(0x7f0000000140)="0adc1ff73b123f31c8b0707ab3e0d1428b454e25240c45d431a42f54543e5667da21ed6c71e24c4991bf4c346ee588f250ba") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) shutdown(r0, 0x0) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 420.557754] binder: 12154:12159 BC_INCREFS_DONE u0000000000000000 no match [ 420.572380] binder: BINDER_SET_CONTEXT_MGR already set [ 420.578293] binder: 12154:12159 Release 1 refcount change on invalid ref 1 ret -22 [ 420.586057] binder: 12153:12175 ioctl 40046207 0 returned -16 [ 420.614125] binder_alloc: 12153: binder_alloc_buf, no vma [ 420.620617] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.626366] binder: 12153:12160 transaction failed 29189/-3, size 0-0 line 3254 [ 420.639093] binder: 12181:12185 BC_INCREFS_DONE u0000000000000000 no match [ 420.649183] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.670621] binder: 12181:12185 Release 1 refcount change on invalid ref 1 ret -22 18:00:48 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000180), 0x10) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x80000000000) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:48 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r1, &(0x7f0000000040)="dca41d9e19011a17f426ebbf3fce4b821cfd99059cf41894b4a5292f48111ac449d672f6de10539bf889e7676ff2084c5ceccd2b3bb36d582c11", 0x3a, 0x4040, &(0x7f0000000080)={0xa, 0x4e22, 0x4, @rand_addr="e117728969f5e81082cb1f5b8706d819", 0x5}, 0x1c) 18:00:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x400500, 0x0) ioctl$EVIOCGSW(r1, 0x8040451b, &(0x7f0000000200)=""/177) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) openat(r2, &(0x7f0000000200)='./file0\x00', 0x400000, 0x40) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000140)={'raw\x00'}, &(0x7f0000000000)=0x54) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20, 0x7fffffff}, 0x19) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x200000, 0x0) r3 = getpgrp(0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000640)={{{@in6=@local, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@initdev}}, &(0x7f0000000740)=0xe8) getgroups(0x1, &(0x7f0000000780)=[0xee00]) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000007c0)=0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000800)={{{@in6=@ipv4={[], [], @dev}, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@multicast2}}, &(0x7f0000000900)=0xe8) r8 = getegid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000980)={0xffffffffffffffff, r1, 0x0, 0xa, &(0x7f0000000940)='lo\x00\x00\x00\x00\x00\x00\x02\x00'}, 0x30) fstat(r1, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r2, &(0x7f0000000bc0)={&(0x7f0000000200)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f00000005c0)=[{&(0x7f0000000280)="15b5f0ebec681b8b441413b04b49bf3119a2efe365d7db3c8a04084e39e4312b191bae6ef87a99c2703254849c7462033f213dc6fb7eabf8ca983ea33570ca74229e7f3803549b2d01e195c3026bb9dcfb6168a8133594f02b7322cb8dbc7f42b4b94ca2eb6ced9d8e664db2f8eb4a14fccce3e295f95486296b6a98c3ae8c52b64a64ad213fce597ebcc7b419ad48f6e96113946953395c7741c4c1be6b6c", 0x9f}, {&(0x7f0000000340)="6d92f2d01626aefe575012afdfc2a9993ebc59dee3fa56785e468c9b104669b7e19249a8a5f16cb0d3402328160a4f606c091bb5131a03000deb59d97df10e04747c1e1607808c357310a0f7ab64f2e49cac6c113ed348456cc1cd1184de64e8d4adb1f2a6d4e0c38d27385bc7bc6a86f12531f3d0d453048caf109b09949e634b8d2f44a6fa98d963174082b2bc09eb874320f8270aad9e0e063fd392f83467a87aae4e838cde6664869fd0318e95b669c5d6d417e66a962e135edf182e3543105e6fec0f27fd1720", 0xc9}, {&(0x7f0000000440)="2e6628cfd9e30b59cfbb83e4f80518199ad0de0ac3a2a433aa64a5c71977c7fbf5f7e1d33a15d1c721dddae44b3a9aae7f93e8a9a9d0c44ea197347eb39a0c3e327e880df72ca6da0c849afabdf166f58c069516cd36808d952f807827352efc2d2e8cdc8f279a3a81a55d", 0x6b}, {&(0x7f00000004c0)="077328d4bb2558f35a641a26fde11ad0b77e3b2d47721de4baa819ebbd19844f8bcc317e994ecee2e93f97ec3903127f4224757d55e5ea8fb77660b6b7642906dc77f7b70b8affbfeb30e783daada60976d0cc45f18f76a8ebc61f85fd79d4eca37f3f8006fe0bec1a3d8e5f94440f53dcbc6b285d51451c98668b5e55102f0dfa776f474485", 0x86}, {&(0x7f0000000580)="f1605bfb7d467a5c1e1032d0242776354a28992c066659aeb5974782d73ed25ea51c40eed86895797a1cd9f21c", 0x2d}], 0x5, &(0x7f0000000ac0)=[@rights={0x20, 0x1, 0x1, [r1, r0, r1]}, @cred={0x20, 0x1, 0x2, r3, r4, r5}, @cred={0x20, 0x1, 0x2, r6, r7, r8}, @rights={0x38, 0x1, 0x1, [r0, r1, r0, r1, r1, r0, r0, r0, r1]}, @rights={0x20, 0x1, 0x1, [0xffffffffffffff9c, r0, r0, r0]}, @cred={0x20, 0x1, 0x2, r9, r10, r11}, @rights={0x18, 0x1, 0x1, [r1, r0]}], 0xf0, 0x1}, 0x4040010) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r12 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r12, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r12, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r12, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 420.809212] binder: 12202:12206 got transaction with invalid offset (0, min 0 max 0) or object. [ 420.819525] binder_alloc: 12201: binder_alloc_buf, no vma [ 420.826254] binder: 12201:12207 transaction failed 29189/-3, size 0-0 line 3254 [ 420.835127] binder: 12202:12206 transaction failed 29201/-22, size 0-8 line 3348 [ 420.844416] binder: 12202:12206 Release 1 refcount change on invalid ref 1 ret -22 18:00:48 executing program 4: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000001c0)=0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20005}, 0xc, &(0x7f0000000500)={&(0x7f0000000200)={0x2f4, 0xe, 0x4, 0x20, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x8}, [@typed={0x8, 0x72, @pid=r1}, @nested={0x200, 0x3a, [@typed={0x8, 0x2b, @ipv4=@loopback}, @generic, @generic="a9196ea7ecdbe9139dc12039d805e6073eb52337e5b18efd956cdd0ac9a698139c9b34ba71982a91240788b4d3392797ad2f6e7be7e0df078994188b6ac692003f9540088d9034d3113a4cf53f559283148e31ed6707df8a01eaab0e7ff49f1efba829fe8ff748939c0142a8134dce1de23393f05365fc586b8b850af5ff97e76242f03891b00699d62f98d32b89da7219894d802dec1a4c2aef13b6fa42462732e68edc24754686ac981015bfdd861fadf1c6ff8a3fb0fcda8219a76ef402dc59aa2f0fca26e1a9", @generic="6d8e4c034efa3b7c020850886a797d717bde41604974719b43a52e605aa9f0bcf4b9fe5756f590f83a4b1a9317d7bfb0a14b827b3781b1ab822ea2e3c07fa0b016d24ecf64e82b5ba4b2df1ec6a9616bb93030ef1f536c020db261bdd0081fbc909562dbbe4ee01aa35f5a569afcd8c4095dc045c740b6d6b6801abfc7b039333919691e8d80d90c45b66a782bc541c093d6222e9de36355402baf72d722c4aff763a3f1fb2019be188d94a4509337277afc5e72404d2a5d0a37e4f8075d151460571c5048c6e6cad8058dc6fb4000e9a83ca16ea9299e68022b41cf", @generic="8d2aaed9ec67ac7f3a16bbbd3ab17793da1e57bc016f7b0680efa10604f3da4502f7b35dd119c6cd43706c3dd6cf6f64beebbf025b5d465590", @typed={0x14, 0x61, @ipv6=@dev={0xfe, 0x80, [], 0x19}}]}, @generic="7df37b82e2c24d168b939eb86cf605c85bf05540147a1f9fb235f10a452233af5b2b3957035bc74831a5f724c38c3388d7740064780c008cfdbbd518f51eafef8a6b07799ceb735855c0917234edc344c86c272cd41e2e91efdf92bedc00158bcfcd100032c8a7ee81f921a07d15ece67a9898bc2a6c53079a3bf2b9ad0744ffcf799efbb68e9754d330b0b726c9571bebfbb323f61f6fbca644eb17eb819c75a07f26e91d90dd06ef58683960d8368cf629fdcf2483385b8ccf090bcbd1f298480d1f4df8e810d67dca0d0351d6b2ba3bee6b26d9"]}, 0x2f4}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(r0, &(0x7f0000000600)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000080)={&(0x7f0000000580)={0x54, r3, 0x10, 0x70bd2a, 0x25dfdbfd, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x5}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x3f}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x80000001}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x1}]}, 0x54}}, 0x8800) setxattr$security_ima(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='security.ima\x00', &(0x7f0000000880)=@md5={0x1, "bae945779d6ae94ca6c2e1642619f61f"}, 0x11, 0x3) select(0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000680)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x4c, r4, 0x10, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x20}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7f}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK={0x10, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000095}, 0x8000) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f00000007c0)) ptrace$setopts(0x4206, r2, 0x0, 0x0) ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000008c0)={0x0, 0x0, 0x2, 0x0, [], [{0x55e78db0, 0x5513, 0x2, 0xd15, 0x9, 0x7}, {0x1, 0x2, 0x9f6, 0x81, 0x100000001, 0x6}], [[], []]}) tkill(r2, 0x28) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) 18:00:48 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x20000, 0x0) getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000180), &(0x7f00000001c0)=0x4) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 420.864282] binder: BINDER_SET_CONTEXT_MGR already set [ 420.869392] binder: undelivered TRANSACTION_ERROR: 29201 [ 420.892726] binder: 12201:12223 ioctl 40046207 0 returned -16 [ 420.919892] binder_alloc: 12201: binder_alloc_buf, no vma 18:00:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000180)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) r2 = fcntl$dupfd(r0, 0x406, r1) r3 = dup(r0) ioctl$TUNSETFILTEREBPF(r2, 0x800454e1, &(0x7f0000000140)=r3) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000001c0)='ip6_vti0\"\x00', 0x3d6) r5 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) r6 = add_key$keyring(&(0x7f0000000200)='keyring\x00', &(0x7f0000000240)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$setperm(0x5, r6, 0x10100600) bind$inet6(r5, &(0x7f0000000080)={0xa, 0x44e20}, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r5, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 420.920950] binder: undelivered TRANSACTION_ERROR: 29189 [ 421.005607] binder: 12234:12238 got transaction with invalid offset (0, min 0 max 0) or object. [ 421.009758] binder: 12201:12207 transaction failed 29189/-3, size 0-0 line 3254 18:00:48 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000200)=ANY=[@ANYBLOB="6d616e67192f0000000d00000000000000000000000087a3014075000000000000000000000500000001000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000200000000000000000ebffffff00000000000000000000000000"], 0x78) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) write$P9_RLOCK(r2, &(0x7f00000000c0)={0x8, 0x35, 0x2, 0x2}, 0x8) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) pause() 18:00:48 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, &(0x7f0000000000)={{0xa, 0x4e22, 0x2, @local, 0x7ff}, {0xa, 0x4e21, 0x2e, @dev={0xfe, 0x80, [], 0x17}, 0x1ff}, 0x5, [0x5, 0x6, 0x0, 0x4, 0x0, 0x7f, 0x4, 0x56]}, 0x5c) [ 421.065589] binder: 12234:12238 transaction failed 29201/-22, size 0-8 line 3348 [ 421.104895] binder: undelivered TRANSACTION_ERROR: 29189 [ 421.136115] binder: 12234:12243 BC_INCREFS_DONE u0000000000000000 no match 18:00:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x191802, 0x0) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000080)) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x0, 0x80000000]) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000180)={0x3, 'caif0\x00', 0x4}, 0x18) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 421.192879] binder: 12234:12243 Release 1 refcount change on invalid ref 1 ret -22 18:00:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20, 0xffffffffffffffff, @empty, 0xfffffffffffffffc}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:48 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:49 executing program 1: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x10002, 0x0) fallocate(r0, 0x42, 0xeb3e, 0x6) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000f40)='/selinux/checkreqprot\x00', 0x10000, 0x0) fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f0000000b80)=0x9) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') r3 = openat$cgroup_ro(r2, &(0x7f00000001c0)='|puacct.usage_pe2cpu_sys\x9e', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000dc0)={{{@in6=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, &(0x7f0000000d80)=0x7ff) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4002002}, 0xc, &(0x7f0000000040)={&(0x7f0000000f80)=ANY=[@ANYPTR64=&(0x7f0000000300)=ANY=[@ANYPTR=&(0x7f0000001480)=ANY=[@ANYBLOB="be861357c85d88c040224e364cc20ea579fd8dc2acf059f8231412055e673ab458f8340a8bda191e5a5d318574875cdef1a1d9419650bec3fbaeb3edee12c31194acba6b127fef8bbf99471d2c802aca6d0f55a0834a6fd03bd56cd5208ea232391ad8d0092d7cd8876b8fb9fba613582c17fa9aa451a90f1732d488c0fca421c24a0aa497050dff2c33cd8f397ae0cdcedb5641874547a94ce7ec3bdae9e99132ce340000000000001b28e40e0df4dde96ee41a3b4ee731c120ce80906348160000b4f054763f8e0b44741cd94b2a0b8a372f421a521f15dc6bcc7460b87e9a287fad073b011a8dc1d286d02ad26911bf041764bdfd4b87acc6156a8d35e3aa093fca5837a4b9bdb7d4a81ab485e1f011f74f173c45d44a334432ed300138e965f9f70dfd95897b8e0d79027793d20c6b4823a997d5d57568f54fb2da93c35f111940a4ceaab93f0fa83631a7566b6767e8dcf3152763bda48094ca27c4a6b878f0ff496dfb6f0cab8767668d5fe76939af924de11a6320dcad4beef31c4b5c083c1733f18c737e994c0f7e645a1c1d44ea63568df90d375133ee62c50b2e00a2bd3c5dbb9379570a128803d96d8ba7a1ae24b5bfe7dea930e0877770fc716999ae4c9b608c1f5a4ced889eda6d33e22b00ff9d551b82e14c043e67673dcaead67d52c1dc80173aa8693031f4f8dd5e1b32d12344fc2da0fa42b3c69c47f5f5f8e4bdf150f0734ea836ad5d84e63f6544afd7ec591c7dc10000000000000000000000f8006adaa8dfa34f28ddc0a439eb2545983426ab2a89acb889e5c27c3fe4eea42afabb949930b76bdbfeb86cfebe9e7da9439495ba8547"], @ANYRES16=r3]], 0x1}, 0x1, 0x0, 0x0, 0x800}, 0x0) r6 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_IP_IPSEC_POLICY(r6, 0x0, 0x10, &(0x7f0000000480)={{{@in6=@dev={0xfe, 0x80, [], 0xc}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e22, 0x8000, 0x4e24, 0x1b7, 0xa, 0x0, 0x20, 0x77, r4, r5}, {0xffffffff, 0x1000, 0x3, 0x10001, 0xffffffffffffffcf, 0x9, 0x4, 0x100000001}, {0x0, 0x1, 0x5, 0x2c7b}, 0x7, 0x6e6bb5, 0x2, 0x1}, {{@in6=@empty, 0x4d2, 0x3c}, 0xa, @in=@rand_addr=0x1, 0x3503, 0x3, 0x1, 0x2, 0x21a, 0x5f3, 0x899d}}, 0xe8) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000bc0)=0x7b, 0x4) bind$inet(r6, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r6, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) r7 = getuid() sendmsg(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001800)=[{&(0x7f0000000600)="80f17a0b8c8970cad4e7c2198c830f262255157995a738328a6ea456e2363942b6223ced8e1d157847f0c1b27a6f790486384b94faefd0dfba2444691133054cc3c8e8e0c3448446a3c2b9f6f110a48d3902d829438729dc7496c17992daebf777fcec616e2ab5ee4386fc35ddb3c5be77d95c0fffaf93cd81c953d311d52830de1d0e9e0df27d08c3fd370198119340781d16aafdfe831593becee6a47cb0fc059d70333ded95e2eb745ff068798a7f26f16839020454432ad0db8fad8c6f345d112e5a6324307d2828ab93a8466da7e80f1a9a4e52857001931223755f7cfb153a98e80cf6b91cf3b9d6634bb2a11f78cc4b3e54a5ac1f17ba23f8eae550c41ab7fcfb549b1791b61093ef140b2b4974e454654ecf5d28797058e196c632fe4f8b71816b2e3c766121499ac4ccdabdbb8c2c57d4a2b5a2e123d0eba31d36285709a22bbdd00e1da947b486f23cdf7453fb1ea5a4775d4dd315e6555ca87c6326efe9bf74b8daecd441eec2ac284d3c062ca8db46acd4e54eafd2cfe5871feac2ba09f31813b44eb3de3515a7b702ee6e0858841ebaddbc8a01d8bfc444c7c0d5d9829a7f61063e31f4fbdef237ff9d4809dcb115c5ffd86af35d1d2edadae8d793a6a0b37adff41ba5a7188e3d46764a5f242fc20b3f44ec5d18ff251b231135c066b9ab5b889b0774613a5dc7a6d6ad5e2d6d095b610f674be6ac519c7d19be29ddccdfe3bf7ea744230ff61d1f3657407d2cc64a4a432cb843d91f98e39f96f47fbd513a12d4a40bd7e15b5910792bea8f197731950245000a99787b4d267c70852d07c94c280f17934214c64677bb5c3c6a996f4d20fbf54f520ed7575f66cd07aa2e14423134962f73d86bce9eb93c697f66adeb655b7898d1f9e66a045f421937f85c251cd510614d3f5f8ca6230d4e04e3e9f36f73f8484749ac03c6b657e81cc9a201817e44f8cad068d100c2ae02c521a83d7bd5f26d8eb9de2f769a356a4adbcbb4425f66293ad1f49851c233a3a64f474860bd6e78b9edb66e259358fd322140140341245fb111b95c9b2e4b6b63b82e711b59d65b06b70ec3ac731d916a5b9f3d4c84c63c4e25db1ca40b2662e0d03327ea4f82d4d19b65527d48859ae051f6c7726bd84ceb1f8c40cbaeb08ecd0fd6aa1367b62f4c41d85525b4c4d39c0f314d88bb1c63554c199bc5f2c8aed9d2b4e864e232107e28658a612fb8589105b00004308fe4635e3a20cc44ba33557a8c3dbba28d78c5390b6a1e292bbdd4ada2244c87a4135c9dd3a426908b9aeed9adff063fa6fc056b7587e3afc5390bd5f1069db6277e3a84282157c1d4fc8c9326efd496659955724cccf7f0ac6d767dfc9511bcc3b51ab7061a35a24310b1f7b0b003f132360fc2f0df5a0ccc27bcba0395fc3ff3842071f0a4dc2debdc1becfffc9f0519e323f5d9793274b0e5eac4be6da21055b44e3db6ab0bb550cfa7305a78a840e1e46b29ffc4f337b1c6165aaf284290f69a620fe2dc9cdc6db45dec913ab4d083d77207439e758c156a39299872b288c9f18d13e8ae0284e132ddf77140b4d4a1c8b5f2c93359efcf948dbd92338fa90641069b479ce2a2ade41edb50f32dbc746903fc41d9b6c0c478848f8c60e1c77a6fd41f4a859609b944350543a4694c913d8cd8ebf9209615b9a1b726d50e1ed2e810ccb2ed4340eb30d27b22120292057a8c11dc888825c97f2ba1d558246bc5d972c141eb8633592bd3246962f08a5595ae01220b7a78bc7a090d1ccc8613537f766e4e9602685bd00aa5ad7309f5883bcecd75b65b341508a5beee817be3fde4b38cc6da3be077760693023a4295", 0x519}], 0x1, 0x0, 0x0, 0x800}, 0x44804) read(r6, &(0x7f0000000200)=""/225, 0xe1) shutdown(r6, 0x1) ioctl$LOOP_SET_FD(r2, 0x4c00, r6) prctl$PR_SET_MM(0x23, 0xb, &(0x7f0000ffe000/0x2000)=nil) unlink(&(0x7f0000000100)='./file0\x00') setresuid(0x0, 0xee01, 0x0) geteuid() renameat(r2, &(0x7f00000005c0)='./file0\x00', r2, &(0x7f0000000b40)='./file0\x00') setresuid(r5, r5, r7) [ 421.239035] binder: BINDER_SET_CONTEXT_MGR already set [ 421.261151] binder: 12253:12257 ioctl 40046207 0 returned -16 [ 421.271628] binder: undelivered TRANSACTION_ERROR: 29201 [ 421.277573] binder_alloc: 12234: binder_alloc_buf, no vma 18:00:49 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0xffffff02, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) wait4(r0, &(0x7f0000000080), 0x3ffffffe, &(0x7f0000000140)) r1 = socket(0x2, 0x80800, 0x9) r2 = geteuid() getresgid(&(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000300)={{{@in=@empty, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) getresgid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)=0x0) sendmsg$netlink(r1, &(0x7f0000000540)={&(0x7f0000000000)=@proc={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc, &(0x7f0000000200)=[{&(0x7f0000000740)=ANY=[@ANYBLOB="2000032cbd7000fbdbdf2508008e005d0000000a001200ddd630be1dd2820e8e95ae44d24a93717243d3a3fe4cd0db41f6c127e66917a01cd370ae5d9d0be7d8d541b3048200bd2f1278da78fb20d830dda689f6d7f7ad0ae19af1664daf2fcaa0894d7e77efd8e5e6f4dbe3a67c64964cbac82db9a0203701211f1fbbacaf676da9ad3e584165f3711523cf653dfbe1ab287dc9f7a8626c0da3af24408a11e0e1fd2d08cf425a5db140d8a9e8da9dc26f5ddab0b84d0a96579e1befb9b62dd2a3b2853f6d1a33972789f386e6e0875197403bd0fcc51444bbc0a5f935cd000554aeab93c2b855b0858754017704f2274c9ec9ffa78c89dc8c9252b9015bd0152ae5a8ea12655226256c1de9af65268f23eea3145682f5faa2c503d1847313bc03d33cb18c70fb496f08de038d5966e95cba26a0fbb25e60ad80c9e70ea46905e8bd241acab3e99a23bf94cbbf9ea9ee88d37b0c5cd96804e10b6e1517a049aba427d8dc4d9a25c9ab7756774a16bc764d4e99d642fe46270d34f70b35865d9415a7700d", @ANYRES32=r0], 0x20}], 0x1, &(0x7f0000000500)=[@cred={0x20, 0x1, 0x2, r0, r2, r3}, @cred={0x20, 0x1, 0x2, r0, r4, r5}], 0x40, 0x14}, 0x40000) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 421.293822] binder: 12253:12257 transaction failed 29189/-3, size 0-0 line 3254 [ 421.307411] binder: 12266:12268 got transaction with invalid offset (0, min 0 max 0) or object. [ 421.318324] binder: 12266:12268 transaction failed 29201/-22, size 0-8 line 3348 [ 421.327411] binder: BINDER_SET_CONTEXT_MGR already set [ 421.329571] binder: 12266:12268 Release 1 refcount change on invalid ref 1 ret -22 18:00:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1400008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffffffffffe9f, 0xfffffeff7ffffffe, &(0x7f0000000380)={0xa, 0x4e20, 0x0, @empty}, 0xffffffffffffff77) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) socket$inet6(0xa, 0xf, 0x7) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto(r1, &(0x7f0000000200)="5f126eb902c5918d12acc057c63c6c706bef7f8f2548cc9eb8507f1e21094e674bc63dd9de03c53fc1154215cd7d7f338693b794444adab7804701dbddf1b5fac2b56d6ff6f3d04be915df60783f65cdf496033081a0610691a227e2aba43f0dc49d1dda61423a477cc1261ae1789f3ff6359c58e5440eee51bb64d434d1a385b730e69803321a0a6e65828f62638b6f5553d473dd4edb0167e0253ef153e4e47ce50bd1aeac444a85cf8243cd7580f5e4176158a83ed3e77a6740ec50740565553dedc2", 0xc4, 0x10, &(0x7f0000000300)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'sha224-ssse3\x00'}, 0x80) 18:00:49 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:49 executing program 4: fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)={0x0, 0x0}) ptrace$setregset(0x4205, r0, 0x2, &(0x7f0000000040)={&(0x7f0000000140)="ef3236e80e6f32e6da5c39f38339a8e07a58490164753a66f4699717b92c72890f701e91618aa54a2f9b8bcf42b936fcfbefb436b0c975555c549b1cc0364e598251d055f076c173e2e8580b99b9e5af01128bcab3f2868ef884d1d667ead2edf0e9754f497d1c2b381a2b793584330b99e2a1c17095625ed677d5f396eb6656a79c09c77428d917043436482501f0fa71066da6ce22616ee27b391c44ee502f7d6670bae7b00cd9c72f15bbc7f4b0be488367b65f2f4d8bc9c1f84d0bc9e9bbd9bf222d0c27e8db0f546c0d557bee2abb38529fde133bb15c07c8", 0xdb}) clone(0x1000400, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x28) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)="2874a7d230436741bd503c487b4cf877a8e73ca4a2ad84bd5ec7e486eb9f3961c3ac4a3f24e539fd0dc53657fbf925a5004b46d6") ptrace$cont(0x1f, r1, 0x0, 0x0) [ 421.356081] binder: release 12253:12275 transaction 556 out, still active [ 421.363641] binder: 12253:12274 ioctl 40046207 0 returned -16 [ 421.372718] binder: undelivered TRANSACTION_COMPLETE 18:00:49 executing program 3: r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/loop-control\x00', 0x200002, 0x0) r1 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/relabel\x00', 0x2, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ppoll(&(0x7f0000000240)=[{r0, 0x4000}, {r1, 0x200}, {r2, 0x80}], 0x3, &(0x7f0000000280)={0x77359400}, &(0x7f00000002c0)={0x83ea}, 0x8) r3 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000040), 0x4) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqn(r4, 0x0, 0x0, &(0x7f0000000400)={@initdev, @local, 0x0}, &(0x7f0000000480)=0xc) r6 = geteuid() setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000004c0)={{{@in6=@mcast2, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4e20, 0x1, 0x4e22, 0x8, 0x2, 0x80, 0x20, 0x6f, r5, r6}, {0xed8, 0x137b, 0x7fff, 0x0, 0x7, 0x3ff, 0x3, 0x3}, {0x4, 0x713a, 0x5, 0x9e94}, 0x40, 0x6e6bbc, 0x0, 0x1, 0x1}, {{@in=@local, 0x4d6, 0x2b}, 0xa, @in=@multicast2, 0x34ff, 0x2, 0x1, 0x78160321, 0x80000000, 0x6, 0x36}}, 0xe8) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000008ca8c42cddcf9dff7b5d8286768aeec88a69970cd347947e49403cff5ac565488701cbc14abfabffba58d7cb29e1adf7919b454504de5bc96ecf013f10aa03a1e90cb945a04177f53438038b5222e28f4046b186bcda0acd37c6397d79bb5e5583380888527606f507d77455ea2b3b4ab5c85f461eb6b628c5e531c4c45325adb04d86d1d4ca60f558878cd985a7d95c62f8f04ebfaf6a8c53a3e7b926be71e663a9c9c59681d7c14a8823611debbab27bc5370261a96afa3f1c2b674aca362999aefdcf944d15402eb96de030030029e5b8cb788ffbf0dbf49498b36a540e873a67be3c7e986a3909379d38afd91b2c35c68391cc1dd06612a6fcd3"], 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000340)) [ 421.441986] binder: send failed reply for transaction 556, target dead [ 421.496086] binder: undelivered TRANSACTION_ERROR: 29201 [ 421.496368] binder: 12288:12291 got transaction with invalid offset (0, min 0 max 0) or object. [ 421.517863] binder: 12288:12291 transaction failed 29201/-22, size 0-8 line 3348 [ 421.518675] binder: undelivered TRANSACTION_ERROR: 29189 [ 421.533545] binder: 12288:12291 Release 1 refcount change on invalid ref 1 ret -22 [ 421.545669] binder: BINDER_SET_CONTEXT_MGR already set [ 421.555138] binder: 12290:12294 ioctl 40046207 0 returned -16 [ 421.557180] binder: undelivered TRANSACTION_ERROR: 29201 [ 421.571810] binder_alloc: 12288: binder_alloc_buf, no vma [ 421.591615] binder: 12290:12294 transaction failed 29189/-3, size 0-34359738368 line 3254 [ 421.629565] binder_alloc: 12290: binder_alloc_buf, no vma [ 421.638174] binder: 12290:12301 transaction failed 29189/-3, size 0-34359738368 line 3254 [ 421.648070] binder: undelivered TRANSACTION_ERROR: 29189 [ 421.655609] binder: undelivered TRANSACTION_ERROR: 29189 18:00:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) r2 = open(&(0x7f0000000080)='./file0\x00', 0x101000, 0x14) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000200)=""/209) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x44e20, 0x0, @rand_addr, 0xf50}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e1e, 0x0, @loopback}, 0x1c) 18:00:49 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) recvfrom$inet(r0, &(0x7f0000000200)=""/252, 0xfc, 0x0, &(0x7f0000000180)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x9}}, 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:49 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:49 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(r0, &(0x7f0000000000), 0x1000002, &(0x7f0000000140)) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$cont(0x9, r0, 0x6, 0x2) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$EVIOCRMFF(r1, 0x40044581, &(0x7f0000000080)=0xa474) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) getpgrp(r0) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='pids.current\x00', 0x0, 0x0) write$cgroup_type(r1, &(0x7f0000000040)='threaded\x00', 0x9) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:49 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) socket$inet_tcp(0x2, 0x1, 0x0) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0xfffffffffffffffc, 0x0, 0xffffffffffffff4d) r2 = socket(0x10, 0x80f, 0x4) getsockopt$netlink(r2, 0x10e, 0xe, &(0x7f0000000040)=""/118, &(0x7f0000000180)=0x76) bind$inet6(r2, 0x0, 0x0) r3 = getpgid(0x0) ioctl$TIOCSPGRP(r2, 0x5410, &(0x7f0000000140)=r3) syz_open_procfs(0xffffffffffffffff, 0x0) [ 422.010324] binder_alloc: 12306: binder_alloc_buf, no vma [ 422.021663] binder: BINDER_SET_CONTEXT_MGR already set [ 422.022752] binder: 12306:12311 transaction failed 29189/-3, size 0-0 line 3254 [ 422.027072] binder: 12309:12315 ioctl 40046207 0 returned -16 [ 422.041098] binder: BINDER_SET_CONTEXT_MGR already set [ 422.046685] binder: 12306:12323 ioctl 40046207 0 returned -16 18:00:49 executing program 5: rt_sigprocmask(0x1, &(0x7f0000000000)={0x5}, &(0x7f00000000c0), 0x8) lsetxattr(&(0x7f0000000080)='./file1\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB="00f8eb2924000000000000000000000000"], &(0x7f0000000400)='\x00', 0x1, 0x2) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = openat(0xffffffffffffffff, &(0x7f0000000140)='./file0\x00', 0x200000, 0x0) ioctl$VT_DISALLOCATE(r1, 0x5608) setsockopt$inet6_udp_int(r1, 0x11, 0x6f, &(0x7f0000000180)=0x100000001, 0x4) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000380)={0xa, 0x44e20}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000200)={{{@in6=@mcast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000000340)={@rand_addr="9cefc0d26f40228648ebd436e273ae3c", r3}, 0x14) 18:00:49 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) connect$unix(r1, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e21}, 0x6e) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 422.057992] binder_alloc: 12306: binder_alloc_buf, no vma [ 422.071178] binder: undelivered TRANSACTION_ERROR: 29189 [ 422.087187] binder_alloc: 12306: binder_alloc_buf, no vma [ 422.093830] binder: 12306:12311 transaction failed 29189/-3, size 0-0 line 3254 [ 422.101789] binder: 12309:12315 transaction failed 29189/-3, size 0-8 line 3254 18:00:49 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000000240)={0xa, 0x4e21, 0x2465, @loopback}, 0x344) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000100)={{{@in6=@empty, @in=@multicast2}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000200)=0xe8) getcwd(&(0x7f0000000040)=""/86, 0x56) 18:00:49 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:49 executing program 3: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) ioctl$UI_ABS_SETUP(r0, 0x401c5504, &(0x7f0000000000)={0x80, {0x6, 0x7fffffff, 0x8, 0x3ff, 0x0, 0x100000000}}) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCLINUX2(r0, 0x541c, &(0x7f0000000040)={0x2, 0x80, 0x7, 0x0, 0x40, 0x9}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000"], 0x0, 0x0, 0x0}) [ 422.106526] binder: 12309:12333 BC_INCREFS_DONE u0000000000000000 no match [ 422.129486] binder: 12309:12333 Release 1 refcount change on invalid ref 1 ret -22 [ 422.132003] binder: undelivered TRANSACTION_ERROR: 29189 [ 422.150830] binder: undelivered TRANSACTION_ERROR: 29189 18:00:49 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = dup3(r0, r0, 0x7fffd) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f00000005c0)={'NETMAP\x00'}, &(0x7f0000000600)=0x1e) sendmsg$nl_xfrm(r1, &(0x7f0000000a00)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x24000001}, 0xc, &(0x7f00000009c0)={&(0x7f0000000840)=@flushpolicy={0x144, 0x1d, 0x300, 0x70bd29, 0x25dfdbfd, "", [@algo_auth={0x134, 0x1, {{'md5-generic\x00'}, 0x758, "f12b33025c44b662d5ff5988f6a6503d38dc57b36bc60d1c883ae3e253b77a423578d74a8e584228147bf1bbc172a77cfe01c79da4232abe0382a41c6311454c3bee821ddf3591574f7163eb5225a4e98e09a576e9d4121681e11ddd1d38a9fdd7bba1e5e1ae9f2f57874b477400dcc989f8c2b67cca73d30650bba9fe4177ba3529534c240cd1e2e016499c31a529b69ee1bfa67236eab1e14faf004f914d5e025914b936e7270bf82315f8e6ddf047c0f1ba1217183f7f347e6ba03d75651ddcfc6f379421005f7b09599890838324cde47b976e131de36acc4cf443f9c7acb020586978f0231940029b"}}]}, 0x144}, 0x1, 0x0, 0x0, 0x10}, 0x1) r2 = socket$inet6(0xa, 0x1, 0x0) ioctl$EVIOCSREP(r1, 0x40084503, &(0x7f0000000640)=[0xffffffff00000000, 0x26a3]) recvmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000140)=""/98, 0xfffffffffffffdb0}, {&(0x7f0000000200)=""/198, 0xc6}, {&(0x7f0000000300)=""/133, 0x85}, {&(0x7f0000000000)=""/12, 0xffffffffffffffc7}, {&(0x7f00000003c0)=""/225, 0xe1}], 0x5, &(0x7f0000000540)=""/121, 0x79}, 0xfffe) setsockopt$sock_int(r0, 0x1, 0x0, &(0x7f0000000040)=0x5, 0xffffffffffffffc4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) getsockname$packet(r1, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000006c0)=0x14) r4 = geteuid() setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000700)={{{@in=@empty, @in=@dev={0xac, 0x14, 0x14, 0x17}, 0x4e22, 0x9, 0x4e22, 0xfffffffffffffc00, 0xa, 0x0, 0xa0, 0x3c, r3, r4}, {0x62, 0x80, 0xa4, 0x263a, 0x1, 0x80000000, 0x2, 0x4}, {0xfffffffffffffffe, 0xff, 0x4, 0x8}, 0x81, 0x0, 0x3, 0x1, 0x2, 0x3}, {{@in=@multicast2, 0x4d4, 0x3c}, 0xa, @in=@loopback, 0x34ff, 0x3, 0x0, 0x100, 0x7, 0xcec0, 0xffff}}, 0xe8) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:49 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) r1 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, &(0x7f0000000080)=0x80, 0x800) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20010000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x38, r2, 0x805, 0x70bd26, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xc33e}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xfffffffffffffff7}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x80000001}]}, 0x38}, 0x1, 0x0, 0x0, 0x20008084}, 0x1) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 422.199184] binder_alloc: 12346: binder_alloc_buf, no vma [ 422.210366] binder: 12346:12349 transaction failed 29189/-3, size 0-0 line 3254 [ 422.217463] binder: BINDER_SET_CONTEXT_MGR already set [ 422.235001] binder: 12344:12352 ioctl 40046207 0 returned -16 [ 422.239276] binder: BINDER_SET_CONTEXT_MGR already set [ 422.251741] binder: 12346:12349 ioctl 40046207 0 returned -16 [ 422.257821] binder_alloc: 12346: binder_alloc_buf, no vma [ 422.273467] binder: 12346:12356 transaction failed 29189/-3, size 0-0 line 3254 [ 422.273540] binder_alloc: 12346: binder_alloc_buf, no vma [ 422.281855] binder: undelivered TRANSACTION_ERROR: 29189 [ 422.298819] binder: 12344:12352 transaction failed 29189/-3, size 0-8 line 3254 [ 422.309319] binder: undelivered TRANSACTION_ERROR: 29189 [ 422.316401] binder: 12344:12363 BC_INCREFS_DONE u0000000000000000 no match [ 422.326325] binder: 12344:12352 Release 1 refcount change on invalid ref 1 ret -22 [ 422.335386] binder: undelivered TRANSACTION_ERROR: 29189 18:00:50 executing program 0: r0 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffffff) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000001800)={'bond_slave_0\x00', {0x2, 0x100000000, @rand_addr=0x6}}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r2, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f00000002c0)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r3, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400802}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r5, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x6}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x7}]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x0) getsockname$packet(r4, &(0x7f0000000200), &(0x7f0000000240)=0x14) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r6 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r6, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:50 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) r1 = dup2(r0, r0) setsockopt$sock_int(r1, 0x1, 0x37, 0x0, 0xbc) bind$inet6(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, r1, 0x0, 0x9, &(0x7f0000000040)=':vmnet1&\x00', 0xffffffffffffffff}, 0x30) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100), &(0x7f0000000140)=0xc) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000180)=0x0) syz_open_procfs(r2, 0x0) 18:00:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12634840030000000000000002000000000000000000000000000000000000000000000000000000000000003000000000000000", @ANYPTR=&(0x7f00000000c0)=ANY=[], @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00h\x00\x00\x00\x00\x00\x00\x00p\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="b7064844fc3c39dc"], 0x81, 0x0, &(0x7f0000000280)="27dea0dbd674becd3bbc4260967d56aaebedee3d972f2749e734cf94458addb841ae8c6c8b374061740d8b4951edfd97f3ce0e8975fa8f94f97d50ba04c5a85764340b5fadd9016b02dd339a4529ee75eb5e5e8242929957113782bd0a3b3f940405c41cb18156aa8699bd149b997008394c71086c9a66bbe9c59077028692e855"}) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x1000000000) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:50 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:50 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)={0x24, 0x16, 0x200, 0x70bd26, 0x25dfdbff, {0x18}, [@typed={0x10, 0x4, @str='procnodev\x00'}]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x20048004) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r2 = dup3(r1, r1, 0x80000) write$P9_RREADLINK(r2, &(0x7f0000000180)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 422.845852] binder: BINDER_SET_CONTEXT_MGR already set [ 422.854378] binder: 12379:12384 ioctl 40046207 0 returned -16 [ 422.855408] binder: BINDER_SET_CONTEXT_MGR already set 18:00:50 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x200000000002, 0x1) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$IOC_PR_PREEMPT(r2, 0x401870cb, &(0x7f0000000340)={0x7, 0x9fcc, 0x20, 0x80000}) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r3, 0x29, 0x41, &(0x7f0000000540)=ANY=[@ANYBLOB="6600000000000800000000fecb00000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000006eae1e04cad42e33e2f50000000000000000caf0f75480c172e53524d2111f4ca20da9840000000000000000000000000000000000000000000000000000a189d1a26d21365553f4cb1d3eca48b1fb34f3109c754141fa4c3f812afa883d3fc54b36808b4d87cc36da81dafe8b0ccdb69f1c767cee4585de555b1bc2d6091e555683bcfbd77195a7205db95d9567e307a43bcabd00e0493b39c9d71d07cce22efb8b9bba4b4256476d1889d90377bba4f9e8daaeda44a7d5ca673c1d102ae754d894a7fa9bd2ba9c70b5c273805889c1852957b7d3c503e286bc1fbd11555be055709f3f62314c47d1889a7cc128ba2dfd44c0c2a7533c504bf8d5bdcc3e1e5dde0d43f0099d5d6e9164c74fac308053e78247644dc71448b34e7507d8cd1c65e1aed9fdcf3e4eae340710cd1fd7b5cc5ab262e4c66209376c75ca1ddbcf5a4620932ef118ae5e2e2f2b90a19ba0e346989d94f02833b176748fae8b18e2aeaccad32461741089c38b7500dd1c7a10730a69b69e92bd57a66c2220e881933a"], 0x68) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) fsetxattr$security_smack_transmute(r1, &(0x7f00000000c0)='security.SMACK64TRANSMUTE\x00', &(0x7f00000002c0)='TRUE', 0x4, 0x1) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000480)=0x0) perf_event_open(&(0x7f0000000400)={0x3, 0x70, 0x400, 0x0, 0x8000, 0x9, 0x0, 0x8a1, 0x4000, 0x8, 0x1d, 0x9, 0x0, 0x0, 0x7f, 0x1f, 0x10000, 0x0, 0x81, 0x6, 0x7, 0xc3, 0x9, 0x0, 0x0, 0x400, 0x80000001, 0xe96, 0x5, 0x2, 0x1, 0xffffffff, 0x9, 0x40, 0x6cc0, 0x8000, 0xff, 0x9, 0x0, 0x3, 0x1, @perf_bp={&(0x7f00000003c0), 0x1}, 0x440, 0x9, 0x4, 0xf, 0x4, 0x6, 0x800}, r4, 0xf, r2, 0x2) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r2, &(0x7f0000000240)="4e1a45dc9c4c0bb30bc02b47af0e84b8cd2e08dc8297aa3c3935c8a44c29b7e0ecf976231c85a2220ae866179868271924ca2886e85a87d34a265c720c6457782446cd34c20a89c0dc173b7fe8e76f8beca3a0940fd5ca53b427b6fbca3e7035", 0x60, 0x84, &(0x7f0000000380)={0xa, 0x4e24, 0x8, @mcast2, 0x1}, 0x1c) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f00000004c0)=0x4, 0x4) socket$inet6(0xa, 0x800, 0xffffffff00000000) ioctl$BLKBSZSET(r2, 0x40081271, &(0x7f0000000200)=0x1) getsockopt$bt_hci(r1, 0x0, 0x1, &(0x7f0000000140)=""/67, &(0x7f0000000000)=0x43) [ 422.901462] binder: 12380:12387 ioctl 40046207 0 returned -16 [ 422.901672] binder_alloc: 12379: binder_alloc_buf, no vma 18:00:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x200000000001, 0x401) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040001, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0xfffffffffffffffe) 18:00:50 executing program 4: r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x10000, 0x0) symlinkat(&(0x7f0000000180)='./file0\x00', r0, &(0x7f0000000200)='./file0\x00') clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000280)={0x2, &(0x7f0000000240)=[{0xe24a, 0x400, 0x1ff, 0x2}, {0x3, 0x3ff, 0x1, 0xc8b}]}, 0x10) tkill(r1, 0x28) r2 = dup(0xffffffffffffffff) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000040)={0x4, &(0x7f0000000000)=[{0x100, 0x2a39f116, 0x7}, {0x7, 0x8, 0x100000001, 0x662f17e9}, {0x1ff, 0x5, 0x38, 0x4}, {0x3, 0xa8ec, 0x60000, 0x2}]}, 0x10) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000300)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r0, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x34, r3, 0x210, 0x70bd29, 0x25dfdbff, {{}, 0x0, 0x4102, 0x0, {0x18, 0x13, @l2={'ib', 0x3a, 'bridge_slave_0\x00'}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x1) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) setrlimit(0x5e565f78883adc06, &(0x7f0000000140)={0x6, 0x3}) ioctl$BLKIOMIN(r2, 0x1278, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) [ 422.945787] binder: 12380:12387 BC_INCREFS_DONE u0000000000000000 no match [ 422.963126] binder: 12380:12387 Release 1 refcount change on invalid ref 1 ret -22 [ 422.985671] binder_alloc: 12379: binder_alloc_buf, no vma [ 422.997150] binder: 12379:12384 transaction failed 29189/-3, size 0-0 line 3254 [ 423.005312] binder: 12380:12397 transaction failed 29189/-3, size 24-8 line 3254 [ 423.038714] binder: BINDER_SET_CONTEXT_MGR already set 18:00:50 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000180)='/dev/full\x00', 0xc00, 0x0) setsockopt$packet_buf(r3, 0x107, 0x7, &(0x7f0000000200)="1dbdfbe07e24daaaa5429baf3630a8681e906117799406a00060c2ed7664721dff604df2f5e2cb6315119e5babe836b19df1e31c6375d687409cb4149aceeb90215971cf9e140023e867", 0x4a) r4 = syz_open_procfs(0xffffffffffffffff, 0x0) fsetxattr$security_ima(r4, &(0x7f0000000280)='security.ima\x00', &(0x7f00000002c0)=@md5={0x1, "5e6e674b5c75dafe76dd88cc7ba3dc6e"}, 0x11, 0x1) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:50 executing program 1: r0 = socket$inet6(0xa, 0xa, 0x1) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) fcntl$getownex(r0, 0x10, &(0x7f0000000080)={0x0, 0x0}) syz_open_procfs(r1, 0x0) [ 423.048120] binder: 12379:12415 ioctl 40046207 0 returned -16 [ 423.070455] binder: BINDER_SET_CONTEXT_MGR already set [ 423.076069] binder: 12379:12384 ioctl 40046207 0 returned -16 [ 423.089229] binder_alloc: 12379: binder_alloc_buf, no vma [ 423.112993] binder: BINDER_SET_CONTEXT_MGR already set [ 423.127192] binder: 12379:12421 transaction failed 29189/-3, size 0-0 line 3254 [ 423.137743] binder: 12419:12422 ioctl 40046207 0 returned -16 [ 423.137830] binder: undelivered TRANSACTION_ERROR: 29189 [ 423.175431] binder: 12419:12434 transaction failed 29189/-22, size 24-8 line 3117 18:00:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000000)=0x8001) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:50 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000000)=0x102, 0x4) pipe2(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) r4 = getuid() r5 = getgid() lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) write$P9_RSTATu(r3, &(0x7f00000005c0)=ANY=[@ANYBLOB="700000007d0100000051204900ec0c0000100000000007000000000000000000000081000000018000008f1b0000040000001400637075736574274e73656c696e75786e6f646576000000000a006c6f00000000000002000a006c6f0000000000970af2c709767f5942af246c63894051f430d2b04df11e2cd37f02cdd16dfa5d2846de8b17173224e39cbd6b238f10aa94d32da967f03197415061a10cd582e5b5c882d20fc3a201d57c12a20916352eeaf612ecb90b324e2952a65a40377e1082d3e1ea64a21dbe74f0f957ec473bc1ae000000000000000000000000000000", @ANYRES32=r4, @ANYRES32=r5, @ANYRES32=r6], 0x70) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0x7, &(0x7f0000000200)={0x101, 0x0, 0xfffffffffffffffb, 0x1}, 0x10) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x800000004e25, 0xffffffffffffffde, @ipv4={[], [], @remote}, 0x3f}, 0x1c) dup(r1) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) clone(0x20000200, &(0x7f0000000240)="07a2c300d26791678bce30c39fa7751ba977821031f673a269cf228d4e54b7b57e2eada9a160675afdc7522c0b50843829b92132764f7d9251e6848a031c5829b5f21007d81a40c21e2e", &(0x7f00000002c0), &(0x7f0000000300), &(0x7f0000000340)="f5633792cc14a276dbb3f1505fae63d1dc0f164bbb4c4ebb9f6e7885d8b9d81e85dacba93b32d66ca81a48a2571d33bf3d64d0b260d456aaed0038807a32365bd067c2dd56d7eb3b5f0a7cdc2f9860f6394c0b19876dc16abf73c3934a091870b3e030afc8e5f76295ead9c1834bdb42691ce8887937b9c3bc9740479124183321") r7 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x2a, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r7, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r7, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 423.215622] binder: 12419:12443 BC_INCREFS_DONE u0000000000000000 no match 18:00:50 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) fcntl$setown(r1, 0x8, r0) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x20000, 0x0) ioctl$KDMKTONE(r2, 0x4b30, 0x8001) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x6, 0x60c1) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 423.266051] binder: 12419:12448 Release 1 refcount change on invalid ref 1 ret -22 [ 423.290940] binder: 12447:12452 ioctl 40086607 20000000 returned -22 [ 423.317690] binder_alloc: 12447: binder_alloc_buf, no vma [ 423.332629] binder: 12447:12452 transaction failed 29189/-3, size 0-0 line 3254 [ 423.341971] binder: undelivered TRANSACTION_ERROR: 29189 18:00:51 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x145000, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x4) fsetxattr$security_smack_transmute(r0, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x3) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000014c0)=@newspdinfo={0x1c, 0x24, 0x215, 0x0, 0x0, 0x0, [@ipv4_hthresh={0x8, 0x3, {0x0, 0x60}}]}, 0x1c}}, 0x0) 18:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x40000, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r1, 0x29, 0x2a, &(0x7f0000000200)={0x7f, {{0xa, 0x4e21, 0x944, @rand_addr="faae7371e8c29845228eff3c9811453c", 0x8}}}, 0x88) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r2, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000140)='yam0\x00', 0xffffff4c) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f0000000180)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20, 0x1000000000000, @local}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e24, 0xfffffffffffffffe, @ipv4={[], [], @loopback}}, 0x516) 18:00:51 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 423.376117] binder: 12447:12452 ioctl 40086607 20000000 returned -22 [ 423.397717] binder: BINDER_SET_CONTEXT_MGR already set 18:00:51 executing program 4: clone(0x800ff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0xfffffffffffffffd, &(0x7f0000000080)) r1 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/load\x00', 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000180)='/dev/net/tun\x00', 0x400000, 0x0) nanosleep(&(0x7f0000000000), 0x0) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000140)) fsetxattr$security_capability(r1, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v2={0x2000000, [{0x0, 0xb61d}, {0x8, 0x56f9}]}, 0x14, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) getsockname$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000080)=0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 423.427578] binder_alloc: 12447: binder_alloc_buf, no vma [ 423.443714] binder: undelivered TRANSACTION_ERROR: 29189 [ 423.451473] binder: 12447:12465 ioctl 40046207 0 returned -16 [ 423.457279] binder: BINDER_SET_CONTEXT_MGR already set [ 423.458625] binder: 12447:12470 transaction failed 29189/-3, size 0-0 line 3254 18:00:51 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$9p(0xffffffffffffffff, 0x0, 0x0) clone(0x2902001ff7, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigtimedwait(&(0x7f0000000040), 0x0, &(0x7f0000000080)={0x0, 0x1c9c380}, 0x8) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000000)=0x0) ptrace$pokeuser(0x6, r0, 0x7c, 0x3b) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f0000000100)) ptrace(0x10, r1) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ptrace$pokeuser(0x6, r1, 0x388, 0xffffffffffffffff) add_key$user(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) sync_file_range(0xffffffffffffffff, 0x0, 0x0, 0x0) 18:00:51 executing program 3: syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00') r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x1) fsetxattr$security_smack_transmute(r1, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="4000000000000000000000000000000000000000000000000000000000000000000000e0ffffff00000000eb000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 18:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) getpgid(0x0) getpgid(0xffffffffffffffff) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000180)) r3 = getpgrp(0x0) syz_open_procfs(r3, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 423.484299] binder: 12471:12476 ioctl 40046207 0 returned -16 [ 423.496285] binder: undelivered TRANSACTION_ERROR: 29189 [ 423.512784] binder: 12471:12484 transaction failed 29189/-22, size 24-8 line 3117 [ 423.547801] binder: 12471:12476 BC_INCREFS_DONE u0000000000000000 no match [ 423.562692] binder: 12471:12476 Release 1 refcount change on invalid ref 1 ret -22 [ 423.576902] binder: 12489:12492 unknown command 64 [ 423.583534] binder: 12489:12492 ioctl c0306201 20000440 returned -22 18:00:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) fsetxattr$security_smack_entry(r1, &(0x7f0000000040)='security.SMACK64IPOUT\x00', &(0x7f0000000080)='\x00', 0x1, 0x1) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000240)='tls\x00', 0x4) r3 = getpgrp(0x0) perf_event_open(&(0x7f00000002c0)={0x3, 0x70, 0xffffffff, 0x93f2, 0x80, 0x5, 0x0, 0x7f, 0x0, 0x5, 0xffff, 0x10001, 0xfffffffffffffff9, 0x1f, 0x80000000, 0x2, 0x6, 0x6, 0x0, 0x3, 0x9, 0x7, 0x908c, 0x4570, 0xffffffffffffff7e, 0x101, 0xffffffff, 0x80, 0x20, 0x4, 0x99, 0x7fffffff, 0xfffffffffffffff8, 0x400, 0xa0, 0x2, 0xffffffffffff0000, 0x0, 0x0, 0x9, 0x0, @perf_bp={&(0x7f0000000280), 0x2}, 0x1009, 0x9, 0x3, 0x8, 0x5, 0x5, 0x401}, r3, 0x3, r2, 0x0) setsockopt$sock_int(r1, 0x1, 0x0, 0x0, 0x150) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x1, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet6(0xa, 0x80000, 0x5) creat(&(0x7f0000000340)='./file0\x00', 0x20) r5 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f00000001c0)=0x0) write$eventfd(r5, &(0x7f0000000480)=0x8, 0x8) write$binfmt_script(r2, &(0x7f0000000380)={'#! ', './file0', [{0x20, 'posix_acl_accessself\''}, {0x20, '/dev/null\x00'}, {0x20, '/dev/null\x00'}, {0x20, 'wlan1-'}, {0x20, '}#)nodev-'}], 0xa, "d0ee3752ee3eb16703b4df0bf991adedd3d64629784214043badcb94129e293da63138552adf42b24392b468a0f27aa320c2259ded217606330575e870ef8c9fedc8c1ae1821255991d01cb729be120cd079473997b22966be307dfce1155c436bc2506fab69a4bac0cef56f482f1703b3e521a82f09a63ccf8234a9edfc8302c16c0e0b07d863a553ef3d4d78430aae4d97ac7b4299183f6f393b33f24463e35615dfb4bc0a74de98b5e7a81f"}, 0xf5) perf_event_open(&(0x7f0000000140)={0x5, 0x70, 0x3, 0x9, 0x2939528e, 0x0, 0x0, 0x4, 0x20, 0x8, 0x8, 0x101, 0x2, 0x4, 0xa6, 0x6, 0x200, 0xf7, 0xfffffffffffffffa, 0x7ff, 0x9, 0x8, 0x2, 0x100000000, 0x20, 0x1ae9, 0x0, 0x7f, 0x4db, 0x1, 0x400, 0x7fff, 0x7, 0x3, 0x3, 0x8, 0x9, 0x3, 0x0, 0xffffffffffffff00, 0x4, @perf_config_ext, 0x40, 0x0, 0x7, 0x4, 0x0, 0x8, 0x5}, r6, 0x6, r4, 0x2) 18:00:51 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockname$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000080)=0x1c) tkill(r0, 0x18) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) gettid() ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:51 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:51 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0a0800023c390d3188b070") r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000100)={0x2, 0x2}, 0x10) ioctl$sock_FIOSETOWN(r1, 0x8901, &(0x7f0000000580)=0xffffffffffffffff) ioctl$int_in(r1, 0x5452, &(0x7f0000000040)=0x19b) write$smack_current(r1, &(0x7f00000000c0)='/dev/full\x00', 0xa) openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x900000020000000, &(0x7f0000000000)={0x2, 0x2, @local}, 0x10) sendto$inet(r1, &(0x7f00000001c0)="a5fe9e7be7060850100792f46b647308d3e2a67328969288734cc698158a84b40408261762639ee5e5881d4fb471fcb9639d30513ab42a04f920d8c1fa0c6ed49b0028fda44d1e69121bd2ff68125d42c7beccab2998e3392614583dd729cd341292ded369a34c4c75e12e8e0f519531fc8f11e74b74f2e5ad24cd0ab65395a2307394f48438306edcbb2ad2261f7535abea9833df32f75d92d392390b4fef75c9923a1745b53c", 0xa7, 0x8801, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000040)) 18:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x800) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 423.654529] binder: BINDER_SET_CONTEXT_MGR already set [ 423.697837] binder: 12512:12514 BC_INCREFS_DONE u0000000000000000 no match [ 423.707198] binder: 12489:12492 unknown command 64 [ 423.713893] binder: 12489:12492 ioctl c0306201 20000440 returned -22 [ 423.728043] binder: 12489:12508 ioctl 40046207 0 returned -16 [ 423.739319] binder: 12512:12514 Release 1 refcount change on invalid ref 1 ret -22 18:00:51 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_ifreq(r0, 0x8917, &(0x7f00000000c0)={'irlan0\x00', @ifru_flags=0x1800}) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="0180c2000000aab1aaaaaabb080045000014000020000000907800000000bae6157e4c03caa5cdad0001"], 0x0) 18:00:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000080)={0x0, 0xfb, 0xff, 0x7, 0x7492deb9, "d5f8b4fc1beb49fd8bef0b97f03baaaf", "0365ed502827c459d12d21cfe184bf412da91206ee19e8175714d318e8fd05b997e90cd460a2bdc60ef35c453c488b5db90d8262a8e648ae8b152030d3385a617ab9e54088e0110da502a939bb1e0a36caaa739353bf51abc992ba47717895ee3180819802c2152943c4d841708ad2ae7e6c156c4fa0684082225a6696154888600f1eaf1a95bb4da946a5e9a76d934a24c7e1f852b8dd6ebdae893936d8da77f7029a861bc9402e622067195573f838421a3b7021049f7677cb7c10727ddbd8ef2ee0a23ead78c994d41d7e8003709fa76ed53e81dbe27afc92fa07f5800c233225d4e73f8c3944179b"}, 0xff, 0x3) 18:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f00000002c0)=""/122, &(0x7f0000000180)=0x7a) getsockopt$IP_VS_SO_GET_DAEMON(r1, 0x0, 0x487, &(0x7f0000000340), &(0x7f0000000380)=0x30) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000200)={0x3, 0xa7, "0778f91c25a37ca0fb8565498f1434ce6ad79aa9310f77c9a7743d831512d81a0505b845ae68fd67a6d3ac5c0aed0fed45bbffff1bfbc734ea2211509a33d6ac3427ae4c5787007c54420ba92737956a7215311933427cf780fbf499a469969ff3248cc6b4ff6de0575d48ef23d8698d00bcf27fae11e0cf89eb63b14f10d81a39d55658daa149ca63c6cba162e9504ecd687c1442d8617714b94160c75793a27cd2ed60003e72"}) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) recvfrom(r1, &(0x7f00000003c0)=""/135, 0x87, 0x2000, &(0x7f0000000480)=@ethernet={0x307, @local}, 0x80) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 423.759628] binder: release 12512:12514 transaction 581 out, still active [ 423.784682] binder: undelivered TRANSACTION_COMPLETE 18:00:51 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 423.814796] binder: send failed reply for transaction 581, target dead [ 423.841460] binder_alloc: 12528: binder_alloc_buf, no vma 18:00:51 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) r1 = socket(0x1, 0xa, 0x100000000) setsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000000)={@rand_addr=0x7, @multicast1}, 0x8) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0xfffffeff7ffffffe, &(0x7f0000000180)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 423.866812] binder: 12528:12539 transaction failed 29189/-3, size 0-0 line 3254 [ 423.883755] binder: BINDER_SET_CONTEXT_MGR already set [ 423.894751] binder: BINDER_SET_CONTEXT_MGR already set [ 423.900933] binder: 12528:12549 ioctl 40046207 0 returned -16 [ 423.907227] binder: 12538:12544 ioctl 40046207 0 returned -16 18:00:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) ioctl$int_in(r0, 0x5473, &(0x7f0000000080)=0x3ff) r1 = socket(0xa, 0x80a, 0x7fff) setsockopt$inet_msfilter(r1, 0x0, 0x29, &(0x7f0000000040)={@multicast2, @local, 0x1, 0x1, [@remote]}, 0x14) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:51 executing program 5: syz_emit_ethernet(0x6e, &(0x7f0000000000)={@local, @broadcast, [{[], {0x8100, 0x100000001, 0xfffffffffffffffd, 0x1}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote={0xac, 0x223}, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4004, 0x0, @local={0xac, 0x223}, @dev, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, 0x0) [ 423.920287] binder_alloc: 12528: binder_alloc_buf, no vma [ 423.926297] binder: 12528:12539 transaction failed 29189/-3, size 0-0 line 3254 [ 423.934420] binder_alloc: 12528: binder_alloc_buf, no vma [ 423.940512] binder: 12538:12559 transaction failed 29189/-3, size 24-0 line 3254 [ 423.944077] binder: undelivered TRANSACTION_ERROR: 29189 18:00:51 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) ioctl$int_in(r1, 0xe42c769389e5942b, &(0x7f0000000040)=0x1) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000440)={'\x00', {0x2, 0x4e23, @loopback}}) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000200)='/dev/zero\x00', 0x0, 0x0) ioctl$BLKBSZSET(r3, 0x40081271, &(0x7f0000000240)=0xfff) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r3, &(0x7f0000000400)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2dc2f4bc001bb337}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="98000000", @ANYRES16=r4, @ANYBLOB="000225bd7000ffdbdf25100000000800e30004000200300001002c0004001400010002004e210000000000000000000000001400020002004e22ac1414aa0000000000000000100002000400040008000200ff0f00003c00020008000200040000000800040008000100ffffffff040004000800020003000000080002000000000008000100060000000000000000000000"], 0x98}, 0x1, 0x0, 0x0, 0x84}, 0x408c4) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) ptrace$cont(0x1f, r0, 0x0, 0x0) r5 = accept(0xffffffffffffffff, &(0x7f0000000140)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, &(0x7f0000000080)=0x80) setsockopt$inet6_udp_encap(r5, 0x11, 0x64, &(0x7f00000001c0)=0x7, 0x4) 18:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4008000000000002, &(0x7f0000000180)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 423.975740] binder: 12538:12544 BC_INCREFS_DONE u0000000000000000 no match [ 423.983719] binder: 12538:12544 Release 1 refcount change on invalid ref 1 ret -22 [ 423.986968] binder: undelivered TRANSACTION_ERROR: 29189 18:00:51 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x40000, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000280)={0x0}) r2 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3000003, 0x120110, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x6c, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0063404001000000000000000400000000000000000000004c7aa757000000000000000050000000000000001000000000000000", @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000003000000000000002f00000000000000852a747000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000003000000000000003300000000000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="09631040", @ANYRES64=r1, @ANYBLOB="040000000000000009631040", @ANYRES64=r2, @ANYBLOB="f3ffffffff7fffff"], 0xdc, 0x0, &(0x7f0000000340)="cee6b9e416994a9b995ab9045f5ac0bf41decb5b353facde85fd5ff56acb534398212a601c12a8cb93fbb53ce0e6fea59b228710ee40fd212706f68ce8c719149144d55e0d208ae1f8c25f7eb715e3db95fb704f1ed0becdd9d4c606d7acd4440b6b2348e1ccaa32b1fcac9a529b7f10605103d675d9eb83d8029b3f854e97c6b1bc75ca45258096b3228d3135b4d57160d13c109d92f3ee3f1ecf847096c0d02ae7e565a3ed496cfa6db027df2eccfbd5c76ebdd89b48ebd7dfcd85aae10f58ad0eb8095592592d0cbaf7c71bb0e106eacf4fe916aceaa89c44702a"}) r3 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000640)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000900)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f00000008c0)={&(0x7f0000000680)={0x228, r4, 0x30, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_BEARER={0x9c, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x6}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x8, @local, 0x5}}}}]}, @TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xfffffffffffffffa}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_NET={0x14, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000}, @TIPC_NLA_NET_ADDR={0x8}]}, @TIPC_NLA_MEDIA={0xc, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_MEDIA={0x50, 0x5, [@TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000000}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x81}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x76bd0f9f}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_MEDIA={0x68, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_LINK={0x34, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x90}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x4}, 0x81) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) io_setup(0x8, &(0x7f0000000480)=0x0) io_cancel(r7, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x6, 0xffffffffffffc146, r6, &(0x7f00000004c0)="a932dc0b3ca4346c66303ff39140c31962b1cffa66d44c1854112593aadcb02fd5e99aaae285ed0916801616b81a8c06e630997f7546b03a4de8050d808af9204dd70a1e26b9ce1632a616764b235342926519c6ab4f78d497777128349ef68c5843d00be16bf20854b7402e5d66456bd23a0b2d9152aec5ea42087e9fd120966005b50545add8bec20701f7f3a79a2be246a4", 0x93, 0x9, 0x0, 0x3, r0}, &(0x7f00000005c0)) socket$netlink(0x10, 0x3, 0x17) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400204) setsockopt$inet_int(r5, 0x0, 0x5, &(0x7f0000001ffc)=0x6, 0x4) r8 = dup3(r3, r5, 0x0) setsockopt$inet_int(r3, 0x0, 0x31, &(0x7f0000000940)=0x1f, 0x4) setsockopt$inet6_MCAST_JOIN_GROUP(r8, 0x29, 0x2a, &(0x7f0000000000)={0x100, {{0xa, 0x4e24, 0x3, @dev={0xfe, 0x80, [], 0xe}, 0xffffffffffffff7f}}}, 0x88) 18:00:51 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x10, 0x0, &(0x7f0000000000)=[@request_death={0x400c630e, 0x3, 0x1}], 0x81, 0x0, &(0x7f0000000040)="e54dceba9ec83ecf5c41e5c429f660fce6e0dc49476ede053268dd544948c66e806828579053bf9f4b4dc627101375c3818863b73fa7b7028821ff09b39f86f4f8fa31552015d4002c793aea5d71489590a4c1a5a2bc81e178f9be354f0f2afa291792a5bd7befd6569773d6a1c8b43d083b8f3d7e331ac2094c7bfebb931ca8af"}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x200, 0x0) write$P9_RCREATE(r2, &(0x7f0000000180)={0x18, 0x73, 0x1, {{0x22, 0x3, 0x1}, 0x1f00000}}, 0x18) [ 424.021265] binder: undelivered TRANSACTION_ERROR: 29189 18:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) syslog(0x0, &(0x7f0000000200)=""/224, 0xe0) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 424.102407] binder: 12578:12584 BC_INCREFS_DONE u0000000000000000 no match [ 424.121280] binder: 12581:12588 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 424.132870] binder: 12578:12584 Release 1 refcount change on invalid ref 1 ret -22 [ 424.147661] binder: BINDER_SET_CONTEXT_MGR already set [ 424.155308] audit: type=1400 audit(1553623251.863:44): avc: denied { syslog } for pid=12589 comm="syz-executor.0" capability=34 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 18:00:51 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0xfffffffffffffd44, 0x20040000, &(0x7f0000000180)={0xa, 0x4e20, 0xfffffffffffffffe, @loopback}, 0x1c) 18:00:51 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:51 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) dup2(r1, r0) lsetxattr$security_smack_entry(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64IPIN\x00', &(0x7f0000000100)='\\($\x00', 0x4, 0x3) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 424.208199] binder: release 12578:12584 transaction 587 out, still active [ 424.217841] binder: 12581:12588 ioctl 40046207 0 returned -16 [ 424.228711] binder: undelivered TRANSACTION_COMPLETE [ 424.245678] binder: send failed reply for transaction 587, target dead [ 424.254836] binder: 12581:12588 BC_REQUEST_DEATH_NOTIFICATION invalid ref 3 [ 424.258789] binder_alloc: 12581: binder_alloc_buf, no vma [ 424.272248] binder: send failed reply for transaction 588 to 12581:12603 [ 424.275225] binder: 12581:12609 transaction failed 29189/-3, size 0-0 line 3254 [ 424.286914] binder: BINDER_SET_CONTEXT_MGR already set [ 424.286927] binder: 12608:12613 ioctl 40046207 0 returned -16 [ 424.287072] binder_alloc: 12581: binder_alloc_buf, no vma 18:00:52 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:52 executing program 5: r0 = socket(0x0, 0x1, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x0, @dev}, 0x1c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='ramfs\x00', 0x50, 0x0) r1 = creat(&(0x7f00000001c0)='./file0/bus\x00', 0x6857b21ff1155d90) fcntl$lock(r1, 0x7, &(0x7f0000027000)={0x1}) r2 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r2) r3 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) getpid() write$P9_RAUTH(r3, &(0x7f0000000180)={0xfffffffffffffe8d}, 0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000100)={@remote, 0x70, r4}) sendfile(r3, r3, &(0x7f0000000240), 0x7fff) getsockopt$inet6_opts(r2, 0x29, 0x0, 0x0, 0x0) 18:00:52 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000280)=""/97, &(0x7f0000000300)=0x61) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_SERVICE(r2, 0x0, 0x483, &(0x7f0000000040), &(0x7f0000000140)=0x68) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) r3 = open(&(0x7f00000001c0)='./file0\x00', 0x418400, 0x80) ioctl$RNDCLEARPOOL(r3, 0x5206, &(0x7f0000000200)=0x6) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$getenv(0x4201, r0, 0x3, &(0x7f0000000180)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 424.287094] binder: 12608:12613 transaction failed 29189/-3, size 24-0 line 3254 [ 424.287252] binder: 12608:12613 Release 1 refcount change on invalid ref 1 ret -22 [ 424.295667] binder: undelivered TRANSACTION_ERROR: 29189 18:00:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000200)) sendto$inet6(0xffffffffffffffff, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r2 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$sock_SIOCBRADDBR(r2, 0x89a0, &(0x7f0000000180)='hwsim0\x00') sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) openat$tun(0xffffffffffffff9c, &(0x7f0000000000)='/dev/net/tun\x00', 0x2000, 0x0) 18:00:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) timerfd_create(0xa, 0x80000) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x505400, 0x8) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000200)) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 424.402748] binder: BINDER_SET_CONTEXT_MGR already set [ 424.425031] binder: 12620:12630 ioctl 40046207 0 returned -16 [ 424.425238] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.450918] binder_alloc: 12581: binder_alloc_buf, no vma [ 424.456717] binder: 12620:12639 transaction failed 29189/-3, size 24-0 line 3254 [ 424.490540] binder: undelivered TRANSACTION_COMPLETE 18:00:52 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r1, 0x0, 0x486, &(0x7f0000000040), &(0x7f0000000080)=0xc) socket$inet6(0xa, 0x80000, 0x94) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e23, 0x9, @ipv4={[], [], @broadcast}, 0x5}, 0x1c) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000140)='/proc/self/net/pfkey\x00', 0x200000, 0x0) ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000180)={0x3, 0x7, 0x1ca}) syz_open_procfs(0xffffffffffffffff, 0x0) [ 424.491504] binder_alloc: 12640: binder_alloc_buf, no vma [ 424.498551] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.505439] binder: 12620:12630 BC_INCREFS_DONE u0000000000000000 no match [ 424.524005] binder: 12620:12630 Release 1 refcount change on invalid ref 1 ret -22 18:00:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) readahead(r0, 0x6, 0x7) setsockopt$sock_int(r1, 0x1, 0x3d, &(0x7f00000000c0)=0x102, 0xfffffffffffffcb7) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_buf(r2, 0x6, 0x3b, &(0x7f0000000280)="02ab3958e0052d3ec1f1ddd85ad5ca61a090884b6dbc74957eb416d2185ffa1afa59801e07d44af52748077ec2611805c8adbd28c94be97ac8b8392d996e3f0e57de0f70ea70ec75d1b83b18d3eb21897198dd9dd53241", 0x57) lsetxattr$trusted_overlay_origin(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='trusted.overlay.origin\x00', &(0x7f0000000240)='y\x00', 0x2, 0x3) sendto$inet6(r2, 0x0, 0xff24, 0x20040000, &(0x7f0000000100)={0xa, 0x200004e20, 0x0, @loopback}, 0x36d) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000300), &(0x7f0000000340)=0x40) 18:00:52 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) getgid() 18:00:52 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 424.556755] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.563768] binder: 12640:12646 transaction failed 29189/-3, size 0-0 line 3254 [ 424.599509] binder: BINDER_SET_CONTEXT_MGR already set [ 424.606011] binder: 12640:12651 ioctl 40046207 0 returned -16 18:00:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioperm(0x8000, 0xec3, 0x200) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 424.642193] binder_alloc: 12640: binder_alloc_buf, no vma [ 424.646530] binder: BINDER_SET_CONTEXT_MGR already set [ 424.667495] binder: 12640:12646 transaction failed 29189/-3, size 0-0 line 3254 [ 424.703271] binder: 12658:12661 ioctl 40046207 0 returned -16 [ 424.703511] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.718446] binder: 12658:12671 transaction failed 29189/-22, size 24-0 line 3117 [ 424.734954] binder: 12658:12661 BC_INCREFS_DONE u0000000000000000 no match 18:00:52 executing program 4: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffff9c, 0x0, 0xa, &(0x7f0000000040)='/dev/ptmx\x00', 0xffffffffffffffff}, 0x30) capset(&(0x7f0000000140)={0x399f1336, r0}, &(0x7f0000000180)={0x4b6, 0x3, 0x5, 0xc8, 0x8001, 0x1}) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ptrace$getsig(0x4202, r2, 0x92a, &(0x7f00000001c0)) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x28) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x0, 0x0) r4 = dup(r3) ioctl$TCSETS(r3, 0x40045431, &(0x7f00003b9fdc)) r5 = syz_open_pts(r3, 0x80000000006) r6 = dup3(r5, r3, 0x0) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000000)={0xfffffffffffffffc, 0x3f}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r1) write$UHID_INPUT(r6, &(0x7f0000001640)={0x8, "e52aac313baccb9b551156a2d7c12b770dc32a17d3c4c9ceef08c2046fe288a7036e513019e5e114cc4ae935d23a9990952824f5d0c1f52e2eb94e5301ba9dc9a02818038eaef46fc2c3ebbe46e4a6024c93823f66462ba3d68913fdeadd1087b06846aa3ddf6ed3dc2b61b4960f48c2edf5cdf23c7e8d3f2e6daa71e66b29bc19e377d7df4637d735194a52da503a0ac44383ba5b3da867e09ceae02a9bfc21e7f28814c2fab7da41344e207ca706dc37592abdb685e4b80eb6dc2b1dc550a1d16166d163a4a220a54d7844facbbb2648ee90aa05c3c03ee447d79e517df8ffe70c215bd0bf69e86a5f48d571b9337590d05e9947727c0d77d18a117f110252735ca6700a55fd26838935808cce7b7c222a75339e44230bdeb99bc39c0c1cc20de74fcb9744f4c4a988f3874a846d31abcf5504d78a3e14f35f6cbd123fcff22890cc17c730c3ea9f74616dfe60064552ec25568a6211bdc39483a28bed0df0afc7d7c6d13d301e080c8846ea512a8ccae7a99da8dd3009feaf204d22e32c5ecc333e616159d55328d375e59194c5c9a0b3843afb283d1d26f59e03105e91aa552386468432a09be73220e942394f34c559797b74bfe7c5c2c639a40e4d2e81e1004b127540a0bdd6be2f95698e75e4f1203a47d61f506ac9364be9d98ae46536f74afe08c450ecb902e00f188c9f32aed0677455e10bbe82c763a464f10f64c403c35376b7a675546835209f0e2809e9c2bd191f784dda4b727bfac512497a07474e6d3e13233601df81abcdb6fbfb152483ec61baaee45a5d733c62107f63c55a046401a5ddef70cef8d52cb4784e3efc34de554c8ff48f7ae3d6dc1ed4eb70fe1e610355fd66ce1af8ff63b6641fb3dadfab8a9b0b1f26ca11f7287258ad4766e08340f8f2fd53e7e5f287bb73c186f0290f225687040c762776a02e5e65f1b9b713e8ef98ffe111b3e4e7b761dd3ed763ed8dafd67625fb300ac752c0ff9c0c04b75be292c3f0247bd0b3560f1c76aff38791037fcf2b812f1601934a8fc769f7198e0df685841489263a1495a8a8bab1a63cb12b3089a3e30aab15ae872437e52a6f0dbc4df2d0e8df4c6bcd47beefc179d85b70b42b319453e6efaff96a509420bec299f227c4b676c58038916897f15430ff52087dd97dd329c6b6e207378053accaa31843a333e4f69586103424f44bd67eb355c1fbe078e62f07ebaae46c3e335372127dc5fa70a4579af715e531bda52761dc206aded4678079720603a577ef7e5fb5a81a525b7c96a4047d9d6bb80d7e0ce55cc0a4f73256ae9c515307f13fe54126786de425d7a674b05116104176faac5b9365b33fd2f5a710a5159d342abecede83ad421bbb712cd5b006671a958cec907311719eb3e0b5dc4fb51054e06656a7a2a066c0aac65ceb434ca3f242cb2b1d7a22179a85cbbeeacc2f0135d8dd4d1363a98d2543fa4973e19eb359e956d27f142c75f62c7aecaf47090236b9791847725bc6fde15cd4a119a4976a3f0f2d622973ad9000aae56f88b396fa1881ec0b0a5de9955fc8f864b36eacd635b88826e0a64897d605fa4a14f7786b037cf308bef61c7f860e38f1ae67fe8cb7802dbe85f9c0c082eed1a13e645370d0c95d63bba215ac8a637b8f968aef06329d62ba131b56b46bfcfa6a5e82016d5eeb6e7db45595d1acaaa5ec9886315d3dced9d0a15c44c043ac91e4ae7077139774607b76cbc017f636145beb84c1829a6030f4a895a56b8d141f743c9189a71387893f785804f85927a23ccd79c432ab686b621ec91706ef082b4ea4fa608ce2daca0d2e2e07ff51e6a8fdc22f1c8ee5ae53720f93b4547704fae580e5560e3c7b1ac2a38ffc294d3c96635e3b919339394843c8a171c7d12ceb9c0a11be25783694b177b399e7a495538e293a59d3ab44b176afed6894aa0e501d9b98981be3f2057bf6c9869403a34cb83ad57150c674301f39524a026f3608a3414287bc4e507355823c6f8640bb803a392fb8847023d1db3c39753e72414682c617de9bd0d5b6a55d46004d49f20d2f8f53cdd8eb11402f7895cd7c01b4964fd005c564b0b0e156969ccde818dda3a7cae02d1d3af95081e6549f28976fa81b5e90fbb0a62fea850ffaf0220132189c11a74996261f6de6001c50364f08c4f48fd46a0417ec8ee4d003efeead64b87d64b43cd6868f365e72e26dd9f5f9f74d135f64464cb38dd62051ae70c5a4daabebe700eb9b290b8ed4142db0090219e6186f8f71fa8fe1ebe42f621b8eed182ee8ad0401f0a3530fd48e4d1eb2637f1fbd2a7032b0f85715203c12ab8ff48131bc4ff28272b57119a76bc0b30fef5294c23c0b2bcadfbba37a00502b5e43d72148d9acc7cb7cb39dc830cd6f30262a09eecf29d1055c2edc3926cfd5076aa5f9f172ed145359fc974ca5ded652433d212607bed155df1aff269414548a39a644b6ce927de5de6e6750575c4fd7ea7fe10b1e51fde6975c0c23fc012a8b12fe3fa64e972e4e09eafea165ae5c1ffc9d761e1314a781959c223b96eefde0f4f45c7ac032a8d3f1bd304114c3329a3e4966eddcc8d44ae70bad2932f963100955e2d2d487347c2aa8356bc6bc3c84e418163c758f1372246884e6d80d87d7ab3fe660dda13ada65f200b4fb365223b93bbc29493ae6dbbbb1823edb8e9f045b60414edab955e1046b67a8d4908ab08ad90216125d2ffd8c7814a9a4940df0a653b1cf53cf456412228445ebc8e1584adfe13207ff24fe602e2a506218710483b5544347a3d515b7d2ddcaa1bb7ae3578841918a8ed00659d5f260d23ae17a9ffc77f79758844586fe53517097838a92dde8873e8be1cd5934f1a4bfdd9d0b5725b811c4a2c121b7729946993a736bd195c55684ea680304af4844a1b2f74e2c2b2ccaeceb00b9c2c515b70912efb27643c5624025e358b44853cc0efddc103ee514471af902cd9b68f102c95a91d2b825b473ce842e6367b0b7305ce8be6f9c812abe860bb632e00b69a0370e5c8f9ba0cebbcbe1b9276949c303a4e9e3b6db37a0716520c07512192364abb58399fca973a1b32106096eda8bb85745562e8a35c5e917fdf858091a4c29d6549e10098d6b205fc5cad546fe07b3a70756cf7079c88f3708f0c8527002b99e80cbd584a3737fb37953cd6dccf21add4d4b6e65894490840c008578737d5e208649d1cd34beb403c2226300297853a29cf6c661b426c13306575d81f6fd21712e0ec4366013883b95a71d5094acbf156e42de11cb873744983ec1ff9cfbee2278053b8b4e523388bd41dfd3c2ecaacc5d9d2958bbfa94f4bd0ac1c61c98ab295dd5c69020f1329818df9a2aa88ced03f4e6a4d1f8cb020afcd2384e65511ddeb908ba0c13a03dd32e8d4ccf0246008f35ef5184f81b8fed73b4aae4998bd8c7d784210042247d39396ba881bf43555d0ec58deede7b4729e79d31b2a346527594ca3a47a1723a792a701dc18d0124365e2c4a4fefed48c29a9f2fc747b302eaf92a100b2da211c91de4ab79d4aede483d852635c6f14d38095a5739d475c7aa67fdd54767a056eeb3098dfd8d1c21f32e76f0247f04118448273586856e641b83f540a643e72dc15804b78bac475f39e23291798aa45a2c10aa5fef2d5e4d7b8f529a66535d11c6149e9797f2fcce2804f2a5370345e98b0c02c7dd27135d414fe72f0740423920d68b64f6b8c05788c6693ee1b9abb5d4593a970dc3ee2528765fb739964f4fed7200d7e796a9f3d0d60834e638dd8c29d4e85011e4ba4f127fe765954a5b5bb5d1cc69f2376599d5a3e8c30714893f763c06061072c10cb0eee17eb2a2514acc584b04e169d4a33a330367bb725ff9462f5d50282a2e393293eec8ea1eaab8217cc108798a4a57eccdb00647ab9f07318993f7c59c395a93cbd681d0a967a56e3f13c832c48dcc0d0096870b0d51b754e70b12a849b6f376923f7f7d909f64d64e1d6e338d39166b725265b96ed21e36b12057148d66e5df04b7b734ed0957d47fde172be2473b9ac6fdb823abe3e11ec69a170a14511d5572d6c0d9f6b749acad7003f0567bb6f9381649e42d02764077330d5af3d93185968a9f8dfed16c4a7c768a2bb98304946a557182c0ce93e82b340074e384cc6bd6129483386c654a6ab3bb12fe8e86adafa93f218fdf5019c09292858acd8ef7aa6a78e3f846215856d630ae9c5fc4009693b2767ea55c469f9099693287b35d43ee0f7a5baf3328d37b2c536f2abd6e21e472c105ae982cdd26a5a20562122e71efb1486c28d9409c3114b608f297695958c5604cf0918c0c70c56c79170260d73bde297e47cae1c404cca0a96eed51a2dc8f6f6ad862fe767ee5b5e68f231096825d935b809b3c1b5d9a2cd76cae22652bed7d263b42612ed717eba0aaf2a3989c4520c402d29428010000000000000062fb3fdd073b91d4e2f6895fba9639ee78bd8ccb5bc3ce442fbeb9a1521314b82804293159fd7df4db66b78a06fe93e705bbc4e0d294a787c3cbf271b2acd15e7b4998c822f7724d3191e2265bd0d694dfb08063c9ff26a424884b46e26b5560d756c114ad1a7b92eee3f49dc2883b604ecc49c5ce92ce467778301326588a6577d44758e8d90710248d110dbf3d3d568779bd1c616369f84619dd089e38b51634f7c5d2ac9f1547a342877815a3864ad70b68b196bde9d810512f411d5235633ef65088788dfa3f152df7cee3a0803f6ac7ae192301dec07ff870ff3d7cf1c09cc9093263b225d01222376531007af9e6fb96e5ccaa8274f70adc786db7f33a20a752717b56b9a03bfce15a1aacd78c4adf8bdf41de8aaf421684c27526088c54322b5eea9175ef9c574c1f873218cc6f5df233892d7d5b0b0649ffc5a1c4909f2967a8c1f15b419ecde0448f071fa71e553f4f12cfa5e35022e75ddc5509edddc3de82d9097759b27f7c24776702e0ff64559281f796f11c1a9c77a156f390d2d18d1759b6be0347eb5bb4df912e9cfafa0db3be3243bacb378ca0946cece695a8099d6d7a24fc8bcca4c09695e3208f17f00bf404f6eb7852dfe73c163a19fd4e890e0edd5c7a727984b6f47a952373b95200bba061756c699c218b52c265b22bcd5cb24fdf056621fdd2126cede171e435320ca34e56e4c82a2afc9a59d3bf4647877658b6f23a6484f37acd8e2e184926993b5d1bbe6cdba64f486b4fb41bb94a644140540894f8fc14e585bc8beae88eabf926add289c82eb8cea99743baed842d76eb5c5573f7a7f3f2693960d6bfed697b5619afd942f41689dbd281a35e32478ba3a388dada82a2f4164481aa6a8f3946a84ea6186b20ce388c202be42996ae90feec7258d4a4a276353df84c96b160ac003d81cf395c0e61b0f0a9e692c32fab307f754cae5de7716a00cb96160cd39c931f4885d612862cecf6ba76502c9d266f97e4cf6cf0a16f787788e5471458a0dc24d3f2a28caa0f7ee00cf8bb113bd9c2b086037d765b5ec9a849df6f482fc01b48261e44299b0bc88321d837b6e2d221ebf2996b4140cd82e531de27f8de445f31c64469a5a145b031cd2569d19e27369c31ec63a989f0c9aaba7cc9d36d652001d40004f83a90d6465854f31bf15d1ef6bff4c02d60b948a37e3f50d250d7f85f545f507014aae5a35908283168c034f654acbb9d0fc261671d612e3d74261653e69e5e9cf7c8fda298b4d6c879cbbb97eafe648ba70150599089d65c1fdc0d5af879a2d46a443ac6dd21b33f72510742db4faf7eeb1580580ffe26e2d5ff", 0x1000}, 0x1006) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r2, 0x0, 0x0) 18:00:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) syz_genetlink_get_family_id$ipvs(&(0x7f0000000000)='IPVS\x00') ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80, 0x6) getsockopt$IP_VS_SO_GET_INFO(r2, 0x0, 0x481, &(0x7f0000000140), &(0x7f0000000180)=0xc) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000001300000000000000000000000000000000000000000000000000bcafce04535d0f311587204bd73b69cdda0fd65441217adf3605ee493539e2fe9743703efbc4864a670b2c53cc54d2d16ab8a8aa9aca8f50d20967f82800e2ae7cb192db92931ca56632e604fdc9"], 0x0, 0x0, 0x0}) readlink(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)=""/155, 0x9b) [ 424.735171] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.777478] binder: 12658:12661 Release 1 refcount change on invalid ref 1 ret -22 [ 424.885123] binder_alloc: 12680: binder_alloc_buf, no vma [ 424.891806] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.893640] binder: 12680:12685 transaction failed 29189/-3, size 5348024557502464-0 line 3254 [ 424.914850] binder: BINDER_SET_CONTEXT_MGR already set [ 424.924610] binder: 12680:12691 ioctl 40046207 0 returned -16 [ 424.938102] binder_alloc: 12680: binder_alloc_buf, no vma [ 424.946498] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.961606] binder: 12680:12691 transaction failed 29189/-3, size 5348024557502464-0 line 3254 [ 424.982611] binder: undelivered TRANSACTION_ERROR: 29189 18:00:52 executing program 5: bpf$PROG_LOAD(0x5, &(0x7f000000d000)={0xe, 0x3, &(0x7f0000008000)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0xffffffb5}}, &(0x7f0000014ff5)='syzka\x00\x00\x00\x05\x00\xf3', 0x2, 0x1000, &(0x7f0000014000)=""/4096}, 0x48) socket(0x5, 0x80000, 0x0) 18:00:52 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000340)=0x1c, 0x4) r2 = socket$inet6(0xa, 0x1, 0x0) recvfrom$inet(r0, &(0x7f0000000200)=""/201, 0xc9, 0x40010100, &(0x7f0000000180)={0x2, 0x4e20, @empty}, 0x10) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r2, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r2, 0x0, 0x0, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) fcntl$getown(r0, 0x9) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:52 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:52 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x33, &(0x7f0000000040)=0x81, 0x4) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0, 0x0, 0x0) r2 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$link(0x8, r1, r2) 18:00:52 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() timer_create(0x7, &(0x7f0000000080)={0x0, 0x7, 0x7, @thr={&(0x7f0000000000)="a206d68b19fb152e3095c0bb87ccd37e049fd3463652aa45671d19c3475b1f27b08a2bbe4ff9dff904400aea47fc499c7d724ff2e8e1fc6fafab177c747e70cd48e703f00d3fa1ccba84231fbbd75f9d2e3ebf1c23174a1b3bc2cde377ccdc229e10a61b822920a1c27e7c02ef3d9263c2a4c061d0", &(0x7f0000000140)="772c151328427001dabb1a2d77d1439b651e35dee41f95c725aa830168651de35e1f97c561325febbd66c08e004563c381b43c7b9b4308b85b661ce84c49d50bc6b8cf8cc340610a9954435e71b43c425e08d43275c0fde1c40c8ede863753f4b02b31b4c9ae0e62072a65eede94b8b6b64898ff496d44093e7fba66da5dcc1684e2dcd21dff73a9f5467fc24b92082ba3163a83a546f2e94798d60064f2a58f8dc44cb1c6b669d93af4eb39d462d83339ce3d9f7d658765cbf236db33d82c0611aae53ae71d88dce2a3992d"}}, &(0x7f0000000240)=0x0) timer_gettime(r1, &(0x7f0000000280)) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xf, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000b8000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) [ 425.232928] binder_alloc: 12707: binder_alloc_buf, no vma [ 425.236513] binder: BINDER_SET_CONTEXT_MGR already set [ 425.245265] binder: 12707:12709 transaction failed 29189/-3, size 0-12058624 line 3254 [ 425.247019] binder: 12704:12712 ioctl 40046207 0 returned -16 [ 425.263203] binder: BINDER_SET_CONTEXT_MGR already set [ 425.273281] binder: 12707:12718 ioctl 40046207 0 returned -16 18:00:53 executing program 5: clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000100)=ANY=[@ANYBLOB="7365637572698c790000000000000400000000000000010000000000000000000e000000270000004803000028010000000000f7280100003401"], 0x1) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x2f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="052f143c006ddcbeb6887f723fef3daf00ab31518b1a1cc4a700193c94d8df58d046d6e7765260c21d47a83b8c4e0a1000000000000000b022"], 0x39) ptrace$cont(0x18, r0, 0x9, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f00000000c0)) r1 = socket$inet_udplite(0x2, 0x2, 0x88) syz_open_procfs$namespace(r0, &(0x7f0000000040)='ns/cgroup\x00') ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") ptrace$cont(0x7, r0, 0x0, 0x0) [ 425.273381] binder_alloc: 12707: binder_alloc_buf, no vma [ 425.295791] binder: undelivered TRANSACTION_ERROR: 29189 [ 425.305765] binder_alloc: 12707: binder_alloc_buf, no vma [ 425.313762] binder: 12704:12712 transaction failed 29189/-3, size 24-8 line 3254 18:00:53 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000000, &(0x7f00000000c0)=0x102, 0xfffffffffffffe57) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:53 executing program 4: clone(0x80000100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 425.331146] binder: 12707:12709 transaction failed 29189/-3, size 0-12058624 line 3254 [ 425.339072] binder: 12704:12729 BC_INCREFS_DONE u0000000000000000 no match [ 425.368675] binder: undelivered TRANSACTION_ERROR: 29189 [ 425.373286] binder: 12704:12712 Release 1 refcount change on invalid ref 1 ret -22 18:00:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:53 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 425.386465] binder: undelivered TRANSACTION_ERROR: 29189 18:00:53 executing program 5: setrlimit(0x7, &(0x7f0000becff0)) eventfd2(0x0, 0x0) r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BLKRESETZONE(r0, 0x40101283, &(0x7f0000000040)={0x80000000, 0xcbc}) [ 425.432589] binder_alloc: 12745: binder_alloc_buf, no vma [ 425.443417] binder: BINDER_SET_CONTEXT_MGR already set [ 425.449000] binder: 12748:12752 ioctl 40046207 0 returned -16 [ 425.453148] binder: 12745:12751 transaction failed 29189/-3, size 0-0 line 3254 [ 425.470865] binder_alloc: 12745: binder_alloc_buf, no vma [ 425.474510] binder: BINDER_SET_CONTEXT_MGR already set 18:00:53 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) r1 = epoll_create1(0x80000) ioctl(r1, 0x0, &(0x7f0000000140)="66f9c3ce49e03c69048885d2d00d25ad55dc7e2b3e191fc562604909da354a72e681d5c82023df28f380aac4cca42b91fcf266c1d502ce15fbb5ea7d4e8e8f4b86e81d7da326d5d1f98e50791501616005454be22663730545fb2973a32d6233cc2bd676c22c24d3c4238da67630bcf809187d3d0d0a4fed3fedf1d0a6a191b4f7d41cd86072c90a7cf1f5b17a08779ed530e09524e3084d5d3f530a88cd3bfa22654531b10ad8943f2d1d24463845dbb20bf42378f0b7ee24b76c737762cb1777878d8645e8ad") ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000240)="7ee0972241710df5c2631b5a34bb44a787f34fa00997431cdf3a25f546dbd79da1c1b84e72bd14747b4dd884a1c8c5f79616fd83d1169073c8365e8281273ba08d7ba1873a6669f165d44b57d8dee6905bfd7de5f925aa3b392007d9a710d50e83e660dc30fb4608d45d87f719dab30aab0d95cdcb42aebeaf9829a0ca478f31df6834d9cdc0c63a12e3256c9324d1197a57243077b0f321b18f695d311ab50b7be3da1c5c23d714ba3afb77c37f579bda21d3d01cbf0fd0194a87fa7697676a689e6d20b7749bf86df2bf37ab304588ca739512aaf01ac1f1a675ef0e9e19938a3e11637dcd9b89cd9e10cee8e628fba5f6c9980af15491ff3eaeba10b4b362") ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f0000000340)=ANY=[@ANYBLOB="af0a00000000000010000000000d14511d63c681006e3a79edd6430d8000000000000014de3bb40000000000000000000000000000040c7e8000000000000000000000000000aa940c55d206d3b25e0000000000000017000000000000000000"], 0x58) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 425.483021] binder: 12745:12751 ioctl 40046207 0 returned -16 [ 425.484064] binder: 12748:12752 transaction failed 29189/-3, size 24-8 line 3254 [ 425.489249] binder_alloc: 12745: binder_alloc_buf, no vma [ 425.511027] binder: 12748:12763 BC_INCREFS_DONE u0000000000000000 no match [ 425.518352] binder: 12745:12759 transaction failed 29189/-3, size 0-0 line 3254 [ 425.530740] binder: undelivered TRANSACTION_ERROR: 29189 [ 425.542741] binder: 12748:12752 Release 1 refcount change on invalid ref 1 ret -22 [ 425.546780] binder: undelivered TRANSACTION_ERROR: 29189 [ 425.559523] binder: undelivered TRANSACTION_ERROR: 29189 18:00:53 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000180)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L-', 0xfc}, 0x28, 0x1) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:53 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x101400, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x29ad, 0x7ff8000, 0x5, 0x554, 0x0, 0x10000, 0x4004, 0x2, 0x7ff, 0xf7e, 0x6, 0x9, 0x1ff, 0x7, 0x6, 0x1, 0x2, 0x0, 0x7ff, 0x1000000000, 0x4, 0xcd, 0xff, 0xdf80000000000000, 0x401, 0x401, 0xee7, 0x3, 0x7fff, 0x0, 0x8, 0xe, 0x0, 0x100000000, 0x6, 0x100, 0x0, 0x0, 0x0, @perf_config_ext={0x5, 0x2}, 0x9183, 0x4, 0x53a7dd38, 0x1, 0x0, 0x57ea3b62, 0xfffffffffffffffc}, 0x0, 0x5, r1, 0xb) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x0, 0xffffffffffffffff) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000240)=@md0='/dev/md0\x00', &(0x7f0000000280)='./file0\x00', &(0x7f0000000340)='ramfs\x00', 0xa82040, &(0x7f00000003c0)='\x11/\x00') setsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x4, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/policy\x00', 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000140)='cm9y\x88\xcc+\bn\x8f\xe0\a\xf5\xfa\xcd\x1aFI\xc9\x89\xff\x14\x9f?,\x9f;\xce\xfa\xac\xad\x10\x1c\xa6T\xd4\xdeY\xf4\xc8\xffn\xfbj\xfd.4\xbc\n\x9e3\x17\xec:*\xa1\x8f\xd7\xc6\xe6\x7f\x01\xb6lB\x80\xf5\xfe.A\xde[\x13\xb35\xaf\x9f\x9b\x93\x96\xeb\x82\xbb\xe5\xe9\xb1>@\x19{\xc5t\xb8R?\\\xec\xaa\xceL\x05\f\x00\x9cR\xea\xec\xa6\xbf\f\\\x80&\x1dI}\x1e\x82x\x14\xfe\x80[\x00\xf3>\xd8\xda$\xed\xd3#\x04\x02e\xd3-\xca6\t\a2\xa6&\xef$\xe8\x1cd\x01/\td_uW\xd6\xf9\x8b\xdc\xbc\x98\xa3\xba\xa4r\x95\xe7P\x00\xef\xbdb\xf1f7\x7f\xd6\x17)Oe\xac\xa6``_\x8f\xea\x9a/\xffi\x8a\xcd\xa2\f\xe4k+;\x80\a\x95.\xd9\xb0\x12\xd7', 0x0, 0x0) ioctl$TCSETA(r2, 0x5406, &(0x7f0000000440)={0x147ec00000000, 0x5, 0x8, 0x7fffffff, 0x14, 0xac, 0x80000001, 0x800, 0x2, 0x8}) 18:00:53 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) iopl(0x9) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/arp\x00') ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f0000000100)=""/101) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:53 executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000000c0), &(0x7f0000000100)=0x4) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0xfffffffffffffffd) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x20000, 0x0) write$P9_RRENAME(r2, &(0x7f0000000040)={0x7, 0x15, 0x2}, 0x7) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_mtu(r2, 0x0, 0xa, &(0x7f0000000140), &(0x7f0000000180)=0x4) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:53 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:53 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000140)=0xc9, 0x4) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x8202, 0x0) ioctl$TUNSETSTEERINGEBPF(r1, 0x800454e0, &(0x7f00000011c0)=r1) ioctl$EVIOCGBITKEY(r1, 0x80404521, &(0x7f0000000080)=""/40) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000600)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@multicast1}}, &(0x7f0000000700)=0xe8) r3 = getgid() r4 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000740)='/proc/self/net/pfkey\x00', 0x581, 0x0) getresuid(&(0x7f0000000780)=0x0, &(0x7f00000007c0), &(0x7f0000000800)) getgroups(0xa, &(0x7f0000000840)=[0x0, 0x0, 0xffffffffffffffff, 0xee00, 0x0, 0x0, 0xee00, 0xee00, 0xee00, 0x0]) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000880)={{{@in6=@ipv4={[], [], @remote}, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@remote}}, &(0x7f0000001200)=0xe8) fstat(r1, &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KDGKBSENT(r4, 0x4b48, &(0x7f0000001180)={0x5, 0x6, 0x7}) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000d80)={{{@in=@dev, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000e80)=0xe8) write$UHID_SET_REPORT_REPLY(r4, &(0x7f0000001140)=ANY=[@ANYBLOB="160000"], 0x15) getgroups(0xa, &(0x7f0000000ec0)=[0xee00, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xee00, 0xee01, 0xee01, 0xee00, 0xee01, 0x0]) stat(&(0x7f0000000f00)='./file0\x00', &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000fc0)='./file0\x00', &(0x7f0000001000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r1, &(0x7f00000010c0)=[{&(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000580)=[{&(0x7f0000000240)="d65ac621f07b404c37edde85545a69ef1c89ba9a0e9e6065d16f18f43a8d403997fb71308a9c59cdf705828e57a8fccfb8913c1d9347232472a1c6846046b85d0235f02443cc46c6a8284c26f4334b9236b789db97f522b43583d6e915262b4ab790cc1a838abfa6eb354bd40f94a5a4a39e83af853804e668595f864525af67ea34c8a139eaa623b82650ec3ddc4d75aa26a7ed65380f24f70d01a84a9cb163381656", 0xa3}, {&(0x7f0000000300)="1b5566b632fab4832f144ddc65e54c8d92fadb7ea5bc0fa3b2f4da41c9f46507fde71406a206b833b7bda14ed916da607ef6", 0x32}, {&(0x7f0000000340)="b332e7128d849baec6706319a1f980499e391eeb10d0a724c791f7a8ab1812dfd150bee8b625b3aa25bcc54973fd1dfc0809bebe4a8007560d29c4d9c84350c89190ff67febde8cb6858bd3689059bb6a72619f5741365bb376a9d807e3a8a2954a7d10020002f412f3e45d78c82a4bb7b8fdc2992795e59c738fe06413e6ba8a4c2cf541e62527799abb040aaafac1a3e537dc4986b6e056712f17c7fdd9766905cd9073bb74e8e9e7076df7ad676f7791ad063c1ca6701", 0xb8}, {&(0x7f0000000400)="89b6f1a10d79e8", 0x7}, {&(0x7f0000000440)="0db418fb7e6577bdde08c2b50a8ad75039a01ed8e17347", 0x17}, {&(0x7f0000000480)="a1e3970bc98e44f2d9d1af38d387153011c193e24db89f57347b55ac0e1743ddcb8e9c3fb826f71b3baf59e8e1046a59e56cb708789d78d8fb9a36b1070ef130fb4eedb7498504a8feeef77178f295907afb8ff5f821e9d6fbd2e77ee3093a2d388efd0d119a66826e3b3e477817b7318b188d20013297f4e5664c9b3436ac683447179562623171054d0bca5db980254a8c40e012baa47aafcc58aa694d78b59ff5547980", 0xa5}, {&(0x7f0000000540)="804943794a3d2f1cf1fcfe2bbf70a81dec85370b15121ac8a154cb93b75c94dc9f8f046bbe73846025be3959a8c0ccf36b22e6949b521b9cfa58bfd22e66f6bb", 0x40}], 0x7, &(0x7f0000000a40)=ANY=[@ANYBLOB="20000000000000000100000002000000", @ANYRES32=r0, @ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r1, @ANYBLOB="0000000030000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r4, @ANYRES32=r1, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r0, @ANYRES32=r5, @ANYRES32=r6, @ANYBLOB="0000000020000000000000000100000001000000", @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32=r1, @ANYBLOB="20000000000000000100000002000000", @ANYRES32=r0, @ANYRES32=r7, @ANYRES32=r8, @ANYBLOB="00bb0000"], 0xc8, 0x800}, {&(0x7f0000000b40)=@abs={0x0, 0x0, 0x4e21}, 0x6e, &(0x7f0000000d40)=[{&(0x7f0000000bc0)="0e1d418e8df7ad81fc662a7c58748645436e951baed070c86ec108cac150130a2d84eaf9feaeb4cd8f3979a9f00e23aa67bd201ef6d6188935e964a8c55083c44236b30c9d87e18ad00052d75a46303b60324bc95a5af34555a0cf40fde66ccd93df21f8c9bd9bd7897f7867bbbb6613d6e92ef4b1d8eed0284b03159feecb2475eeb1c1684b0db1eb3c01c217659a87065f26ebe2d4210cb9e0b8a551d2a654da1473c5136508c3bc", 0xa9}, {&(0x7f0000000c80)="8a3c3b3d834f11818582fddf6cebfa89", 0x10}, {&(0x7f0000000cc0)="210ee8fca9d4db6ad0307adcc3cf24eff3317cc0a90bdcdb9cc6783d255fc9e0f107d1742e5eb244f526b089aadb", 0x2e}, {&(0x7f0000000d00)="07bda60b06465b858f4349800e692187ea75ab5894a302bbb6c5ad2b83757e8cf08734f9bf19103ba1fe98c2703edad2", 0x30}], 0x4, &(0x7f0000001080)=[@cred={0x20, 0x1, 0x2, r0, r9, r10}, @cred={0x20, 0x1, 0x2, r0, r11, r12}], 0x40, 0x40}], 0x2, 0x20000000) ioctl$BLKRRPART(r1, 0x125f, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) sigaltstack(&(0x7f0000fff000/0x1000)=nil, &(0x7f0000000000)) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ioctl$sock_inet_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000180)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:53 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:53 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f00000004c0)=ANY=[@ANYBLOB="72617700000000000000000000000000000900000003000000180300004802000000000000000000000000000000000000480200004802000048020000480200004802000003000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="474aca182d04a4fbb88a205fd353829a00000000000000000000ffff7f000001ff000000000000ffffffffffff0000ffffffffffffffffffffffff00ff0000ff6e7230000000000000000000000000006e723000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000000000dd0040000000000000000000000000000000f00018010000000000000000000000000000000000000000000000002800736574000000000000000000000000000000000000000000000000000001040003000000000028004d41524b00000000000000000000000000000000000000000000000000020500000054640000ff02000000000000000000000000000100000000000000000000000000000000ff000000000000ffffffffff00000000ffffff0000000000ff000000000000007665746831000000000000000000000067726574617030000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000003b0003070200000000000000000000000000000010013001000000000000000000000000000000000000000000000000480068626800000000000000000000000000000000000000000000000000000009000000040103000004070009000800080006000600080009000100090008001800ff7f1a09010020005452414345000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x378) mkdir(&(0x7f0000000480)='./file0\x00', 0x0) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='sysfs\x00*\x86OK\xc0\v\xce\x1b\xdb cr\x13\xb1\xe8\x94\xd1 q_\x9d\xc1\x12[\x04,r&\xeb\x016\xd9bN\xa1\xd23t\xa6`\xfeZ\xc1sr/\xd3g\xad\"\xe8U0%\xa2\xe8\xbe\v\xc5QCy\xafr\x13\xd3+\x8d]\x06\xdc\x8f\xbf,\x84\x9e\xd9\xcd\xef\xc7K\x03\xdf\xa9\xcbZ\x90\xb2\x8bK$\xd7\x86,=f\xfc\xa51g\xd5BB5CZ=\xbbv\xbc}0xffffffffffffffff}) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000340)) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x3, 0x0) ioctl$TIOCGWINSZ(r2, 0x5413, 0x0) readahead(r0, 0x80, 0x8000000000) fstat(0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x0, 0x0, 0xb}, 0x1c) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) [ 426.282129] binder: release 12822:12827 transaction 619 out, still active [ 426.311162] binder: BINDER_SET_CONTEXT_MGR already set 18:00:54 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:54 executing program 0: socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x2f, &(0x7f00000000c0)=0x102, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000200)={0x3f, 0x1f, 0xba8, 0xfff, 0xffffffffffff0000}) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000180)=0x1, 0x4) sendto$inet6(r1, 0x0, 0x0, 0xfffffeff7ffffffe, &(0x7f0000000240)={0xa, 0x4e21, 0x0, @rand_addr="ddd1140a888c98bd1342f55b529f3b02"}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) get_thread_area(&(0x7f0000000280)={0x9, 0x20001000, 0x2000, 0x3, 0x1, 0x7, 0x5, 0x1, 0x1ab3bd3c, 0x3}) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000000)=0x81) [ 426.343146] binder: send failed reply for transaction 619, target dead [ 426.351855] binder: 12807:12838 ioctl 40046207 0 returned -16 [ 426.364920] binder: release 12807:12811 transaction 626 out, still active 18:00:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x20800, 0x0) [ 426.403938] binder: undelivered TRANSACTION_COMPLETE [ 426.412467] binder: BINDER_SET_CONTEXT_MGR already set [ 426.426583] binder: 12852:12857 ioctl 40046207 0 returned -16 [ 426.433490] binder: undelivered TRANSACTION_ERROR: 29189 [ 426.442708] binder: send failed reply for transaction 623 to 12839:12844 18:00:54 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x802, 0x0) [ 426.454047] binder: 12852:12857 transaction failed 29189/-22, size 24-8 line 3117 [ 426.474067] binder_alloc: 12862: binder_alloc_buf, no vma [ 426.491204] binder: send failed reply for transaction 626, target dead 18:00:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) gettid() getpgid(0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000180)=0x0) syz_open_procfs(r3, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:54 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x1a000, 0x166) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000040)=""/98) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) select(0x40, &(0x7f0000000140)={0x3f, 0x8de, 0x8, 0x8, 0x1, 0x15a, 0x0, 0xab8}, &(0x7f0000000180)={0x9, 0x7ff, 0x1, 0x421f, 0x0, 0xb394, 0xc051, 0xffffffffffffff81}, &(0x7f00000001c0)={0x3507, 0x1, 0x7fffffff, 0x5, 0x1f, 0x0, 0x7f, 0x1}, &(0x7f0000000240)={r2, r3/1000+10000}) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 426.499531] binder: 12862:12867 transaction failed 29189/-3, size 0-0 line 3254 [ 426.504572] binder: undelivered TRANSACTION_ERROR: 29189 [ 426.511112] binder: 12852:12870 ioctl c0306201 0 returned -14 [ 426.541595] binder: 12852:12857 Release 1 refcount change on invalid ref 1 ret -22 [ 426.545040] binder: BINDER_SET_CONTEXT_MGR already set 18:00:54 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) sendto$inet6(0xffffffffffffff9c, &(0x7f0000000200)="8551a4a4095e30cf0211b950d5a9ff026dc34e0e4188cfdd851474d106c6e2981776e883714c27387a3376127e0578efbe16fed41962b812cbd6268bff7047515fee268d0cfe62bfa0e1f06bd4df5d29034378819608d5cec4626c82bdc858a33f5822b109d0e08ac8a025f78b1879aa6e0cae63190c425d8459b6c36f1366b428f3ab9f2f747adc83dd3cb8dd7dbd3dc9a4caf3486c865e378678bc39caedf2fee37afbe01cb0f26bfcccc0cd5e5254c2afc652bd82b35208709e66ed9acb8c2533c546d50a5d8130cc7b8a2fc3d6a834af8354956f15ecf8d93cc3976dd34a0e77ec4c3fe2", 0xe6, 0x40, &(0x7f0000000180)={0xa, 0x4e23, 0x3, @empty, 0x80}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 426.580450] binder: 12862:12871 ioctl 40046207 0 returned -16 [ 426.590724] binder_alloc: 12862: binder_alloc_buf, no vma [ 426.601309] binder: 12862:12867 transaction failed 29189/-3, size 0-0 line 3254 [ 426.602031] binder: undelivered TRANSACTION_ERROR: 29189 [ 426.628532] binder: BINDER_SET_CONTEXT_MGR already set 18:00:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=""/247) 18:00:54 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000040)={{0xa, 0x4e21, 0x3, @mcast1, 0x4}, {0xa, 0x4e22, 0x7fff, @remote, 0x1}, 0x80, [0xffffffffffff7fff, 0x8, 0x9, 0x7, 0x80000000, 0x400, 0x8, 0x731322af]}, 0x5c) 18:00:54 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setsig(0x4203, r0, 0xff, &(0x7f0000000000)={0x9, 0x8, 0x3}) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000080)=r0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 426.661714] binder: 12887:12891 ioctl 40046207 0 returned -16 [ 426.661902] binder: undelivered TRANSACTION_ERROR: 29189 [ 426.680692] binder: 12887:12900 transaction failed 29189/-22, size 24-8 line 3117 [ 426.701469] binder_alloc: 12902: binder_alloc_buf, no vma [ 426.722272] binder: 12887:12891 ioctl c0306201 0 returned -14 [ 426.735172] binder: 12887:12891 Release 1 refcount change on invalid ref 1 ret -22 [ 426.743231] binder: 12902:12903 transaction failed 29189/-3, size 0-0 line 3254 18:00:54 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) rename(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='./file0\x00') setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) read(r1, &(0x7f0000000240)=""/33, 0x21) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f00000002c0)=0x7fb, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) gettid() ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000100)) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000280)=0x0) syz_open_procfs(r3, 0x0) 18:00:54 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x18) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r1 = socket(0x11, 0x806, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001a80)={0x0, 0x0}, &(0x7f0000001ac0)=0xc) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001b00)={0x0, 0x0, 0x0}, &(0x7f0000001b40)=0xc) stat(&(0x7f0000001b80)='./file0\x00', &(0x7f0000001bc0)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getegid() getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000001c40)={0x0, 0x0}, &(0x7f0000001c80)=0xc) lstat(&(0x7f0000001cc0)='./file0\x00', &(0x7f0000001d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000001d80)={0x0, 0xffffffffffffff01, 0xcd, 0x2, 0x1a, 0xffffffffffffff9c, 0x401}, 0x2c) r9 = openat$full(0xffffffffffffff9c, &(0x7f0000001dc0)='/dev/full\x00', 0x100, 0x0) r10 = open(&(0x7f0000001e00)='./file0\x00', 0x0, 0x100) r11 = openat$urandom(0xffffffffffffff9c, &(0x7f0000001e40)='/dev/urandom\x00', 0x80000, 0x0) r12 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001e80)='/dev/ptmx\x00', 0xc00, 0x0) r13 = openat$null(0xffffffffffffff9c, &(0x7f0000001ec0)='/dev/null\x00', 0x402, 0x0) r14 = accept4$inet6(0xffffffffffffff9c, &(0x7f0000001f00)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000001f40)=0x1c, 0x80000) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000001fc0)={r0, 0xffffffffffffffff, 0x0, 0xa, &(0x7f0000001f80)='!:em0ppp0\x00'}, 0x30) socketpair(0x3, 0xa, 0x6, &(0x7f0000002000)={0xffffffffffffffff}) r17 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000002040)='/dev/loop-control\x00', 0x40, 0x0) r18 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000002080)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r19 = perf_event_open$cgroup(&(0x7f0000002100)={0x1, 0x70, 0x6, 0x5, 0x100000000, 0x8, 0x0, 0x8, 0x40800, 0x1, 0x5, 0x10001, 0x40, 0x3f, 0x2ee60000000, 0xf2, 0x5, 0x8, 0x2, 0x401, 0x0, 0x0, 0xe62f, 0x401, 0x464, 0x4, 0x5, 0x3, 0x80, 0x9, 0x55b, 0x7, 0x6, 0x40, 0x4, 0x1, 0x2, 0x1, 0x0, 0x4, 0x0, @perf_bp={&(0x7f00000020c0), 0x2}, 0x2, 0x6, 0x31, 0x7, 0xfffffffffffffffd, 0x8, 0x20}, 0xffffffffffffff9c, 0x5, 0xffffffffffffffff, 0x8) r20 = syz_open_procfs(r0, &(0x7f0000002180)='autogroup\x00') r21 = accept4$inet6(0xffffffffffffff9c, &(0x7f00000021c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000002200)=0x1c, 0x800) r22 = syz_open_dev$sndtimer(&(0x7f0000002240)='/dev/snd/timer\x00', 0x0, 0x8000) r23 = socket$inet_tcp(0x2, 0x1, 0x0) r24 = openat$random(0xffffffffffffff9c, &(0x7f0000002280)='/dev/urandom\x00', 0x20080, 0x0) r25 = socket$inet6_udp(0xa, 0x2, 0x0) r26 = socket$netlink(0x10, 0x3, 0x13) r27 = accept4$unix(0xffffffffffffffff, 0x0, &(0x7f00000022c0), 0x80800) lstat(&(0x7f0000002300)='./file0\x00', &(0x7f0000002340)={0x0, 0x0, 0x0, 0x0, 0x0}) r29 = getegid() stat(&(0x7f00000023c0)='\x00', &(0x7f0000002400)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffff9c, &(0x7f0000002480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r32 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000002500)='/selinux/context\x00', 0x2, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000027c0)={{{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@initdev}}, &(0x7f00000028c0)=0xe8) lstat(&(0x7f0000002900)='./file0\x00', &(0x7f0000002940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r35 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000004a80)={&(0x7f00000029c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x98, 0xb0, 0x3f, {"cc5ae610633c6d9979ae6ef4acd2af28796ae4c04157311213ee2dec7bdbcfafaca1f5b30e3b02989107a7548d64b934fe2fec428a8e98055b68c7150ab1182f492716d3366921a8fde3479809ebfead3c0de1786dd705edb52884db29eae7905723bfc782b58e45168133410765949f127bd6b68cba475786b6c98bb4c82bafa7ad07ae9c7c6bd4e8c9e973a99b1c2eeddd2a3fa06cad"}}, {0x0, "5f8ad69377acfb5558105b0f8fe4e822b408b1a16a344e7a171b5aa789a6a164808a08959274b19c82b4337801d6ea2b17fbf3b21320e5ff4ed3eb148f794a51f130ae522513f36729be52694ab336998b9a5bca04173b4d7956f3abc938829e0d8a49d617c2aa0829dca7d9001a06ca695109cf74a7a325612e90f843f47f46951e0d35683c33c1d8ae31c5a37ae2705f945df5c53e01647d74d71f231ea471e98c2b4966ec8ae046ab4f0c6e78241bd9fbacf351d7e575f38992381e25f19e0cb50b923a5b1efba93a8a461f3a4707b1dd05034cb9c25637151aa9170e1338daaa0de94dfd9428a12ac62d2f2d05ca360ef58bcfa9d4e8d08f3a6fe7cea11930891e0517151e7c443649ec7041e740c4cb9fa1413fa770fc3a4dec73d43d32dc939f57e074c77f63d0c3f9a9cc82b0af5de16ff19d8e7ae6d3574c094571054fa3e9a155436177d7a3c68583a8c1ae08483c4c070d264457b0a91b0d7fb9839086934073774e54b8017ebebf7ddbcf05a0cc67521dc9490c6b0f5870ec7cc4b9a273bb140c086e7067056963c2909d95feff4e1fe5f7b84d09066ec3a69da0f158ce9751f332a833d732735a8f4cbf408bc6e7ad52ae8b57c3c75a858b20167bc31887ede8a3405b04eccea5b79ea00d0061dd4163d588df697ce177314d35359e59e1d2fb65644bea2355abafa01ae02f3872a382fcc315e3b554c534886e914c18a7a4fff2fbfea4c5a49090cb8461c9930a04c5512c5ebca320f25ef710c5a0f48a88d297ca2fc3bc037bb9ebbe661e9b05eb80874356195d7e400153387a3a12aa9aa1443b82946fd4b7dd2e3beec34d84be83303fa217433332557b2138dedbb4f803627e55b2bf3800f6a16d8b4227fe74c1f1666f13a8076461e25b590d355edc04b94bfe3fe3112f5a1793bfac5586dcfa0b56425b7b94e3ae1382ce43502561124c21779f735122f93f293b4c22d2ae8d40acfe2682fcacdc2e594a8a62ddaa575bd867ff9dc7748b558a6784938c2f900d056eebfc2fc325fe33be1b36c91a7524ad37102f1f5b5aa1acc993931e1fd360e2d8230a4773502189a70b789e5e2e62426e64f024cde950616a3d3f6a7e8974e68491dde4c9812fd8396c5bcd6623c0fb67e802c25a3a66a8edcba341444b29cee04a6cd3118ff2c6697408e8027fa8296e1c478cab46cb89476fc5e1546f8915cbbc0357a358f75ec50dc9649adc007475eb04b4751a9640ecd8801df3a0735eb9a29e330c3e287e012b9908733c415437320c52d4e71191b93b7c26fc6b7fa01e568bec56a05f6637a84eaaca3d72e3fa09e1ff3da55c1ccb0a9058328856a3d120bb81d0db7dd0afcf8d9549fde1f9ad7ce5427a87ac34f916f2b5fa73a1684377580db3f14f0f2dda40a79837ff7d6c73555ff254c29331be6956af122e71b73e7ff3c6f9fa9305982ae511527b93ba0a9764d6c01062156df225f10db9ba0535be75afeeffcb2482c52c5222c9d0ea7160829c67213cd99b4a9d313baca065e4c979f3a86f9c4647ac753da9af74b9049f1882b1a9d2f5a1e6ac6aff42bd0d23710cc133b45dd560166ae1476a88ba916094e76edc59275817ce29eb095e30190cf6136c2a5ce0e16208f08a6aa32275a61aecf8fc8e9d9c308588fb80976e94b14c5327208bcccbe617c840a701348e2b43ca84dc4e2a842d0c2efa7c14fb3d3c1355b9c694fba6be895b9407ab559158bc7771490912d7ce01573b64510c55844aa35ce306422e75cfbab4bfa0a727888768ca850fbc82611ca1a48d41d9e808380e06d790d681e3cb68fb33a5112a90a2ec062336e0276ad97352fe7aba3d074341051a5aec784a9d7d4ce521b9a3fd330105786750b70ef4bd602838bce6a123a79a9ae0570f64641355e8e4b1940425d39555392fda65cc499d8c8897c34b1369a43b51dd6e4044dacd41b122fe473ff611941f9b15ca95f3552def1997752a16164716c683267df1eae7714632db67317a1518278322a65419584bed8e49b7a9dfbe6602a58433043024eeb4b5215c931fb067fb92ad3a87515673be38e5ce9bc2e3a15cf3e9c7e92e6ff10000f2b12debf9b36c7bc3b229cff3c04ef4c465fa9ff04a34acdf413e99909b8418a85831b5ee9d41bf55713a3954ddf73314df28c831bdb70a2d2c591488884abae845de6a22a29b67d91554bf9f05c6ccab607d6ad6d2056dbdb4d7554babf69f7f81cbed391470df2d45111fb4299911b0b1255115a642915fa72bbdde95ab114693786a2dcc9ec165137641c79f223187ca1ece295ad25abf771ec53146932f2821d4790651bed0943151948747e6e074f72df6ddb9a160411cb8bd261861791a1191385320b1102057b89d8b4c5510accf0fa1165b5fd4f95f50038d114f8da7cc6953b1b307e851ef3247ee321125c2e38f487d86c711fc8e81f2da11041fcdcc3c781b0bf974c213b3f28d9f0a0df6061d5848da94ce83b33c94721536f40fb15df62e8de76531673dbe31fe303565fb805140ba6828d61db2e23a896b2276de6304175c42e5175c26d62884c587ce3dffa4fe1d495af035aa5b6bf4961e8822d2c773e9a9d36f15f03ba658017be923deaff37b43e6aee7fad0c05c502299197caa60d129a4ad014cb9ffb77db44a559a50fb044d818dce0faae7d8c9b2d374d0410509813d3432ca1d3feb839a736927eed3f3c9096e117e36b541eae41475fda65e2e70b054ff7de0f6e2ff029dc2ac2c18ab2f167533aca1813ce05935806464da4636c5a043fddd8c25d59aa11070a5a48f22482c2cbc74f910305964b8f52367189b91a7f0e4afe1f3a87949e3e3838fe18e1ff2b3fd9a64d4d2e674288033706f5db775d8cd95df60a47facb8901b5c30326c98369862ade5b45191f91b31b83b4d16625d6f0955f8c150f012a146a673502bad008b95c72984b839fc29f8576b980d0d19049d1cb9e95a8482c2c211a7958915aeae80d72a71a9d31bd8cc4c353a9857e9214eaeb78f6401c1e1ae6818dc56d00715d5414a7265fa28bfbdf3976c2796e18daeafada5741351dfa7140a763ff20b8816c8368b031b3e56600244d2f74f7f3133604f539b953ac7124ca1bfd05880bc5b75a1f34695162cdaf8b66c952aec757441a46e6824534f8dbeada1f53dbe092e231f54fdbc758976f6635fb6797ec044bbdff1a45192afd2dd0878ddae5fae0ac7436cc38bdb1b37a440f2af76ab5089e6b9e47fb584c9978fd0435716c5dc5aa72eee4b4c160c42cf6419845bcb7e8694bf0a7635204198b7804d49a5e44f491a59188e1d2d8bbc519fe7123f61f31835d2367bbe575471d2ec3a1cc149ae77b352aef80ce279f050f90dc7f0526ce07f075fd7a5546d1987b55d11b60acc5bd719d9064365c6f80aaafef4b2f7dd3e5907d141a3f9ccbeda3cf25c5c413cf8a346cc2e97e5185290bedee654e2472e6ecab17526faee49dc452a81df494ff18fb071ecb411e427e475456dd1a539bc13f3563e9b306628de4638fa6339965d4d0a5641ddf495549740ead52807dc4819a7bac766e3635d6abf6ccec7f8b47585a6c4051a4e380d014db9cddc2b40a4edc6450a85370734e2d35667e3234cd2c5c71319001ae9a3dec595e39b14a268807dc98f5bbcbcb1d1f1ac46b1183f7796c5196f2f2a44a8b05311f43a8a93313dc2d3617101b11a9ee0bfdac53dfb57ec08b9aba33f8ac5e030a3aff48edf8dd857d25bb19dfed6218365a5fd89b41ac53359f0d0c0852655d4cbbf6f26132254996ac919e4ac6c6c5ad5abf43d8da568ddc00a3dccf22429734aff7661de59b28da051b159a82afa2647f39403631e58df738590fec63a7e16de826b0098fea81f1573ae96bf4c40c1cc1675e67a7b06865950665aed59bf4b6ecedbf0e8460af27f6a92bc9baa5f0e7fdce1b01da57fa4aad606bd4466a13cb7bb4df92b15c5d942593fe16185aec11d124d9987b546e00cdb20b21100ea4f68805358988d763330376d4fa8a75180bbd3a2a442c687d57a8604e533b21431a826c4715cfb5787696a01defd21b12930bf53e9955b74aa855e3c8d38555a908f368516c6e211d1876f306cd619962488ba75d1e987bcc6a31e72bedfce3b3b07c1717b0f49d9cfaa8e1111583da6a21e71a4bf6f2d7c6d2788f7a4a1fe0c546d150ce856c3789f597f61923dc51063900b4824d991ac6186ad332a4af82307ed384601e3e226b7b619d9fe174eefdb28958d385c7017822659d9748fcaf73eb57f0d5325d483d7c7fc4a3319c896b1a7cb0f18e98c8cd7201750ab0f2b683df4d4be29df8b6f3119d1d0f40720abccbe96059deabac536c5f76b240945fbf42eefb787559aa99c1fa70b87daf0472249ccbaeab6e598cd750e2c03a340e83b55e4da7eed5b6e419ce16968429d7281ff6f1e79e7e2a11b8d84b839ecfe6f6bf60deb938d8222bab40b9644c11a28b1f8725ad1e88baa25eb888a1910b5de2c0723ce183969048555fedb2e6fb1c0e881b8d9b0f3a60ef23ed9b856ba0990b79759fb38f1adf04fce9989a8bf40decb2e3352084043cb314afcbeec581ef5b313859928b1b1e97fbd374a32016c7b89adebc1fb1ba9167fa887d95f246c22bb9b98bba05ab109824b3f3e85e1fb25cde9a9bd9af88db143e205c93c57423be0b01e2dee719c192d28d171f8d50952b03188d82148376be3b6aacf962f85378a4f2a969d9b93d9dbaa748d2b714907c70aa4d531025b2003ed8502f8e09a3bb6f124bda331c1d7183708cbc7ad024e68173795f7236c001918a39eaecee4da293c4d69498eacbbe474cd661abe9bbf8d7d43a67249d4632e95d5bda845ac6a91324bcbf25f5fbfda5d58d733c1613599ffaac710dfc13e7e0b5ae40ee184e3680f452a36ac4a2d785c3fb8b5776b32c177ea429093665776ae0b27c2fd1ad16d02b34918ea511453a17a689505ee427e6d895683af6d788c9e2ff62a003ca7834b1e67d144f578c00db998329dca0f412c3f572bced61e310b43e4df83ed4f92e2f692135d712c0ac24497060168a6ccebf94206801efe9fda5cfcbbf1f9113fe9788abc046eef22fc90a8e7e41e61601fdc62f20db315ff3483e81df56887bc4618f7fb068533e80037b81bc0774be381013ca62fbd98f82f87b3daf31640423cd6617483939d1aeae898a6ce7ab199c042ea530454e381dbdff16f5fba8fee7c34cafc0cf37182d6a05c98998ccfb35eed3681d7f82c35e9895c7b73a99c8b7dd929b46c4d03db6075c226ab5305e3d82dbf11194e65bbfc1579a5b4e7d728ce627ecf12b5200b814550e9dd26cbc9e05c8532a4957700db2b94794ae31b4aa13ca18fecb3f3cd8b795e66dbc125283c24cf5a7752e7b799c60f533b2d82a69b277749d8be26edca94eba32061b87dc534fed25629a377078130f025f71cba528521f4b7699dbbd7258ffe276d83be2bab73a5651aed98a9d5f0cd5407dafdf8da7cbda41735613f7208c9181b35716603b3f088b8c916edc973105efc57fc01aef0ae4348ebc1caa08089e445c771cb15f8a9acef7654c5b97fc72c060400c356df86e7de2f8df5680b63b967819a925266cd582df65e07d9993d32d543c0d81b906742af10633db4510a7dc111b4c312d14c216d671b7eff23910b867d423041774dbdd432da88633038407374546c74d5c8a475e4b5e13fed959547b8fe14ab4ee4916370d458b25e55da807d1af4694c80512b32fe286f883feabf29346e665b7ba4a5ca44f7527c87bf6deefa"}}, &(0x7f0000003a80)=""/4096, 0x10b2, 0x1000, 0x1}, 0x20) r36 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000004ac0)='/proc/self/attr/fscreate\x00', 0x2, 0x0) r37 = geteuid() lstat(&(0x7f0000004b00)='./file0\x00', &(0x7f0000004b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000004bc0)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@loopback}}, &(0x7f0000004cc0)=0xe8) fstat(0xffffffffffffff9c, &(0x7f0000004d00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r41 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000006280)='cgroup.threads\x00', 0x2, 0x0) r42 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f00000062c0)='cgroup.procs\x00', 0x2, 0x0) r43 = socket$inet_udplite(0x2, 0x2, 0x88) r44 = openat$uinput(0xffffffffffffff9c, &(0x7f0000006300)='/dev/uinput\x00', 0x0, 0x0) fstat(0xffffffffffffff9c, &(0x7f0000006340)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f00000063c0), &(0x7f0000006400)=0x0, &(0x7f0000006440)) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000006480)={0x0, 0x0}, &(0x7f00000064c0)=0xc) stat(&(0x7f00000067c0)='./file0\x00', &(0x7f0000006540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r49 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000065c0)='/dev/loop-control\x00', 0x80000, 0x0) sendmmsg$unix(r1, &(0x7f0000006680)=[{&(0x7f0000000000)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000012c0)=[{&(0x7f0000000140)="9d1d3690821af0df8676702fc40dd280e0651fa47d45fdb1c2f50bd903e489bb1a28fac3f1610c9de6f839fbe9f6e377452093ca600a497d7af1f9db786d2bc8b3c41228a15427be5208ae3f41aae2cfac10db6676e6597eae113f134d0c0d81905587ab15407aa1e89c94df827fa50548d8540b1eb419626ae110a8cd25759dc9f0341b0d50dd271b8490679ea9251a2f2337c287678ecd39995aba896889831b46f4f800896479dd9b55a9a82c093ca9d9232fd659c52e225a2ab706a8f66d619621e939d8291cf9e94948eaa68adc41eebb199e0ce14f12cfe3819f51d42405c67a739514841e2c82632601e9d342b1f5d5fb6450075f3612dd9cd62a26e119187abf575fb509762a94199516911f802ebc91b1a57cddbe9a6f32c54fc51ad16465b65251047470865361fe31f29823600b7bb5ec4f0ba12ca3e298d77d6fa41c7435f22f206e6e4e9e82bcaa91f1f8f11f91a6b773d746b73d701cdec27c1f377ed26ee27b5b5021005fbdda0dbca0385cd6063347ce5cdd3c3c547249a9843de9d432ae8aee48c2092d5867a4ab44570286d91d9f1dd68b963f235640d58fccac08e2eb94462591024b990852b2927bbe73fff347cfe0d43be226c1720614528684552a2a3252c230c61948362a5b7d9f30308eb4ef7c75156686206b43ed1a798ef813655b0dde50942c64c9bb7ab3f1fea3df9a94713b8706a65050c29ad578fa653e3e0b0665e0e27742823c5e219d769ae7a00776bf51a50af8bcc0eec6599f1e0eada1cddcf1cbef33bfe75b637e04e7c562113076060cc812f60b7fceaf323d4470578088a138a8d03bb049d5024357912d4a413f581fb1037a2f0f2f81a2ab9796fa4db6e7027eee5fa3e13fdbfc186b943e505bfa0443469528e59bfb4e3712d02ec795d9253337e98ec9180849de7b2b05e0419d829b833057705680a3db00dcf22684cbd7e90625ede56a3222ee3b6a435764a45058a68ae2081a26d3b37994306c75b3bd61cbc7bbde695da5396e8d9414636bfeeb8ee5ff1a9098ad810eb6cf730dddb310ac3a9a6624dc01f586e19ff46799dafcb6e7e5016eacf1870859772fc6e43032b08dfa9cbe054e532a6d6165311ce78a6db0e4d27f0bd64fc30499f1c0083c4c94d5fdaeaae0f7acff5dbf71b15d911cc457c4add6d714186ce38e94939d08f69b55a70055c9138245a3a76a5e247762cfb255c9c39459a30c9aa374d558ee354223fb5eccc0334728745495bde8ac514409300746f52e4d1de004c5a3bdf83636dfb888f016b03b871e715a6b7871fdb1a68dab3e4dfa78ffe99a537ec45a2d2d7528498fe8265a4fd822aa64f5e7b6ab834524643da1056a97ba6458c4622a65632a1b65f02d06fb48f10da8b20730ab744bf9c73e8f53c35dd5571e91c3658f3a29561c1671cb212c8c5a094c010a5082ca67132cbfec8acd0630f7b333e24e687a60bfe1abe5cfd73a4b6ba80bf2a5b6a24c22425a797d5dc02396f7362fc0980c6172b03b6503b3810f06278e5db8d8c2182838d80b115b6b9ec24589f5e67fd1789ed47af4b30054c91b9a4358465def7c794f2e52c150aa0d4b409bbae40b1076663a2f4143141163c67b62e6f20212c2b76cde41f5ca41318689d7df112b6494864bdcf3b02e107acbb0850b2c415e87382254f5abde9ef9fca321413861ef62ad82a48ca6492ad9ac9d755ea85c8557ca3294bef14a26d8916674d6154e64840060560c99a8e7165f5c08a8c08d48c616b3283fd6291087e6cee53e1a3a3e6302111c0b7fc83d17f4a02d4795e6aa80d6c0f272a713521125e13507303e67349a361bfb56cd246bd5470bda6d3171948793952579ff43afff290ad6b961950ca9c87bc9061271238e94e2c515c0b39cfa20314a1bd2268eecba373b97533ee6f42a2d5fecb14fd3389d423fddcb813f24905c824d2a301bae4ccdf4e641f9ad82c8a359bf23b5db2a32cb096bc9de90823d89f346dd05d16b03c7f6bbefb1bca2af18dd9fb43cf38f18a59c37d6d83b6b9b6448d73fc3a417d3a62160d442b3504ba599985349fd1e7405f0f38d2bb3f70725b0274abe00329ad3b881a3bb5117fd79bc3246dfe4c03eb7b8df4556ab7a2eae74ec9d6e8bd358923e88791638ddc6eeb05e48847bff58cb97e5a7e57cb0fd891cf4191cbbdc4fce5abcbe2f3a69fd1a414bcabeb6060c98e08b7562cc723b3b859211317d2f3771703d984cd685b499906e6b0dec610759b54b055a5d4a391c3e26dc6a8fb452f972ff3f17cfb36cec5376a82d30daedc588bd61ba5213b416b82cf3e147866b7f90a8582c4121d0752b5a88769cc3ba3e72ab888d1cf0dc4121b77f464cd360628ca1772a5141bea28ca6c7ec0bf9fa6080ce7e08daf47aba2a390a53fe38180e8c1c084e770fe68f17492c08de3f5b2cec7e5050bb037f9e67ea4360943db92eeafb040491ed264869c538ad857b9480c5bb936572bdf53f6e867477666d981ec9e444d9ddf756225ea3fd183a3b5864bf80e6004e5b31bc9a8ffd41801e219904f8d50a93ff558930651ff3c85951ad76b74115fa6cfdbc0b8b71a24f1d7ae3ad2feffa632dc948d52e792791d938e032fe865e6289aef470ba7ff2f4bb474673ef89695c6f67449c0764f45e30e1998f58aabfed90a5de9466c8b9521210f5f5c6259655892eaf6d85505fb78e9145edc219edb4d4b6f6ef2a9e3776c5ce90f8d3409537e56ba6483328a2d5e0b526784c551325717308be5fcd56d8c63036f8d30d64fd0422d9a7db89dd8c9b7a58ec589d4872086b69dc427a47b72b0c4f132e78fed283a7d95d8a9f1f8bc708c399b3da9586cf76198e46ca0a1988438b3cb56c500821d6d3de23c267067e1335559fbd7f45785b9ff99e66a22f0ee17ac593c29a509a00ca55edd8fa60f424118d922388019a2406b07a241f25622d0a2f1a72922df8e6b9ee516b56638ed533c2f3859b7591db3d35739c04fae96c7668ab14be3b29785f53b83efaf24c87de2b1bd5061a5af98339b52320d0aefe3b554d88e429ebaae72a5e247fbf5faaf0806b29f10990c5b3417eb6cd8fee000283850fef73696e47655b388b997d1f83dcfd2e9edf7102aacd249db85627d92726b76324c6915ec67e668cfd31c68bb8f45a8d6078b11bda069bbdd063f71b0b014484de6a437d96c364b8160b71697efa9cbb95eeafc5c890ddd0ebf2ec2a946511de2bd7447203bf5633d60314e9c35ababd474482dc000de877c1a01f8d9f515eed348e2b0773e925a645e18b3bcef915e47e9ed03868b4984e6c371a230e0d9297b57528e28ecbe928a99bbae2f2c5c27fe5502337554063c9d1c3fcac9e1806cd6392ccb33ae0328bd63f534d2cf74fab631a6ce512ee50fabe1913e58cd7002668056fe329e958a9eb7a225b75f39763825126a7b6739b00749c3a42582070668c1fd2d99ae2baa648a7c7cf320009e37279225ede02e44e2c46e0c3937366668b0e46b59eb13119fce938c06980d07751b56c70f22d471fdf1041bc807f19f1e3e9a660895f57fa745ff43d08ce1b3239b221396dc1629c2edcd90261523b31f37b5a560dfcb97fa5cca712a2e1ba24039d4a4c30638dac0b9c334be196681fba4b675c83dc96c6035c1b7879f8eea7603cfa94e3b5636d5e70edda4efc7214b70245a996f254b7d93340ddbdc2e7271d85ec4170d495f34232de461ea83212870726f6167902cbcf50d731023dd58512dbee6badd846d5bae420cd12bfbae9fcfd1b373a00c64b5ab33d25731efb8828022a7594a30d78cf4ea72c8b8f662a907b38e09607def26402726e054ca60bdb1efb0f0e0d7fbfa031143e37de15c81f9bf181b19740df4178cebfefaf486c80e507c9ef54d552e9abe87416b608b5a03d5f539a5052c6df3fbb323deba80bfa74af5aa10716258a635ff6c08edd0ba5a220699fc9f9ed35acfb5cdf5f80da10647d0423329a72d6cda6cf385944dfeb94fb11cb96ef8bded228ec3f3c24c8976b6742621f9a6629fb782679be7dcc12a3ba9157486e7a78d0da6cd5eab7070366c70d3a73c340a9c55ed542cea013ff62f7ef01c7076cf7561ba1a0d96579570ae32703fef0c46beedd7682612a09133ee26155d37f8cb64620eec628a43888cc3683ecd34f338375d64c3205b5b1fe50e4b8417dccb713893099f14d0e4b7ab3b28d20fad0b0b560af10860b1a099ea7d235f0409856fef47f4135868978e28c81046f0192fff8545e5a96f0d5b072f0c930b348fdc1cc0b075d67ad1a8b07c7e415c73651c66319821353ad51352acd4d493d5cae5ecc513292f7c9724f84c700ff6b8317263416708fcf45c50ce857191cb6554b975b0e8d0f5009d096945704ed3e12b5cf9b208fa86c592d07b23eccf0a1b91a0fc51e3981f494f0b67f33dd2852bae59d5652d33bbf111caa835dbdd509f3f2690c51d800b6fdf2a4b049af27528e7313082ba1fd3809f820c5bf6667049ac5f4208666566e70088b460ed2c617b940defca4216eea383d5b3bcd76cc75408a2967c352930f1a2dd336ea92558dd7710ee9f2cf4f4124609652a1aac80623c5a0008c91b14d5b902ce48c12800e3716533b1fc19200f0708576fdc3bc04364dedb33679d2789279fdb29d655ed4c0c0cc0f733892eccdd7aa063fa77b1da528b5c9d5888760f9b92c5425dc5b57bc1b4e90e1906a700c9191eb7649b196ab62589f02d55f3e18b246f1ef2109708ba735424383a3c658be71d3f3ab9e3e91d9950f5652cc941564287b61996ef8b8dea4722515fa0fd1a09658a09d7cf14ca71a4a52afb29b40eb2d0e0162e008a365c936b2201059fbdcde38ac5b7abd421952e63017e0395cd1908c2c01c9879e00eff099ade015eb3d1b2e019f2a0e8633b9afd611f659a24040c203dab03f398134eec5999562af2d2c362dda931c9543686404937029a79eb8a136c8aec7f7e7318fde0313137865a46bc6ee68538ec3cc9a5b0e88baa528f851ac80af905469d0628983acd82e43774e9756a7dca077d456400d2ae0fb19525eb9ccc875ee55de1579e60e937a0358d4265bcc9cf0121a420f22c6f0f985741d6c7ab9b329ab5badfd5c6b5013c82536ba1fd4516d4d744149a1ea51e0e3c538b80972d48f583caf926aa57ae64a8ff5c9abd6caa617abf6a5b70dc48121245e589f08000973db30bae17ff8614cd384281d1836543bc1d8c4c2711a2a9171353d9a9a8c7312b57275d9843a676484ce581da283a1adc60d291aa27505a2bd4f0c29f1e4f3238a0b8212d007754dc39e7fd9e4a332a28d85c7c54f925553dd76e5552d2290a94c930602cc7921c86377079ecc488ceb08b8f63572841b03acb23d8d0621936dbf71bbc9f9c0f80064c6c878f6f01a7dd193b41d92c605017962e0ede47e4dae60c725904f4e40926bf30882d3eb3b8e566aa72b336a23a7e7e4e7a66a04b2444d3904a223b6617ffb71e0297fef00165e9227cfd5fec9117bc29c18f395123a5ce779db8db8298aea04e0332718fd4521123719ca9f33139fb5d2250393e5f4a88d860f281a56130c9ba70a36b4626212de051a2097aaa73dc3a6328da4de8a7d055b6788c9d89b6465e1dbd82b6509220bc4416d999f8fe0e668c6155b624520eb23232a74159bfa5dec891b3e8c0e6edcba35ae10f3a35cc50060e18809fcd940a6d71f4a6f338c8ad26013703be2907cabe73b284bb1549078d1256a497cdba266d64a5ec23732ad52689c8c544d1c9682b2229b0138c267", 0x1000}, {&(0x7f0000001140)="2f714e6c962d4a8042f33238a73c740a7ac1b612655b96b9f6ecf933a2bcb749cad36d1e346ebb3eacd0c812aed34ffaf9c77fdea8478c5cc8df59d1a7f190b9d459d178e815d4a70341415f121843f5930ce7909df4a3bb89d17be9a3d1a8a9156edb5a9bf946ac45a28ce7c5119ec2f3a5ff37b8af4d00229fca30791660be5f60be0f0f3a716a345fcfdef8e37a83fbf152cbc6a646b968ad9ed41c6e54b06883a2b8b4766abc54e42e84a9913f90bb730e3cc5a331e7", 0xb8}, {&(0x7f0000000080)="f953fdf58924b1673e28be392d0f5cc72885e2189636c3cbd49d0217f249dce069c9246ced8782f05506562f21a38dcf80acae1b55c7180f8905", 0x3a}, {&(0x7f0000001200)="4f007f863fd6444d8fb0df589fa953ba98e9c5d74240851cead2ffd4335c7cdcd596d1a91dfd69969b230d4a1968270fdabf50703b418800d6b6dc261469e1405aaf7c7b503bd9708d6687f0", 0x4c}, {&(0x7f0000001280)="4c54c9431f9920e881d4512a652d06a89aad05bba34000fcc142426daeb62d44f1fc1b3d6ef125a494e5a4c44602c62cb0d0ec8a71ce6c7ba27437f2393b5ad3", 0x40}], 0x5, &(0x7f0000001340), 0x0, 0x4000}, {&(0x7f0000001380)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000001a00)=[{&(0x7f0000001400)="0f95354e3944a234fee2f398a3b450966cadada5b5efce400aef6783e456cf95d276b01b9bc3d4cc4b3dbfa1d5a15e34a9ec86c4464443dfd1d7b69a8aceb770bd74c041d030058be1cae541454aa5fd985390a5fc1a47c4c9c0326db6e873c377b70c38fbad28e77c61ebfbdd72c8f282d99e1ebb13d45763ad3b458ad7a2220e25e7ac3f7a0b7bc74c08225c7c7e10dad27eb48af500a44f5a8c13e1e90c66f34952917e8cebb4400291e129cdb8d765c5db831d734b94dc4d8d8baac011d817f223bdc0927786ea8ee03e63dfb40a7683f854d3094c", 0xd7}, {&(0x7f0000001500)="f64fdf2aa96f6e6852c2f9b4bd04d88199fe38441d66756af4169b80c7b79ce2ba73422da25c6aa990eea7650b8714b175a5edaabe066b1c7cc6eb2ee75ebdcf5ddc3b745cf9abda890840ae367b85ac7c4f48f5f591887776e8d34b10d4eeea07ef1aec011c9409aa96d381b6ad1330a795936e493a6baec68c087776bef48e68b95db49e56651cf6485972840418adefb7174827047feac549fd9fde0f94129ce44fdb6751163441dd467a4d0166c07563ca6cf03958d1f1bb494292fdc5a32c71ec81e86b975dc3d3bae0252147dd2a0dc08f05622d0b59dc963b9537", 0xde}, {&(0x7f0000001600)="17200011056715a43322c7c6052dc51264ceeb462dc3eaf1f7f01d0e545c80608a5b60494aa59a91426e3b305bc1fa2f678a21b3a945244479d76396fd5e88fd144e741d8ef4dbf1e5b00dc1140b6526da0c62152330bbd3f51cae0da5351a6c18e5eda78049ad8a2a7c1973d95bd90dccce6018f1de4f9fcf0a07dbe64c7236ed1d", 0x82}, {&(0x7f00000016c0)="06c06aaf242d1f143590844301bd8251db0ac8facdb39126e2590b3910a44559d0a1fd00d0aaab74a1e7260c6dae4a0a0313c2ab3827b38ef38030d30ee6ddf97a3005610cd26b294d53b37285ad0f113d9df887228a591ed81d5bff3282dcadae1912c1ec4fcd73c8abe472bc917e81be2702bfed02a5eee27a4ae0f533537c193a44558abf231299ee3c608ae9f294de05336047f61e2a", 0x98}, {&(0x7f0000001780)="9d3c710d5453aa963172fc", 0xb}, {&(0x7f00000017c0)="64a2bc06d970241c234f1b386edf80b64d0d10509788a7f398b6c205c217d600f06a27e2064b8353cf5e0f58fba19e6299f1d19b1e3a2d15547994879435f7341558d0f899f71e0342025d33c8ffaeb75128edf778cf875931129884c80bb468e5706f313b1be603fad70530ece4bbf6f003c670a319ecfa6bf9705fd83ba5d757fef8e4cfabb0754c67e92fb8096944fec46280caa7f5e58d1b035a6ea3393b70", 0xa1}, {&(0x7f0000001880)="04776571f118d8ad1da65a145543ce5e87caa41be833cc08d8386c4f80b3ee6e7bbc485c75a51a39620ec202316442265be7e49db4705b327106bd9cd13161281d37d266df8441f468cfb72436d38b3bf23a09c920e37ada94f885eb28cdd6092caa66264466e07404f95e79cdd68f3def450881dff609fc5e90265de05bcda055f9b6b34c754dfe9bfa1b1783078b27f40cb399f70381d61f01cf6475febfbce14cfe17074b6ab195e89178949fb43042e49db9948570986424c1a8e7b8b30eab2115ac9daae9fc", 0xc8}, {&(0x7f0000001980)="3d65fabfe34fc910c1f4e08712f200f0201dcb102986c64aa8ce61161e6d7e70c0446fe4e58b4ff45d0077e402a291654352cb93c399bb8645845c260a3655efab725ded2e399d7d26dba13c05cc31dcea9898448be1d8a5aee4e201809aff1ac55ab9c393b3d58de95a", 0x6a}], 0x8, &(0x7f0000002540)=[@cred={0x20, 0x1, 0x2, r0, r2, r3}, @cred={0x20, 0x1, 0x2, r0, r4, r5}, @cred={0x20, 0x1, 0x2, r0, r6, r7}, @rights={0x20, 0x1, 0x1, [r8, r9, r10, r11]}, @rights={0x28, 0x1, 0x1, [r12, r13, r14, r15, r16, r17]}, @rights={0x20, 0x1, 0x1, [r18, r19, r20]}, @rights={0x30, 0x1, 0x1, [r21, r22, r23, r24, r25, r26, r27]}, @cred={0x20, 0x1, 0x2, r0, r28, r29}, @cred={0x20, 0x1, 0x2, r0, r30, r31}, @rights={0x18, 0x1, 0x1, [r32]}], 0x150}, {&(0x7f00000026c0)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000002780)=[{&(0x7f0000002740)="cb13b3a24d6692411e7b05069f034133b196eb62bdef3921b2449860cb4a05d7d96b7f9c1e4e68e1", 0x28}], 0x1, &(0x7f0000004d80)=[@cred={0x20, 0x1, 0x2, r0, r33, r34}, @rights={0x18, 0x1, 0x1, [r35, r36]}, @cred={0x20, 0x1, 0x2, r0, r37, r38}, @cred={0x20, 0x1, 0x2, r0, r39, r40}], 0x78}, {&(0x7f0000004e00)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f0000005180)=[{&(0x7f0000004e80)="1767f8171161b4c38b5b85d0757905c843f644b470cc41e8c61ec75b7283f585b0e955d1fc179b1172e56ea163e68d6623dd2649ed39fcdd6311de8500cc4123c8b2894d6c538b16f696c0f45ab47eb8c4c214c2bf25dba83febf18f4520be034e8a248755dfbf87510317a5f20bbc1f3d841b947ba2a0560dba7ad28ff2d062f1893670e2bb15f8bb563dd7872265fa16eb4b2d26ddbe99595eb52dd1ff770bfbf41d1eb8ce54069274ea9634", 0xad}, {&(0x7f0000004f40)="01622d7874c90a60c75a70f7306f9696bc5c10adcac1cf3bb61948db340f89baaf17b641f17e9b6b586f86e86119fab116c6e438f58456fd81b549342b5160f62ef3abedf40a829574c1619543bb1a0ae42db599de09bab013d590c672ed6fe6734c66ca6e3a052bca0c8b76f56c95bf1bc918396cda69fcbfebadc583df06b3b15b5dfa36160433bb48d63bf56bc08b5efe5ae3ed046f5e1dd51aa89e1b01b289cc", 0xa2}, {&(0x7f0000005000)="241ca204c009d153560c7bba73b2c30508109d73e06b7a738ae82fce6382cd334456134d0b82ded1f80fbce29464a17b59d12e4b75c5de8cf7746af443f004c810b2730094ef7a095c6526d2327cb270d6ed21d60eafbfab92112bce0ec56a3f25356f8591977ba1ba1132d242d97b3549fbe4e92a8aa937a4e3ea023132d85140a5851df507de717bc887cf5b659bd355ee70c40bcedcc3e29714a68012658921b65425f13d891eea7a9465944e279299d5c78dc63ee954b1aa149bc1e5c0480e3e8ea8052d798363bc2a1782994feed9b7491e3a", 0xd5}, {&(0x7f0000005100)="5ce11f02c3d2e99c9cd1a5e88d3b3d0052d0d59044d7149514f10085fd5063d358b5c7c8ae04a477b04cb0034027a65f06c9191a82e377db8ae8a7fd8a907f4a581f4f71ff28238f46f1d6bb3a3cddfe6910981923", 0x55}], 0x4, 0x0, 0x0, 0x40008c0}, {&(0x7f00000051c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e, &(0x7f0000006240)=[{&(0x7f0000005240)="1a3c1d7e905d575426a80ac088492f881529e8e7f43bd74b7e2d0dc79df4e069965fb6f3951a4afead87739d368a875dd94fb7eed7541dd69f089e64fd1a9b0706d47439a21494663860db5acc8e00d676de731a888c7891ee48ce7a399fdb3aed9208c39ecb34de2848c91087711d0e8c7bf6920dc3f09cfa9c21fdbe6e58eb486771ab6fb081184af4a8f1e161880d1e6c41cec48acd8a4510b9a42385db4f0ef8e5e6fcc86df29a525a31c1668e6048fec83c31cc1f18aa65c2e793941fed6399f47d48e2ae3260608693079a93cfed3d66804d52b1e0b6b2b4890085ebdf173a19893994fef943b0c26900bfbd051cc2f3761e6c96e9021111cff6a25286eabe31f3edcc564ad6540a5ad19ae1ab80a40983f7668273f72a681492dca03b03d09d9babfa44e8e9f20d7842117fc89964c339c0c85fa112fa92f57c0883971abce31b8f53aeee04ea7e634289110f72fb18643d6a2446da38f4cbd5d6ea65fc4910efcdf96265b3c4567e39e532ec66bca0ce2eddf1694daeda608c282b2e415fbed00d420deb80e4c6aca7f5133cd54b98a384c0f0279d67e9afcf52dc5094edc7a76998dfbcfa0a1b8780e6677263b478f74c86e92447c04397bbe05109f5ae931763c365f4df372c00d0e846c902fe5bda3d90f0ecc00965b30c8afd50f904bfffd03c2b692ad4ecd74b55e2ccff19feeb72d531cf9f2b3efda600118edaad06cb8bb48187ea880e6233cafb074db26c3598657ca3fbd995320030a1aac59a26ecfad3f06a1bf5b5f893dd34bf8b74cfc5bf3a4135bea42c4956417a9061b388f9b8a597b56a0cb63fdc4167e2cab4c5c26d6bcce62344147a29ec572b4c8f79a9c195bf4aeee4f97d15045eff8fe430052ba545e193c08cf4721a4fc84c1caf35e979dc9ef0c14b11eb1486057ef84e96252a18acf41f48c3c643fd1a1149843ab71827298879c1b63dcf28532f08085034e22ace04c88455275b2154056c7816c38064126d10d1ca09d9efde85ec40a0da536060900135ea6f29d38f3074a9ca8abfa83be068fb461494981bbd3bd3848a9dc67179e3780f5c26a4f1c4e400fab4e0c8cc21f95d006435615a8da2e93897aacd2bedac70a2f752b85ea14230b4184797dd03816d9ccc94ff8ee72b1b743eacb4a71cd07fb57e7ebc4bfaa4fe0959bd3484e6800d2c0913469752552aa7654f8f9ac67cdbace12ec751a0fca8b28ec4b5a33b2e9fe6140a98d7d05513710f4309b77557f88c5ab54061d02c80dbff6f8d2ed4a039cf05f2e3e92d0f5570fe481aee9983b6c7196eaba0c16214dde9d3191d9772828a4dd8536f1529aec2a5dc5e01627c44978c2835249c40f7d5499648de925b46be3a59488711a53aa7f4b4eab2c047715ef33508303d43bc4ee3e83fe04457addce08265a9dac8172e8b7be646a2ca18ca99f1e52c0984e33d1d695ac07b956bf9f6c49907a63cdc4d819d040f8d659119e1b53e560821ba4cfbfd9fac621aac418a3e1bba5cfd1c6e45093357e769347927cae5f993a72bebb06a16de7b09a8ca0a614abc65f89070df8b8cd3b0257eb42d1ba120445921b65ce6d77923d5de0e76dc3515040d3241170a67b07cd0619f17b5b55e72f7420d4400ad25ac2a508b698e75ccd6a0f13f1640a44cd200ea90107f82449cb6090e1595fe84fa4fc292088050765486248249b5ba3d62acecac77a4049fff8fd26f5865264de65bfa5a9ceb28c409cc45227b8e78db9f1f4fb9d8892294a4c1db2320d053db730b585c72793a86288cdae179fc9433008c1b741fde9d76f35e03cf46b2a46ec06481569ac144153511d4171f47375f89ffea935517199e731e539fcde6af711f5e309bf2d093c34249c295a05b5d2fae98051c6a5ecd4b2e06c8a72dee4414c0e2af490ebfe6a235662cb58976dc90c2f41805f1af520fa066f34450a758aecd0e25e2ea8e752ec32e91b9612912c5259378d6612f3ad75735c24a88aee86b32ea6d2e3417449d8a8d6b81baf9a7c9f52be0cf0926da6f70d4a94bfd4bc58bcde02df4a45617d59ac75e6e5ea42fc400d6fca3c1d0d2f172fd38b246fe58f56c019201b60f7cd4f51200e2b2611c9ca5dfe7540fdc4df8f18aa8459208bc4c7cd8ee54abbc724fa4f931d96c3abfed5e2ad271ca1d19fbe83c6ac3b492192ca58316684c724db2a0a121a8aba5b407eb05fb0e7ed0e6e0552ce71eae6725cabad0bd25ed9d9f2a43aec64753b89970b890bc23d0fa00d107fe97a57ddf3ca1865b74e59fd008a714463453231435e6dfd8ad483bf4ecef2718a34a1fe33757252eed0fc98ab7f84b7cb375e255b6e5145f28079728e57e4f7d7a8db600d675dfd2d402157ce996d474a30753bc06cfd4676394f81910d745b5781becd1d723d29df5eb3054e24068014588d7891f76b04b955b0f46775b2fbb7dba55351d529adfe57380f7e5d7fea43e50bdaeafd5c6cda1a9b76c6deecb372045e35f87c8c7f56b51e384a92398e2c9bf8637558f4d6669ffd42e010f05ad08466e6abfba3c21bddbf21a936e820cbeb3796ed07cd8922f8d0d50124d417310790dd2f39b62e65f98f9a795f0ad9b4f62ac2743c4e9098996ae0f3143eb1fd1e618a7930c7b11ed2e9d0a81295de1df11a111123d2ea2d094c33c46fb0617157b06c883f54b602f480a7f092101fc30c3915743c05710c14227e2282a179f1b815b92c6d64344fa1ad72bec27c812121be8142f840de4ee3f61e2c8189d9c1cd1f697d0c6b284b07154dfbc463e726b0292c8619a17eba3e79a836382a65b4595302f38ec85d62d7fea85743b8ac075dee467fa43e612b546a2bace3d0cc0eec6fea519e2bf33fbd5c0fb09f77c37b9da3e8b297cf4a8c57577bdf319f8422ec60b4cc222707b5b0d56eb049bd6631c66eb9e2fbf9039c57eacc40c056bbabe05b1d2643c7d6a94e69d8925075f4255c3db2a6f987a4a3b6e75479f867a56e1e26b6974bf9dd85e3552215fd53d1cf83d21d794f2374e82b74cb7066966c7a594a3bb3eb8c0450b1c0711efe69c27c0c020bbcf6efa476fae18f1605f4ee81ade2ab721fd901535aedfc60c6cd9dde76f3af4027f670068ca15d8fcf32660b790fa25b6b6e082ca8d0f698add5ed2f03fe52b7eb09f5fcdec6540cee35fe2bc8ae5c91f87c805fa6c71517cafff5ad028ebe6144c4cadddc5a8cf03c4b8054d2bdebbdcd915ba15cbc38c51a3b1b0c842820475ed4923c8f4eed1d34eadf552a5ac15aefc1aea93f5c959fd5b1b3dca05502ac2726d05d76a53cd473357531e719b08f1ca9f76ad4576919c0aaaa90a7cb361a82a091e144b520b78f13f7f87392262f3368ee69b1ef31e6b386944166719c0f8c22607d7326353306583456367a8e092d114f52974d2df258876247a1e037337164aefd3186d195e315aada1ce931357325559df6855aee10efa9e4bc7066e7c0b071aabe4be1109f88baac4ff17ce017e90542e06d596015ad5067159a10c62e459b0178dca556491f4734df7086921ca11cfa8d76c6f62d0df8fa54ee1298a77988a48214e997c944e1bdb2cbab1bd579146c8b4f095f7ccd6cb2036400e3feabe03f977ad8ba4ee3fce81bfd953cb2872fa951cd3ab1712c018f7e56d0db0c6e7bed12d792ddca4b761d3fa34891748489b85c1efc808d1f4cc3102d8964bd7dc55bc4fff44cea8cb98700922cd43685e05f3d5475b03f428f85ac5c44cdfe7de535b12dce638637a970b21b4dbe2683d81142e1e68ef06c89fac4e05d7a0230bd974d539dee59143352a2cf067b0b581dfd570a29221be73af707cf802acd17d90c854b0f5345b64dc80b6307a2d1ae4654ffe061de7471583e8e6d7abc038cc130c7bbddcff67217a9b1414e0c5222964cd1e9fb93c01b9b5346db2d7d81b11807dc1c8ccceb1b9f96ed00502261b8cce3927e85b065572368b1520bd302458fa11dd8ced881e2c8e5b1a5bf6c4206c889109e0386802c0300d67eb58046b873fe6fb5da28e76f47da2ddae8d9478cbe22a437ef5dcdbfe8889bee148d563f525602e90f38dc1d641f80fbeb5706192f2207fdb50e7805994daf30e97bb8d8b26fae2a61aaab0e97b9e06db7348fad27249246cda4253a1459c5b4b764e506e14eb68fb669b465ae7104857f7a13f99b81eea67d5e98f3b4eb1dd8e9992bad3952a277b1a83603efae993deec393ab818afbb731b2d9ea07b439a77293c5421bc98b25136826a8c79eb90c76a7dd52df688de5ae265768c9c989e884cf61012fc7c3a38fdeb96af5a83c881090a2d75f1e9d26faadbc94f04c1743e820e2d3537b2f739f15491003636a2e3223bc1798700e7748e475d249de7fd27bedb1dd183165c5e45c95d760e2715d00c22153a3016526ac0736d069acb840639052d02130479ddfb892bf6dab544709fa067a9bdda50c387bf648df777381dfe9f2e648c69cd0b7f3f274eda53b447dabf2d872043ce8dbe2c6bc9e0600c148b3a2fb8a49fc252487efab4743fd0e462be96ebf4d6db3004388f128beae9dea3cf7e9455071d2f367eb428ab57d3aad201f0bfc76b71837e0fab5998c0addfbed4178d132b8ca2ab7ea835ab9cf8755a927ad636eab61a403d4b0939c7f068678d88aea1ccc1bd3f73a8abb6c98906390177efe86d1ecd59bb5e461fd67cca2ddb87be3d4699c7a40640a5d0bbf1ee6c9cf2938435b91520396915e81d0e4da45a08d48502bdc474f569d7bfb2fcddece104819ea2b5169b478212ab7cdaeda9273495b7f1df1f38712c67746bd0872c5491fb3b3becd4e350fb6181f0d601a1c3f861bb9b673e4ba5ecf3e911d32ee21e0cb7f6954a05738200575c423e0d4b45476c6e1ba0711c3521e86cbd0e9aa9040512e2e71eb82e247d833e332118bac6b4bc4c2266cebec60fd10a9ba89f4f046170b4d5e36e16b7d749029e666b655f8c16baaa118b2e2ff826f89f9c2127b8a689d7389866e4ff1fedd107e76fc4aa018fc19ee61cb68798331a821fe80aa72640cc8c3397a6cfaff65c94572298f3d50d190fe93951bafa592fb3b5690368939f6ef8b9b4f542a6bbe96a321b2bc1beae2b3687f0988ac6e30079e478cb7988fe5c645ca029ea8205705e3b48d4fcf401fed9dab30132f6dc9673fde3f7d69c257e8a6089fa02c13028e8a953955a89c9ae3375de297550329724d4f83c623d7f61a20ff685a9ca89dae739920a00f090cd53f48fcfd1f80e7f72134b2f60807882c08560e4893bbbb3f0c3489fd60619165bc419425a1a573882a3c0b9217071979de5ee8e2353064943b9a63e7d69eeda82e063ae3e05b29db7e5402b92e7ac598838d0b899f8d98704b4275b57704b299a8ae0e5dfb3942da2ec4a2e5a96f5659dcfeb554599241d0361c2b7883b7b48eabb6a155bf75a4e303f292388b39d788b936848fc14921add92743d1bf6a7cbfa9a65339d775157e1e08cada597f599e151c82de394ffabf1e14c0553282aca1e219c14d19538cffa64744a4becdc6e1da6346f5f7816b3133d2bbf7e95d96c1751048f3aa791ec19d716f088ed0dfe67489617938a394fa57278534536c3811e6683ebee81893cd7c425730e828e3283698fd651e3a38a5960bc7264f5386962e0bed210f0b0268477f09c30d142550230a7693ebc9c470e844584b1832b0dffdb31947a163d171c729cc54b355f84248853e5af9662f4dcc4318672ff55c8faf95506d9826596969f5d2c616953324752b9046262f2c74ebba610e217e217cc6c8eb16417", 0x1000}], 0x1, &(0x7f0000006600)=ANY=[@ANYBLOB="20000000000000000100000001210000", @ANYRES32=r41, @ANYRES32=r42, @ANYRES32=r43, @ANYRES32=r44, @ANYBLOB="20000000000000000100000002000000", @ANYRES32=r0, @ANYRES32=r45, @ANYRES32=r46, @ANYBLOB="0000000020000000000000000100000002000000", @ANYRES32=r0, @ANYRES32=r47, @ANYRES32=r48, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r49, @ANYBLOB='\x00\x00\x00\x00'], 0x78, 0x4}], 0x5, 0x4000) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:54 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x23, &(0x7f00000000c0)=0x81, 0x1ed) sendmmsg(r0, &(0x7f000000d8c0), 0x6a9, 0x0) dup2(r2, r1) r3 = request_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f0000000100)={'syz', 0x2}, &(0x7f0000000140)='ppp0]vboxnet1}\xd0*eth0md5sumvboxnet0em0}eth1##\x00', 0xfffffffffffffffb) r4 = add_key$user(&(0x7f0000001740)='user\x00', &(0x7f0000001780)={'syz', 0x1}, &(0x7f00000017c0)="f2947c8374d133e95b3a", 0xa, 0xfffffffffffffffb) keyctl$instantiate_iov(0x14, r3, &(0x7f0000001680)=[{&(0x7f0000000180)="2ee81b2cb32d4d1b6f2d55bd16e4a5c5e66fe4de3e00d3fa856c0c16f4b270b0ca70ec44de7b8475b30a039b6c90db9b11ff60a668d1ea5553", 0x39}, {&(0x7f00000001c0)="7f53ece055cd5447e78d448a1084e16949b1f03235114adeb9082bef70c531c1425b3f1919e839dc5889699f1ed605a9f06a7a39c3a3a5b4d861e0d8fbb33ee07fc91263311f72c668fe060b98e97c6537812f", 0x53}, {&(0x7f0000000240)="b0d880977500aff99b", 0x9}, {&(0x7f0000000280)="2b89eb5291b14311540d6206e713e8003a86977ab20258df7b0675f8233721136a2072bf3dd429430c034d961de4e0cbb9cc9f775428a20f06f19969b936631ddec30879b3dbbe8716d8378fd8e09193d6aaf43d48b05caaaa1d63e1b285f10db1b9ed0a5d557ae82c3521dfd3a62cd950f2f9f793342886b4bbca71891f85b207f99f3e8a", 0x85}, {&(0x7f0000000340)="3931d032a0258394594899024471fa4809c276c8dfb33005fd44954571592fc7a9763a0b89c5156aba7a6b5f675de611961440cec9c959d82ba1caae185fda6c8154dc4723d21b6cc87cfe70bf6eaa6602bc893e27eeba5d52ebd668e80226a6c7fa072bc3c7ccef9c6b641f786b201e3bb0eba545849c6cb25d43df4d1bafc733b05eb35e67fa2d43afb1a3cf1016a1c6ee3fe0ee4120d4fa42", 0x9a}, {&(0x7f0000000400)="e8d55eee057f01a0cd26552d4641fbf5c016f479bad29efc1ebfaa2c70e73be33a4be277b5c1cdb63abef04fa7335aea72ae317619eb53ca5afd37c977933fd09d61712c17ac8ed96397642f6c2d21c6bd2604461135213bebc3b9ea3a3f733954566bcb61566cb783ac66551cdfe50f68fcca8fc46ea51a711bd07b70e626ae7a5c6f1c1537195f347702316727e5a939c24992ae7298855e1379a3e863878b1b8b342c0541958ce0aeff9e1111ae8d575fad6707c0e85d17858c1d93edeab49ee92edcb5c78cda937f95f863eb360f50d310fb1a8a417e431ab9d0f238b96660f965a84b34cd0f8f358d9ee76f8dbe0624dab7a3759074a0c339465d98ea7f27997f41e4c54589dfac9b0ebee631bf7a4ab536e9b9bde21f9638b95e65b4c25ebf1c0011a44e03349fef969d79981464d1c1e227af5c1a30c0ea793afac50b2d84023fd920d367b25a37be61f14542297ddd77a110d0c6fa770285a22b6bf6f001330793a753061cb77c8689b1949bdb635d5c64cb0fa31aa08a295e9693c1cdf012a2c6534686ac05f17a70ad2ed60a25068d80f6e99e514129bc1f72843b2322ee7fb48e453eb138636c9de0f7bcb4a23ff0f677cbb51193b5f93d4f9c8416f199de3739600ee0abdfd4b696315caee7f2f1527ea7400a987cda8ea95d8f3e187d863526130794aed5343c51a0174d719079e91afe966967602e689687ec9873a52f93eb99638f0d8cb644cd58592a8d9b3bca23ec34443cff86e427cf33e52011af3d157d84ae0f33a41e7ede20e27cfaccecb7ead2a0a1514dd97cc7b4c32b047241da0ec4155d03992bddc9d622cf4bf17fba0f158787557a4a6d932e17876be3f7a3b09dec50a449c79e212b0de57aedd931a472c5c6e3ed6ec595cfe7bedb121e328149610bf0315db980066fff672c8e1a1da083e4cf690daf7ecc387c511d3a0ecf4c36b57095e941384161286800b5d6ca31016b229eac10194c131f6da146632e4e6178e9d2d9235f0481e0805e4ddd54d229b1274fbadc44abb81e0308286bdddbb70dcae4017453975288ab2cf8cdab721b0d52be98c4ddbba2829d95bb7ea6df44680672401723df4c45daadf07c49b0e81b2a1fa32f82f7425969510257fd7fb3d93563711a372007f61c2c3a7f93c19f67e025ddd7e53e1a47254601bac679082d3f39bc673aced89ee2a8e7d14eaf874ea46132155cf06fa1112fb6c444efc2229514617b2c0e78ccbe559cb485d034250a03ae7b6080ea2ae68c922835d911b45d806706d9faa0a8a003c27a4db2094b842a2b22c5ae8b723e404d6281d0fbbba2305b53f1a74916f4f32d0ad5cac3383a13c155372942942ffba709dce6e87ef1ac4f41acf5b0707cd26c560648efeca148686de42df5948347b2936300d71a2c97fce9b34fd1beab83fe110a2e1ce0caea5686af76b940075fbb3e0c5daa7e7aef9f8f80915de272940c8634b873fa6244c2dc9c39d0e52412e7518a2a5bc8f0e1b5d58c30de354abccfa997081830b3c30cceaa7538857d52524e87276f759c1c777dee33afaac00e60005030e0695ca8cf4453d2417ecd76948035debc1305e92e8b6f867e0bdddc53a2f9882cc1a9793c30ae122f8a7cfb6a1a3933df68c928828d9c42fce4f7d2447cfbd57a630237fd2ebb9d25a51ae2ddd03f620f0de5af07f4f9e77ed664bdfa5c7709585136ec9eef81092fb5f9eb96dea8c21a688101b1e380440ebd82092d4c7ba2adcc6b5f71e51093b38b839a05eea06753df1dff02e874532c5cc11261cf34e7e4a6833a477ab6ebcb23dce692ce5e40e48d76b32b8ec8109e2141bc3685700ec8cd1d2700b9db93b1cb83b9f73bd596305dcc3b6721e01e1a514471ef3b23b3dc8217abbdfa81444fe13e7327ac844f16e314b5376065fcfde3b2761ffec0a235c13434e0553991b54d407b8d07e09599e7db9cbff223a0181c2bbef2dd311dfae733a918b082b2e0e75ce0335022ad6161241b947350b6094bb6b67bfedbd99bbf8ea6ff67cbb68a222bf88c0bf50302b99cbe9e38fd943b084e02b42b7fc6b1b36e18c564e568898f061b823e4b392ced669767cafdfad5ed0a96a01baedde7256c307d11636b6ef44a143162258c570a4dd3664bdfb13c548e451552a0aab3d8094822c797ffc66b9c0e74e3a030a286d7de8e3922ff02c01609f0689821791ea0380862b80ba5ce1de9c5126c598cba7a6c68acae8b042e9ef00ffd83c482d2a534a94b4ed6b39d98f605533bface081a1494704a5203fb653d8532dba130e0cd6a3be6d61f3d05436db52c5b6b21b0b1d3c361e6977328e14d02c1bf5490fb2b9e785c2cf3863c2f120f7c088de5eac8e87ea5e160e72aa32c89ca593bdd152431ea3ee9883b869d090402254a4e37db0624ee9a7b614b308bf9dd3bd66c5e616c02f20b3e12097ee283e90a3cdab69c9da334eb6374676b5abe7cc677fad567a2c816dd2d8551e974b0d94e8d46b14deebd1954605065c78e912d379fef59424a0122e8055656376c1654b5b0b79888113d1baf15d62a29976aebedf881d87375ce104251b4fbabace7992ab38afb20521b89a7c7c828d84a3540b41925f81aec52783f621787c9a3deaf65d7a49fd1a71d1d9f7b3274affac6393a1fa15243618f4b5c1676dfe1f80be373bf2fa694f9f904f775417ec279f2253a24383ed7b18d9ff59863f7e2d888d757f0b15c3792bf597b4645caae1f4d3230e410fd9686e3ffe93142269ecbd90e1a6f1ef1cb5c91503ae66cedfdbd07c5a55b0c836bbc5b5e7f50c8a1c7bd93da73d4bd48fb215f2592235b3ec771c0b40704240d60b54e26e6cb4ad1479fabe02928d81ff0fc1618cce7783b0865728bb2ea4dd4584d5589d0df827b5e549a86303a588c17e082feb6240da559eb98961b666426b04d76228439a5dc45abd5b62519e6e870da40cb0b173fbe924bc8967611d8f62c9d647ff416bc133c0aad5acd0c2472cb803731297bb7a5ccdff67e5a18b0aee8f36fb41c65e7cf8224de6669dda67931d19bb14a5ed68ce9d160a405ecded0de9d5bb10f9d445e67888b5e7fc6deb3ab405e3c2af9c601e7f1d60c9cd9c25790e0de0e2f2ee4ddc0b372892dfeed2a112bf62d52ed2ca76323feb4b04a50ec5c0743686f77ecaf5bb2e96230c60cbd572f1d42f6f379aaeec97e532f03cfe8e6737e8b1918608a51d7edc841edefedf6de5a3086cef6eefdd16a041b063efd50da3affa1086e16440d6898d6012229db7c3cf004312ab2075832d55d9d99baf91ad38d3dc82e8c87ddd5a2d3f61d00c354826285f8a0113703289c2e1fef4e8b38f11ef89069293242251723bcc226e4eab7b9df447c83a2ce37e4fabd6566bdcda3203680d2ee12e333ab2e11b038c0260e1ec9f38f1066ed0fcb5febb519eeffe2dd03ff5a8139d16a8b588fe8ff22fa260378d8c51ca99cc94078a5bff99ffdb99d9e418090a5c5a13be3417994ffadfd7d8a62a294d786edada9ce51308ca0765343c8cd0da06f077174dff0e4e5550b3addb0f6af284dd823876905e46ee4ce12da59ea5b8377a1d643e060077aa6cdf9d25ee20fa99f091dac51ea8673dadd4461c8f494bad6e084743af80a59e12a75e60ef66bd44cd20df4e2858de536dbbb40cdd2f1709a33a6a91ae594db584066b19807f6fd4892dca7f7047db6127a692dd0c9e7b0e2e351c5063fdf4aa251bd0571cb718ea5ced80170911a733a73879862bfdbd83c54671f534a7d4740cc594444262cd9aa794f1292386186364892586ed0d4bc3ca434e446d426f42fcbedf543beeccd0167e19c3086149c877a1b1a34eb022656f7974c9c178a79d62ee31956e74d6f9b44fc5394ef61876e621ae2713125b8b6ed568a4f4882022752c1b21a54b6de00130d5d53afcf8141071ad8220f5d37b4ac57ea661cb024cc21f90ba15bd14d59833eaf0638f0e758b5fc27b63ca3c21c28361c9a7cfbb1690830328d7058b8b88b90cec42654119c499aedd3bd511dbeaf02d400a0dcbd0378d1aeba77c1bbefed62aa7902cc085ae3597e122358cdeb10d4c996e4fb5b1142013823bfc7b81ae6ff5804048fba85a1f3c67388107ff63da5d923996c97af2b78b8c215c7330b12b104b80d43971ace0a2272d0ae09af4c4c452f93fcb50998ce8bf87f07d8e4d9d254d3945f5ee54ec37d5e6cf12ff2188b9d5f566bfe5440595f96b88ed05e3bf154b202d5581df76463ec44f930a347720e04ccaf87968d2c0d72819813c8814c4240693781e50455c00c9b8e88498b6b9d4552d2caa84580f29d3eb8fa01f424fca95fbbaddd6ac03a8c320097ef95677f299a379ee5d6405eca4a1429afc9d1056dca089c27bd4cf8ff9a10c7c0290070bfa80baa1cd7274ae382e59ff5e2366cd9e50ec18b15532b9915fa385cc531420a807d72d553b5b86121ccf7d709bd26b41c58d53956a3c92db8799d989e5a39500e5e71e5fa8801bdde5d5c510331885fb17fa3736b6c458bb4856167b1bbccea4de99bd7807fa32969cef69c8bf34449ad4a0e2f72c69f54df30e9bc359fd894b3df01afa3533549d0fa96feca1afc2f7acaa572dbd8bc1f7291cb25c55a449e2f491525763ba889181ea3aaf25905466552e6d029e59add473ed5b7fc669216665d664cd2f9997ef9698ff02a289c235aef5944c35fb5dea0650ef19841c11434d992dbc0841622daa19cdbebe9fb6e8a22a60100b9b190ef03ca160653214ef0cd2feee86f664db67911dbcd8753208e2a4db236b0495940b99a4c4dcc9c888909dbe28421f5866a6254bc9b75377afb68d628d27b6cf404e3e91f0e2557a2afcec1dd6988313a85713229296c1f60a51ffbbb7fe75cbe0ffc1b0b54d731283b6e821c451a26bd4d6f744fc95c35cfb656437f31ff91c68136ba0770558a2944085c5130abea5e1b984acfbb8da3dd236e64a3a36ac7be5a4ff0d3a3a43d969c127ad1ea949bd1e6a69cddd7ca1351e2c764e32f98ae793722cdf0f6388998431a5b7e9fb4dd1ae41f22af8951392776c543b4105058056f285ba87cc888f38e5843999e23f66d6d70c349e2ecf3c3e98df6894024705b1c0a44e44ef9edc71e12b8332d0d2b332902cb4b6348938a8572b23444a97b01db3ec29d476acca5f259d29232294d88123bba8e714976fb4436e746a2bfae27870251e9231a9ed2b29a4eac683145b7092e93b2f1149322ab4cf67f296287cb4b4d325b29992bc86b503bd3e3cacadea4aef2fd42c1b01736fcfa986f71b33bb786cb39800c66b64c292b9735ea61b293780dc3c49609a7811a42b2f5fad8a3d8b930e92af5deb23b95535e2ca427a61bb7a1f4042b03ef153f85e53d2f204f57480d4e98a3b5613b7e9fe463d2c117482ebe59e33b8236e3514ace453e09bd4acedb574e61e6ed077775e608469928ff052626c278f702bd34ca1e725a4368ff389589a4278b230dffb26cc5e9ae8979bfb5373d533f531a04e3e119c7eb7271feb9c8b1f65ffae8ecbe852dde27746a6a2fecc6e38e26954b9d96f1e708eded202c53d0325eabd4d712a8cab9e188c924de3dd21f8929f5589b4e6619c135bad3459a06136283f0da3bdeee90af3d445c29ffe37cbabaf2b90272832c240b983efa3fcade493a2012df7eba65f81e9e0c4267afb887621f2351fd12a1df66967c981be81c39b97543f8ac3a26355e140be25a554a5584d13650d346886336a236c3f6cb36533e5d985bcb0063ed6dbecc97d6aace726bb77ffdd1e4f59943", 0x1000}, {&(0x7f0000001400)="2fae6e64c63f3fa37b792f9d2455959d97e5f23f095b6b1b1850cf04f478f0d8cacaff0e93153805b4b30e2c2a0e9b156d53b8796d", 0x35}, {&(0x7f0000001440)="e2057363e6ac47b0ac6fc7ec826d76838296f7e2d09293ad4219eb1ed5bf2ba0cfd686e3979dc612abb54ed71d7fd8e53cbae755755eb06a0f3fc4f64739ca6153cc3b14fe930d082c36c0e7a73bad8cc85c914dea37851fa8e39a9de7f5a30f80876a928a7c06fa706aaf22ac14c54b359cd0b5364653cd6b8941da8e710858823e688c7f21f0f566814d8a39fc6dd0b92e5758e8942a2f8a307b3fe4056bc2220ec2f180ac47660bf48112c1d40d09339e106607e5953405b77c4d8a3b5831cb3cb39fa4f38a0617e31184bf95e31632bb45a82cbc5cc5f9c6b715e5e182f19875", 0xe2}, {&(0x7f0000001540)="de867ec88cc3a47a9fafca47bc787620ab19e4ddf5cdee24d29a1e43e4d35e84721beaad100819b4eb8a5646b4c78bab146aa093e7f1fdcfd4b844c8c19fb42d9e6eebfca400d9254d3412a9166faee39cc4ecd523ac51955249f75897fe4f54adf43a0f36cbe80447eb37263c7bc48dbd4845468076", 0x76}, {&(0x7f00000015c0)="1f8fa5904704bfe9f14dd19e429486d3b4293c5eafdffdf5acf3c053f9d6b7f8b25c3c1ca5bea25773a69e9ee7edae6584b0233b20f155a4ff2dc8860b767f9297bb36d3f08c13bcd9c4359d92fe2fbf404ab0b2be0035ddd5474a88ae3c047ad6808d60c21cff46dfd5ffe400b76e9d1bd6eb3034d23db036f2b5d06a73a3e2e6e028d39bab3ea95578ae16ff708b28d92e2cbeaab1e781c1e0d412e24875b1f08311cf1fae19576e0fb014", 0xac}], 0xa, r4) socket$unix(0x1, 0x5, 0x0) 18:00:54 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 426.772321] binder: BINDER_SET_CONTEXT_MGR already set [ 426.785371] binder: 12902:12915 ioctl 40046207 0 returned -16 [ 426.818119] binder_alloc: 12902: binder_alloc_buf, no vma [ 426.821465] binder: undelivered TRANSACTION_ERROR: 29189 [ 426.826096] binder: 12902:12903 transaction failed 29189/-3, size 0-0 line 3254 [ 426.832587] binder: BINDER_SET_CONTEXT_MGR already set [ 426.843719] binder: 12925:12927 ioctl 40046207 0 returned -16 [ 426.860373] binder: undelivered TRANSACTION_ERROR: 29189 18:00:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fchmodat(r2, &(0x7f00000000c0)='./file0\x00', 0x82) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40, 0x0) sendfile(r0, r3, &(0x7f0000000040)=0x49, 0xfffffffffffffe01) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) [ 426.862659] binder: 12925:12927 transaction failed 29189/-22, size 24-8 line 3117 [ 426.881325] binder: 12925:12927 ioctl c0306201 0 returned -14 18:00:54 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x200) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cpu.stat\x00', 0x0, 0x0) ioctl$TIOCMBIS(r1, 0x5416, &(0x7f0000000180)=0x81) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0xa217, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2001, 0x0) setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000040), 0x4) 18:00:54 executing program 5: r0 = socket(0x1000000000000010, 0x80802, 0x0) r1 = dup(r0) write(r1, &(0x7f0000000000)="240000002d001f03ff07f4f9002304000a04f511080001000201009f0800028001000000", 0x24) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000040)) setsockopt$netlink_NETLINK_PKTINFO(r1, 0x10e, 0x3, &(0x7f0000000080)=0x3, 0x4) 18:00:54 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r1, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 426.921751] binder: 12925:12927 Release 1 refcount change on invalid ref 1 ret -22 18:00:54 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 426.964511] binder_alloc: 12938: binder_alloc_buf, no vma [ 426.981728] binder: 12938:12940 transaction failed 29189/-3, size 0-0 line 3254 18:00:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000e80)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', 0x0, 0x0, 0x1) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='memory.swap.current\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f0000000080)={'ip_vti0\x00', {0x2, 0x4e20, @broadcast}}) 18:00:54 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000e00)=@getstats={0x1c, 0x5e, 0x103}, 0x1c}}, 0x0) [ 427.011706] binder: BINDER_SET_CONTEXT_MGR already set [ 427.019858] binder: BINDER_SET_CONTEXT_MGR already set [ 427.026521] binder: 12949:12955 ioctl 40046207 0 returned -16 [ 427.032754] binder: 12938:12959 ioctl 40046207 0 returned -16 [ 427.039241] binder_alloc: 12938: binder_alloc_buf, no vma [ 427.046939] binder: undelivered TRANSACTION_ERROR: 29189 [ 427.052813] binder: 12949:12955 transaction failed 29189/-22, size 24-8 line 3117 18:00:54 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = accept4(0xffffffffffffff9c, &(0x7f0000000000)=@pppoe, &(0x7f0000000080)=0x80, 0x80800) r2 = syz_open_procfs$namespace(r0, &(0x7f0000000140)='ns/ipc\x00') ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000180)={r2, 0x0, 0x18b, 0x2, 0x6}) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000001c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x100000000118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) setpriority(0x2, r0, 0x6) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 427.061292] binder: 12938:12940 transaction failed 29189/-3, size 0-0 line 3254 [ 427.084803] binder: undelivered TRANSACTION_ERROR: 29189 [ 427.091920] binder: 12949:12955 Release 1 refcount change on invalid ref 1 ret -22 18:00:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000580)=0x101) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000200)='./file0\x00', 0x8, 0x2, &(0x7f0000000440)=[{&(0x7f0000000240)="9aefd8e685d7d56ffc0cc7349f2b61ffb4867edf8499aca3b54bd3452e4ee3300bcce4a57c96f722ce3989479f602711b66d9079e9bcc01384a715e8e99a1ae21e70b6b83efdafc5d71a27f0c16167575b5ae9925ddf712305d44571b44f08292512bda9e96a3f0c8216937201eac4f55ae14e52361715f215f89d346cd06a33b4959ca1bff8a187d1c9c097026cd70ddce01ec5d58103a19e793906e130a8810fadc74f8b5d8b2888d6743b070c0d7fe050114c1b72f9beb2a1a0c917c3e22e5a88f8e1ac2675202e972b82c32da3", 0xcf, 0x8d49}, {&(0x7f0000000340)="e8676034ac7de57e00b206dbe7e0fb012e95071b1cf8f8faa1fd789e2df0b5d9eeee3fe2a110a8173a4eb6cfa77bf202b868c4eb4fa73a6fcf350f881a4ef092149d02638dcd82724ed682c4f1ce55be1cb4d0f6ee092896e55e4feba3a686e745cca423baddd42681f62e12af6bb2b31b90c56c78579bfcee74f608a17ab91f87ae4ef9e7df149524d6855cc3eb1fe6f0f6641f4bd5eaf3700ffeab1a065f3f9847c5095a635c477c19de5b4adb38eb02fab59c9de6bde3597349f3a725dc6638d684fa4513d1734df210e4f9f0", 0xce, 0xf356}], 0x2040014, &(0x7f0000000480)=ANY=[@ANYBLOB="020074732c341900000000000000"]) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e1f, 0x0, @loopback}, 0xffffffc0) setxattr$security_capability(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='security.capability\x00', &(0x7f0000000540)=@v1={0x1000000, [{0x81, 0x571b}]}, 0xc, 0x3) 18:00:55 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x101000, 0x48) ioctl$PPPIOCSACTIVE(r1, 0x40107446, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0x7fd, 0x2, 0x7, 0xd0e}, {0x400, 0x9, 0x7, 0x1}]}) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:55 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000fbe000)={0x2, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff03c}, {0x80000006, 0x0, 0x0, 0x400000006}]}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x7fffffff) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) pipe(&(0x7f0000000000)={0xffffffffffffffff}) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_SET_DEST(r2, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r3, 0x8, 0x70bd2d, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) prctl$PR_GET_UNALIGN(0x5, 0x0) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 18:00:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063504000000047480000000000000000000000000000000000000000000000000000000000000000be00000002090000000200000000000003a7e49a1bcfd67d90283a3fcf70320020000000000000000000"], 0x0, 0x0, 0x0}) 18:00:55 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:55 executing program 4: r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = socket(0xb, 0x6, 0x4000000) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000140), &(0x7f0000000180)=0x14) sched_setparam(r0, &(0x7f0000000000)=0x1) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 427.663250] binder: 12980:12986 unknown command 1079010048 [ 427.671838] binder: 12980:12986 ioctl c0306201 20000440 returned -22 [ 427.674454] binder: BINDER_SET_CONTEXT_MGR already set [ 427.686441] binder: 12985:12991 ioctl 40046207 0 returned -16 [ 427.693657] binder: BINDER_SET_CONTEXT_MGR already set [ 427.703688] binder_alloc: 12980: binder_alloc_buf, no vma 18:00:55 executing program 4: clone(0x3ffffffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(r0, 0xd, &(0x7f0000001680)={0x8001, 0x8000}, &(0x7f00000016c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$packet(0x11, 0x3, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000001540)={{{@in=@remote, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f0000000140)=0xe8) recvfrom$packet(r2, &(0x7f0000001440)=""/239, 0xef, 0xde9ccd0faf08f271, &(0x7f0000001640)={0x11, 0xff, r3, 0x1, 0x4000400, 0x6, @dev={[], 0x25}}, 0x14) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = socket$inet_udp(0x2, 0x2, 0x0) close(r6) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r7, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) connect$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @loopback}, 0x10) writev(r1, &(0x7f0000000000)=[{&(0x7f00000001c0)="4f5de840c8e976228a20440d861c088aa80881486f34c49a59873f54e4f60c2deecff2bbbacd4b7a6f0675d082e09ecbd3d0bc02aaf9b093264bab61ae5b2f4f75c743827c5916312c638f8bf8fb8473b7a789941e76107c3936c725f3f0d661a9ddf6b140b0450abc7af16116ba2349a9c10aaf06a7ec996117b0bb6662f21cb8648daafa549353aa6e1ff807394389b8c75d16cbbeb0daf02387055ba84157e1180f2f8a85160a9d0158d94d5febee526e08e08bc382e291dcc93850f89d9e4bdb635eeb5680744f2410bd0b660fe6962af573ea0948538a3e1530d6f6072f10", 0xe1}, {&(0x7f0000000440)="4b0995494ff52cbb1b585c16b00af9224c6873bf77cc51777f3e9f81d56432a6f5187087364971ac90c2c50c4f444fd0b8e882998a9aa1ac1abd86ca58d68298d1ac8c57a9e3fb021ecfd1cdc130e88b8c92da96a06986eb9b633abb8544247d1eb1ba585657307a7da3bc0aad7ab867d32cd5b3e608664204ac52a95175bc5d9c456aa18324b8de734eceb4a33e134b0c1fef793d37faa05877503768635d7f1b151cb41ab5c630b9205da42223c575246636c183b2429229954254af58090ef6c184e84b4d1c7e87b6789de8fbc3211668e028a7ccd0c04492a54a063a26f525154282b03576bf9dbb4ceb87350f154178e7f5a3f600f02f73323249b341187f3a4acd6d480fa6af9696fc320c56690928c3f2d34adf2a27a65840d538576cfff74b1b2f1b9d4b0ccec36437b285af3b763b01a23c5722f40b95260ff6073c1ca45267a8ce1940bc5c6450053bb810ed86a8638092d98817ed4ae636e65d1cfc735a70cfd3616daafc5b286279051eb0b30bc036db0a33af1d840b6896bb80504a4f60d42b16ed5e0c37fbb2d3be2c9261dfc329c2789cd47f7cbd8495face1958995e7fb3087c81f642240724650778cba94300c616758ce86fd36b65a642cf3a986325123e3a8dae09f9fb39ec2784063dbd1f12730f6e5d18217adead04d25b739ca3982ee67b67db4e0b11e92d9d12afa39a61f1dc2290d7045015df0a6ad4cb9263c3ef072a73fceaf9a6ca0dd630143bf0f54e6b4ef1ee7715423be1ee203260f32c242d8a1395abafde18e33082dadcf8f854ed44aa6c0f3f9a117105bbea8a25b3fa628903f12b50056af14565f7dda5bdfef036c38b74d3e8e9031a82cff858ac4df5e17304fbf13008aa847032d13d214ae1ac4a7e318c9520fb36203a410aa8879af67429d450b7677468d2e4d9fb75d731abe5d78fd1356c8fd81fb989a625c5976ca64d3ded6d218660f4ee39c7069fa4dfbcb1c8682ba283b83224009a3040941848f31d4e24cc7a6ea5ee7f6b8c5543e7e0585b6fb896896defa8c0e2d8f0e65e3c11bb5f8e2ab923c1d5b0d49d39865dcb9e44b269900443bac7c9586191abfd8034fa28158b0371a0964e44a655199d6cc7ac4203b4c0ce5a1960880c73d522c68ed773d8635249cf48da2dc3ed68bf305d9ce5d6d33ef972058b126fb7f1a89095f4444fb053e9ecb18d8126a429d6bb363adf911dea2c8f326526b564ae86cdbfbe812a51f22bdd75a34237d7749b39b3d933499c08a2cf8b62ecda6c57af6faeb5e411445b717221dd7e61cb7ba58c9b39ca57f38418bb3a8da814b6948d1036dccb894559168082391b80addc85b78c83234b891ef9ba64be0c297349a03be413426e495236c3f35bdba564efb19d545bb40aa41dc5bd05c2aa8279b44f1edb0b2e2de429eb4db3d1835a75c566daf996515a5d4411bd205564dd1aba7da0efa669177008d0edfdc78f6fd61d936d54a05fce575a3e0904bb6183e0e3c7a766c3e52f2a39c70c183973fb1ce1323ae809b521dd36aebc6cec735caa68cf9a7e69adce037050a8169fec044cda818095e60a24591b28b57f1551712ece9cd3a62fe0aa9ff31b41ca225a7521b29f7544d500bc0b40135e3e68d06664618731e563b74c2dcd8b7dac845a41c8b0011c7fed50f68349165cfd479179c4557f97b8eb3f354939e90f99e04ba605ec57198409c4b48c60dce579dae668758f4f89b27db32cf50d8e2c8ca2df570a1f941e6d70a8626a80737105fd03623f5b64db71a4131b7e0df0a996013882b3259926aead409abcbc49a4d65af648f2e16bb317e60473e0bd3800f7e85b0381fa762e6958d10b9b283bf4ed98f8d004ef66878aa3c42c48c5ff2d887047b6c6c8c42002d57b7cb898296fccfa1164e27a1e44f64897e0da01f7836d408aace208346ede31d23dd3462a17716f017daf495bb67abefb9528cabbbe04c3bba78acc3b647fe932956a6d4e34a1532fce4a44792e4cb8ae640f550f5c396b2cbdce2491e5cdca398b8a26409008bff3123370419710c33d00496c36c8ea7f6e35a29a11b5d1977d5d1f75c91b74c096af558bba17d7053416a7b83d5189bc12bedd11c80362e6c7503597dd198e797c4caeba8f42d35182edbddbf2954f835ecfdde5e7ff153cfc069f96c92a373f16ee164135cf037a3686f4d33dcbdef2daa4257799f8363b318d91da789dbf0411cf4d21365b42abc71b5dd1ec2e50c83d5cc0b68cbbe33ead694a0d8205ef33f2c16b16e69f2b31025fa6a4e6dc4150558629485417db47a2f524ecbe18d9d11ea5675fa9241447484246a43428df01ded79b43b6af56da8c53f066d4c07a66479c8a5173a12765185dcf3279676d144f4cb07d7f613702d98b9abd127b48adc8d6259ebf104e7a993cfcdbce5630f4c340ecb5f1d77d1be8961b7122b5dd3bf09d033f6eb7e5b2411c513bb6943ecf35b762f501feecd7c24056ba177bb95922771f6542ae661a32f41ec0158a9ee9ba45fdafd60e2f23470536d438efdde0fc22245d7c9fea5571454089a6630b82e51bdb6e5abad9c72ec3e6d0b8b7a6c55b503374004b76ea67279b1f07043f9f5b1ceee140a3cbeb0e319bd143f12b532a7db82491fe5ff65a2b773ab7190627b5a6e7053c954c6bccbf1cef48bc373898476895fb6cfedfbb83b25cedb50034d49f9fde8e127de553e36b819921c0d7d2e3c702cb41521b07d518f0945d30c21d0d644e717677a2e1d1f6f8a146617f7832c6cec175a9cfe2b48d92417fbcd25aabdf5a0c9e4121b86c8326f340c53172738a486b6c9579b01061d730277998e27a693fa4eda01847ac8a9f6f58e76e9d7ffcdb234db79a3bd296661650e7e616f19bb04a1078a0a6bd1a5e511d4992fbedb53e47e7d26c2491726d9c226e4b169fbd35134e3768b291bb09a51b23a1323ba7958531c00eddd67c23214173b8833861fc7863313d3b9cbf7839967dbceb09d77e2314f54ed8cb0d8d669375892208629f23a73b5bfdf9c24065ee581c16cce71dd4400f83f1c0925aba27af12ddbdbe018e32a7306c4c5d2bfaadba120321c1d639d0be4401b1b557afe9e9fd34929953bdae7f008551e29bf58390228488234aee9da77a028875dcd5e396b705a27a1ae59dbd4cc407a14caa1b51da77c10a887e21e68a63fe10b74fd341a4090eb640f7c24621cca1773597aa8dc0346dccdde1cb53b97616de0406dd6d37ba4dfd7b3d5a4f9026d590a8e25ffdafbd3c8f5ac1998b11dda298e9b481110dd2e7a3a715c502ba0340039523795d5ee819df2becf801788503cc719de3ea58599430a8947208824f3491939fda9b9530a29ea4aadf7e6432595dd402d77f3801e8b9ad8d53373d540f9f457d437372ac4766df3f0efcaca13d8268a370713e37f13a41d7ae073e46d8904b1161ec0a621032bf4d041d0f57086c6430394c152ff203017905bccc769c82f948db3d147aecb72b521da4d92bfc8b9ab5fbab46c96b8d60e03a0873391f77be990c1b2fff6e387686e47c78cf77648e02ab4f257a179f999afc06396ece80a9d80faa1487d01081824ade4df7e5910b92c86daace98bc3e53586e358b6c0f804b685ce669801cbff1e7293244b467d1279e32575a9c969cf902ba437e60c98c297ab384805c300e13ab3eb2ca651833bc9d1240d9525983198d11482510a33cca855288d8557053f54b0d4454e59aa8e486c1b187cb53e9b5237f24214cb7aef14c6a7a26b72700945fc05ccec77d3c67eb8f89116a7c792e7677ae3e5c472883c711a379de86c07297bde514c3fcb18d841a6f42c40dab227f4258ac1780a5fbaef6371e067126156f549498832ae88cbe655f1ddd8cdad38d78a2d3ed3df0880d18c112b08862a0efbefa34cc7932e5481ff8edbe70c6a92e14e9c52ca25e3bbcbe53473bedd969594008ea24263093c20ddfa62124ce30024b649fda80868f23ebf132f2e3aadbfbd271bd0148e463e1206288e49b025cae33ed39e50012ed7879aa19652415bddf8c1e418f18185f6b1ebd92379d27d159cc0b54429ab0de495e47ada52f3a4f6c47875f0414aa1937bd0dd6d5d1aead45db3419e58d7c07e2367eed1726148240345cc6ba356c3003593c62c95e3cc5961ac39cd25da0b6c54a78a3f19569722feffdb20acee40b6e1f6a37a9871a327b1a0c19a6569b8c281a4a12e169b88aa1e374b109ec837d7ae6f720d8b4fe794daca8a338c9a72b003011a783bdcce9cf3a1adf5656e161fa4c50b24df25f10a82d05d2c4178a93d1528109207dbdcbc63d6cf13191d29888d1ee464a3d67de2526b6a46c1d6e0bd0d787cc5d4d77ebd4dc76602a7435823a69b45cbf53c3e5e36e0c9034bfe1f17f111fd1c15a22e6d82703659d7402be3c9ef3c1b9febf11c418fbedc239f1270a7fa68ea3b91f72afa7c4f0e54d2d784cf42cdf69e38393bda1d2f36f845f12761e278ef294c295d77720e881b6b51b3a3a911b84b420173d83b3bd8f465ee6e387da9992d872e70449e529b406193dc80523cafd74aef78378150d5547986a5ef7f8c0a8fd7c6540bf6ff2b44e3a224dd9a11665ca1edb0ac504c169b8ded0e7f50daf47d8495e3aa97b7020743193bb8a427b23fdeb42607e7876277ed9a8729dc62f390d65f7ce8d42c8ce76a40eae41954617cba03d0d1fea8371d78c808ebff0f4b77152d632babe3ace55aa2c7030f465593820046476af649e1bfd439bfc7c65e522f3b2a3dea3d80967a5291078ffdd41870451fac1ec2f07fcb0be7c90e62faf92681852cc031f13f2ccb334e925c8b271e922bd13469e716bdc51633d261fc314be7e652f5fd33c54e84133d9a60b29f4f171c9c5b106e894a32e95e453f73f9a71ffa45bc542d5a8a6c904a01a1136baa9cbb40f9d27c364e5639b10b3c9fa37c41b3e0ad81921ff61d0276bcdcd9156aac24174d9547f30561d58ccc7b83d7a4d5e10678cbff7d5e8e12a2457d60d839ee078fe464dcdc12bf6dd332e33118d6f1b325d3183450b8a48c8ddd570b65440e111dba6e91e6a02cd28f85376b0cf56412082d1f470f554076785dfc8a9b6eba082db5ef7037681aa5d82d778222521f03f7e5606ba807cf78febaeca5745339ce0a8b167ef93fb767b92811f5aff53cb8f67b21ec1da94388f6ad7316c16718e3e0971703c82fd9c8bbcb683152a5cbefe34747112a7ee17bb189ae67286f9a2ed71bf93931d45685352ab68664cdac998cc2a4f7aea52e0cc89a60cf5ffac36189f48877cc7d0b049ab2ebdcb562d597379008375f1dd3157c8ef1dac7dca81bd10fe479e8112d7ee4efac06254ec823a615d5b0b354c9057eae74c6c5d918ae2c3241c0656bccb6904beeaae806ba32a5e27fb54e7fff4fc01fe2ba8c084f293476b86cadd76e93fc09e7d6d33b981a081cd5a37598c50a6ca0eb940ceaa610625443bac4ec63cfc743527a0f2152549fe4c7f6b34093c359ffdfb750e67826fb7f57d859429ef94561ae8d8bd3c0129237080de94a2a9b711d898ebfb3c60eb79ea24f54e5b22f87f5f8ea2bfeca348fd4340c5e7af6ecc7f220fbb352ec035ae98138d0fea8913377d7f0865399c81904ac8fb384756e0522fedef6a9dd58b85fc314b2ba8ce71b3b8559f5e17ff031bbe5c79487a059a6e73e12eb478eb6dba1771ee5242406e7ee7b3316bfb30b11ce43a9c87c245b1955a23b553c5b547eb6745efaf63e275aae127e7de5c36e6a706fac4ac20c06c8316f5a4584b20b2c785ea60394b", 0x1000}, {&(0x7f00000002c0)="caf8626cdbc2fd6c608c862bae9e550d8e30d418f5fbf67ad54d8b8e76e51c6e824b338e2dbac893e53b10942ff061544b42aa3fd28e23904b1940972ae76f63d30e88e42999e0a03a3a890fdcf2cd69c6d13c199e4edcd00c8feae061cba10b878868423c5de3bc6d5a1a4a55c2a7d84708458e5f6f7fa7f446b646920cf0a4f74434dd266d3e8cb4529409077a74c202d5c53b021a4532f83a5cf6afc3e862718aec42362c3c3ea4bd0cdf63383948", 0xb0}, {&(0x7f0000000380)="10ec5608758bfbde77e505c150f1880b8a73771fe22b2918dc69fd59096459392a0ee8a170b07857e1ef16975dfdc070901d5e81713ae2304290306b1bb7d626941575d52f2f82c1945d696c9b41e14bd2b1bf99b24afbdc3d6aa263f3cd76762dee98d3fbb3fe0d98039ded", 0x6c}], 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r7, 0x6, 0x1d, &(0x7f0000000400)={0x0, 0x8d9c, 0x10001}, 0x14) write$P9_RFLUSH(r5, &(0x7f0000000100)={0x7}, 0x7) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000040)='ip6_vti0\x00', 0x10) splice(r4, 0x0, r6, 0x0, 0x10005, 0x0) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) bind$unix(r3, &(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 427.709808] binder: 12980:12992 ioctl 40046207 0 returned -16 [ 427.726277] binder: 12980:12986 unknown command 1079010048 [ 427.739381] binder: 12980:12986 ioctl c0306201 20000440 returned -22 [ 427.745566] binder: 12985:13000 Release 1 refcount change on invalid ref 1 ret -22 [ 427.747991] binder: 12985:12991 transaction failed 29189/-3, size 24-8 line 3254 18:00:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b67eab4e49923b79628f35c49733e97922cefed9f7c26b6aba7540c185956542e08bbdb4190f5f1495110b72d28d0163f50283"], 0x0, 0x0, 0x0}) 18:00:55 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) fcntl$getflags(r0, 0xb) socket$inet6(0xa, 0x0, 0x0) socketpair(0x4, 0x2, 0x101, &(0x7f0000000040)) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:55 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:55 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x280003, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000140)={{{@in6, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@initdev}}, &(0x7f0000000080)=0xe8) r3 = getpgid(r0) sendmsg$nl_generic(r1, &(0x7f0000001a40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000001a00)={&(0x7f0000000240)={0x17a8, 0x38, 0x808, 0x70bd2d, 0x25dfdbfe, {0x7}, [@nested={0x1bc, 0x7c, [@generic='f}', @typed={0x8, 0x8b, @uid=r2}, @typed={0xc, 0x4a, @str='vmnet0\x00'}, @typed={0x8, 0x31, @ipv4=@empty}, @typed={0xe8, 0x6d, @binary="715d9fb4b8355086d0deb532477384444975e21bc599c590e6ba9478b02ba2ce05fbffb784e87398b18ecc1c0a14e3510e3795c47135ebd94cda8fd7b266f0e8aacfd32841d8ad30c69e4d2a419bbb4bf9f191b9a5f7b6d2605b4d7718fcf85685cd6cd6686208aed8d1e8a5821faa27cde9d739b9e567f7a5a7f22a7ffc27507b353f35606e9349c3afc6059660e6f3305019fb4a469cb62fca41725b4a639fc28787de13827de4612aa934ffa11d1544c833dd48926c97759ad5567c28948ae4a88a35d90b8ac2407dda3f37ab4ea9c18e0cc1712696a160622032da513730623a"}, @generic="3baf6571114a4ac849dd6722949c8e1c8f6a1fb0425b49c96888fa093bdc01a5da3c16b71cd7e285a4e129f05aff1064308d3275e676123008e31461a7f75355a7ca07201626af30875237e47ad02ee606a907f61afa685eec60b503ced1480f6c112844ef3e83a529dc1ed743a2cfdc40e64633638b9df8321f7be6294ee58f867a8ff12e2a5232", @typed={0x14, 0x18, @binary="71c508e47ce3c10acad521c459e6"}, @typed={0x14, 0x42, @ipv6=@loopback}]}, @nested={0x1304, 0x30, [@generic="ca64dc8e6f20c3268e3013e7385ff13723a17643050baed62d2b5e6cb3628634e79d78c9ed36fe04a80d2c193c46c3f5e97b2fe979cebe3f12f248bbdc4e6ae9123e50e5edccc27347f49541c736e22d37d661d483e1ca4922471766cdc9e3214f2e361b58e8e8436d72f80462c73fa97626c346b36195f85e143f7c3452ad6cf36454f07fd3eb4910e12c6a454f3d5c1d34f17a0a8b75f7dbb4a31821fa4a2087bc90cafd0b65ba8fd1e6a1eef2d9e5cd8225732248826b49ba31a61d10892aa40b4e7b77f85a052cc6b624e896d2107c7769f1c845137f5516604986a7da7ed5d6abb86e4ccf42f9eca564db8ed01cc7cdf1f99f8e4757b033328212a542c6a9e37603fb61586309964c328f0aa4cea9165ecd2029c5bbdd61906e35af77ee2f7a2643afdc7311dfdc042f5559e4a6df0f6a61a026f0e36ba0b3d30c67c5c01d3af76529af2e2cd35cb5f882e2e5cad0066ea0ffe8160810fe245f833a912c91d699e95b61f54cc706a9410f02c8853f6572ff4e35307aaf05e792dab844673d000b6bd0e83aa0822154bc57748a59ba9c26e3fc414411dfb2418f8a77298f944e962c1df113b1a74026b5636cc294feeede25668b28f424ae8128fc37bb426ec88c604f24ed5da85f714e7d00962e0bcdfca87a875d8a925f3c9d9afbc6dbf491d911e91c9abb495d36776f36d762d00cba25899d32d6eb01e2bf5e43edbc7d7dd1c0cbe79eb469d97721c0954a6ba3c8bbbaa5ca3e99494fcab0bd2d02d7ed24fc881c05b94b356c53bf9987e27f93ece9bb8e0a62c705b5ea76f55d3d6089a0193536c2eb4ac9132281636c20c18c5161307cb50c94b2679e955ab4d0af2fac95dec0c30fa53823e55dbf7571b5ce071a9ef40a37227825725ca39637af23b72e5f364d39d988dc1f24d99dad2ee36dea853a8e284d92cadc310ac15e9c970a8213afbfb48b0675f308c56da56066f522190ee83b35f9bea7f37e478e11c3340a360d4ece96671cb3e4f03be13268310e3fc1e51c4c71e7dca5a02b6c899260bd7b7c65d16d6bbfc981edd857e40fe60ce49c5e147670ed765871ba575e1e61d7b731ee57c1a8d1a2d0b13828ba3ea2f0f3084d53e76e9a7f94324ac0ee77f14333b200cf6b5f0074b346903d7f4f5716c5cd30840f6195b6da677406b8553ea557075e4c5bb4aa19c505c57a052e7b99b9c37d199b7dfc953526a532caa502545d91d418162bfe992e9fff8279c58d7ab508867eed07c9911b0c3763a02ff54aca7b671b16fe7c55c7b5883c16bf8d18cf862630a5793cb02b8b9f5dca68dad2143468bbfca948c25f13ef8c2ea206ab81fcc6c8c48a2ad5774257993637ffde7d7b0334023ca2ffb7f646cdcd763533596c3ec97e9b4faf8d9c35a31e32739ddf28fc859e6dc6a333192a852725b843babcc076b11fad4f54f81667eb32a51229d5b010bbb796a2d9c4334e554dfd863e4259e37c702afa9f086d7a9683cb034017f6abfb46dfe8fd95c878cbbb739abdba0f8a62ca9b9e0fae0c6b31102868ffe168ebce6c980c26103ed6d6c510642ff53a35385d96697708f282f782ff3b65a161318274f41e56ca7111d69260bdfa28cf6d6266f5af575ba2d6709ec11696bac2d1b35a5b892ba3efb6f78d19b1d9d4de2f20cbe9f24a25f3e9c6b6d9c24e917171fab89cbd1397ab60e91bca0a4fc940fd6d6347de1d13e49fbbda37e56b450c6c01e76f8794ecb40d673d519dd287b226ad28afffa34d2df6f084a59569a6a617525bba73882a4a63878b1df8d76e514a18694af7aef577c71c31a8cbf279714c7d2613b514c19e77cde154bf211210e60a795f892020524512895834938d11ef4b99230eeadae99fe2c8920ac52534431ce22285892902510a2b79ef17238c7df622931d8be706f07a171c0c045ef5df5bbbe2f07ee1679df5379cc7951e4cfbdd0aff671baf31adc19973f344b2f548a01df48950a08a6088c8d5936ffaf73bcd62daa8f5e7982126c7b487e3c73fd133491135f09fa9a70c353371b837203ae3cae4aef7109ff81841509286ccab0deff64dd1e3b9ca7605ec70279c23e257286cfd757e1d965d644955edeef2c3f973cb798b94cb4f553d5d881b193aa2c924297d77b52b8a43b57e9c741c90d74b918e0be6ff288814cc615e312d40294df3602ca90b9e81a66a23dc2ac8b94136d7a7fc8af86c5ad4afccc0d23a24461223ac79168066ee1fbc47bdb1a0d256908b9a48b1ab207e08d256657233c1aad2b0e386569fb4ae2977c36f33acd89a3d9ca372e716a24ff223202a46e2b56eb096f15dbbb5b12fbdebf2beda0aef02c86c08049f6f8829c7308c9db30b3a5ef18f8005f21f1818561cfb63934e7f855a056901e9570152ca324e30b4684cb20e3dcb5637452f767f6c1c9a6366f36d58977a345cb7e992977b187db534e8fe2d82e315a39c55caa10866a96a4f6c9144bd1d1b54d020f407fb265feca8b0c47753cf54a42e838246e2560e61f0f76ac3950e1cc89ca81550fa8e41eb058d01d1032d4b1f7eab887130966cadfb6e3d96b13b3f4abdef3d3d81a209486fd425421e462f9076ad79c212016a9259ed4af33bd2ac1c63ad5cdea461dd265846e9a9ec460ed1dcf5830594ef4f3ce0840bc33cfbda354c177bcb5a1f8f62ac1d251764b05986a8b41a1cd377df4b58f29b782af57b7ddc07f74246432652671bdf4d618f17ef7959270c8fc39762d93f7e7bd3b2058e1b216a238295ea7ab6dbfc7b7d98868cd05df2cde14f5b34125e2b0dc91fbcd418adcc6bb709e33082b2ee4b6397e1500ce8965331ee0bc16829319e4b766d654426b55269ddf9196447a75ea797c6103b69421acfafad43b3e881f7c065044544d72b8e7c16c7c79910314e8e7abc13d93ca12d914b21c7b8b09bf1c851ff2fd848218d5ea1be08d1ddc56503aeb1bd67544ca286d68ff73a32ce990e97d2c35cc602b6209a1d83cdfcb66f1db8496148eef1125c41d6f9b72f927b37f72c0df9640a4f67f2217c7d09d1ff2369a5e6d3cdbde5ee3749571bee54fcbe603a52f30388c9e9934a1a709f05be25a30cfbe4ca27b38903f4c724beac6ae8aa41c20ff861f963f535ca2484122f5e5a09a542c94be1e6f1c996525019991fef809c2f1f4f15ed0c963eea810fc2ff26db7186486ab75d75e4ee1f847b5b53673651d836b0c7dfcea216fcc71ac01e50698d7d5c7dd24ecc704899eaa2acc7a8801d128e337569ff63168f65f6bfc3169c4a74ba5797aa167a2eba0669c8c8c3d674fd6bd31c450f0055b0b6de1dd4def59b85a3ea2af3080c0e75632282831e0382de5c5b47c9e6c237a7fea92268623c0047de0de50c2efc0d7b38c04c7d3981e50a5e3eeca19d2cdc87b90195a88317aab981d63be6d4a01debbaa0823a62b363d5110a3e88f87fb82c40317243eef1b1006cc69bca5426a307ba934091d2c070a940a9cc15672a4c0e0e6898b1f67b1eb893fef5e9b232154f2f474e2a398f55bcbe94a600755375b477677d4979762950493c228dcd57ef3086fa3ab77aa4b8797d8ab1fb84c84c0afed2ddea6b57b0aa0042408b77307b557a42ee7324df84aee77fff6738462723966620454e35517a055c15c4c5347675ba73bfdf80eab5f741250ea18e46fce0a951cd5fa913e25c94bf040b51d0697fe1552a94424339c23af65307ed2170561cc2c91a4a2f3eeb21762bf77729751f29f66a876ca780d7726d8afbd4f5951eac864ec63a4d5a21ab8bd037c265e58c22aacae6a7b3f0f3da0f34dca4dd72fab020a331eb201bb822b4911517efbaebfad93f0a15b14e780222e635e7d8f4a0be29b1f9da34095e9b53050dec61e27ca089a090dd047582c2e266e80b2faf1f212f6bb8d01f63227aa483dd4acd6f64087326de84cc692dd91226b6d7e7c88f364520ddc4768883a13114b4ef4cec0bb669ba872c2d67a80cfaa635c041540068a9a0497cc9224efac965f130cf99773d2f8510c5ea6471ca1a49215b031ef7857c72e6baf171fe62f98384857d66815c04a53596faeb180d5c9fd2ad67cc309aa1747afdcfc1953f0c441f7836bb5bf8c98a729b6742cd1f96e02a5b8eb9db16e8b98023b61c3b2e0a17a07502b09b88754e119dae4ac6f5c8d1df3818159b6b3f7fa8db433893de04033de8b252d51d33a3c2346dfe77146a7d77d84f97b8951c41a24615f92c85e72f1532f5532c610aa7ea7ac03e679d87f4a33ac8e89b7d363123a788bdf759fdc83a89281a69bfa46ace6b33f4752db92c7b5d03f9af957bb714d036ccd5f475dd7add7bef822277d6f29e3420c92c6d477cdf3c5afa734f1ab0034ae5faa702e35967d6918447b6d4d9d8d186e1e3a0cadb44a68410dfbb79ff86ef3baeaeeca817794a33a4f1bf34ed8a736bee8813f4074cd187645339ef108c46a5ec5b4de7160329bd47728815985a827ea9153e747c66a05a51c1190ed8a7ece24729345ba55ed103734ed5c7396bd9ae5e603daba6e772e359ed55d5f825800bdf85f9d322b0a198f6f095d4c2eb14057389310cf05f59086e97e64dedf273591fee3f62f4a14e6fc0afffa3ae4ac7ed6c990fe3040ac71300b2b0d1e138d5e2eaf36dbeb6081f540b45471dd9d7977c98078eda6d17fb23cb8963d555ee87eb1729bece446b17eef389d585ccc61eaecff8daabc552d11cadacd470b127a792bb1d327a33ddc1b8fb8313dff8b478cda8dc0debef8816f5b2b3b36ea4f83cf40085677d14a8b30a8d840599feccf01c15c1d4a37fff41d96ae9129cf86413f70d209dc8e45339dc3dce0ec01b3ef3efb2e60282a758582a25f013d291627dd078727b2fa54cff1797814629d4c30c5eac627356b6a87cc988f0c1bb822bdcd71057e3c231234ef3405d938a6bf31099183b25cc818a7cd232986410d191adaa4480cd5185271ab401372159e855354178b6ce69bd825a2985a86880c76566021c76b1b05907bb639b7601c16e8f839bd7b3c54df6cf1ebac04bc5f0f81c102b5a9c0acbc32069d140fe2d260ac3edffff81a636a69402d0840fcb77cce2bf4b34b728f0ddbaa6fd7db853bfeb71650f2f4211d5b4fbc65c3532b5378781727027a6a5477417a380b5561d81dad7edb121b9b2e2da18a163a0083b196a3499c6108a9e4f80fbeec4fce1bf043b2d84dd247a6719a820ae33508de8bec46624ee96b4ca5bea7de9dc72dcc4edab62e85eb4183d56744cd010f652fb46afc3feba0d990a8acf00dc21bb4825ae46f697cb60244ceb0f03aab346794da316b298fdf465223bcfab48c345bbadfd6b541057c083f54ab725816c751a46fa00d5387c6aad1173c78f86ce785b70a2eba013c5635a225898cceb1451f04bf9e7ee9a6220d187e8fd986714ab561f87dc0d2283b48ca9fb2a1d29d869274b1b197d1d0cee3ee39bd7f404c27f83b279c193d02be4439b2cfba4cda6af2d8934f7c05450029d01c8ded450d2a27d4f8f0f1ffd0a77b581135f703a6e0a192c736f62c304dae088f74df20794ec758d08e088e268beeb3564a151179b70d052702be2bf40fa56f59bf769d8aab7636de0733c34cccba49fb9e301729b90254b68e6e756e9e41b9652fe28575d94fcecf913a0df147ce13d8a8911d9460acde41e135aeda4ecfded303f48e0e881543a69e20aa14ae4f6e8c99428d66eb4598d3f60e92589ca3bb39a97b63d18edbc441abd0d33e4dfdd03c71c44590fbf3917f2cec877241c461c547ce6bf2b72e47ab7ecf888b39d459e0872", @generic="ad1067f11889b8660482dd2f2245d22a108b8033714ebe95c3bda7a11e321e896be8037ade2896eda296f4f434b608691cb0eff8c47a5c2c03c8eaf797fc8e111d676d47ac1f4a58a781814433c8417a6c383f36375c61c38681162e8b50c28ba3b8ed59eb9fd31620e7db121e474f9554c48f3de291f2ef830b2caa96bec60ddc6d9bf461e6ad5b7371eb14d1868128f2aea62640d49878a397", @generic="9f8bf766d015562dac66f09e1b31bd8577d5d628cad2204b9737111e54179550ed7b30766a13fecf06f938ffae51d2477d04484b794638a24847d9a1079128e767c6346be903f4ddbcc8407ee968d2c7f8651457e4e85ee86594d74869322b57279906a5bf88916985f5", @generic="816eb4bb3eaf555b0ed24529e078eaf9cc9455a3b1474556858108a9cb2942d4306f30a50196e5db8bef1af2edf947c5ef8cc01fca595968aad6e75fdc7dfe8ab0e890ff113a673dee4955cea3fee5507cab625da1aba1b75459b354694f02691cee238f12410e5631aeedbbcbb85abb13d6b7eceefec2ddf986fe37e2f58c84d40a7ee790698b2bfcaa135ff02410f4844a840bf48b411e21158804d973592b8e4c637134786df3d9f6df101525dcd47fd20f9c1346a67a3bfe020ad73267", @generic="fe29983394e34b873b03d3c4dc9f", @generic="ba19956d96e22c20f9322cf5385990503ec55b3057e21694bdd04422bb74f2e3a13e70e23c02fbb8d50980d5369a717437101b5adf286a9c0bd0d973018915968a29f208e29a6ebb6bb2abb39e94634b93bb9f048971428e3c8eaa07469b4db389b4c0d0fcce59b892160a40641a6b73804b3d3dd41f97ce6f1279c39c932262fa99bf4ace2f07d30e35a780c2809ef13488b23622ebc5a872ea2c0daa0b3b2141197e2912d010d783a86e4f4fb0488cbf550aafb2d6bd015a63e5bd777c6c070df8aed0f873a8c95db897a69139b813c68660", @generic="5972eac75ff46f5a199c25fcd8305b4dc496b327350cb7e79e1a5e31680a35b81e90f5fa5a3e94be86cdc53774a02fd7ac6de85e4635c8b339bb55e20c4313bc2201b871d6c3f3a9c32fdc362b2b46ae10c3faae", @typed={0x8, 0x35, @pid=r3}]}, @generic="ea5fef6886856edef8709544d088c5d4d1939bd3746b4f1b3cb7034454b245c67bcb11c72688077e4fff567d0c946f186245189e0ca5b85ab6be4d6a5f73729071920d86f0fcc566891cc4ec2b39440a48dea0aaef1a58a17530b4861fa14d56d542a27ccd09bba3f46f739b2d003e193ce022d7fe59b502eb02c47def343edc71675718af725989bd1dddd761706d5f0c6b184760ecbf42c9776c5c9de8223d9b15b571281818da08aedc3ac9c9115e7da9af670b2f620a3b7f616b82f0208e9e8a085df44503bcb75572", @typed={0xc, 0x29, @str='keyring\x00'}, @nested={0x3c, 0x8f, [@generic="2a65294527da2cca0152400d356455a41f053c8d21d81f8a44de2688967dff1de176b3", @typed={0x14, 0x26, @ipv6=@rand_addr="69d0f619fc4459206ff0faa78bad3040"}]}, @generic="3b35e92f3a8c0bd517b9916cf77e6b1e120ccf9ba0c80961fc0484888048a7b4138cc8ce3f950de404a9a228e1d0252f0395ed9d602dc35aa0d30793b3d1b5c75de0e35f3abd35b1a168fd4180577afe3231fd1ea2739c8bccc695e2a8fa280ebb7d19cfbd544ea94ff1b394558392f1582d2f579afe0390c10705d7", @generic="c615d7ac14dd5f68c12ecf9d67a74a04dd827b99084773d44d7fbf", @nested={0xc8, 0x10, [@generic="d1a1681b5de0130da71cc1bd11b958a7fe5b7ea54a660cffbb1346a349c5f5b301757127fecb11a5a47fbe9c2fee39213a5c6bdd32313c86ff6dc9d240490e2b422b7c40e7c8e50a539a95435453c561e3fb4bc88f4b6cc32c417d63025a8b8ee9232ab6fc6db97454c8707df4a7bff32e36cf05f4f0bd983e2c7be10cbb3ffaf34102cbb57bebc335a4f5480374f0a32c60f844f41128ae50ae1da098d9bd25250194ee3ba67cff02edf27e612537117f84b17db33024ca88d5c9", @typed={0x8, 0x14, @pid=r0}]}, @generic="55dfcd08e8794230e4c03b5d78a3911bea1b0d1c195b91df084c6e62b2f4f2ebd090f7c95ecbb52bb63e03d04b6b7063eef84df617c609858d102ea197c1874621eb76a63c1704f9ad12d072768f856730dade9be91bc8145e68eabe92c6f8be"]}, 0x17a8}, 0x1, 0x0, 0x0, 0x40040c0}, 0x20000000) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 427.835711] binder_alloc: 13008: binder_alloc_buf, no vma [ 427.861270] binder: 13008:13012 transaction failed 29189/-3, size 0-0 line 3254 18:00:55 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$EVIOCSABS0(r3, 0x401845c0, &(0x7f0000000180)={0x44, 0x6, 0x3, 0x100000000, 0x1, 0x401}) [ 427.929141] binder: BINDER_SET_CONTEXT_MGR already set [ 427.946644] binder: BINDER_SET_CONTEXT_MGR already set [ 427.953022] binder: 13015:13019 ioctl 40046207 0 returned -16 [ 427.954388] binder_alloc: 13008: binder_alloc_buf, no vma [ 427.959713] binder: 13008:13022 ioctl 40046207 0 returned -16 [ 427.967479] binder: undelivered TRANSACTION_ERROR: 29189 18:00:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000001, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000000)=[@acquire_done={0x40106309, r2}, @acquire, @clear_death={0x400c630f, 0x0, 0x4}], 0xd7, 0x0, &(0x7f0000000040)="6ba289a5b1757b9384d8d90dd47dbe80126ee7448fd4a21f751d40dfb99d752762293b922c29be9cae6b392df8d705c9db8ea9b688a753fe54c4c81b8b308ee7320e6338522729d7d9077c584ac0d4bb3d8e2e3672f58d0fcb88839536e515bff80fcd6bcc9b61253e1b42ffc48def61352b70dc4fa1ba7a79db1a424dccaaf46d8ebef9342bfbaaa9b1f191d6535e3fab0fab917f6a611e76d34e2c40b72bf46ac858b3d850ab09d3fca35cb7082a9b5040cc3d6df662ccf312b72a7378d28f587cfdd7ade601fc31e3d61279320a9a145f9d4e2a9a70"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 427.991613] binder: 13008:13012 transaction failed 29189/-3, size 0-0 line 3254 [ 428.000549] binder_alloc: 13008: binder_alloc_buf, no vma [ 428.009348] binder: 13015:13019 transaction failed 29189/-3, size 24-8 line 3254 [ 428.014770] binder: undelivered TRANSACTION_ERROR: 29189 [ 428.033105] binder: 13015:13038 Release 1 refcount change on invalid ref 1 ret -22 [ 428.095165] binder: 13043:13044 BC_ACQUIRE_DONE node 646 has no pending acquire request [ 428.110175] binder: 13043:13044 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 428.141487] binder_alloc: 13043: binder_alloc_buf, no vma [ 428.147235] binder: 13043:13046 transaction failed 29189/-3, size 0-0 line 3254 18:00:56 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@random={'user.', ')user4-eth1()vboxnet0/bdevvmnet1-\x00'}, &(0x7f0000000080)='[\x00', 0x2, 0x3) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x3, @loopback}, 0x1c) 18:00:56 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:56 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r0, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20001}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, r1, 0x401, 0x70bd26, 0x25dfdbff, {}, ["", "", ""]}, 0x1c}}, 0x8000) mount$bpf(0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='uid=', @ANYRESHEX]) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='devpts\x00', 0x0, &(0x7f0000000200)) 18:00:56 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = dup(r0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000200)=0x0) r3 = syz_open_procfs(r2, &(0x7f0000000240)='attr\x00') ioctl$KDSETMODE(r1, 0x4b3a, 0x5) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000040)={0x6, 0xaf43, 0x7}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)=ANY=[@ANYBLOB='\a\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="280a27bd7000ffdbdf251100000010000200040004000800010001800000"], 0x24}}, 0x20004800) recvfrom$inet6(r0, &(0x7f00000002c0)=""/126, 0x7e, 0x0, &(0x7f0000000340)={0xa, 0x4e24, 0x1ff, @mcast1, 0x81}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x4, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TCGETA(r3, 0x5405, &(0x7f0000000280)) 18:00:56 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) stat(&(0x7f0000001600)='./file0\x00', &(0x7f0000001640)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f00000016c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r4 = getgid() fsetxattr$system_posix_acl(r1, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f0000001740)={{}, {0x1, 0x1}, [{0x2, 0x6, r2}, {0x2, 0x2, r3}], {0x4, 0x7}, [{0x8, 0x4, r4}], {0x10, 0x3d73134cdc14b759}, {0x20, 0x2}}, 0x3c, 0x2) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmsg(r1, &(0x7f0000001540)={&(0x7f0000000200)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000280)=""/4096, 0x1000}, {&(0x7f0000001280)=""/232, 0xe8}, {&(0x7f0000001380)=""/135, 0x87}, {&(0x7f0000001440)=""/237, 0xed}], 0x4}, 0x2) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0x5, &(0x7f0000001580), 0x4) r6 = socket$inet6(0xa, 0x800, 0x7) setsockopt$sock_int(r6, 0x1, 0x4000000000000002, &(0x7f00000015c0)=0x8, 0x4) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r6, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 428.329494] binder: BINDER_SET_CONTEXT_MGR already set [ 428.338024] binder: 13054:13057 ioctl 40046207 0 returned -16 [ 428.362138] binder_alloc: 13043: binder_alloc_buf, no vma [ 428.368975] binder: 13054:13057 transaction failed 29189/-3, size 24-8 line 3254 18:00:56 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:56 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) close(r0) r1 = socket(0x200000000000011, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000d40)={'syz_tun\x00', 0x0}) bind$packet(r1, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @local}, 0x14) io_setup(0x3, &(0x7f0000000100)=0x0) r4 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x8000, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r4, 0x7709, 0x0) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f0000000540)={0x3000000, 0x0, 0x0, 0x800000000001, 0x0, r0, &(0x7f0000000040), 0x5719ac0c0454dbac}]) [ 428.378168] binder: 13054:13057 Release 1 refcount change on invalid ref 1 ret -22 18:00:56 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) ioctl$sock_inet_SIOCGIFBRDADDR(r0, 0x8919, &(0x7f0000000300)={'vcan0\x00', {0x2, 0x4e20, @rand_addr=0x1}}) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f0000000080)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@ipv4={[], [], @empty}, @in=@local, 0x4e22, 0x10001, 0x4e23, 0x9, 0xa, 0x80, 0x20, 0x0, r1, r2}, {0x1, 0x6d4, 0x35d, 0x9, 0x7, 0x3, 0x2, 0x4}, {0x3, 0x4, 0x0, 0x7ff}, 0x3, 0x6e6bb9, 0x2, 0x0, 0x3, 0x2}, {{@in=@multicast1, 0x4d3, 0x3c}, 0x2, @in=@empty, 0x3501, 0x3, 0x3, 0x0, 0x9, 0x6, 0x9}}, 0xe8) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) rt_sigreturn() 18:00:56 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 428.423241] binder: BINDER_SET_CONTEXT_MGR already set [ 428.430913] binder: 13078:13079 ioctl 40046207 0 returned -16 [ 428.440657] binder_alloc: 13043: binder_alloc_buf, no vma [ 428.451285] binder: 13078:13079 transaction failed 29189/-3, size 24-8 line 3254 [ 428.463115] binder: 13078:13079 Release 1 refcount change on invalid ref 1 ret -22 18:00:56 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x104, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) sendto$inet6(r0, &(0x7f0000000040)="81db1f63c152bf7d5e9cfdc2ce005c5fe5bb5f0751d8b4310d41ddb396b97b101a", 0x21, 0x4040804, &(0x7f0000000080)={0xa, 0x4e20, 0x5, @loopback, 0x1}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x0, 0x0, 0xfffffffffffffdc9) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 428.512181] binder: BINDER_SET_CONTEXT_MGR already set [ 428.517902] binder: 13094:13095 ioctl 40046207 0 returned -16 [ 428.526772] binder_alloc: 13043: binder_alloc_buf, no vma [ 428.532837] binder: 13094:13095 transaction failed 29189/-3, size 24-8 line 3254 [ 428.542475] binder: 13094:13095 Release 1 refcount change on invalid ref 1 ret -22 [ 428.888477] binder: BINDER_SET_CONTEXT_MGR already set [ 428.894733] binder: 13043:13046 ioctl 40046207 0 returned -16 [ 428.903244] binder: 13043:13102 BC_ACQUIRE_DONE u0000000000000000 no match [ 428.923763] binder: 13043:13102 BC_CLEAR_DEATH_NOTIFICATION death notification not active 18:00:56 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xa8, 0x0, &(0x7f0000000200)=[@clear_death={0x400c630f, 0x4, 0x3}, @transaction={0x40406300, {0x2, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000040), &(0x7f0000000080)=[0x18, 0x28, 0x30, 0x48, 0x20]}}, @request_death={0x400c630e, 0x2, 0x2}, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x60, 0x28, &(0x7f0000000140)=[@ptr={0x70742a85, 0x1, &(0x7f00000000c0), 0x1, 0x4, 0x2e}, @fda={0x66646185, 0x4, 0x1, 0x33}, @fd={0x66642a85, 0x0, r1}], &(0x7f00000001c0)=[0x28, 0x0, 0x68, 0x38, 0x38]}}], 0xd4, 0x0, &(0x7f0000000480)="e25e22adef2df5ee88125275198530f4f063776780879b2692a7b2f78eca54b35982d079ed4ca17eb462d6fef92608ad5261ec91f7a86489cb65c2c82b3ce699f0e8bfb810337f7b158e35a6e0181b63087114545f03380f454ab36c5c26ec86e4bc9b81b0a5fa6df6f290eac53384a9fbd1fdc8aca53986cf03ef5905fa427cfa7f2bc06543a5d5b6551ea41c423cc6bcc2048e73719a05a944cebe0b0bbe4074292558a5751e78eb40b441c14a5042dca8a83e1681213db02c19077e2afd5fd383f98986da98613d842e764c8e23e608e38471"}) r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) getsockopt$inet_mreqsrc(r0, 0x0, 0x2d, &(0x7f0000000040)={@initdev, @local, @broadcast}, &(0x7f0000000380)=0xc) write$P9_RREAD(r2, &(0x7f0000000580)={0xea, 0x75, 0x1, {0xdf, "b3c4ea526ed15f3a98411e906e7f626e513ba9e282ab6b831cbe8447032951b978869a5c7c3f7fabf4fe744e59b3096ff659475d694e82ccee90b177b974a0e3c795aeb83bec16f247c599edc3d5e6978a82be131750de8e27a60ea007fe8fefb134b2cb80546e0067f922031866f9e9294174a3ab4bf53a3a3460874c922697602645769b3cfeb584a7b0d55a022c25530cf85ecbff5804720480b91531011c9f98c07891be20b1cf9c7e25acb8f8b8708b1e551350e67ca493255c09b62c12df91bf3c6c2a7e982ba53c12c64a12f89c7c4db20598652a53f1dfd14ee343"}}, 0xea) [ 428.943053] binder_alloc: 13043: binder_alloc_buf, no vma [ 428.948684] binder: 13043:13046 transaction failed 29189/-3, size 0-0 line 3254 [ 428.958640] binder: undelivered TRANSACTION_ERROR: 29189 [ 428.967208] binder: undelivered TRANSACTION_ERROR: 29189 [ 428.991509] binder_alloc: 13109: binder_alloc_buf, no vma [ 428.997336] binder: 13109:13111 transaction failed 29189/-3, size 0-0 line 3254 [ 429.007027] binder: BINDER_SET_CONTEXT_MGR already set [ 429.012560] binder: 13109:13111 ioctl 40046207 0 returned -16 [ 429.012615] binder_alloc: 13109: binder_alloc_buf, no vma [ 429.024672] binder: 13109:13112 transaction failed 29189/-3, size 0-0 line 3254 [ 429.033629] binder: undelivered TRANSACTION_ERROR: 29189 [ 429.039577] binder: undelivered TRANSACTION_ERROR: 29189 18:00:59 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r1 = syz_open_procfs(r0, &(0x7f0000000000)='attr/fscreate\x00') getsockname$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local}, &(0x7f0000000080)=0x1c) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) socket$inet_udplite(0x2, 0x2, 0x88) prctl$PR_SET_PTRACER(0x59616d61, r0) gettid() ptrace$cont(0x1f, r0, 0x0, 0x0) 18:00:59 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000040), 0x4) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:59 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:59 executing program 5: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/status\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'veth1\x00', 0x1400}) r1 = epoll_create1(0x0) r2 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000240)={0x10000012}) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$sock_inet_SIOCADDRT(r3, 0x890b, &(0x7f0000000140)={0x0, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e21, @rand_addr=0x40}, {0x2, 0x4e22, @remote}, 0x24, 0x0, 0x0, 0x0, 0x2, &(0x7f0000000040)='ip6gre0\x00', 0x1ff, 0x9, 0x2000000000}) ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f00000000c0)=0x0) r5 = gettid() setpgid(r4, r5) timerfd_create(0x0, 0x80800) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f0000000100)) 18:00:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x200, 0x0) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000000040)=0x81) write$P9_RMKDIR(r2, &(0x7f0000000080)={0x14, 0x49, 0x2, {0x0, 0x0, 0x4}}, 0x14) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc4, 0x0, &(0x7f0000000480)=[@release={0x40046306, 0x2}, @register_looper, @increfs_done={0x40106308, r3, 0x1}, @reply_sg={0x40486312, {{0x3, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x40, &(0x7f0000000100), &(0x7f0000000140)=[0x20, 0x0, 0x20, 0x28, 0x38, 0x78, 0x0, 0x20]}, 0x4}}, @transaction={0x40406300, {0x3, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x58, 0x8, &(0x7f00000001c0)=[@ptr={0x70742a85, 0x1, &(0x7f0000000180), 0x1, 0x3, 0x4}, @fd={0x66642a85, 0x0, r0}, @fd={0x66642a85, 0x0, r0, 0x0, 0x4}], &(0x7f0000000240)=[0x30]}}, @dead_binder_done={0x40086310, 0x2}, @release], 0xb6, 0x0, &(0x7f0000000580)="4e473bdccf0d92d6b09d823871d79bf870021aad9e8d9aec643a0e1db74e22f6d8e394a2de196698f5c49cb4130e2c3ce36a44a3ba61dc4177c1d999fb049f8fb258ac905a2525c0205177f16b06ed851872d2c76efe1c674b64d8dc0facb35624b07119b83a4e88eccf4e38070ea706f32934f20c8fb53333b2f8d7269fcc26dc596fdaa214a149b15f6120473f417e6d73eaca355f1e8621404482691ee9aeb81af148f811cfbcca7db625c04e2953f5a8e05b34f6"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000060000000000000000000000008000000800000000004000000000000000000000000000000000000000000000000010000000000000000000"], 0x0, 0x0, 0x0}) fallocate(r0, 0x4, 0x0, 0xff) lookup_dcookie(0x2, &(0x7f0000000640)=""/174, 0xae) 18:00:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000200)='/dev/keychord\x00', 0x18001, 0x0) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000240)) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000180)={0x0, 0x200}, 0x8) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 431.337169] binder: 13119:13122 Release 1 refcount change on invalid ref 2 ret -22 [ 431.353715] binder: BINDER_SET_CONTEXT_MGR already set [ 431.361441] binder: 13120:13123 ioctl 40046207 0 returned -16 [ 431.369826] binder: 13119:13122 ERROR: BC_REGISTER_LOOPER called without request 18:00:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) creat(&(0x7f0000000180)='./file0\x00', 0x101) [ 431.389236] binder_alloc: 13119: binder_alloc_buf, no vma [ 431.402192] binder: 13119:13122 BC_INCREFS_DONE u0000000000000000 no match [ 431.410498] binder: 13119:13122 got reply transaction with no transaction stack [ 431.414854] binder: 13120:13123 transaction failed 29189/-3, size 24-8 line 3254 [ 431.418848] binder_alloc: 13119: binder_alloc_buf, no vma [ 431.418894] binder: 13119:13135 transaction failed 29189/-3, size 0-0 line 3254 18:00:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000001, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000000)=[@acquire_done={0x40106309, r2}, @acquire, @clear_death={0x400c630f, 0x0, 0x4}], 0xd7, 0x0, &(0x7f0000000040)="6ba289a5b1757b9384d8d90dd47dbe80126ee7448fd4a21f751d40dfb99d752762293b922c29be9cae6b392df8d705c9db8ea9b688a753fe54c4c81b8b308ee7320e6338522729d7d9077c584ac0d4bb3d8e2e3672f58d0fcb88839536e515bff80fcd6bcc9b61253e1b42ffc48def61352b70dc4fa1ba7a79db1a424dccaaf46d8ebef9342bfbaaa9b1f191d6535e3fab0fab917f6a611e76d34e2c40b72bf46ac858b3d850ab09d3fca35cb7082a9b5040cc3d6df662ccf312b72a7378d28f587cfdd7ade601fc31e3d61279320a9a145f9d4e2a9a70"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000001, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000000)=[@acquire_done={0x40106309, r2}, @acquire, @clear_death={0x400c630f, 0x0, 0x4}], 0xd7, 0x0, &(0x7f0000000040)="6ba289a5b1757b9384d8d90dd47dbe80126ee7448fd4a21f751d40dfb99d752762293b922c29be9cae6b392df8d705c9db8ea9b688a753fe54c4c81b8b308ee7320e6338522729d7d9077c584ac0d4bb3d8e2e3672f58d0fcb88839536e515bff80fcd6bcc9b61253e1b42ffc48def61352b70dc4fa1ba7a79db1a424dccaaf46d8ebef9342bfbaaa9b1f191d6535e3fab0fab917f6a611e76d34e2c40b72bf46ac858b3d850ab09d3fca35cb7082a9b5040cc3d6df662ccf312b72a7378d28f587cfdd7ade601fc31e3d61279320a9a145f9d4e2a9a70"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:59 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() lsetxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000140)={0x0, 0xfb, 0xeb, 0x7, 0x1, "cd244ed3bc748903546ee5e92f15686c", "280e5015e969de865974b64aedb0faba7988543aa91f76f565c6a7b22e71da289889ebdc58a70112ccc2eb61212a4b15ba3aa5105ad6c3843fbbaf54dc698f75fa6c53a2fd048307cc13175889070ef28419cca4206fef9524f5148512b3692582c246976de02444173f2e9b02030680b02cd7801899d8ba2b5c6b5cea677004679da0b4eb27e85c526348cfce63a40ee6d900f228832032bdc920a7aa764fb7c2cb3bba23593c7883366398193d869142ad1db14b7636a6d0934a674dfae6c85887ae565bb2602fbfed67cf2d59a27988a629b4f1ba"}, 0xeb, 0x3) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r0, 0x3, &(0x7f0000000240)=""/80) 18:00:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) read(r2, &(0x7f0000000200)=""/4096, 0x1000) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 431.441988] binder: 13120:13143 BC_INCREFS_DONE u0000000000000000 no match [ 431.450473] binder: 13119:13122 transaction failed 29201/-71, size 0-64 line 3025 [ 431.468129] binder: 13120:13143 Release 1 refcount change on invalid ref 1 ret -22 [ 431.482833] binder: BINDER_SET_CONTEXT_MGR already set 18:00:59 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e24, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, 0x260) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:59 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 431.524635] binder: 13119:13135 ioctl 40046207 0 returned -16 [ 431.533978] binder: 13119:13122 Release 1 refcount change on invalid ref 2 ret -22 [ 431.543092] binder_alloc: 13119: binder_alloc_buf, no vma [ 431.548690] binder: 13119:13142 transaction failed 29189/-3, size 0-0 line 3254 [ 431.564694] binder: 13119:13122 ERROR: BC_REGISTER_LOOPER called without request 18:00:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000001, 0x10, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x2c, 0x0, &(0x7f0000000000)=[@acquire_done={0x40106309, r2}, @acquire, @clear_death={0x400c630f, 0x0, 0x4}], 0xd7, 0x0, &(0x7f0000000040)="6ba289a5b1757b9384d8d90dd47dbe80126ee7448fd4a21f751d40dfb99d752762293b922c29be9cae6b392df8d705c9db8ea9b688a753fe54c4c81b8b308ee7320e6338522729d7d9077c584ac0d4bb3d8e2e3672f58d0fcb88839536e515bff80fcd6bcc9b61253e1b42ffc48def61352b70dc4fa1ba7a79db1a424dccaaf46d8ebef9342bfbaaa9b1f191d6535e3fab0fab917f6a611e76d34e2c40b72bf46ac858b3d850ab09d3fca35cb7082a9b5040cc3d6df662ccf312b72a7378d28f587cfdd7ade601fc31e3d61279320a9a145f9d4e2a9a70"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:00:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f00000003c0)={0x8, {{0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, [], 0x16}, 0xb1b}}, 0x1, 0x8, [{{0xa, 0x4e22, 0x4, @empty, 0xffffffff}}, {{0xa, 0x4e20, 0x0, @empty, 0x2}}, {{0xa, 0x4e21, 0x7, @dev={0xfe, 0x80, [], 0xc}, 0x400}}, {{0xa, 0x4e24, 0x72b, @dev={0xfe, 0x80, [], 0x27}, 0x3302}}, {{0xa, 0x4e21, 0xffff, @rand_addr="2a6d0b4e81b72d99e1bed241ae48d74e", 0x6}}, {{0xa, 0x4e20, 0x5, @rand_addr="0b019efac6bd9c75198d45ac9fc11a42", 0x100}}, {{0xa, 0x4e24, 0x7, @local, 0xffffffff00000000}}, {{0xa, 0x4e20, 0x4, @ipv4={[], [], @loopback}, 0x4}}]}, 0x490) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000200)={0x40, {{0xa, 0x4e22, 0x0, @loopback, 0x9}}, 0x1, 0x2, [{{0xa, 0x4e20, 0xfffffffff01a4a2d, @empty, 0x3}}, {{0xa, 0x4e23, 0x400, @local, 0xffff}}]}, 0x190) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 431.574869] binder: BINDER_SET_CONTEXT_MGR already set [ 431.593898] binder: 13119:13122 BC_INCREFS_DONE u0000000000000000 no match [ 431.600778] binder: 13163:13166 ioctl 40046207 0 returned -16 [ 431.601169] binder: undelivered TRANSACTION_ERROR: 29189 18:00:59 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4000004202, r0, 0x0, 0xfffffffffffffffd) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 431.623506] binder: 13119:13122 got reply transaction with no transaction stack [ 431.636764] binder: 13163:13177 transaction failed 29189/-22, size 24-8 line 3117 [ 431.652795] binder: 13119:13122 transaction failed 29201/-71, size 0-64 line 3025 [ 431.664615] binder: undelivered TRANSACTION_ERROR: 29189 18:00:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = accept(0xffffffffffffff9c, &(0x7f0000000080)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @initdev}}, &(0x7f0000000100)=0x80) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f0000000200)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x201080}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)={0x334, r3, 0x504, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x44, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xc60}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1000}]}, @TIPC_NLA_MON={0x54, 0x9, [@TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100000001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_NET={0x5c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x25}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_LINK={0x5c, 0x4, [@TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x90, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0xd41, @empty, 0x400}}, {0x14, 0x2, @in={0x2, 0x4e24, @empty}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x9}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}]}, @TIPC_NLA_MEDIA={0x64, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x20}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}]}]}, @TIPC_NLA_LINK={0x7c, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2000000000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x40}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}]}]}, @TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xa0c}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x463a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xe8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8001}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xe7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}]}, 0x334}, 0x1, 0x0, 0x0, 0x8080}, 0x80) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000100000020000000000000dcf02d84550a3260834e7742349fd729d9838d6389e82710000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) 18:00:59 executing program 5: openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0) r0 = eventfd2(0x8, 0x0) r1 = dup(r0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x10001) write$P9_RSYMLINK(r1, &(0x7f00000000c0)={0x14}, 0x14) 18:00:59 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$RTC_UIE_ON(r1, 0x7003) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000280)=0xfffffffffffffff9) r2 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2f, &(0x7f0000000100)={0x10001, {{0xa, 0x4e24, 0x195, @mcast2, 0x5}}, {{0xa, 0x4e20, 0x1, @remote, 0x8}}}, 0x108) setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000040), 0x4) ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000340)=@buf={0x8b, &(0x7f0000000380)="c9f40d53c21c1b5523ec92998eb37f3f5fe9b521eb027a8783dfeb83b85d43610c3e6e1c7169333e578e8fda6debb7220a85c0a18282776761940e288885da922890d862790c327637894cd7e565ba928b390c8bb70cde986dbb7a1211cab99a826e619ef0e93a7a86ec586b8bb9a017d86e575491f00666264353df296cad99708bc259c00a76dc6d0208"}) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:00:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) fcntl$getflags(r1, 0x0) r2 = open(&(0x7f0000000180)='./file0\x00', 0x80882, 0x10) write$eventfd(r2, &(0x7f0000000200)=0x20330f45, 0x8) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 431.665647] binder: 13163:13166 BC_INCREFS_DONE u0000000000000000 no match [ 431.686682] binder: 13163:13166 Release 1 refcount change on invalid ref 1 ret -22 18:00:59 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:00:59 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x800000000000000) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 431.733485] binder_alloc: 13189: binder_alloc_buf, no vma [ 431.739251] binder: 13189:13191 transaction failed 29189/-3, size -8980122637010981392--2798468614657509554 line 3254 [ 431.768217] binder: BINDER_SET_CONTEXT_MGR already set 18:00:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='ip6gre0\x00', 0x23e) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x27, &(0x7f0000000180)=0x8, 0x4) signalfd4(r0, &(0x7f0000000040)={0x81}, 0x8, 0x80800) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$sock_netdev_private(r2, 0x89fc, &(0x7f0000000200)="e1db3d55631fc1aaadfe04df774c39431a18db6999cdf273708c80cf14d1080f00360d4e13051c2b96d8942802424e1726b3857181c4ef21380480a3f5e8bdaad02daf4cb83c7b7d75b3b890bc317d5ccee99b1a996959b657a0b34156eb025b6cfe7f") ioctl$void(r2, 0xc0045c79) ioctl$TIOCGSOFTCAR(r3, 0x5419, &(0x7f0000000280)) 18:00:59 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) preadv(r1, &(0x7f0000000600)=[{&(0x7f0000000100)=""/141, 0x8d}, {&(0x7f0000000040)=""/46, 0x2e}, {&(0x7f00000001c0)=""/123, 0x7b}, {&(0x7f0000000240)=""/137, 0x89}, {&(0x7f0000000080)=""/14, 0xe}, {&(0x7f0000000300)=""/252, 0xfc}, {&(0x7f0000000400)=""/24, 0x18}, {&(0x7f0000000440)=""/191, 0xbf}, {&(0x7f0000000500)=""/211, 0xd3}], 0x9, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 431.779061] binder: 13199:13203 ioctl 40046207 0 returned -16 [ 431.789690] binder: BINDER_SET_CONTEXT_MGR already set [ 431.811878] binder: 13189:13209 ioctl 40046207 0 returned -16 [ 431.811915] binder_alloc: 13189: binder_alloc_buf, no vma [ 431.828210] binder_alloc: 13189: binder_alloc_buf, no vma 18:00:59 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000140)=""/4096) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 431.841646] binder: undelivered TRANSACTION_ERROR: 29189 [ 431.847397] binder: 13199:13203 transaction failed 29189/-3, size 24-8 line 3254 [ 431.855769] binder: 13189:13212 transaction failed 29189/-3, size -8980122637010981392--2798468614657509554 line 3254 [ 431.858427] binder: 13199:13226 BC_INCREFS_DONE u0000000000000000 no match [ 431.873461] binder: undelivered TRANSACTION_ERROR: 29189 18:00:59 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x20000, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000b4284ad5c8c558ea0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) bind(r2, &(0x7f0000000040)=@nfc={0x27, 0x1, 0x2, 0x6}, 0x80) 18:00:59 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r2, &(0x7f0000000440)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x11}, 0xc, &(0x7f0000000400)={&(0x7f0000000240)=ANY=[@ANYBLOB="4a29a858", @ANYRES16=r3, @ANYBLOB="020127bd7000fddbdf2502000000800001002c0004001400010002004e22ac1414bb00000000000000001400020002000000ac1414aa00000000000000002c00020008000400040000000800030005000000080002000300000008000400400000000800020055000000140001006574683a73797a6b616c6c6572300000100001006574683a69705f76746930006c0004000c00010073797a30000000002c000700080001001f00000008000200f9040000080004000800000008000200ffffffff08000200020000000c00010073797a31000000000c00010073797a31000000000c00010073797a31000000000c00010073797a31000000001400020008000200ff01000008000200040000002800060008000100fcffffff08000100070000000400020004000200040002000800010004000000340005001c000200080002000100000008000300a1e7b71c080003000080000008000100657468000c0002000800030005000000"], 0x61}, 0x1, 0x0, 0x0, 0x20004800}, 0x24040000) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r4 = socket$inet6(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) 18:00:59 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 431.902024] binder: 13199:13203 Release 1 refcount change on invalid ref 1 ret -22 18:00:59 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x30000, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000180)=0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000100)={[], 0x3, 0xec0, 0x0, 0x10001, 0x3, r2}) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) fsetxattr$security_selinux(r1, &(0x7f0000000340)='security.selinux\x00', &(0x7f0000000380)='system_u:object_r:lvm_control_t:s0\x00', 0x23, 0x2) recvfrom$inet6(r0, &(0x7f0000000240)=""/32, 0x20, 0x2, 0x0, 0x0) fcntl$addseals(r0, 0x409, 0x5) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, 0x0, 0x0) write$cgroup_int(r1, &(0x7f0000000080)=0x400000, 0x12) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000280)=""/69) bind$inet6(0xffffffffffffffff, 0x0, 0xfffffffffffffdc4) ioctl$PPPIOCSMAXCID(r1, 0x40047451, &(0x7f0000000200)=0x9) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)) ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, &(0x7f0000000300)={0x7, 0x57b3}) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0xb0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 431.964948] binder: 13240:13245 got transaction to invalid handle [ 431.977252] binder: BINDER_SET_CONTEXT_MGR already set [ 431.978956] binder: 13240:13245 transaction failed 29201/-22, size 0-0 line 3117 [ 431.984822] binder: 13243:13248 ioctl 40046207 0 returned -16 [ 432.008109] binder: BINDER_SET_CONTEXT_MGR already set [ 432.013884] binder_alloc: 13240: binder_alloc_buf, no vma [ 432.019852] binder: 13240:13254 ioctl 40046207 0 returned -16 [ 432.026580] binder: 13243:13248 transaction failed 29189/-3, size 24-8 line 3254 [ 432.035086] binder: 13240:13245 got transaction to invalid handle [ 432.035569] binder: undelivered TRANSACTION_ERROR: 29201 [ 432.044090] binder: 13240:13245 transaction failed 29201/-22, size 0-0 line 3117 [ 432.049184] binder: 13243:13248 BC_INCREFS_DONE u0000000000000000 no match [ 432.062160] binder: undelivered TRANSACTION_ERROR: 29201 18:01:00 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) mount(0x0, 0x0, 0x0, 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000300)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='timers\x00') ioctl$VT_WAITACTIVE(r0, 0x5607) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0xfffffffffffffffc) creat(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$TIOCEXCL(0xffffffffffffffff, 0x540c) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='cgroup2\x00', 0x0, 0x0) pipe(&(0x7f0000000180)={0xffffffffffffffff}) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x0}, 0x18) write(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, 0x0, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 18:01:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) r2 = fcntl$getown(r1, 0x9) fcntl$setown(r1, 0x8, r2) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r3, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) getsockopt$inet6_mreq(r3, 0x29, 0x14, &(0x7f0000000200)={@local}, &(0x7f0000000240)=0x14) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r1, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback, 0x95d2}, 0x1c) bind$inet6(r3, &(0x7f0000000180)={0xa, 0x4e20, 0x5, @empty, 0x10000}, 0x1c) 18:01:00 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:01:00 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:00 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000001c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000140)='lo\x00\x00\x00\x00\x00\x00\x02\x00', 0x10) r2 = socket$inet6(0xa, 0x1, 0x0) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) ioctl$BLKPG(r3, 0x1269, &(0x7f0000001200)={0x4, 0xffffffffffffffff, 0x1000, &(0x7f0000000200)="f128b31e9b1dd2dc5a5f6dd106096f44169115e60904dbe53a95a937dbbea9d65ed88d6c36d11542bcd17076cba1ceb953d85182501b5556592ca44fe348a195dc4de50f8c5ff4e236affee063f204f79f407ef36d76bf133b1f978ab507554d433498ab65773c1016e969b71caae0ead548681e25cdcf47a03dcf6e4a9fbd4d1cb8b2ca97772d10b7f80e20320b148fd5f4f7ad5cd818e72cb1912cf2bd2f7574480f4791e40879436a60064f8092f4d883703ae412567daa1141ae87c0c5076e19117d08b5fa7a50359a69d4c4366495aeb3d0a8383978f7766b1a3f2a06be2b50d6e162d50979ec4d2df554dad7f11f0f75884e94084f374bc37e4118034831584baeb8f3e4f78f83fb6aa48bb4768146e70fcacdc8391b7d5f35adc68ab53c9a7bd2bd4e272a91a19580015cd6b063a20070b9338555a4b0b159557b3b9d2989026fda6af3e51fa5db733bed2090add61d31b7a3c11d866820fd69689202789b069a04723bcbb8fb103f833133dc45c01ba93be092b4c71b5b39cc15d239b906b2f7508e48778a1064c2d8f41b1ba656705eddadca757e2902172790e752d1f6b9bc2814ed4e90fa2b79fce77e44ba2ca7849931a21dd400cfb1be024c38d7bc1b896eb133b2b7041368790272b4d4d60cdf475d12af91ae58bcdb179e73e56a7b1c5fb5a957029f2e026ce3b1b299b4b4ec00b134488e16fe7602d45d5f0259857f338ad90959a6acbf10ac18d6c6e6c8aa01c1ff0846f50f662c79f63d58032016ed3bee95d85f2202f37144b4cc62ceb247cf0fc6eff0c12514fd5a4b85da8143eb6f89f0eca558d3991f2e31d8973e065b1a6d7e9ecab849b6f69f11b860f4b94e89801b7df33a2607d8ada9938e82109fdf5776606232ecfd2d0791b4d32c527a50234f86379127db9bce25110b890312a5e4a1a42f60470b7989f8688b65fcbdd18f00257c0a65092c8786924fea2632e828296e2785e0815234c27852d80cfcd642b9063eb7ec5c9fec228040db40563ef9d4f087735d0836508e6d87a0a456756dc9a8a0cf8bc7efa67468dd17d8f5789dd50993cb21c09c5825faa9fc45d0092b77b2ee1d4ef695c935e372936a928a08841a9b55337fd6b386efd764d15ffb3b4f3ee15fe42a62dd8cec0cd4c94f26b3e60b437a622cf92f7005a34430875149fb141de615ffecef7a5bfb63cfd8f4bec13cb02399ec9c675f892345f7f93f12fc029a355dd46b6c20579f70bf8717c29c99dc28e7ed918ee9440f603f5ec609e818f5e33449d4dd6b34b543e58500a6c7ff3891e6a31639f8ae137b646d068a04477fa29c352b0937cf86bd1da07fee1668457a73ce9c2e002299eaee996eb3e1247f660811b42e798394fb14ed8e8b09d4627884012ed8a62832382cce9fb584e454494b522452f6e5dde57d5220ebecf3aab7f71baf42786a219940ede2c72dcf340cc7083fe01352a22e95777327007882a0db5043cea1f2fefc021cc63dc0892e04ce36f28b885dfcb6ac2e71abcdfe969d3bfbc9d6c3f76728337ef87eb6853946e745deabc924b98f44e2bc99d7111293e8ea5d4bf1d3e17b975ab2fe1868e86f344504732e4652cd46b8f84858f2120061d6cba9c52478b65efa75ad9afcbbde1c5832465a4c12c2a80f6d8cf9d9d91af732a41f6246b5f92f550ff0926c570b2a06d148118fed19d67eda8529ce00c85992d53cc298c43f0ca7219b6b09a26c824c7b45c28ea4a989cdf0e51344576b64351946e34cafe6766510dd1241668a5320cf54e9b1b2364bd2b3405ab3459c54c5dc1cbb824bdaa34ee2211068fe10c123a335d5c75548cc28150c355454158d1a3d0258652aae2a6cb92c2d3e306efc7b3d654ee2ce3e5240159a2d47fc8b0c058680f80ffda10d229c3b546dcd22652aa23d3ea10e3f1dac1cce8749505a07839e04a67220ff604d0d344bc62e618a7eb4932f64664b0d22623618b4bd1cef0af98b6306aa242d42f447863951f62bc4b45895d1f8410685ae5cb8de771d0b1587a24bfd904349f95969a017bfef1ae4211e7a5ea984d12313d12c438ff1f8c76d30d235d5e5131690d787c3035d9dc4fff594610883c72369bd3548328a5a13da658ad2efe4084fd7d9fd09278bb53812857a9990956c760bd7dd4bd24d2d6a59c802fd2d16a3515db787da56e1d180ce13ec423f687b233df88a56e372df5d52a3576fb143e13bdbf630b4bb5d274248b785ec613f9bb9f8c20090b7b56f2b53e38e811afa0df2f69a7f829048de30577c65d5f47bf32e0d882ffe25c43d146d1aa8603a4e2d0073499dbc5618634763b15648a0b676d3740eacce660ab1ce4c55852e606967d35f22bf46b88b52e19581e85fbd57539eeec1451dd78cf2f49a784ffcfa2cc0fe0364e1f2255e63e9c150c6048dd5260692317ab3aaa8d9773013f15cd941df83222c3915b2c337fc3b9c7624031c9d0b5ee8c99ac46434696ec41a0c18677e3cd004b9f0264ee28c5934b29d9497f476dbd1b3d6241fbd595875cb2f92bfea7b679e433557fd53feb26b57f01703947ed6868687a3af73a6bd90abb0814b0f9cbea8012dc265bf5ba31432fb193a11d120ef3a87201f9340882c0435d3d7a4ac970a03661b0ad53f7f3c9540b765ccc132504ec51ee50dba4d13feb0af98cad54f1df12e0fe6e8e14943e2fda80777420ca89ef2d1e432a049bc1681f7cb232fffa24ddd3c6385ee339b37546cb3a97d6e8d6abcd2c590d8628d90e601ca79efd9422f133f3cb79432d9195e3c17d8dccc8bad314d2ce201ed67c3e703ed23343adef7a91535278d0b5f7758a7e76341b93ae1f732a2ce30879ea22149305f9153e4221b90ef29e9c20396134e1eec2c9889e3300e3263692fa43243e0de904edf7ce873c53f03de77d3d475b463e3fe4c93e1d3264fc5c12f84a02dd52a1925565e4a8ae54074739c51f2b434486f7959f3f034b71c7899c02ee622e0218ae8ab1df96213d557a6c602c594cb3f4daf837455d6b348742f07823ac2575bb62979ba2aa4a6ef66dcce39553d192abb07cdda74d4a0ee443a85a1b29441894252393d5d5950f8267b57cea977c093851bf200330492ac8ed8d2c11c524e7aa59f17ed0ffb05b1f5e855c8638561f4f88778094154d77d5125afdb3a54ad6a174c256a47044ab07345b244b0649d7ac09842e7ac5eb4c60374e3908dd8c10fbac26479819982858364b270fe5f789cce4d539801faa882e4c36111ff903f0e1df0917a7b088f711c25baf5a9bf1806e4237f5a30931c9fb733f2682fadb693e7052b86a993975d4b005da5a9a44a7336770e20f80fee1aaae237b75e0b1bb385407d13e417829aa9d2ce72cb7abad59765b95ff41e82d02eaf1c91325753b6bbb54dc7a9acd30747279b5f7251c6ecda8db0ff42cd541a96236c7ae9d78928c679afcf0736396049e74eb79dcbcf525b634274c47d78e439aea75b047d4f643f1c25f5664e0e68eb0d156702d3b71b3cd8f065b22de0136b42fc5379121d2bc948a56937503ac05e9b6891d8e25b24ac23f4c35d19e87c51bd02c8c5a72fc0aabf3b8fc4e9c139b5370f1ae5fa8b6a8d284fcf35545f135ee6f14356ff29f28ca88f82ab41375f17179d7a6f3ca818eaea7b3facc83471720a8c7dddadac3c3a1f01770345c8432cc2936ac0d79419d5a1400c7ddc36668ed39fffc7f3d4a904895c303b88ff18036ce5cecaad2907df1eca6043f349e604d87700b5ab594a2377e2a2d2ba5d86afa682f007e6bb37b408482e9bd0fb99c876ab3c8d487cdf1130ebfb89280ec88d32755f2e1e20f9a2206da003bf53b2f90a1635da7dec593b07813bd7d852d08affb06cf0cfbc9d14c3907bcb1a978397f390502a5a2f6e44b5931b0a591d47ef3a7b5191923dd8329722193dd83e7efae33c1a261a6c9e77e661521dad110ef8a88bac40863bb4db9cbf6f935795501287f92b6d3375310aa5165fca3b0554fcb3ae55c8b7f4227a04b1d0d783be8884c7f3d7ce1da6bf641055c243f679a8b6244e3de17a276dd47d07aed6b70cccb70f53214282e64fdc3a1ac1a60061baca40439d5e3f8fa3f758215e2be30be4db647ee55e09bb47f770984569d264650bbece21c0ceb23d6ea3d11335ee5914baa10fb19ebe7aa23ce08ef2c2332e4799251c55e0d7bbb2571f51e30a7842b9abc5e9d36a4ad1a53a1f3352b78559fd84c87ce1b0945284bff566755959a8817fa791e2c443857852618a3a289f21deaa335303a1f04609fbf5b5d5e95e73b36a5cb465281bbb0452e2662a5077388866499bd9e5f56cc802b95a26cf95914bbd9f048f298fea7ad1019226bda1bf815e28effcff254fb109fa0ac98cab4e7197f8072868e6e2bd6a1f6de92111431d23ec59cbba2a4253e359d4b2db2c73ca65b9ed14e4113bd22c100ccc9897f1c103c62a381cceec74782c0950150513bfa0bc84999c88321b4b87dbcda0624323fc79deee220722a63273af440e9d43d76f983cabce6d0aed5d701ad559fd3286d74d0bd08933d84f447ced0ccef999bc1a3824e348b481c03bb4508c6c099145259194b4819452b1c404807645016b5dd6fcc9328d09df76fca297392fb7df5727029799c97f7a3a809b90250b2338ea55566fe04b1ed0573ae7f03ffdf82701e6dfbbe38449145d24c08269eaa32931927c7f7556d24ea8d083f531fe22651c4b6e0cf45ee52cff3d617d5e4155245775ee7819562e9393669c161522a9f23dab134999baa5bf15558d38abc160903e005f077fe627c8b93945abf160ed3b6b73f1652e9a1fc6176eec7f9f232ee80349fcf2986c91fff6198e8bd38b1b5a10734f114d5091abac1ffd58b2515eeac8ebef51ad0bc9c686b78735f33b8746fafcbed51e26f6dadf6a641ef18c65caea962a6f4e526f83b4895e3e930c2fb363fd5ed68323d85778195d127b7078ed6caaa477f2bd3cdb4a225c49e949aa67771ca41d89013f474d19cdb5cc2789cb99f936b436574322b71a0f8d5358396bd20f72ac4fb807d027778bcafab840b1d2c7d0b3262d55ef4e7d58123aef43a1aefa0f5e2f09a9560d9d36f84f8ba6a3e5c3dd51d138e45e7f61c89ca5fd6334cf8ac8f1190a9c388f891c72ff73965d5c99607872b476a911f7bbb88822f9e8f7889b38ec7553efcb73946b7b87f239f80b78818ebd859a971900133c41e2af462b38f8f1bdbb4309f12457187eda8cf1087a777933334f16cc8de679c3957c0db544bb0bd74d1caae08b3a111fae51abb4ead2ba3061c806ef7630b7887e27cdb1c1628b1c3ee3fbe192af539920ef541f82f7730c56f3a3fff42ab2ddb49ce9e6889299f9e0e30ebdd2a158878d81d70f5850ecf60b2da4bd34a20fca5a0fa2e705063d692f926633071b5c4cf2f6850b3455f40439c80cdbc71837044985d7645b8434ba7f06b353fdce583c5ba177abc342eb39e81f52b0357028066afecbe85b761a50b31ede1af1eda8c9364d8925f9a93d38daf47276795b70f79b97433c5543fdbbc9d4ced27a25a22c4c2b7b7407118fbfc3fbc04e69c6699dec0e8566176ce074ea84d7f9965f5492663a2534a3524f20504fa9a6083979c2711738045213321ef249a4a30438a8d954d37c6dbcc3a133a00656ef8c7d9afe5a19c59c19186cdaf67837f36e1654e5718170caa359ce1d1c35fc8a6d663b6ff33062a330cf4804b70213a157a67c11c87c87d837369d63c0679b95f2c5dcdfcd877e95e47676e3d1ea9709dc252f759444a6cd565358ad"}) setsockopt$sock_int(r2, 0x1, 0x4000000000000002, &(0x7f0000000040)=0x8, 0x4) bind$inet6(r2, &(0x7f0000000080)={0xa, 0x44e20}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) sendto$inet6(r2, 0x0, 0x0, 0x20040000, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) [ 432.520158] binder: release 13265:13267 transaction 673 out, still active [ 432.527954] binder: BINDER_SET_CONTEXT_MGR already set [ 432.533979] binder: 13263:13266 ioctl 40046207 0 returned -16 [ 432.540310] binder: send failed reply for transaction 673, target dead [ 432.543032] binder: 13263:13266 transaction failed 29189/-22, size 0-0 line 3117 18:01:00 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, &(0x7f000000dff4)) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x3ffffc, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000280)={'\x00\x00\x00\xe6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00', 0x5002}) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[@ANYBLOB="28ce54c3b2576370151774dd0810996800000010005fba000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) ftruncate(r4, 0x2007fff) sendfile(r1, r4, 0x0, 0x800000000024) [ 432.576066] binder: release 13273:13275 transaction 678 out, still active [ 432.586380] binder: BINDER_SET_CONTEXT_MGR already set [ 432.598025] binder: release 13263:13277 transaction 681 out, still active [ 432.605647] binder: 13263:13266 ioctl 40046207 0 returned -16 [ 432.616034] binder: undelivered TRANSACTION_COMPLETE [ 432.633605] binder: send failed reply for transaction 678, target dead [ 432.643970] selinux_nlmsg_perm: 6 callbacks suppressed [ 432.644090] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=22450 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.656509] binder: send failed reply for transaction 681, target dead [ 432.672931] binder: undelivered TRANSACTION_ERROR: 29189 [ 432.677120] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.692586] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.705785] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.718952] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.733393] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.746972] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.765071] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.778080] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 [ 432.791154] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=13286 comm=syz-executor.5 18:01:02 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x3, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:02 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) fcntl$setflags(r1, 0x2, 0x1) 18:01:02 executing program 0: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000740)=0x1fffffff0007fffc) io_setup(0x80, &(0x7f0000000000)=0x0) getsockopt$sock_buf(r0, 0x1, 0x1f, &(0x7f0000000780)=""/72, &(0x7f0000000040)=0x48) io_submit(r1, 0x7, &(0x7f0000000700)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x7fff, r0, &(0x7f00000000c0)="20650197b2d203f7019c91cd5e736a38eea74546e234095dfcd149614408026cfd417413b0a96e5f13ef7c7152aa185126e4b415e6cefa258a", 0x39, 0x1ff, 0x0, 0x1, r0}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x7, 0x8, r0, &(0x7f0000000140)="35c4ee25bd5deb58e0d8c51807ad101fcdb1987dc4c8a9c80440605c8d5ba1c24c5b18a5a938f4236b7aeb5b07048c3853243d1ea8d6f1748d913806ab573794b7ada9c395168a60252720e186e515fbe538dd1ba9027c53cdcea088d16a118dd531cb94430eea806b4727cf04e58a31793b68679ea7d8acd8da0e3a93aead9c62f6672fe2709791e8c5af74c534487b547476db55c4cfc0ffb1d594a1203c4cdc9cb80d75482255a486fab2f46fa5847ae2166cb5444e5825f36dc375ccf2c175eafd08dafb", 0xc6, 0x100, 0x0, 0x1, r0}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x3, 0x1, r0, &(0x7f0000000280)="d2ba972337f0595e6b4ff53df0708746a6e8cdbd7004586981ce676fbfbb0e0bba2dd9d33958e2b184d78d3e049306505bbe9762f537e0ca56512189ff48a8620907dc7b80927d97d6ba85febaa8cc3dc0632a3568fcf0e3bae3b1c4a4f19bbdba3caafe1dc1754c8728975b3dbe71baeb51fc12b667d90acc2f5a5b48562d33", 0x80, 0x8, 0x0, 0x3, r0}, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x5, 0x4, r0, &(0x7f0000000340)="f6165580d4799d51e3cb48248e781f2f0d2c9ac0feff8dcd8e723215b0342878def8a54524597bd1d3a1097b10b3e9b9d3b5d4efabd80989f03a79c08ed43d2d020fc78de3981539ef2ecf92f3ea6037684241516187e8e00d9f0fdb328f938ecd9ef749ca93aa4ded7fcc779e286a1265fcae09d995ceba826e08370d3f944345626f3510e8f03a9189e7d0ff2191bf050d57bfa631adc31ba02c1cd420399d634c2d08", 0xa4, 0x1f, 0x0, 0x1, r0}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x3, 0x9, r0, &(0x7f0000000440)="e589a3f1c89399456e7ece89da019c02d3e5c36d1f72254fc2f02b5aeb1d63f41403f435a8110f59fe0e47b1cfe437076b6724dfcc684fbaf791f90558cd6135d16c0b4023e896c82a9a1a6cc1b6dba8f73b92c93434fe57c5ed2be31cd2f37cc50dd6ddb7f030d7885fb2f4af54b8fbc5300eb1bc144f48a0ad49a07429dbe52240beea9f4918fd965874d1170a7ea51905b6696b776634bb44", 0x9a, 0x1, 0x0, 0x0, r0}, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x3, 0x2, r0, &(0x7f0000000540)="794d0d9953a9ffc3136e98da7446af1e0a2351fbea72417d20fda6b3c40e255bcf247a5f40162eff4c5c9cf1e306aa031631bba32287615baa30af0df9f3b2f49ef456", 0x43, 0x10000, 0x0, 0x0, 0xffffffffffffff9c}, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x7, 0x2523, r0, &(0x7f0000000600)="51094ac6e7505841705bbee2f17e9bf9455fa8a4a2af31795c68881a534ff43f740591ded99d03f16d365014ca2ee6a9e3d04c7429d0c0ddcc1cdd9daacca34d1dffc51a7ed450737b809a93f84d06de321b183b39b20bb32d313a37c7c12eb402e63e61697e2309af0151f364f83cad62183d65a5ba744e5985a4064b01d82f7e8fac882fd0a5bb7581e5befccdbfec4bdfd10c28", 0x95, 0xffffffffffff1698, 0x0, 0x0, r0}]) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000002d00)=@nat={'nat\x00', 0x1b, 0x5, 0x480, 0x318, 0x220, 0x120, 0x0, 0x0, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x3e8, 0x5, &(0x7f0000002c80), {[{{@uncond, 0x0, 0xe8, 0x120, 0x0, {}, [@common=@icmp={0x28, 'icmp\x00', 0x0, {0x1f, 0x9, 0xff, 0x1}}, @common=@icmp={0x28, 'icmp\x00', 0x0, {0x1d, 0xffffffffffff0001, 0x3f, 0x1}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x4, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x21}, @icmp_id=0x67, @port=0x4e23}}}}, {{@ip={@rand_addr=0x1, @broadcast, 0xffffffff, 0x0, 'bond_slave_0\x00', 'ip6erspan0\x00', {0xff}, {0xff}, 0x5e, 0x3, 0x40}, 0x0, 0xc8, 0x100, 0x0, {}, [@common=@ah={0x30, 'ah\x00', 0x0, {0x6, 0x3ff, 0x1}}]}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x4, @multicast1, @rand_addr=0x1, @port=0x4e23, @gre_key=0x80}}}}, {{@uncond, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@ttl={0x28, 'ttl\x00', 0x0, {0x0, 0x1b}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x1a, @multicast1, @remote, @port=0x4e23, @icmp_id=0x67}}}}, {{@ip={@multicast1, @multicast2, 0xff000000, 0xffffffff, 'batadv0\x00', 'ip6_vti0\x00', {}, {0xff}, 0x63, 0x3, 0x1}, 0x0, 0x98, 0xd0}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0xc, @loopback, @broadcast, @port=0x4e24, @icmp_id=0x66}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x4e0) syz_mount_image$msdos(&(0x7f0000000800)='msdos\x00', &(0x7f0000000840)='./file0\x00', 0x8001, 0x6, &(0x7f0000002b80)=[{&(0x7f0000000880)="b9a48430267137dcbf429cc691aa3d688700e2a293e5f87b38a8a4d52637cbe6b289f9a9f81e55c138f44eb231b810a639fa84587038294092ed7de8fed55b9f770d6bc042dc4e4e7ca1257da07dfc391b04cc2ba235c825a7df071b40276af7b1fbf743e68c3078b2a5808f725f3d938b7d94a458d5ec754f655d0118bf2b2df50b449625d06fa741352f6d6fd23e0d00f5851339635a111b6975d230608c6859a9376bfd88d5832af2b0476eea6ff8a82ac6f4f18780646dbc78873001bd4311ccfdf0448b509fbde936ae4be0f868f98201ba569892cd893a47a5a6f4f7d13e54d20c9c74e4244662407ee8449d0a4b54cf56f1b739e3c9d79a4a3296521d6e017cac2ead61d3e0cdc1561bba0f1671d2752aed3a474857cb2a9f0a0bf74a02dbaae265a6549056adee54f3305b1de29cfb3a26191bfc74fd03740e01dc8a057a10b358bd95c63276f428eb150616439a94cd1ced0cfe5b7695d8723e7152ced018e4ac7f4506b7160990dd4d452535d8850d629a8591841f74c96907b047dd5264e4fd9a4648333156db9c11058bd69aaef3c89e2dd7305c897e61af46439fdfcf23162ad191612f33a4b8da445cb4ced3082cdb55f260c89c7cebbc086ebec3a89b44640201ff00b5c58d0f34d95b4c06b0fbf7b881daf4b0f8dd00e2dea65bec80de6048931f7c9f3fe253570f0fa4f98d81eacd6ac94dae425718c32db6d3849ffbad2dbac888d467091ee231ef7b29350950a43d33b162b11eac2b31653779b903c0fe51814bb50b4794a99ed46e03f5eca4cb7511eaf6ead801e557776777a9f664c9eddf56c42260f7b499199eaa55b1eafddbc35bc13c133f8dbfbbc7caba3f53c9cc41f73c2782afa7f952b172abcaa4fb7eaf5bec2fc8a934f7ae2f817d2cb75bbe86d2d2a68179aeea4262abd51c26dbd835b11955b1f7b17c98425af0d016edaa7955d929fc5ee862476b0a7159df507870694b73cc23d1f558ab12b9955d530797e1570fdc294f94eb5267017031da51665c01ce84b93d29e59fe22b806a9ffab7096120cb1b0ee3d42c6e26e4397263fc954fd0a06ebcb0b94710f615566ef85c7a951d2cc7106b577dc875277c129a77400f0569c761f3feec6b6ec059f061266a5fae91171424b466f2d051958d888cc8f05b003f66e8f2a67b9f69d1c912d85169df2f750b31ac46bd68612f4793c579a0f6b8b314239b954bd90312bddea984b2ddf72255ff9131f2b8f5869c21976c97473279faa9d4fc94d8511e34522c9eafdf5f23c61694aa6aa89748b3d0bb8a46e0a75e03b36453150392b1ec0d4f29d9046ab70ef4172d1076dddc1548200e2d4c676eb0b6325f50b6f19ee6088f79fa29c1114907cdddb974541beed8260babc1178c702de75037649cb7790e82bd389edf8a4513c49393aacaae42cf574088c3cf125eadc2a3508551b5cbd493303908aae4cb707f8c4f3dd16a48cfc1f9f681d93536ce2e00180cda297d119a2d059d149da0bd40049c676679dbca56d6633cae74f6bb80a0e7d1319929ad052b08d3ae574f758deb33fc8a363b93608693c1f7f2a3c20530e6b9168eea0f1b99e1aa149ae5049fc5cb542aa750f1900b35d1892354ba370beaf578f3d81d6c4c77dfdbdc17ce18d8f1807c1d94453d238888e0457b3e7d0b54600c603593267faca7d85bf71d510fa8c6ee908db0691066ed44f877c9bce1e84fcaa7a956405d35b0fb0e670367a50a1b5bed1d95647ba9c2d2f509f8364f5be52bafd975aaf8b12c3ac577b28f9325538b7790afbf9b12e9969107de561e8464c1b758bb2531698421b774a619cc15a964a12e3b3ddfa4062b7bd9231c9146e49a2572e0b01808d2aa29c922219602893eb47be46e9cfb8a5751c7855d23301dd1057492d3b7f72f58bc57cae7eec7cc0ba3fd254254fca9416b0808bc9de24953f82f980df5a3c088085efa3fcda60e35292862502b9e4a72768ee3f00b338bad1a09765cf0b9c7e89e4709212adb3c8b067b65e65da7781e41c50a7593775b51462f6c97a702b8feec7627853b74b59054f4fa0dc776655aed7e92b39de8abd9ac6f37341bee5e109af708fbae9addd566c840c3d8a4682af6b83c00fc7d5c3a8f3f4a34145b08e6990b9da2a0f7f22edf8095fff1d9598b3e78dc05a496b8057785dfd999a07da1a4861e0b66956240d70078ca537dd1f2d16ea7066a8306484baabeb5370865177482a700d6059aff89fd98eb5bda1f5f1a56b17258fb9e40b8c3fda1a73adb149c658b19f0cdfacb14d5cbd25b7ac641b769196e38741882d67791567c5ca68d0ddc87950cdab4b49cc8f09203767cf5bfd68dfb58da8138b33ac28f55c9b2e81233cee88c72990489e45f4dc02d673bde59c7aa09fb0dd6b4b38191ee3056cf6db752f6a88f02918dd990f22b69f9aba1af7c586cf48b437a640f94ee718a0040f11e577ef11253299dff436aec788164542e14e5a412d0ae84358d3bb7804541c5d114f17cfa7aced57d6dbd9c3c4d61d789a9f60004536372a615ab99b1b5825bcaebae6b85489327eef04086e475186e4200f3b56009e92e41d5000379e05ad4d64c1085def465e10e395efadb5b206cb8f65cbc314ad9fea8919d8814e4d6cde64497ac8616d1678299b491d06c1b7bbbaa9d548fb223d0fbfc3ce09c7db65d83e683e1d8bab112b570fa8288216730f919dbf075d9267c78099ad620a6bfe1f824fde11836b397a85f8be02004af9890f118aa449f781bb71744ef852493a841b671d607b0d4daf6d58d9872c1d77673f0d8f1e2fbc125e68596ebf201099cee49ff7a29b46cddb43a3239e3018e23e1298b0a9f2c5ca0faeffc32d516c96e7658f0222f194c136a9235b3d6c10a4c3a648c4dce40aa3b6d246f759b29c4895cc41eac9059475e806d8b11f49f34150e67d45a4431b7ca5c0ade9f967e6d2169f19ad18bc7d22af1197a692d6f9996d5d2c96dc06e33b015229567e17467be0f59ee4eea11ca6ffd9a6af713535db2d38adb50b1fd9bb0411b3a313275f33a862140ff9566b39c9a4e790dd26dec5e63ee698a2a23646fc8ec796099fda40f31cf1f76f0fed7be68d4e3ba363bfd7053501f9b22d0f9b139509966f4bd693bb281bf1376587444ed12910b313c8eac17792a8958de286631723233257f9e5f0c7fca8da57ec3b1b7eafc12e0b1d89797472480b2ddee2f6c0a03e521f6345d0c6e9b240e2811bceeba1c646eb36f91188054fdf9e4cccda459c28b8344785d42e2f48ede5b193a2e988e69203cd840e2c8b8a9f00bbd56f26edf16113490526d8d58e7ad6eceb70ec7f75620fbd39b354f95ada1394b07b82cd1faae6f346aabc64ec4e78f44b11dd2bed2b5424bf067065af3a24e847184a9331cac96af279e82f5609845258aa082a21fa74be3353a7ad7a0097f94f4719b52f2ee2d42c2aa7474487e8f0472a927e754bbba6a5d058d8b50c1cafc8050065df89f0c09e3b4ebfca5b2f3387b4bede169d3103825e64fd64fc6992970402af22e88e79911929b5b034309f0ddd62bf4ba558db09779e8703f67ccfb3cba52c11db99f92d0bb95283db66675978ef8ea24e9d18fc44f2519e0c38743c8d333a9a288015cb04889565baecdbfc2a332f1344d5bbaec4d1bd4d78aa08100bfc483806a2ad8c78ae143e25d5ce9729125a7c317a058727bf897f7140a0fc9a70af9cc6de9694af42572c5c6ee4db699ede0a7bcb9bc6fcf37141c0491cab1d68d475afb7acca8b486b3eb4ce9ac04df10ba27bbe0acbd8f73dc3a91501081957f21389e156c4d27d44b6267dbaa860eec047f6287c4179474e134b7b2401a943e8ec8c922797ab6f4dc76628c39fa1abbfd704bfcbfdd6d8f3baea34da47a97851f13dfc64abf47264f6bb67935c3beba37c59b7445fdfffc258527a778b8ca508b8eb8f99ce166985e613e3e8a63119e0df758b610e521da314b0db018aee7275edfe1530c41460f388f3938cb31db653edade16ad732a7212af39d633f135d56517b3ebbbc66c18a97a564d5139ebbbd7643143c1700eae62f6bf4c8b557c950ac9ba4cfe64e0171da62025c6fd83c46f6780dd7b81ca49236baa92bcf20f5c7963eb3516fe52c3c6f2781ecbf94a64f66896d3baae716d2fa3f60a409f73be27cc5b4c321a4ae85a8aa860081e498cd6413371b0a29dbc82ed9cb3e362b3dfe6b3ef97f16fdee338c9c3fb635dec5311440b1412e18010e77ec4e6fdbea34dd7a907fa245e5f63efd4f3c8d844fc39a5c75ec3fc85391ec658eb4b6ea75f10ac26f3de37f0717345a4152c1922e0b1a446492257a26ff2e9202b3bbfdb696e96ac046299c4d01d80e33f462c639cc89132ef1a78f2911c5eff2862a80c5bce93c7c27828400e857655b82ab40a1c2a90bba5638234aedc581046518a0c8bacd89004c3147c0537eb195c34e3194e66b9f49a49114d89faf7e12d63ee9a302d66f869dc8ec30a21a4d1396a555f240190c6bfa622631a269a5093f91e8bbdcee461926f9b458fb44f8cffdf7cd2c41b823f6cb4beae13e1e06f95b729af294259432b9dbba5c80f8248dcea697d4f9487a36cab06c1a6f2003d5a8ead39ea34ad0cbed7bdc76733fb346870eadccf5d75938ab3b8b4d13c9d8124034a6dc41d7243dccb10235a85812e3495d17d9464900fadb7f6cb6553a8fc575546ae616f7a6d69c29c0d964c684bac6535d99666dfe2a9c43f07530ccb2330e3c0c3e9bcdc70f83ad9bf19e08714785e2667c693942f3c0876283c340a9dfd31e37e5ba8b848b44245e9cc0d3d964fd1b49baa98a4314614a935573782f9c974e3cb41ac459b48a68b575dc2893019f995caff6e08450f1750b8351dd0dea86d5b8a358a1944b27a6d8e7cc3a1f19ee4320a47953215a454e0a9f3f2aa0fd88a35f867cee43c8b6b189fc5308800955bb5ad7498aad920a61e86eeeb7a2cdb98dc79d9c8f773d882aa58846de5785b2688f79de09c44e078862e3596d6f23ea9105d9bf62ad1e0bcce039c2cc646e22d2193fa9a5ea6b48d6eade0dc731de118f7845c7a177fa69f26d5ae9e1c6bf8bbb2320272b385827ba31d1e7eca2c31a924d8276e10e6ddce229f6a43e0bfec0928bcfd8e833b34f5bf13dedf397360e606857773ba870e73f9e89c81d91fca1753c33000ef026a0be4b5dcb52d69d10eac1e094145a893e0d97a52d71ac240f5d88094d2df35b5c1991c73bcc1b293c206f1999236cabd38575e3dac7388095c7778b5c545bea835ae1b6bd4d4e84229f1beb61f2537d9b8d0e6e0df0b0644bca4835e21c37e859cb9a299bd11b66483f6e5dada9114b6ae6929a793bcb49730f8017b6a8fb719fae6c47f1fbd78717ab146c582422fb47bbe16e28523d6d2ba7bd4791d3597859f6ae1e57c9b5cfe0bdd4ad654de8a43703236bd62244f084b954718e41e832bad60cdc8aedb77faa6f49d67af7e715d40430b511ab2339d1c86f3369d029a9a9582f4db08c504c33776ecd970d16007441919995f0e6d0831639ae90782673f043e5e3b447e307410c6b432ab6d58c507197b014400dacf06e84384e923ee6cd2e72d861efb4ba600b9c13c7043d86f8f80b2fcfbd13911b929cc852ec272d333609493484a70baecdbd2206e0dfa00ee1f7a29a86a23baf6c49b575b516c4c82ee281d63d9d47b2787e530a4bc0b2510f3166423ee2baff94ef554e31fa12b06679f4777726421f2bb2d8b94ae41318689638821105c5da484f8dbf897e6839424b208", 0x1000, 0x8}, {&(0x7f0000001880)="a35d59c1029e3e30116d7c30b7b3b951e3812dfe3062f72121378fffe7e4c46f0f1057f706d506e53aad27379d839d927d03f45feae46e79a1280cf0dcad7a22ea606ee25768991e20a24ea732e5cb7087381686ed75f2f9f60c7df08500b6c0150087290765d9edfc58b076eb2743c826e531f0d4682538facc713284f3df0fb195cf00bd8f71517066dee854cebdb650c0ac77cd2fa35f92356e3120183ea0403fb6d0e5cc1bfc166c6814880eb00cd30f707805e5a3fb3057123c326614cedc9d03e54c25fc40ff37251ac953a81bb70fd971ccbe2c67d225d581edb6ebe7888aad", 0xe3, 0x87}, {&(0x7f0000001980)="c1996a70f2d0535677dfa2f4375c0952854e633b18012f719f547a05921393d8b8048c110466dbdf5dbb40d8ed2323e1b4ae99942c7595e4ad9a8c9fb5deec2630e0e53fd99fc871f1ed9a8605f82699b14ec96314c032a8daa8fa51fec4fedfab5882f33f20f7f481c24a7e9bbcfe4cb30f30a2c465c25af720ab", 0x7b, 0x10000}, {&(0x7f0000001a00)="a53384b2d76832a29cd8cfaa1ce0c4aa78a5578e3118747652adff0f4e0ae615acb3306a963f834d5a366ba11fcabb97272121b3bce6493cbea0a3776284b228a8c2a7f5d4242a5740949ddd244ec3e2b7406835801f61a5403131e1431aa999b7008c70b83452825ffb82cb1b8214e58cfbe849014d712963a35fe73a168370154afc81113a17f8ed952bbb689c6c8bdf00ca5444965acc9da280c4494aeaba97696d7cf38d7c97686be70f003feabcb6c07200f051d2a4fcdb4ed3db02a3ee774c16c0eb1439d41727430d18ec0d", 0xcf, 0x4}, {&(0x7f0000001b00)="5023a71554843d3647a45caca7b63dff5a03de92c05fe75e3c255099e1fa92c0f25beb18edb6006c601423f264f2bdef42cde7ea1a436a008b56e0fd2b8b87dd4d6c4fc30f6d2dba7342ae6c0541739f91159f5f9ddcbdc82cd0761b9588d22f5ea4efa8dd9d86ea3b42cf3da80e28aee03f483c9128771945c829", 0x7b, 0x1ff}, {&(0x7f0000001b80)="0b89046816eac8e8313c9ea5575b71b264b5d422295b2f870149ff2a86c3e93de3d69ad83964a53872b578a4ac035ed1d480ff79b7c3afcb1ae24d2c372d6556aab3c918a83f9b4f79d039e8918b23afdfb22a5e19c7579a4ebaa1f0ce7ccf8d85b162a95ba1cc90323ebf1db9a4cad15c3c89c6ea2c782529f04350b9858f18a205a6835d004127de58d99a6f8880b168dad3a1725fa58c1d460ab704ec16726b78647370418c2c783eb5d299e07f0ef9a26499008d89b9d7118d498ef7acd3104b23503f64f5a86e1c7822635364765cc1bcf71e8802e115e0ea6df18fda9e3e49353fbb6cf06e10174a1cadf961eef590acb68d00a79297a02fd45e3b5aa4c1cc44bee8ebfcaee2c3168d50aeff7f9b286ac9138e8f1f776354121ca90871c1b2c0bb38d60e5ff197888277e0f954df02a155706086c6eb2f9cc1e06ba401493705b1a15f8656c0ef06788377c20333cf028cfa60800385f9ef9b8dd1bd559122ccd4f8d0c7e30b06eef3732e775159a034778ee79db4d9338c30461c482ab896520c37ff7675a63a2b5a49a71bbad30ba1120f3c010c7b23ee34660c2a0075b224bd5b09c9130811d4864f6d58fe816cb84e302602fe2d6990887795bbcee1d4a5088778d9a079c226c61da51ef0e0293731c014ecd6a26698c9450b68b9fb9af8039b7b35a99752df4471cf229afd25a772650c05d268a2d73d7899114fa4f6fd0dcbb0f30b85548f71a1452674e72ccccf15c9e827396aa064faa0710fecc9e3de0bc2fb9561ea02e528bb09a64e7f7bed8baef2a4e8c4c7e7276789d6f166eddc973f9e2fd514de7c0129a7352ac0504b7acb8f72051b9e189f3368ce8c38371876c349b240249f47f7ff83210b6644f6302758c82d0a3075b65c6c5b28f3796edc3420106a52d83934a4ed1daab7100acfe6cb9157f4676288affdc56e9c234a51aa8b7adcb50b80c08abc09b3a0103d85b3a418cda901a3021ffbdeafe31514f0fcb6343dec86492c4266180a6a9b8f34009d0291bd13e04cadbdc1f587ad9431023bca2e7b000751c5bcd193ce3b6b63400753f0a10ae43187418d13629917b3f1387e101e75701df8a70bf1088ffe9a5469ca1d129e1d684e1937c00b7c0c340b715644b18c04b85e17ced1a9c101660ea310754b58f375025947f084be36597c1d02bc33e174e188557e679e1d7bdc3ed236cf05e83cb85bcd69026f7e3936767972361ca8eec69fb204f6f7014ba706e2c0159436bbf1007045d3cc217ccd3e874960b68da855b0b04b5ec948e9ce62fb0c3f0714b8a4d8a63755b069b269563d8c815e6cebda4bb2319470291eabd1ae1174cc5199527ddf4e2b7f75080e4d97af1fbc9d74d17a70547fe45ba3fc8db19068ca1dcc65756c1faf5d77d28fab76443cbc185c88676791cc9799bcd0330eb7ee1db067147bc63283b88c97752d531064c4285a528a86c3faccb0c93eb5f065e7a1a6ed05d9c788e09611177673f5e38d43d8bcc3873efa61f73c3d2020e113bddc7bd20f20181268c9ac5c7c9cb83b635590c9c3979d576d97f624435f4e85a594705a0df2d7f97564ace82bd049578b5f768a82dfd0b495cf3f94021f9eb3dcd781a28f37af9fced9d50d0da29b43ab177a5f77faa7bfc44eb9ad2bbfe36f0e279db40fde86a2b24ca6df296d92d0201d8316e14c0ed1f7a6fbe47df9c842a71f760c1e43193f69cc89a0e1f483ee3513134898d69eebb47076a5306615c4ba503154d13dd59947f85237d71c9d1ce340035171539317d7bf6747b95a3dce38a41ea00b862cd62ef0e1eb675cadeb6dfa9d70f1d18579d293f6114b194521ba66672b794d6836a70fe0a0c6f5ea2e526dead32f6cf1d1f37b264518147686a0a0232569814833810e8c6e3f5ceb108fbde4cc98cbf2abe0a334109d84efa8dc6d39c2510525b1b907afaa167bde5fa41a048e53b5fec9020462473d959a6669297ddfd89b1690c011db739f7476e26469db3901a60580488fdb3c1bb0b3108f040bef62d04197438385132948c29fa2ef9c7e3c655ded41cfc7831efba362d508593c71aeb5104076df325bf76cff5f500d3cacd14710366b1730a6c4b498836bcf0448091b72b7d5ed43e4b7b0767a47f887048189336290e2219ad328dd23f8f9a72a178ae8c74171d19df6e7be2ca48ff8ecbeb7c147570e8cbd156d22b7be93efedd11fb1f9489c055ee2c964de57db39a5eaa1e71a02b3dc2e788652f86f3a50499c8ca02f6b4db5f08e58b342b8fcac8cd11215cb1aca5ca14e14d92e3f24f8485efe75646c3baa3df194546d05c78c4cd8c81f7d69d0ed5f06e1c5014a080a671a3ede60141cd9bb327828aa42e6406616957787fc4efc93818733bfdf3cea5a1ab86e4af5ec58d8d4ec17651fcecf86ff28af2f3aa7c97378ce67331349aa71145fd252edb8f25368532fc14c92dc1b41634be07f0ae252f9aa49d6e0f39d745b7116ea0c7924d3420860b0fdcb46fff0c8e0c170821903c727be9e18fc07668b243b7f096f0b8e2ca349faa70edbf338e8828ec325eeca66398fdda3b1ad3c06fd218dd0f7f0804103a235cb072bc58bbcd32270eecc6b74a784b410abac767b83e9e06c398bf8cc946993fbc1aba4dcb3635f96b207102e5d915761590832b9a84005ac0631b94f3981d3ccaf15cacdd8d1095a7e86c483134ebad53041d9b40e6f2e5d0a97e249353433ec1e377759eb325a865935ed31b819c8ce6750c2af4a1785136b8e597f9216f0a3acd4b64cc598127f0589dcc77cc8849fe120d4abb1e1b6dee4bd4551d8728238a19c606fdd61d7b435f588eecfbc593e2b6a7832d2245cbbf2aa56c8dc0fb2b119f5437adcb9a6c64895d587539764bced2d1741870c634784ac61c567caad3a96396cc479650b468c8e07328e795154e3808aa94929f86ef680e6376598dfebe05d7f8317348ca4019eb435da860e05cf5035e1fe73a80fb3d2841cea22ccad97b02e00afe679c28dd35e21a9b7628ca3ebc32ec57ba5d16850fdf7ec8936e65a45c7e97aef981339c3472772f04067bb9ce6e97fd119a560dd698ee7f1a6960ed62b7a9c2871e23a390f689c2ea46d3c67d403fa1a9da73c4ac446e5fbd1c57af421d4c4153150700ddc6d59c055159cf433b4c12a054d29437b711ce9ce4c2b2df89ccb2e4b87cc44c42616d9bd8a4309b79e4e3d76f48df127001679fe3f7f92810da95a21abb8862bdefb9befef9b740ffbe926af921e2169c19eb9b6338b742d3ff0b6470b10f725302c9adef7e5074dcb97cb53c439dff65a6150c6e431fec1edf429a80251487a90803c79d38855b9f09a014105c9d5e1bc968a84da4bcf40fec1bfe32a29b69aacda893ac8b5fe3b523c2fefe9ce1bff026aa45e70679723acb0543fcbc032b73786c92de794964cc50b07c09003ba044acaa7bb48928128a2bca1420772cb5110129c0152428551af647c94aa6d3205a3d22f296519e04487675ab150af4c7821d73c5d2bceacadc915c9c23882295d15ef2d8c052b66c20b85cb8583d3edc68ec0d6befe8e04e2060cf98c561eaf8ef95b4ac5dbc2ba63a2d0a8c3cf297b22e01ade47668f4141cc242f6e8c391106bdf5ec3f9bc451c0d594fba5b51cfbe9e58a235898535f20de21a7952cc85548fda2aed37f9445772a2d6f8088b9c1cdc517ba8ef14ea930941251e59aaca81156a033ed92c9cbcf96aa40c8899a9e5c3454fb4772076210c80a250667d78a7c017688c3d00122c2b5b748767b77d64d8e7bbcf941f0f1406dd5a9c2364ca66a1ccf66b40d45131a63f997acc22fb8f0dfd1d8ad8b99c863261665b1f5daf7e73c32df49980271850195dd3f227dcb54af5b34bccd51dc0f09030d2b19a1ac4464ab0d23b870959627b9adddfbfcc950cf062f9448a1125041dd9e71e5613c7bae7f676ccdd4b97f7f2e7ddcc68f2d182a27ffb7024396be5dbd6e50ff1aedc108dceba4c25ab11505e15680de9a167e5f7e4b02db8ff70682009a48cff8976d05cf586f84c64bfceb0d6c2f61708d7c5ed6603816894be4c567a4630e79e1c2e33f16f90d84d0b6daee33fc9d21d8860df18f228906d8c7b8bc59d3e6aa0460faed0a2ed3e634a2007e5230165efcbba89c547fa9d84eee5a800b0caf5b6e30afde41a02a40b2df35967dac147fc637ea58493a3d62ff04b5653a9d75971074866956b3f85adac625e5f990daac74a3c2c56ca7fe973ec3c23085c70d3d7dcdbe53b9a524647588c05d43d8eb4c58e4ca2ed8f5b74fbc5aa12f793de1b601141a77c17827cacab50de21fa6e4b1b24d8d4a80b9af522668e3fbc32849f994d1ea5a5165d0e3871e26b76fbfff4c930f98443a17726f077b2bcfa48f0208f72b6d8c0b502d4251038b4d851e1cbcbf252ddb8e56fd89a95108e599c24d10ff87d7a89c3bfbd1edeeb56d2b748d899cc2dcc2877c894fc59cdb0a5cc036af27967bfa302ae6dbc7ae5cb3620fefe293e9ea1d46a381330712c3a8137ff96ba7f95e576fd414ef4f791cc90193c571283348696d33efd37147f2867c1859bc901cd71d46dc03083295aff62dc43813f445c882b1c8ba5b6aa2d14aec61676528751a4a893da92059f37b0aa6003fe38b0b497a4cfb9516a5e25e6920792492b675b431e3e53acb69205439db3b6d9aa6e0e6f3244d11ef2df0cb72931580db99ef7f6c9419bc20d827fec13ae5a6154d432c1f171fb6adf2902133e38960ac90f8baa668f28707052f34d8ada08bcc59c6319d2153f13f9392e02abf6a7f58376da495485b2bb709288086c160517b2829afd7609f7e918f4aac23be2a8e7b4ba49ec86649d73b65cb7e328a3b5a4c2e8614c6fc0cbadde149aef6fc3107874f98b8438dcb69cd2ff21f2fd774f087e805d0be90865e60d315e0c02c0f0da7330c725e637bb7bf8a4c3525821a3a31429e0e663fcfe3dcd0eb5209c9146f3c73ee33d3b084afeefd6b20237b02c06320d1126ec93315f80fb3748616555cad143bea8b1b763c48f6da79db1534f9ebc9a0cefd6b204839d01e858ed750d27d0f2d493ca71ca8ebb552d6c5026dc1f57e5bb5eb1493b0fbe49a578389482323e30c97e6c43c842b36b3ed640ccfd5b8905b26929b20414462a75fad168f568ce0743df316481dbcf4a07500d1a31c31a5c5b8254ef8ad521fed2344ae0b5ae64d1384013c318206afb6021be2bd77228ae4e9d9dfd9b8dfb6909a22c18d4451779c131f16294f0ce16c97331418eec7ac7d74469a8b55121f38d8b9f22585ef0ebfae6df98b574b4e88830c34ba99aa6910cff9daecca7d5c655692e5b9c961c7be983f9126aaaa8a2c9eb518b9f603265e0c7a7732b7b601c01434a3746e675d7e298243de2264712b7d751adcc784e15ca457bf0a4aad8fe860f5f46ef08908a1bd14d96e297acf7f15b2531064c6c3d8affb056177128d879dc3266ad3ea6b98a53e28beb40aee5fa4fe84c82baf2f2c87e3e15a52290e941c0ede31618c2d448c0a78d6ecab65b6e03ae98329fd6cc668614028384badbf120916517eb52125324c3f0b1885791eaf5e2a5420a72979329b20f3de7596d1eae6a44369071a448a52cc67e1be0eea6948c24c599d18a93935730868e29fc297569e937125345112bda2c5435e3b9fbe991a43a0ad18bd970f0c781ce796faac4137c235e44f08d83543b1272f48da98e1cd4005f7e8dc85944b4c048cf439229be72040469cdfa19a45e1ffe7a921f0eba993fb566d2e3cb908a23ef57a52ebaa85", 0x1000, 0xc80f}], 0x40, &(0x7f0000002c40)={[{@dots='dots'}]}) ioctl$KDSETMODE(r0, 0x4b3a, 0x5) 18:01:02 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000100)={@in={{0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x0, 0x81, 0x0, "e452def4bb24b2d7f058599ce77be25a747596b46633e70efb8b4603f43d70359f0605ec465e5c21c51c64611b077d3e811275cc1c20d4e227368398b914e6d1073424e1b2d7edc8fe1aa6b23dc35b91"}, 0xd8) syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000040)=[0x1, 0x100]) 18:01:02 executing program 3: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000000040)) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="006340400000000000000000000000000000a6c226ed23e7647b9af5413bbc2acd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000826e052a97ad97b0c4f82b75594e5d88c7c7009883196a35257c932f08058d2ab225a73a3576ee329b928486061b61eef48dc52a3ffaf32752d2b5c1060055dcf99938d32359f737bd3f0fc4829aa26cfda9ed01ac416713406f7a3aeb4c7b935a037e33c64fe5fa7d163d353340f1dfe2b0625f9ce0b69db706ce549f7bc910d1"], 0x0, 0x0, 0x0}) 18:01:02 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) dup3(r0, r2, 0x80000) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$sock_int(r3, 0x1, 0x5, &(0x7f0000000000), 0x4) setsockopt(r3, 0x0, 0x0, 0x0, 0x0) [ 434.899466] binder: 13295:13297 ioctl c0306201 0 returned -14 [ 434.910452] binder: release 13295:13297 transaction 683 out, still active [ 434.922985] binder: BINDER_SET_CONTEXT_MGR already set [ 434.936435] binder: 13299:13303 ioctl 40046207 0 returned -16 18:01:02 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)=0x0) fcntl$setown(r0, 0x8, r1) capset(&(0x7f0000000040)={0x24020019980330}, &(0x7f0000000140)) clone(0x1ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setpriority(0x800000000000002, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f00000000c0)=0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x4) getsockopt$IPT_SO_GET_INFO(r3, 0x0, 0x40, &(0x7f0000000180)={'security\x00'}, &(0x7f0000000080)=0x54) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) getsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000200)={@multicast2, @broadcast}, &(0x7f0000000240)=0xc) setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0)='tls\x00', 0x4) setpriority(0x2, r2, 0x800) r4 = request_key(&(0x7f0000000340)='dns_resolver\x00', &(0x7f0000000380)={'syz', 0x1}, &(0x7f00000003c0)='#vboxnet0+\x00', 0x0) request_key(&(0x7f0000000100)='syzkaller\x00', &(0x7f0000000300)={'syz', 0x2}, 0x0, r4) 18:01:02 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) fcntl$setflags(r1, 0x2, 0x1) [ 434.944020] binder: send failed reply for transaction 683, target dead [ 434.953738] binder: 13299:13303 transaction failed 29189/-22, size 0-0 line 3117 [ 434.962729] EXT4-fs warning (device sda1): ext4_group_extend:1762: can't read last block, resize aborted 18:01:02 executing program 4: clone(0x400000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) syz_genetlink_get_family_id$net_dm(&(0x7f0000000180)='NET_DM\x00') r1 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffffff) getsockopt$inet6_tcp_buf(r1, 0x6, 0x1d, &(0x7f0000000000)=""/152, &(0x7f0000000140)=0x98) 18:01:02 executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getsockopt$inet_int(r0, 0x0, 0x15, &(0x7f00006ed000), &(0x7f0000000000)=0x4) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x400000, 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000080)={0x5, 0x1f, 0xffffffffffffe30e}) [ 435.022673] binder_alloc: 13299: binder_alloc_buf, no vma [ 435.035296] binder: 13299:13322 transaction failed 29189/-3, size 0-0 line 3254 [ 435.039121] binder: BINDER_SET_CONTEXT_MGR already set [ 435.063032] binder: 13315:13326 ioctl 40046207 0 returned -16 18:01:02 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) sendmsg$nl_netfilter(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000c40)={0x20, 0x3, 0x1, 0x1, 0x0, 0x0, {}, [@typed={0xc, 0x1, @u64}]}, 0x20}}, 0x0) [ 435.063084] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.083689] binder_alloc: 13299: binder_alloc_buf, no vma [ 435.098310] binder: 13315:13326 transaction failed 29189/-3, size 24-8 line 3254 [ 435.107582] binder: 13315:13326 BC_INCREFS_DONE u0000000000000000 no match [ 435.111281] binder: undelivered TRANSACTION_ERROR: 29189 18:01:02 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) fcntl$setflags(r1, 0x2, 0x1) 18:01:02 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x7) r1 = open(&(0x7f0000000000)='./file0\x00', 0x800, 0x10) sendto$unix(r1, &(0x7f00000002c0)="c0d7fa3869dce615e72b7bc6fc65bb1cb29598094c4100c930a341b6ea0592a63f947646f7c7d8107412ba9cf2b081a7b2c7a458785da4f71d5bcdfeb9bae3977c1efc28616e177866b53c4201", 0x4d, 0x83, &(0x7f0000000140)=@file={0x1, './file0\x00'}, 0x6e) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) utimensat(r1, &(0x7f00000001c0)='./file1\x00', &(0x7f0000000280)={{r2, r3/1000+10000}, {r4, r5/1000+30000}}, 0x100) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:01:02 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) getsockopt$IP6T_SO_GET_REVISION_TARGET(r0, 0x29, 0x45, &(0x7f0000000040)={'ipvs\x00'}, &(0x7f0000000080)=0x1e) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x3, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 435.115443] binder: 13315:13326 ioctl c0306201 0 returned -14 [ 435.121329] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 435.185201] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.0'. [ 435.196886] binder: 13342:13349 ioctl c0306201 0 returned -14 [ 435.222107] binder: release 13342:13349 transaction 691 out, still active 18:01:02 executing program 0: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x4, 0x0, 0x0, 0x511, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r0, 0x100) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) ftruncate(r1, 0x208200) r2 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x7ffffe, 0x4002011, r2, 0x0) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) prctl$PR_GET_NO_NEW_PRIVS(0x27) read(r2, &(0x7f0000000180)=""/19, 0xfffffe47) ioctl$EXT4_IOC_SWAP_BOOT(r2, 0x6611) r3 = openat$null(0xffffffffffffff9c, 0x0, 0x10100, 0x0) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r3, 0x6, 0x1d, &(0x7f00000000c0)={0x7f, 0x3, 0x59c1ee7f, 0xffffffff, 0x4}, 0x14) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000100)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r5, 0x10, &(0x7f00000001c0)={0x7}) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000200), 0x4) ioctl(r4, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") [ 435.235620] binder: BINDER_SET_CONTEXT_MGR already set 18:01:02 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x200001020000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() setsockopt$inet6_buf(r0, 0x29, 0x2a, &(0x7f00000001c0)="0e", 0x1) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x1000000003c) fcntl$setstatus(r0, 0x4, 0x42803) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f00000000c0)={0x0, 0xfb, 0x42, 0x7, 0x7fff, "20a69adea08881bfe2cb17570d466702", "e78c99b2cd070e0e4de48ab5d791a5f31c376c8bfbfb564bb044eb9a446f2b1d7f7f21e13f30456b3c18f98ccb"}, 0x42, 0x3) 18:01:03 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:03 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x1, @rand_addr="d05f252a65773081253a56f73d7e075e", 0x5}, 0x1c) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:03 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x14000000) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 435.271518] binder: 13348:13352 ioctl 40046207 0 returned -16 [ 435.284529] binder: send failed reply for transaction 691, target dead [ 435.290573] binder: 13348:13359 transaction failed 29189/-22, size 0-0 line 3117 [ 435.336852] binder_alloc: 13348: binder_alloc_buf, no vma [ 435.343990] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.351429] binder: 13348:13352 transaction failed 29189/-3, size 0-0 line 3254 [ 435.357519] binder: release 13363:13368 transaction 698 out, still active [ 435.376400] binder: undelivered TRANSACTION_ERROR: 29189 18:01:03 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x1fffffffffffff) syz_genetlink_get_family_id$SEG6(&(0x7f0000000180)='SEG6\x00') r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000bd581e6dd166434600000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) sendmsg$nl_generic(r2, &(0x7f0000000140)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x800400}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, 0x21, 0x300, 0x70bd28, 0x25dfdbfc, {0xa}, [@typed={0x8, 0x88, @u32=0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x800}, 0x4004000) readahead(r2, 0x8, 0x2) [ 435.393168] binder: send failed reply for transaction 698, target dead 18:01:03 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 435.442808] binder: release 13378:13382 transaction 702 out, still active [ 435.474092] binder: send failed reply for transaction 702, target dead 18:01:03 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, &(0x7f0000000100)="9658b8199dd0c2cc47aab43e429593cf6d080392cf02ecc81d75c305e93898b4753cfb4c38eb28bc7e167f46306b1f33dc5af3645a4f8a68b06742a777bf427512b1c83bfc74824eea98ddb93320c69db984e2dc5727133c0a66b522e5bc285d0ff3cabaeede4a2112e9fb9485f835dd45a973e8d60978b32dbba6eb056928d6d9410d9d9b91e8a357516c266b6026a4f2b2fa611f0f391f32e2a1db8a467f7717aaae3a79e0962a00d9f4962650fbd1d8360faf368f9a4403fb277e6bd26507c8f402f8b47927e792e089a34e8e30152402ea15c09caacac7250e1506d329e0e8e4606723618c56402e65", 0xeb, 0x4000000, 0x0, 0x0) prctl$PR_SET_DUMPABLE(0x4, 0x1) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2, 0x0, 0xfffffffffffffe8b) connect$inet6(r1, &(0x7f0000000300)={0xa, 0x4e24, 0x7, @rand_addr="498ad8afa144cc1497408afe1c4c1cc3", 0x4}, 0x1c) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f00000000c0), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000340)={{0xa, 0x4e20, 0x7, @local, 0x4}, {0xa, 0x4e20, 0x4193c07a, @dev={0xfe, 0x80, [], 0x1d}, 0x9}, 0x4, [0x6fd, 0x80000000, 0x8000, 0x2, 0x3, 0x7b91, 0x800]}, 0x5c) ptrace$setregset(0x4205, r2, 0x6, &(0x7f00000002c0)={&(0x7f0000000200)="c7d84e35ac5692bcdd23e27d3747572ef37ffcdc111e315fd75142245b2cc3529e96f4b2ec150e0952d5cf1ae0d2fb3799fbb1e146d4c5097e5d41422e0e7f3c9f24881d7a2834fc9c08a2f1420e45bcdd94966d5f603b38d3331eddf246d836090e7923f78230df924c80eed46151bb56fa7a15c688894c27f5601e416ab234430487d2294f80a6", 0x88}) syz_open_procfs(r2, 0x0) 18:01:03 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000040)={{0x3, 0x2, 0x6, 0x6}, 'syz0\x00', 0x20}) r2 = getpgrp(0x0) fcntl$lock(r0, 0x24, &(0x7f00000000c0)={0x0, 0x4, 0x9, 0x1, r2}) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x486001, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x840) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="006240400000000000000000000000000000000000000000000000001df694f92f438e130000000000000000000000000000000000000000000000fb0677511afa1c3f11992cf778a9d84e54d62516a8d26f1893b31ce4d9f4813db3e6dbcf975e40abfcdda924149e30fd90683e376090fecb39ad772a93fa4d301beec6cbf94f377e76a401db4295f3bfa053aa53a14037f61351ae73eaffa67a59f584ed6526cd703d939644d0237ce5c7f1fe2e8ca6d2378cf60d5bdfeaafe148c731973a9de0d38400dbb7acd895bae6918014a6d3a60e0a8acd8b309775c77c0cc8ea13ebe6f2f03ac0742e85fb35201973a100c9c045426800197d4445d7692495f63965086c420a342338ce9e4ee6ad3bd907749c2733713871ca276abd811191535fac5b6557d875bcfca3f2987dc8acbe2c19e2e848bf13951e459d42e324ee84bcede116b7d3e2a30d1a4a0000000000000000000000000000a108680085606a1aac26939e415aff875a6808"], 0x0, 0x0, 0x0}) ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0x1b) [ 435.503133] binder: BINDER_SET_CONTEXT_MGR already set [ 435.517296] binder: 13383:13385 ioctl 40046207 0 returned -16 [ 435.519389] binder: release 13389:13392 transaction 707 out, still active [ 435.544553] binder: send failed reply for transaction 707, target dead 18:01:03 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000040)) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x5, 0x9) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e24, 0x3, @ipv4={[], [], @local}, 0x5}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:03 executing program 0: r0 = open(&(0x7f00000003c0)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x2e7) rename(0x0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, r0, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000300)) sendfile(r0, r0, &(0x7f0000000040), 0xa198) ioctl$TIOCGSID(r0, 0x5429, 0x0) ioctl$UI_SET_PROPBIT(0xffffffffffffffff, 0x4004556e, 0xa) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip6_tables_names\x00') writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f0000000340)}], 0x1) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000000)={0x8, {0x7, 0x8000, 0xfffffffffffffffc, 0x4, 0x3ff, 0x9}}) write$P9_RWRITE(r0, &(0x7f00000000c0)={0xb, 0x77, 0x1, 0x10000}, 0xb) syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') write$selinux_access(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="73797374656dff5c4582626a6563745f723a64686370635f73746174655f743a733020756ef6a1ab95cfbaf1e76e66352c9ad37e696e65642030303030303030303030303030303030"], 0x43) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r1, 0x6612) [ 435.619863] binder: 13400:13402 unknown command 1077961216 [ 435.625084] binder: release 13396:13401 transaction 711 out, still active [ 435.626318] binder: 13400:13402 ioctl c0306201 20000440 returned -22 [ 435.638115] binder: send failed reply for transaction 711, target dead [ 435.655476] binder: 13400:13402 unknown command 1077961216 [ 435.665968] binder: 13400:13402 ioctl c0306201 20000440 returned -22 18:01:03 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x6) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000000)={0x5}) getsockopt$inet6_int(r0, 0x29, 0x10, 0x0, &(0x7f0000000180)) 18:01:03 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:03 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) r1 = dup2(r0, r0) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, 0x1c) socket$inet6(0xa, 0x0, 0x0) clone(0x1000000, &(0x7f0000000100)="edb52521b19ebfb6b659e1d8b7624937520b7997d59ace5a0a18e71ba00699839f498f16a1fb1c77b4ab64900ee5140efa7324681dd3f17efd4e0c69a24b89b5d3c6563734bec242d1293d7efebd7e9be49ec7fc9d80642e0dbd438140784a15516838eeade30cc19bdbd26353ec7a57e137a796c4c9cab099a3620ed28785015168de02ce204b65974d3314e85bf3d8715237e90d9e6322694e3645e6742ab657ce22007206c1467e6202d859622511e7f2ae9dabcbbe9bf781bbc2ff8abda21f457aae03b78884a7d4c3", &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000200)="e81002679341f39509b60ac680605fafa192718a097d8867bd9fcb9af914ec71daafe43dde111fcebdbf64afe2fc9dc6f0037d1dc33ffdec849e84d4a4f4bffc6c32813ab8f129bdd20375a55fa9729cef3b5ec49aa85cfeebb6af9a8c95bf12157c2e2ed014ff70b2ba98567a6b6cadf3715cd1526fad32e5497fd4838a986351aef87ddf40c6e1aac94a76c75c1bf3ef2b7890f2c17bcce099c30517c9ef153a95a42c433095c071b3c2d0e4815d4a2cbb2464633fdc03fc669be4cf624b3651b573bcdc2b920d7fb4bf9a5355db6bae6494bbff30d35867b09862fea6aa3290db21ee68df35378058ee16047a970725c1da5486de2d19a6d760c24b24ca084fc13c49b744f3aaf36a1e880d218841a0c8cccbfb9bca6fd01603833f5572590b98861a0a0ecddcea59590937ec80b6eb7bbea75888c59244c3e159d718bb8204663301886af48bd85b8f795ff8e54dcef43476ad5f267e76de2ddb8af8837d842d1de6ede3259117516cbfff2c461f76acc23ca264c9106189526cecbc19606c44486c22307383d56ca5e9bbcf56851977cfa91c9ff77d3a8ba201d910946eff69c24d2bc01b85e4c8b4630cb04c8f5fcaab452760a8496bd643d0b6f98f57be5123423754bed95109cf3d2f58181efda7eda87a9f6e6336bc33bd58d2f0bf0a7561313c645fe016ab31d9da48bcfb9ac8cacfd175a0d11352bb41037ed1793ecc579e1d508ec6bd09e5324ad0261c712dc30a6902a98af7277e06e401f9fa93d7b2d9695fbd34bd075beaf8690cc9272d99f821cb554b3eec31b26b5cfd67a9991969721623bd130085e0e494bbdac87e1436b811ee9b5f9c69897d636fce5ed05bc7b7a0f42f3480a5ae3ceaa72510f6b72763754ae331e3ec65d3ec9d20ce5ae9a14dc23387cfc53935688a820a64e9620cab201df72159414ade7acbc2b89ab1879b455cc980af3001aa4bad83aa5d2d5cf687bf073c936241f9ccc3620b8ef87c5a26d05a03032dbd3b23a683c91a2276b1e587a423d0de52c8c8bc69ccf625cde84180182d8033fa1a74c6e0ea820653f2b7303f7ad9b049a2ca5ef6913ff50d0067351284d523a0c260c9fe346330bbdef9548b2d58edb595950778d1e5e9a036fb10293fb6c2d25cbf6ca85e2793b20a3cb725e455695a90a39b9da4481c02d85703d5a42c03352d0363232983ee9f47a030ca9473c3d005af9c0a9c04c7cb7bacbbe1057e2577aa05a50f962a9b5762820fc5453804e404ae43b3be9611c2353151343c8bec235254a3899c8c0242291354774ab01f104d240c877097eaeb769fabf553b1d2a042c4c89ab7ec105ee6c1c3d2a8ae8bbbf92ec832b1c8431b3f1b19d658a953616d3feb390fcdca9be0233732e456701a7a558313c8118745a625685c10c8b999221e4dd5e09ba0426cdfbebba3cf820c0aaee2c549accf31140e3d15082f3cbdf9ef59bec03c851c6ea8b0a1e9c8a5da9951b7874f57a5680f9cd3a695fd961d0eadb40520bf8d6440a45f46e572741aa54c7f761dbf58cf166a1dcdd0162e43a34c9f36656f18ee77792816285f6d06b4fe7ca2ef80220bf0d567edd379a60da12ccb0d38600e31ce2537b30984850978a4ff38e6490404b620b6cccca122fc4e11786be1578f338d8a7c8f216d3e588050bb4c23b6f575584dd06778cf9104a408fed40585cda3fc643b0a91bc3a4f04b292266a13b4c8fedaf1f8534d5dc7a5a054d82869efa7908afe4aba450e264d0b60ba94f86e175d13aa06f71d8bd9a4fc5fe8fc2a1e3265c31c8ab552129813eee1067092233c87c9a93f6bd4d02d57b8328d237709c5b8d3157aa96a71358abd51644cb9b8df433f02b4a51786e0fd40d481a271cd574e9640f67673505ee5ca1781fb458d76a6c1bc8cc7186d8f8f6b2d69f823134b8747aa97a6815fd00e014330765a7c1855ac8badeb4bff30667dfcb006203b000545619445c02f3ba2a8a49df22100442dde4e766acb57e1c9e54c5e607afb0f406d459b2236fbb2a0eaae1db4fd5a678a905f21bc24a36b5be373e4d011553d15881764db3ba097b341129ad8cd50494fb8464189b634e455a9c12851066a164a0ea0363057316276e953126f3a2b25d8e2bf3bd6a769617af095fd47963b982ab18bf5b7172dd8feb184d07fe71695d210b96f3b88f2555cdb8898f280f109fe4b9c51eef68fc95c20eae355669249e1d2aa6e23fcccde7576f66032165498037a71e70a1532003581539c9229b6747cb6f351bf300c727d33a0f81d9c87f956657c605c4a25783d72307616c8552759c55cb2c7e33e59bf67bf046cfb77ebc0054d7575902599821e044b08ab894b9dd8ebf692dcdd3de957aec55d808641e98c2534e9dee5fc2e485c6a1eb94a12795e3b15b2507a9eff3f20148cccebd1e0b3a688802a2a5769d7866365f31d46137c75eade824941c37f4f4afae7fe1f6e876b50c60fc0ac8955e2a871550b203701da6dd853548073ee54346afe6db8af5571e0a914ffe9b1363db9b33c0c93e5fa1903c5481bd2e0fc858a554d8b13fa0d1b4a2c76d8f607ee02f3aca649f0e4ef43ef9f4bbe356ab0f8134d440d22d3e01d64b3322219ead6308b59a12db1acae80690495efd6fd956950c7b15b1b389941a8a3d2c820615e39108a40d80fc300a4e7352c787c306fff53ed1f8e0efa6e3f051c3819c81611cb0bbd25dbbb2ac3baf28cfb7122d9579fa7bdd503d7e2ddcf6169e23ac20801d8a90aeaf62d02a519ed4c566d75675bb2558d3104d15923f5e2971221889f426f976f08e4417e6c6092d3805a90d466878c84a1f4228c7411bbab0dbeecea681d416cfb2b2bfdbcfdd61b1df08992d5b343226d654c8e7c9dfca3d306f46a210b0932c466f7490f762e054c805acd251b0eca097a211cfc5ff53f65dfcf14f3975e57a696dbcb404ea401605b2da0c81753f916bd93fe84267447d0ad341ebec3674d786ae604921bf30c1c939d0a7fd377229439586337a43780326eed878165e838dd462e2bf1087d30962725fceaf72b917c49d65b5f5292ddc5f6d49d1a5354ba7f696fe0a4dc6301e9168e3e0d71fe2211bede359baac508befca7a42df332d0734a7f8ed52f8e927655b8f6a8f9f54692e44d927e06753772ceabe798d1c81de3595e97b5d6bcc6d56be1ef5f46dc92e6f3a446cce2d623f919dcafd9b28f380ded91fa776aa397884ba743982d7bc2f33c15b822f0e7b5011a1fd2ee3fd2fc6c7fdfaaca924f4d1d7105338b3697d51e9547abef97f6582fa3ea3153888001e8508d9e92e73e7788a7a34f633d924556c50462379015b3c10de483827189a90537f495d8f1fec79b51212373f32d66ba30193b7673c4080b0644d3473886b42e271e537c3a69809b054eea0d0bbb35c3f0403b463c35f3088d2e13fedda3d2da6c2ec59e4ff1de9cfa6185962da099c8a23c4ffd098f95240201646f99cb9f50c26a8db604af5bf895f93d0d7ebbe32c8f8218cf7ed2615b96b6172fb984361ea2a74d36653ba2afefff1be6ecbfe8acf153ccd7bbf3f5df9e82f3bb6b04026da21e6801bf6fd2941cf3334e806f653be4cf6fcad9d486d24b53a91b423865b8203ebad10f3d3e2276827a8443cd03013ed803a0ad29616fa61148a322a5a0b95f14b40c826b76b2c07850b9e00c22f50adc01b04e924b3574920c6da4aa8d7182c2c1600dac32a44b9fba37c594f60f51c67133d595d1cd8fbc422e7c26f1cdb27a29b1a578118865d369ee56038f2e50441bb2727acf606a1942826b6361cb9fbc818aeb3e954f362df72a52d7ba906e6ab2eb1396c28bd0192049fe7b1903aea7cf6bf015ac28c10d8038e6bb5fd9a825a231ee84e1c9e61d7ba2f5b699295aba73214dae69888092a10e5b4b007ff5fd079fc9430099848c196f3aa63f511bd1f8a83abcdc0b6edd9064ba8d15c04cd7b912c6c72ece3cc020278051e2afbb72a59e596b4adb8a41fca21188cb4a06b2bdc14747af0dce5d1a4c4d61b05d60d68ed95d73ffcd5196718f7fb58c945ea6e096e2a565908f6f51034818190f8605536c53e61b97ddb72b3ae8679eca863be5b147c2ad4dc31d8efa09c20076eefb90048223b343d3c34779c5524487145e69c1a8fda8b4729727f26f57ebdfbbefd602f0e9027604ba7c8014b0ba26d001f3129f9f00a333baaf68b3fcdcf1850443a4eada3113adf38d137664364a1dea1e4330f921b26d9555b9be9bea87f8fba2dd9b6e20e618d02a875e2b7a8a699601b05641b7f6b794917eb22d256dadbb9c5691a7dffbfa0a22470fd46ee18e6bcf0238d0e1de0dd34d292f59ddd72bda8ebec122c0c3c879ce9fe3637d7231d4422371bac7e092a171b62747a76ef153e922fdeaf79e0ce943060b350da2b02cad49cc52529e504451dc9381232eb2c6a79f05b43a8283c2bed272ae54fedff5cf2c40d9b867eb86d36d724e20be09410df5ef86e523cf3ea2d1c80dc43f4ff29b3e2de49259541b676a1e660ca39bc86aec2d1fb0692dc35008fe924cf6bcbc9f25943c1f76091027212aa2223de9916201bed2444b42eef175fcaa0b2eb8f6371939bba8c1cfef2209396831e9c4469bc3bc41818686d684abbc4ec93bcb13ae14576acf8b005a5296ebbff71946ea20edeeec90ee24aebfe3566dbd94d760a7b0ec5333b0141a5320c228d71d895ed7c017e5f8a3ec8d0b34e58f3286fdcd0c7c42a3eba7e1431cc3557c8dd82da5f590d2da42487333b0cc0128c79c6bf8f3b266fd837c2b26587ead4a872973a9d5e806a85ec07ce0a90b6aa8426f066bd96e6733837642a4ea3f23555d1071849429988ab543a9e729e5f63e982671c602543d9f93b481e98aef32786a2415ddcbf8b12db2e4efc6abe720abfa6a497c5f4c9192af3fd97fc6992018a1d3fc0f29f30bb0d3fd2e344b0f88c86ca879cf43a9c46b1f0769d0e8fa37fd20f92949faba3cedfe7b851769e85b7eef46472d0844c164f6f31eaec8f302a82e842aa2159ffe59e1d3457cda6747a5e5c71b3afcc08dee8fc4a8d31772e0335f42981b05918a1d67e0a4a12eca85f972f407a8a107b9389865384147c9cfd0162a81a0aaa7eb638a04770cca7aefd006f76e2f564cd18ad1f9dc05b263fa27957557084f845a46f97e864d6d68521b2c169443ab0eb9e8876b93c90ad86547806d4a94299a9028f74bf01043cda3a1c78fe4b4a705e35f6a47e51a9e512d9eac8a795ae9ff3f343da09dc4f09624401a1b50c327984b04cc022841a23f6943d9ac31f01b6501cb14330297513848751680c9cc3c69cdc317be8402a2be5da88775e986c43230a98fee460ba2b108fb3d6febc587289ecf465397ec82884e68218b0fb119356471ce23b76fb6c7854f9fea41cac7aadc1dd0eae46c9e050969e3cf597d3cbb92d13ad2b39948141deb611739cf353f4c33df36d0c7ab6832b7e2363ba36c5e493abf1f3cbdec0418980be23e30b40111baee8a5ecaa3b53ae6ea4de18e1c45386178f5a89be808d0b8bb6dd6feb83bd78ef70e99da6e30912939b6746b03c3f3b18b74f99ffef06898cd7e3b56106c3d7ccfd98f0cd4984a3079f435da447ae026a7de7a96e69f79f53a18836d0d4ffdc2b069c6f6439de1ac698ec426ac2d41a9c448e3d14d0ce8abb2df180b5f8398854257d7edd7758da58588045df5d4f38207c0a6ade798fcf6cff83cebdb02d1c35d10d8d1fad529721f524db7be385651b3361943d4a23349d26a086efeabc713b0a7a27d09d7df27") setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000001200)) ioctl$TIOCSCTTY(r1, 0x540e, 0x6) syz_open_procfs(0xffffffffffffffff, 0x0) [ 435.831204] binder: release 13422:13425 transaction 715 out, still active [ 435.841955] binder: send failed reply for transaction 715, target dead 18:01:06 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:06 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf32(r0, &(0x7f00000001c0)={{0x7f, 0x45, 0x4c, 0x46, 0x8, 0xfffffffffffffff8, 0x6, 0x8, 0x81, 0x2, 0x0, 0x7f, 0xc1, 0x38, 0x309, 0x6, 0x7, 0x20, 0x1, 0x0, 0x256674e2, 0x3}, [{0x5, 0x20, 0x100000001, 0x4, 0x29, 0x9, 0x8, 0xf6}], "fb2bdfce682913a20d336fe041e37ab0642fe8741c1be446f43143193e6accae78335f8ba32b26a438317f18074d690f1f35994ccb4bed576398d7c724c0c94a1cad0cfb2cc32d1bb53e4d2bdf73b30b38d38869ada06728ba314833365be2f90cb8093c3a5311de722de8a64b3cf79f078e2c775c75dc2c67b7e2ac04efc5023cb6a29666dcdca1962a42b35538777a03416ca351eda94d414bb10d8685a306917166488c3944cb6d9d5a8ba5f9c75e20e587ba954878c2b64bbdd268e66f4732a7afb73aba36b3a4c9884a798ec5069e424215ec4b27701db2432f3f96ff5a4f069c9545af5fa232596fdbe47f1a0204eb8933a7af1e9d8547746788389d", [[], [], [], [], [], [], [], [], []]}, 0xa57) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) socket$inet(0x10, 0x0, 0x0) sendmsg(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="24000000180007041dfffd946f610500020081001f00000f00000800080005000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}]}, 0x80000000) 18:01:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:01:06 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) wait4(r0, &(0x7f0000000000), 0x1, &(0x7f0000000140)) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r1 = syz_open_procfs(r0, &(0x7f0000000040)='net/dev_mcast\x00') write$P9_RMKDIR(r1, &(0x7f0000000080)={0x14, 0x49, 0x2, {0x0, 0x1, 0x1}}, 0x14) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:06 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x105, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000200)='tls\x00', 0x4) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@loopback, @in6=@ipv4={[], [], @multicast1}}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f0000000040)=0xe8) socket$inet6(0xa, 0x80800, 0x7) r2 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000240)={0x2, 'ip6tnl0\x00', 0x2}, 0x18) 18:01:06 executing program 5: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) r1 = gettid() write$cgroup_pid(r0, &(0x7f0000000040)=r1, 0x12) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$selinux_context(r0, &(0x7f00000002c0)='system_u:object_r:depmod_exec_t:s0\x00', 0x23) r2 = memfd_create(&(0x7f0000000080)='\x00', 0x0) getpeername$inet6(r0, &(0x7f0000000240), &(0x7f0000000280)=0x1c) fcntl$setlease(r2, 0x400, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x2, 0x400000000000004, 0x24, 0x9}, 0x2c) epoll_pwait(r0, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x5, &(0x7f0000000100)={0x6}, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xec4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc75, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setown(r2, 0x8, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000300)) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) 18:01:06 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000180)={0x4, 0x70, 0x8, 0x6, 0xffffffffffffffe1, 0xfbf, 0x0, 0x4, 0x18024, 0x2, 0x7, 0x9, 0x0, 0x5, 0x7, 0xffffffff80000001, 0xffffffff, 0x4, 0x100, 0x0, 0xffffffffffffff7f, 0x90, 0x5, 0x1, 0xf7, 0x100000001, 0x7, 0x1000, 0x470, 0x0, 0x3ff, 0x2, 0xffffffff, 0x800, 0x11, 0xff, 0x3, 0x411d, 0x0, 0x299, 0x2, @perf_bp={&(0x7f0000000080), 0x8}, 0x4000, 0x40, 0x68c, 0x0, 0xe7, 0xff, 0x1}, r0, 0x2, 0xffffffffffffff9c, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2902001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000002b80)='/selinux/policy\x00', 0x0, 0x0) socket$key(0xf, 0x3, 0x2) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f0000000100)) ptrace(0x10, r1) open$dir(&(0x7f0000000040)='./file0\x00', 0xa0002, 0x3) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) ptrace$pokeuser(0x6, r1, 0x388, 0xffffffffffffffff) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) 18:01:06 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) [ 438.359325] binder: release 13442:13446 transaction 719 out, still active [ 438.367942] binder: BINDER_SET_CONTEXT_MGR already set [ 438.384456] binder: 13443:13447 ioctl 40046207 0 returned -16 [ 438.391492] binder: send failed reply for transaction 719, target dead [ 438.406069] binder: 13443:13447 transaction failed 29189/-22, size 0-0 line 3117 [ 438.413290] binder: 13459:13462 Release 1 refcount change on invalid ref 0 ret -22 [ 438.424337] binder: release 13459:13462 transaction 724 out, still active [ 438.427040] binder: BINDER_SET_CONTEXT_MGR already set [ 438.443535] binder: 13443:13464 ioctl 40046207 0 returned -16 18:01:06 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:06 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) fchmod(r1, 0x4) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$peek(0x3, r0, &(0x7f0000000000)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 438.456808] binder: release 13443:13447 transaction 727 out, still active [ 438.474501] binder: undelivered TRANSACTION_COMPLETE 18:01:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 438.501538] binder: send failed reply for transaction 724, target dead [ 438.502453] binder: 13472:13478 Release 1 refcount change on invalid ref 0 ret -22 [ 438.535069] binder: send failed reply for transaction 727, target dead [ 438.544650] binder: BINDER_SET_CONTEXT_MGR already set 18:01:06 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:06 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) recvfrom$unix(r2, &(0x7f0000000180)=""/95, 0x5f, 0x40, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e21}, 0x6e) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) getsockname$unix(r3, &(0x7f0000000040)=@abs, &(0x7f0000000100)=0x6e) setsockopt$inet_tcp_int(r2, 0x6, 0x1e, &(0x7f0000000280)=0x3f, 0x4) [ 438.570564] binder: 13482:13484 ioctl 40046207 0 returned -16 [ 438.577726] binder: release 13472:13478 transaction 729 out, still active [ 438.593579] binder: undelivered TRANSACTION_ERROR: 29189 [ 438.602551] binder: BINDER_SET_CONTEXT_MGR already set [ 438.613379] binder: 13482:13488 ioctl 40046207 0 returned -16 18:01:06 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:06 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x19, r0, 0x0, 0x10000001f) ptrace$getenv(0x4201, r0, 0x100, &(0x7f0000000000)) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 438.621869] binder: send failed reply for transaction 729, target dead [ 438.653006] binder: 13482:13497 transaction failed 29189/-22, size 0-0 line 3117 [ 438.655675] binder: send failed reply for transaction 732 to 13482:13488 18:01:06 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) [ 438.669152] binder: 13493:13498 Release 1 refcount change on invalid ref 0 ret -22 [ 438.687004] binder: undelivered TRANSACTION_ERROR: 29189 [ 438.696608] binder: undelivered TRANSACTION_COMPLETE [ 438.707052] binder: undelivered TRANSACTION_ERROR: 29189 [ 438.740499] binder: send failed reply for transaction 735 to 13493:13498 [ 438.749675] binder_alloc: 13509: binder_alloc_buf, no vma [ 438.759229] binder: undelivered TRANSACTION_ERROR: 29189 [ 438.769606] binder: 13509:13514 transaction failed 29189/-3, size 0-0 line 3254 [ 438.791110] binder: BINDER_SET_CONTEXT_MGR already set [ 438.796698] binder: 13509:13518 ioctl 40046207 0 returned -16 [ 438.803349] binder_alloc: 13509: binder_alloc_buf, no vma [ 438.809170] binder: 13509:13514 transaction failed 29189/-3, size 0-0 line 3254 [ 438.818293] binder: undelivered TRANSACTION_ERROR: 29189 [ 438.824543] binder: undelivered TRANSACTION_ERROR: 29189 18:01:07 executing program 5: setrlimit(0x1, &(0x7f0000011000)) r0 = memfd_create(&(0x7f0000000280)='\x96[d\x04\xe8\x19\xac_\xac\xce\x8aa\x86>H\x10\xb4\xfe\x1e\x1b\xfd\xc4\xa7.\xc2`\x18\xd3\xef\xa4\x11\x87\xc3|x\xf7\xdd4\xb3\x84\x992\x9c\xaf\xdc\xf97@\x7ft\xbb\xe1\xb43(\x00t\xfc\xa0\xc5\xf8\x00^\xecQi\x1c\xbd\x89\x860\x9b\xde)\x98\xc1j\'g\xe4\xa4\xe4\x8a\xa6\r\x1b*B\"\x92O\xd4\xaf\x91\x8eg\xb2\xca\x93\x97\x8c5\xec\x16\'\x98L\xddS\v\xe8h\x9a^\xbas\x1f\xdck\xb8\xec', 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000000)={0x1, 0x10000, 0x7fff, 0xd, 0x0, 0x887a}) fallocate(r0, 0x0, 0x0, 0x400) 18:01:07 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) fcntl$setflags(r1, 0x2, 0x1) 18:01:07 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(r1, 0x2, 0x1) 18:01:07 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20, 0x0, @rand_addr, 0xfffffffffffffffd}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = request_key(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000100)='system@\x00', 0xfffffffffffffffe) r2 = add_key(&(0x7f0000000140)='blacklist\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)="aa0b3b59e3ca74bcf6bcab5481a2448066cc610180d2e70fb6be52df128810c1aa539e097640d05f787da7c81fcc35ca99827b4191d80dc8f68d05da122464f0bff2c4376ad4332816a13d0df710de124b22e7545384afe36c7a69603f3db304aa90496a44812744fedc3c4483c1e4770a71c103b66075e8dde7782af2186649cc7fd35296c2a291b2016b37adc5c96ae898ed0e0fbaa76c85b9341ea0166944f7d27eac4a5c0bc70d9e32154ce859eacf9e4e27e7be65a11b08c779f0a91a76109ba1fb880f20b37af5a9b98a2573f5474272b57bd82a", 0xd7, 0xffffffffffffffff) keyctl$unlink(0x9, r1, r2) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:07 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$poke(0x4, r0, &(0x7f0000000000), 0x7f) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$dupfd(r0, 0x406, r0) 18:01:07 executing program 0: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) getsockopt$inet_mtu(r1, 0x0, 0xa, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x373) ioctl$EXT4_IOC_MOVE_EXT(0xffffffffffffffff, 0xc028660f, 0x0) getsockopt$inet_buf(r1, 0x0, 0x27, &(0x7f0000000380)=""/153, 0x0) gettid() r4 = getpgrp(0x0) timer_create(0x0, 0x0, 0x0) timer_delete(0x0) ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000200)=r4) write$P9_RREMOVE(0xffffffffffffffff, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_TIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) sendto$inet6(r3, 0x0, 0x0, 0x20000001, &(0x7f0000000040)={0xa, 0x2, 0x0, @rand_addr, 0x80000000000}, 0x1c) splice(r3, 0x0, r2, 0x0, 0x1000000000000003, 0x0) fsetxattr$trusted_overlay_redirect(r3, &(0x7f0000000080)='trusted.overlay.redirect\x00', 0x0, 0x0, 0x0) inotify_init1(0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, 0x0) write$UHID_CREATE2(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendmsg$NBD_CMD_RECONFIGURE(r2, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1808100}, 0xc, 0x0}, 0x40800) ioctl$GIO_UNISCRNMAP(0xffffffffffffffff, 0x4b69, 0x0) write$P9_RLOPEN(r2, &(0x7f00000000c0)={0x18, 0xd, 0x1}, 0x18) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, 0x0) sendto$packet(r3, &(0x7f0000000340), 0xfffffffffffffd4d, 0x57, 0x0, 0x0) [ 439.873450] binder: BINDER_SET_CONTEXT_MGR already set [ 439.883459] binder: 13527:13536 ioctl 40046207 0 returned -16 [ 439.891700] binder: BINDER_SET_CONTEXT_MGR already set [ 439.897705] binder: 13531:13542 ioctl 40046207 0 returned -16 [ 439.909787] binder_alloc: 13531: binder_alloc_buf, no vma 18:01:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 18:01:07 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2, 0x0) setsockopt$inet6_tcp_buf(r0, 0x6, 0xd, &(0x7f0000000140)="91b9b9b306753c31ec16891a4add976e55ae3dd0c56eaf9ab76141fa67353797d8961932e8cbffe4f992c0a584d044c73a6234e56598c385761c38ee6a3d45808f2676e03bdc6012e5da3e36ce87519918f8c4157fbe221d716e183f397cc2c7b0fe7c6def5cc9f484ad6a3dc3cd62e4de03c22d4eeb553af92a89d8a1cfd32753f9d64a0f667fe83f116bbec94670e2a3332ffd518a2d77c34a25e136fbbdb3dbfbaf044ba3e47eb4c204bb4dee60cab559f4fa5c9df9c5", 0xb8) r1 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x28) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r1, 0x0, 0x0) 18:01:07 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x6, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x11}}, 0x3f}, 0x1c) [ 439.922228] binder: 13527:13536 transaction failed 29189/-3, size 24-8 line 3254 [ 439.934696] binder: 13527:13536 BC_INCREFS_DONE u0000000000000000 no match [ 439.953413] binder: 13527:13536 Release 1 refcount change on invalid ref 1 ret -22 [ 439.968148] binder_alloc: 13551: binder_alloc_buf, no vma 18:01:07 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(r1, 0x2, 0x1) [ 439.988779] binder: 13551:13557 transaction failed 29189/-3, size 0-0 line 3254 [ 440.012863] binder: BINDER_SET_CONTEXT_MGR already set [ 440.018805] binder: BINDER_SET_CONTEXT_MGR already set [ 440.025498] binder: 13565:13567 ioctl 40046207 0 returned -16 [ 440.032779] binder: 13551:13568 ioctl 40046207 0 returned -16 18:01:07 executing program 3: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x0, 0x0) fsetxattr$security_smack_entry(r0, &(0x7f0000000100)='security.SMACK64MMAP\x00', &(0x7f0000000140)='+\x00', 0x2, 0x1) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x80000, 0x0) fstatfs(r1, &(0x7f0000000480)=""/4096) getsockopt$ARPT_SO_GET_REVISION_TARGET(r3, 0x0, 0x63, &(0x7f0000000040)={'NETMAP\x00'}, &(0x7f0000000080)=0x1e) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 440.040153] binder_alloc: 13551: binder_alloc_buf, no vma [ 440.046476] binder: 13565:13567 transaction failed 29189/-3, size 24-8 line 3254 [ 440.051611] binder: undelivered TRANSACTION_ERROR: 29189 [ 440.068427] binder: 13565:13567 BC_INCREFS_DONE u0000000000000000 no match [ 440.089779] binder: 13565:13567 Release 1 refcount change on invalid ref 1 ret -22 [ 440.109557] binder_alloc: 13576: binder_alloc_buf, no vma [ 440.126514] binder: 13576:13577 transaction failed 29189/-3, size 0-0 line 3254 18:01:07 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x200080, 0x0) getpeername(r1, &(0x7f0000000040)=@vsock, &(0x7f0000000140)=0x80) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:07 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(r1, 0x2, 0x1) 18:01:07 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20, 0x0, @rand_addr, 0xfffffffffffffffd}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = request_key(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000100)='system@\x00', 0xfffffffffffffffe) r2 = add_key(&(0x7f0000000140)='blacklist\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)="aa0b3b59e3ca74bcf6bcab5481a2448066cc610180d2e70fb6be52df128810c1aa539e097640d05f787da7c81fcc35ca99827b4191d80dc8f68d05da122464f0bff2c4376ad4332816a13d0df710de124b22e7545384afe36c7a69603f3db304aa90496a44812744fedc3c4483c1e4770a71c103b66075e8dde7782af2186649cc7fd35296c2a291b2016b37adc5c96ae898ed0e0fbaa76c85b9341ea0166944f7d27eac4a5c0bc70d9e32154ce859eacf9e4e27e7be65a11b08c779f0a91a76109ba1fb880f20b37af5a9b98a2573f5474272b57bd82a", 0xd7, 0xffffffffffffffff) keyctl$unlink(0x9, r1, r2) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:07 executing program 1: setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 440.165188] binder: BINDER_SET_CONTEXT_MGR already set [ 440.174756] binder: 13576:13577 ioctl 40046207 0 returned -16 [ 440.174794] binder_alloc: 13576: binder_alloc_buf, no vma [ 440.193950] binder: 13576:13583 transaction failed 29189/-3, size 0-0 line 3254 [ 440.208703] binder: undelivered TRANSACTION_ERROR: 29189 18:01:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x200000, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) connect(r2, &(0x7f00000000c0)=@un=@file={0x0, './file0\x00'}, 0x80) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={0x0, r2, 0xf}, 0x14) ioctl$KDSKBMODE(r2, 0x4b45, &(0x7f0000000180)=0x178) ioctl$TIOCSPGRP(r2, 0x5410, &(0x7f0000000080)=r3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) [ 440.216097] binder: undelivered TRANSACTION_ERROR: 29189 18:01:08 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) [ 440.257221] binder: release 13585:13589 transaction 750 out, still active [ 440.261458] binder: BINDER_SET_CONTEXT_MGR already set [ 440.272940] binder: 13595:13596 ioctl 40046207 0 returned -16 [ 440.283199] binder_alloc: 13585: binder_alloc_buf, no vma [ 440.285591] binder: send failed reply for transaction 750, target dead [ 440.308297] binder: 13595:13596 transaction failed 29189/-3, size 0-0 line 3254 [ 440.325706] binder: release 13604:13605 transaction 755 out, still active [ 440.358128] binder: BINDER_SET_CONTEXT_MGR already set [ 440.363852] binder: 13595:13607 ioctl 40046207 0 returned -16 [ 440.364993] binder: send failed reply for transaction 755, target dead [ 440.389348] binder: 13595:13596 transaction failed 29189/-22, size 0-0 line 3117 [ 440.398925] binder: undelivered TRANSACTION_ERROR: 29189 [ 440.413938] binder: undelivered TRANSACTION_ERROR: 29189 18:01:08 executing program 4: clone(0x20000000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x2, 0x2000000000000) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x100) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20800000}, 0xc, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYBLOB="94000000", @ANYRES16=r2, @ANYBLOB="000429bd7000fbdbdf250c0000001c00090008000200f7ffffff080002000800000008000200030000003c00070008000200030000000c000400ffffff7f000000000c00040008000000000000000c000300000000000098e8020c000300040000000000000020000524860008000100696200000c00020008000400810000000800010069620000080002000400"], 0x94}, 0x1, 0x0, 0x0, 0x1}, 0x20008010) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:08 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40008}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r2, 0x4, 0x70bd28, 0x25dfdbfd, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x8000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) write$binfmt_script(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="2321292e2f66696c6530200a51817fabedc14fbbc7011c55d2776df66b972cf51e611f727da2ab867503e1d5a7c80bdf1e1e2f5e51ae1f578e5fa5c3cb27b85ac75a7d26583cbb59ae354026d78b0d5a4bfd9093d2d89bb17f049c4257c930bb9e0bb870d8195dd6ced221750d6258023d47ced966d8a11da60377fa19a9a8a206504f619e48b6cccb8a2bbd8ff69c649c617ef174046f773673c182c2ed0d35176a7a8fc6d771bac76ded943c10d21fa6b50f1f161796c9600ae8fc2669d23df8e3023355fd556ee0b792fe597fc7aad161deea82a86473c1785a825c59490f40c8fac238fd929e7da500000000"], 0x45) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:08 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x3) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = dup(r1) ioctl$INOTIFY_IOC_SETNEXTWD(r2, 0x40044900, 0x9) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0xfffffffffffffd34, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0}) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0xc) 18:01:08 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x5) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x32b) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x0) memfd_create(0x0, 0x4) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000500)='./file0/file0\x00', 0x0) 18:01:08 executing program 5: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=ANY=[@ANYBLOB="6e617400000000000000000000000000000000000000000000000000000000001b00000005000000780600000000000000000000000000006001000070020000a8050000a8050000a8050000a8050000a805000005000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="fe8000000000000000000000000000bb00000000000000000000000000000001000000ff00000000ff000000ffffff00ffffffffffffffffffffffff0000000079616d3000000000000000000000000062726964676530000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff000000000000000000000000000000003c006b04400000000000000000000000000000001801600100000000000000000000000000000000000000000000000028006d6800000000000000000000000000000000000000000000000000000000080001000000000028006d6800000000000000000000000000000000000000000000000000000000aafa0000000000004800534e4154000000000000000000000000000000000000000000000000000101000000fe800000000000000000000000000017000000000000000000000000000000004e244e2400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f2ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c800100100000000000000000000000000000000000000000000000048004e45544d415000000000000000000000000000000000000000000000000001000000ac14141e000000000000000000000000000002000000000000000000000000004e22010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c80010010000000000000000000000000000000000000048004e45544d415000000000000000000000000000000000000000000000000012000000ffffffff000000000000000000000000000000000000000000000000000000004e240067000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002280200000000000000000000000000000000000000000000000038017274000000000000000000000000000000000000000000000000000000000500000000020000000000000200000030040000fe800000000000000000000000000022297baaf872a4cdb15aaa45a45441afdcfe800000000000000000000000000010d511d1904947076a4c7ed7e26999bab400000000000000000000000000000001ff010000000000000000000000000001fe8000000000000000000000000000aa0000000000000000000000000000000000000000000000000000000000000000ff01000000000000000000000000000100000000000000000000ffffac1e000100000000000000000000ffffffffeb03fe8000000000000000000000000000bbff02000000000000000000000000000100000000000000000000fffffffffffffe8000000000000000000000000000bb0100000028004d41524b000000000000000000000000000000000000000000000000000200000000018000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a800d0000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff000000000000000000"], 0x6d8) r1 = socket(0x11, 0x80003, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0x5) write$binfmt_elf64(r1, &(0x7f0000000e00)=ANY=[@ANYBLOB="7f454c4619c101000300000000000000020006007d0000006101000000000000400000000000000082020000000000002000000000003800020003000000070057e57464060000000300000000000000ff7f000000000000070000000000000009000000000000000300000000000000560d0000000000003f30dd65e2820c525f24fbb98230925c04fb55000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cb4eaaa6276446fb26e0f30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005b0d7b3950b48d490e4756ac7bb54aff58750a8ee12215cf160e24d25aa4656e1dab2894746ef11dbe2e2519bedd6c7740014937d317ee4f673fa456ee882424efd1d877e4754a7cc5d92c1902e814dcaf49b454a9135a7f67365ca514563ce37d8fb48a50973c8a4a2466a24b260683a0cb4149a9c183b804ea0212974d6996cfb8b1de2"], 0x48b) prctl$PR_SET_FP_MODE(0x2d, 0x0) setreuid(0x0, r2) setuid(r2) getrlimit(0x1, &(0x7f0000000000)) [ 440.740608] binder: 13619:13620 ioctl 40044900 9 returned -22 [ 440.754121] binder: BINDER_SET_CONTEXT_MGR already set [ 440.762900] binder: 13619:13630 ioctl 40044900 9 returned -22 [ 440.764003] binder: 13618:13622 ioctl 40046207 0 returned -16 [ 440.776653] binder: BINDER_SET_CONTEXT_MGR already set [ 440.783299] binder: 13619:13620 ioctl 40046207 0 returned -16 18:01:08 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x5) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x32b) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x0) memfd_create(0x0, 0x4) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000500)='./file0/file0\x00', 0x0) 18:01:08 executing program 3: r0 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1c) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000100)='trusted.overlay.origin\x00', &(0x7f0000000140)='y\x00', 0x2, 0x1) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0063404000000800e44cc436921216643d894fe30bf3000000000000fdff00000002000000000068e0cd503f98aa2e0700000000000000000a00000000000000000000000000000000000000000000000000caa5f1d603f7f7b5793b459882f6381eb3cea4a93ea1322da6cbedcae29124d49b"], 0x0, 0x0, 0x0}) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r2) 18:01:08 executing program 4: clone(0x100000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() syz_extract_tcp_res$synack(&(0x7f0000000040), 0x1, 0x0) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0x14, r0, 0xffffffffffffffff, &(0x7f00000002c0)="8933fc94668aed2b4aaf8d2c24c47565779987e6ed958fe2b2ff6efa7ba6408f353c363a77fa57f25dd258b91dd04b550702e9c705c32493cf0244c7f1f5e90b2a2faaeb484ce5d68d630bed4074c4321fb7c3b1ebc8c15ff5bfd4d0fb73a647d3115206367fae57c4381400000000000000c8d0b0b977556cdd48cc780862712fe45a336e908762a4") r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000180), &(0x7f00000001c0)=0x8) ptrace$cont(0x1f, r0, 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000000)) [ 440.805778] binder: 13618:13637 transaction failed 29189/-22, size 24-8 line 3117 [ 440.843409] binder: 13618:13622 BC_INCREFS_DONE u0000000000000000 no match 18:01:08 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x8) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 440.874146] binder: 13618:13622 Release 1 refcount change on invalid ref 1 ret -22 [ 440.900786] binder: 13641:13644 got transaction to invalid handle 18:01:08 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 440.923286] binder: 13641:13644 transaction failed 29201/-22, size 4562372786227511296-120498840 line 3117 [ 440.952715] binder: BINDER_SET_CONTEXT_MGR already set 18:01:08 executing program 0: mkdir(&(0x7f0000000300)='./file0\x00', 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x5) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETLINK(r0, 0x400454cd, 0x32b) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) r1 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) chown(&(0x7f00000001c0)='./file0\x00', r2, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [{}, {}], {0x10, 0x2}}, 0x34, 0x0) memfd_create(0x0, 0x4) chdir(&(0x7f0000000340)='./file0\x00') symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, &(0x7f0000000380), 0xffffffffffffffff) lstat(&(0x7f0000000500)='./file0/file0\x00', 0x0) [ 440.974373] binder: 13641:13653 ioctl 40046207 0 returned -16 [ 440.974625] binder: BINDER_SET_CONTEXT_MGR already set [ 440.987604] binder: 13641:13644 got transaction to invalid handle [ 440.988583] binder: undelivered TRANSACTION_ERROR: 29201 [ 441.001218] binder: 13651:13654 ioctl 40046207 0 returned -16 [ 441.008359] binder: 13651:13661 transaction failed 29189/-22, size 24-8 line 3117 18:01:08 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0xfffffffffffffcca, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x400000) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x40000, 0x88) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r2, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0xc0, r3, 0x0, 0x70bd26, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x40}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x1c, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xc85b}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'fo\x00'}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@rand_addr=0x401}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3f}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}]}, 0xc0}, 0x1, 0x0, 0x0, 0x1}, 0x800) ptrace$cont(0x1f, r0, 0x0, 0x0) r4 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r1, &(0x7f0000000040)) 18:01:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffe19, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) 18:01:08 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() ptrace$setopts(0x4200, r0, 0xa4af, 0x6) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) sched_setparam(r1, &(0x7f0000000040)=0x5ac949bc) r2 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000300)='/dev/keychord\x00', 0x80, 0x0) setsockopt$inet_int(r3, 0x0, 0x1b, &(0x7f0000000340)=0x80000000, 0x4) ptrace$setopts(0x4206, r1, 0x0, 0x200000000000) tkill(r2, 0x28) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r4 = accept4(0xffffffffffffffff, &(0x7f0000000140)=@sco, &(0x7f00000001c0)=0x80, 0x80000) sendmsg$nl_generic(r4, &(0x7f00000002c0)={&(0x7f0000000200), 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x28, 0x3e, 0x103, 0x70bd2b, 0x25dfdbfd, {}, [@typed={0x14, 0x64, @ipv6=@ipv4={[], [], @empty}}]}, 0x28}, 0x1, 0x0, 0x0, 0xc800}, 0x20000000) r5 = dup(0xffffffffffffff9c) ioctl$TUNGETVNETHDRSZ(r5, 0x800454d7, &(0x7f0000000080)) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000080)) r6 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x0}, 0x0, 0x0, 0xffffffffffffffff) keyctl$set_timeout(0xf, r6, 0x7) ptrace$cont(0x1f, r2, 0x0, 0x0) [ 441.008385] binder: 13641:13644 transaction failed 29201/-22, size 4562372786227511296-120498840 line 3117 [ 441.038042] binder: undelivered TRANSACTION_ERROR: 29201 [ 441.054908] binder: 13651:13654 BC_INCREFS_DONE u0000000000000000 no match 18:01:08 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) capset(&(0x7f0000000000)={0x20080522, r0}, &(0x7f0000000040)={0x4, 0x101, 0x0, 0x3f, 0x80000001, 0x3}) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:08 executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_proto_private(r0, 0x89ec, &(0x7f0000000100)="e779f6f33e5a97d5528e046ac440bb56e8e6009917cd67b72cd9ec603b10e398803c81f2331c621c0fce3ec3070154549d02c3bbb58329a9f6b5a8a095af8ff1a17a136acc5f41067fe73f784bf0ef4c578981bc5d5a51c5a38e645da17a20b39bac6c665554fee1d7131779c63bb3c4483c561620773faf636b9c39fda8d712f38ab07a51676480f81207315815925c31e8495677e601666d4057d2c7352523aebf52af5a4198dd59afcb67312c465f058aaf433db885fdedaa1443c2e238e832a9f28026b9") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x31) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) timerfd_create(0xd, 0x80000) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 441.071966] binder: 13651:13654 Release 1 refcount change on invalid ref 1 ret -22 [ 441.084498] binder: BINDER_SET_CONTEXT_MGR already set [ 441.114184] binder: 13668:13675 ioctl 40046207 0 returned -16 18:01:08 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x400000, 0x0) r0 = open(&(0x7f0000000140)='./file0\x00', 0x40, 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x1) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000140)=ANY=[], 0x4240a2a0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) symlinkat(&(0x7f0000000100)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00') r4 = socket$inet_udp(0x2, 0x2, 0x0) close(r4) socket$inet(0x2, 0x3, 0x7f) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x21) connect$inet(r4, &(0x7f0000000040)={0x2, 0x0, @multicast1}, 0x10) splice(r1, 0x0, r4, 0x0, 0x80ffffc, 0x0) splice(r1, 0x0, r3, 0x0, 0x8, 0x0) 18:01:08 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:08 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000880)=ANY=[@ANYRES16, @ANYRESHEX], 0x2) openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='cgroup2\x00', 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000080)={0x3}, 0xffffffffffffff7d) 18:01:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ec91e6cfa1ab8d241354baf06af08272092597bdbc7c3760219097ace812"], 0x0, 0x0, 0x0}) 18:01:08 executing program 1: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='bpf\x00', 0x21, &(0x7f0000000180)={[{@mode={'mode', 0x3d, 0x7ff}}, {@mode={'mode', 0x3d, 0x80000000}}, {@mode={'mode', 0x3d, 0x2}}, {@mode={'mode', 0x3d, 0x80}}, {@mode={'mode', 0x3d, 0x9}}], [{@seclabel='seclabel'}, {@rootcontext={'rootcontext', 0x3d, 'sysadm_u'}}, {@subj_user={'subj_user', 0x3d, '-'}}, {@dont_measure='dont_measure'}, {@dont_hash='dont_hash'}, {@smackfstransmute={'smackfstransmute', 0x3d, '/}eth1'}}, {@euid_eq={'euid', 0x3d, r0}}, {@func={'func', 0x3d, 'POLICY_CHECK'}}]}) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000005c0)=0x14) setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000600)={{{@in6=@dev={0xfe, 0x80, [], 0x2a}, @in6=@empty, 0x4e23, 0x400, 0x4e20, 0x0, 0x2, 0x0, 0x80, 0x3b, r2, r0}, {0xca, 0x5810, 0x800, 0x4, 0x10001, 0x0, 0x80000000, 0x1}, {0x3, 0x3f, 0x7fff, 0x456}, 0x6, 0x0, 0x0, 0x1, 0x1, 0x1}, {{@in=@remote, 0x4d6, 0xff}, 0x2, @in6=@rand_addr="d75f921209f0a71fb694b00eeee4a499", 0x3504, 0x5, 0x2, 0x4, 0xfffffffffffffa01, 0x100000001, 0x80000000}}, 0xe8) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x80000000800, 0x73) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:08 executing program 4: keyctl$set_reqkey_keyring(0xe, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) getsockopt$packet_buf(r0, 0x107, 0x6, &(0x7f0000000140)=""/127, &(0x7f00000001c0)=0x7f) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f0000000040)={0x200, 0x2eb, 0x6, 0x9, 0x72736da6, 0x3}) fstatfs(r0, &(0x7f0000000500)=""/188) write$P9_RSTAT(r0, &(0x7f0000000280)=ANY=[], 0x63) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x28) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f00000004c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8010200}, 0xc, &(0x7f0000000480)={&(0x7f0000000640)=ANY=[@ANYBLOB="e4010000", @ANYRES16=r3, @ANYBLOB="04002dbd7000fcdbdf250b0000002400060004000200040002000400020004000200040002000400020004000200000002001c0104002400070008000200050000000800020001000000080003000200000008000200030000004c00070008000200090000000800040000000000080004000800000008000100010000000800010012000000080002001f000000080001001200000008000300fffeffff080003009b0000000c00010073797a31000000000c00010073797a310000000024000700080001001a000000080004007f0000000800030000000000080002000010000054000700080001001d00000008000200030000000800040009000000080001001200000008000100150000000800010006000000080004000300000008000200c8000000080001000100000008000400400000000c00010073797a31000000000c00010073797a30000000007c00010008000300030000000800030000000000100001007564703a73797a32000000002c0004001400010002004e22ac1414bb00000000000000001400020002004e20e000000100000000000000002c0004001400010002004e23ac14142500000000000000001400020002004e21ac1e000100000000000000001400010008000300ff07000008000300c2fb000049dd0df27a631ec7d65613507180a7845360911a95272a49abe48b352c6ebcdd662103eaa1d759e5eb68a1641dfe78fb5c24a0330fab8ea44f65e2b86e051633c464fd20597f6af6c1e5a210615648d0eb21ca2688cdefce"], 0x1e4}, 0x1, 0x0, 0x0, 0x40001}, 0x40000) ptrace$cont(0x18, r2, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$cont(0x1f, r2, 0x0, 0x0) [ 441.246469] binder: release 13701:13707 transaction 767 out, still active [ 441.246535] binder: BINDER_SET_CONTEXT_MGR already set [ 441.268645] binder: 13704:13712 ioctl 40046207 0 returned -16 [ 441.281005] binder: send failed reply for transaction 767, target dead [ 441.288381] binder: send failed reply for transaction 770 to 13704:13712 18:01:09 executing program 0: syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000880)=ANY=[@ANYRES16, @ANYRESHEX], 0x2) openat$cgroup_ro(r0, &(0x7f0000000000)='cpuacct.usage_sys\x00', 0x0, 0x0) clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000080)='cgroup2\x00', 0x0, 0x0) ppoll(0x0, 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000080)={0x3}, 0xffffffffffffff7d) 18:01:09 executing program 2: open(&(0x7f0000000000)='./file0\x00', 0xfabaafd97a895a14, 0x20) fcntl$getown(0xffffffffffffff9c, 0x9) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000080)=0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) perf_event_open(0x0, r0, 0x2, r1, 0x1) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:09 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd60d8652b00140600fe8000000000000000000d00000000aafe8000000000000000000000000000aa00004e20", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5000000090780000d66b583172dceb247ce376f65dec9cf5b647ff72c49cdc99da87e6d83cfa08f8da739c15037dbea9068827811e40524dbb3ce24e8bec4a8cec8a645fa4b93f47a3bba609052eae8312df49508487d95d1d608772a9e103129ad7c21e720c9c0b6074f2b9ded1e6d0cd06682a33f7ca5ced7f721d111c8b67fdbf05c2625030e763c296873ecc396c5b"], 0x0) [ 441.288539] binder_alloc: 13704: binder_alloc_buf, no vma [ 441.313266] binder: 13704:13712 transaction failed 29189/-3, size 0-0 line 3254 [ 441.313706] binder: undelivered TRANSACTION_COMPLETE [ 441.329139] binder: undelivered TRANSACTION_ERROR: 29189 [ 441.335829] binder: undelivered TRANSACTION_ERROR: 29189 18:01:09 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) readv(r0, &(0x7f00000007c0)=[{&(0x7f0000000100)=""/146, 0x92}, {&(0x7f00000001c0)=""/109, 0x6d}, {&(0x7f0000000240)=""/192, 0xc0}, {&(0x7f0000000300)=""/226, 0xe2}, {&(0x7f0000000400)=""/182, 0xb6}, {&(0x7f00000004c0)=""/68, 0x44}, {&(0x7f0000000540)=""/141, 0x8d}, {&(0x7f0000000600)=""/228, 0xe4}, {&(0x7f0000000700)=""/149, 0x95}, {&(0x7f0000000080)=""/33, 0x21}], 0xa) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000880), 0x4) syz_open_procfs(0xffffffffffffffff, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x204400, 0x0) 18:01:09 executing program 3: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80002, 0x0) getsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000080), &(0x7f00000000c0)=0x4) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000100)) fchown(r1, 0x0, 0x0) lsetxattr$security_evm(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='security.evm\x00', &(0x7f00000001c0)=@v1={0x2, "cea60756adb357412008477271e1fa2015539a"}, 0x14, 0x2) 18:01:09 executing program 0: r0 = socket$inet(0x10, 0xc, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="240000002a0007021dfffd946fa2830020200a00050000000000000000009d50ff7e0000", 0x24}], 0x1}, 0x0) syz_genetlink_get_family_id$nbd(0x0) [ 441.378418] binder: BINDER_SET_CONTEXT_MGR already set [ 441.395125] binder_alloc: 13726: binder_alloc_buf, no vma [ 441.401643] binder: 13726:13729 ioctl 40046207 0 returned -16 [ 441.412293] binder: 13726:13731 transaction failed 29189/-3, size 24-8 line 3254 [ 441.427354] binder: 13726:13742 Release 1 refcount change on invalid ref 1 ret -22 [ 441.428125] binder: 13726:13741 BC_INCREFS_DONE u0000000000000000 no match [ 441.455619] binder: send failed reply for transaction 774 to 13726:13729 [ 441.475246] binder: undelivered TRANSACTION_ERROR: 29189 18:01:09 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) sendmsg$netlink(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[]}, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/create\x00', 0x2, 0x0) r3 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1003f, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000020000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmmsg(r5, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) 18:01:09 executing program 3: ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'bcsh0\x00', &(0x7f0000000000)=ANY=[@ANYBLOB="00000000ff01000006000000010000004ef0c07a4b5849b44704e403624619ea"]}) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) openat$cgroup_ro(r0, &(0x7f0000000040)='cpuacct.usage_all\x00', 0x0, 0x0) pwritev(r2, &(0x7f0000000580)=[{&(0x7f0000000480)="c6a27f1046e934ad590633ca8f0eea217070fe1a83bb4d299357ffc4d210218ea1ad30d2c923c0d5fb4ac321ade2241e2be54d71f71d48148835dea70689cdc3af01ef2f7ab91c5811b293d049c1af98df9a3e6852007d99554ead99b73ee8e6b8d89359df38ec0b804f7519116711de9c83f89efb72fbafb9721930b52f770f508537fd8db612b1609c6e42cfe190e6f6b921207fdd28744b2ffcc29f3a6300970ffdeb1059edf794ca4e913de1100cb18fa9c83afe8780660f1788944b00bdc0443ea2fdb0f424b1715da2f7245e66b8d327f43ad8b17b1c958a29ab0db6b08e17576fa99ba293d85a553a5cba4c4bd5b7253f190c640f", 0xf8}, {&(0x7f0000000380)="734f2fe774ee33382b17d5a4a98502e56f7df0106b9008331037bc03c9fa1a3f2b2666d4b0e4de6f3dd7a7af15667975d8fac5c81c1c784eb6dc2639f29d649eaf0bf3822f77cf1f6e0370a52f35d5811fb59a9541111f691809f26456bf2fe09fd8984a749e9c34c20e36d0", 0x6c}, {&(0x7f0000000400)="b399e442af3a3f6d5c6c042c1099d133e09bc4fe23fd8dff789eb68b0aaa4a4083bb4a25add0c6d6dc757edd24af124b09546e4b43b6e0eac612daac3795257c1513fe6e2a5ad03d0bd0edc839a183afb7a577dd2d92ddee456ddd7245f5", 0x5e}], 0x3, 0x81805) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, &(0x7f00000001c0), 0x20002000005) listxattr(0x0, &(0x7f00000013c0)=""/21, 0x15) sync_file_range(r1, 0x7, 0x930, 0x0) write$apparmor_current(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB='permhat \rx0000000000000001^syzsyz/selinux/avc/cache_threshold\x00keyring\x00/dev/loop#\x00\x00'], 0x1) ioctl$LOOP_CLR_FD(r1, 0x4c01) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) socketpair$unix(0x1, 0x0, 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0xbfffe, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, 0xffffffffffffffff) 18:01:09 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @rand_addr, 0x4002}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r1, 0x0, 0xfffffe6e) r2 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$TCSBRK(r2, 0x5409, 0x101) 18:01:09 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r4, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = dup3(r4, r3, 0x80000) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000380)=[@decrefs={0x40046307, 0x2}], 0x56, 0x0, &(0x7f0000000480)="f9fe96fd343741ab7f04a82ac2a1869862e19153621064c8a837a9ccc1ad3a068a976db1230899e18a8a21b8c2bb01c173c2a684cafc395687dcb76d17f80edaec7dcafb63033f998d0ee212ba2500d7af26b53e98c8"}) ioctl$TIOCSLCKTRMIOS(r5, 0x5457, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f0000000080)={0x7, 0x10000, 0x5, 0x0, 0x0, [{r2, 0x0, 0x2}, {r0, 0x0, 0x5}, {r4, 0x0, 0x800}, {r1, 0x0, 0xc5}, {r1, 0x0, 0x7f}]}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000140)=@sha1={0x1, "a8e5fdbe84c01b392646f5c23362ffdb56881e39"}, 0x15, 0x2) 18:01:09 executing program 0: setresuid(0x0, 0xfffe, 0xffffffffffffffff) getuid() r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/snmp6\x00') dup2(r0, r0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000000040)={0x1, {{0xa, 0x4e23, 0x100000001, @local, 0x100000001}}}, 0x88) [ 442.291436] binder: 13770:13771 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 442.338606] binder: 13770:13782 ioctl 5457 20000180 returned -22 [ 442.351483] binder: 13770:13782 got transaction to context manager from process owning it [ 442.365099] binder: 13770:13782 transaction failed 29201/-22, size 24-8 line 3108 [ 442.373796] binder: 13770:13782 BC_INCREFS_DONE node 778 has no pending increfs request [ 442.382677] binder: 13770:13782 Release 1 refcount change on invalid ref 1 ret -22 [ 443.082243] binder: BINDER_SET_CONTEXT_MGR already set [ 443.087587] binder: 13770:13782 ioctl 40046207 0 returned -16 [ 443.091065] binder: 13770:13965 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 443.093703] binder: 13770:13966 ioctl 5457 20000180 returned -22 [ 443.107685] binder: 13770:13965 BC_INCREFS_DONE u0000000000000000 no match [ 443.107703] binder_alloc: 13770: binder_alloc_buf, no vma [ 443.115477] binder: 13770:13965 Release 1 refcount change on invalid ref 1 ret -22 [ 443.120765] binder: 13770:13782 transaction failed 29189/-3, size 24-8 line 3254 18:01:12 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0xb, &(0x7f0000000240)=0x3, 0x4) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000000)=0x32, 0x4) connect$inet(r0, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) signalfd(r0, &(0x7f00000000c0)={0x100}, 0x8) r1 = gettid() ptrace$cont(0x29, r1, 0x8000000, 0x7ff) sendmmsg(r0, &(0x7f0000004e00)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) 18:01:12 executing program 0: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f00000004c0)={0x0, {0x2, 0x4e24, @empty}, {0x2, 0x4e21, @broadcast}, {0x2, 0x0, @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x413, 0x1}) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) syz_open_dev$loop(&(0x7f0000ca9ff5)='/dev/loop#\x00', 0x0, 0x105082) getpgid(0xffffffffffffffff) getpgid(0x0) accept4$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0}, &(0x7f0000000380)=0x14, 0x800) recvfrom$packet(r1, &(0x7f0000000300)=""/82, 0x52, 0x40000000, &(0x7f00000003c0)={0x11, 0x0, r2, 0x1, 0x1, 0x6, @random="5a265e8464f4"}, 0x14) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) r3 = socket(0x2, 0x3, 0x100000001) bind$inet(r3, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x32) ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f0000000400)={0x2, 0x10100000}) r4 = open(&(0x7f0000074000)='./file0\x00', 0x141046, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(0xffffffffffffffff, 0x4008240b, &(0x7f0000000280)={0x7, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1, 0xe0, 0x5912, 0x0, 0x0, 0x2, 0xe12, 0x100000000, 0x3ca, 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x0, 0x4, 0x9, 0x1, 0x0, 0x46, 0x6, 0x4, 0x80, 0x5e9, 0x7, 0x7fffffff, 0x7, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0, 0x1}, 0x0, 0x0, 0x6d, 0x0, 0x0, 0x1}) ftruncate(r4, 0x8007ffc) sendfile(r3, r4, 0x0, 0x400008bca) clock_gettime(0x0, 0x0) write$evdev(0xffffffffffffffff, &(0x7f0000000500), 0x0) 18:01:12 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) tkill(r0, 0x1f) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xf, r0, 0x0, &(0x7f0000000000)="2a21e877ebe1937a5247270c6aaf0c0000000000000d256d02000000dac41bb09a614ff78b053901f72e73dd86ce5488b0d900000000000000") ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) write$binfmt_elf32(r1, &(0x7f0000000140)=ANY=[@ANYBLOB="7f454c4600090404bb98f8420000000003000600feffffff5802000038000000000200000800000003002000010001000200feff000000000500000000c0ffff070000000300000001000000cdbb0000d40a000000000000744e66d4df9cfd56a15bdae5b419fae6b7bc403ed3be64a80100000000000000a11fd6ce620ccfd725c699ec474b0cf5c4580ef237ca72c1bbe3d6630219eafb23092b3896bb9719e164e8e4039d47542fad0f7eefe51631547b3318d619ed6c9781e03feb77bf3de680748938021229cd8b6714849a35d08f29a6e035e6692f1111dca4a68c7beaff4f910863ce3aea6df88afb138d7ceb52d2ac38402c652237ece63c721fdce32399f491e010b59665c2a79fb12308e4950e3ec33b9eb3891e9a4635f10fde37448be49468b1e26eeed070accb0c17924e3e5c5962e5ad990953a6a59c7bd6b672b3482279dcf43a2e2afc4aebbe91f2c0db5e179622fa8fce590b947b36daf76a95dce6701ef30bcfdb7069bf8073573c8dc47c49d21872e214e1e071e36af34d1d99bc4b9dfd8a726583d4efbc8c39cde7ac3cfda8a254c6b07ad919c09862905799acaee4492008daf4bc8939e7a95782a3e071628a454ef38aaeeff13b5de5ae0a9ddd671d4409c5489b1347eeb0115d7a4564eb210782996ac03e0d2420f0dbe7e515642b35ad2c1a2e03d2208b6c012e8d86a3abb46fc6f9db44cb20386ba4fe289eea66a04011d381b79d2ff203202d406bf5d071208cea099099359bc1ddc1787050f828748623ec07305fe1655b1148c1fe4147a5270bc44ca6bbf97c713c8cea2ec36c13082be28d93c9186383b6cc394252c47d7d9d9239d2020035f82aedb592b679af2b601ec5804d9f90b50c4a81304ec9291d78f07d59e60c8186db4f19388becaff9217a5f242b02499f8b8bf2fecadfa9ae5fc702c3b69041d22d5db6e6f2a800c8101b8ce6e1825aeb918b31fdd6be6f6fafd35886908905316857fa6b4941018e315d6c539a0991bf41389650a6bf63e094aba8e21f1377ab49c29170e1e55f908ca28bb1cee004c63feaff00604f3fd964b1e99aeb02ef55e5312acef8da617f45e9c05bfc74b39fbdd5428b57fe222150bef976da157377aa66427d1f9efc87a16fa3c569c4c568bef65fda7f0a39512bc979831a5e31f6647516fbe8af402f221e51c8910dcb28aa7cb94f50fa58f9459d016a76ecb1571497dcefd9b786241c4eb641b6970f74bb668c691cd514f561522ea3b7912b754975fb649e3c9a9ac943fc95eb344adde03d35c7d1943f559fbdf636db9db692c20568e639f80aa6f94a8594b5766b9feac37fb076c0010b5d8b5266dd4b1837d201aa2409a599dfd96e54cbdecc16c9aeb22a12de2b55e36fa341d646e7272a7c8cd693db1825e7b48368341cedfa23e7476b33c4a795d96aa56223135f379d73eece492068293395eeebd043438493365694b41346ceec2d34dafcb8e123bd3c9a3c60d061c46bbc6306e827eb72edbd0e516484a1386748df7cc8e659a0ac4ed35b8a0f2d36547f2e9c990f875f5f83ea18c2b057763a0a67e97200fdb2ca5148671ff0910b2b7bfc3b305c790cdf977f8cad60f944712dade8ebdc7874d0ec2cb78491915b37e268828d851ded3cbd0b733dab4363a55e16e9b78e68a6866aca6bf833e59c6b372d50bf4e3e216c5efc47bbaab676a739331c8794ea6f968d9f56362a25ec622a220b9f066e0125815332f8ee32c311cf56c83ad85f53f219c7eab5ff8d25765dcfc86cd89087b3b66f8ba07385c784aeb7461ec45ebf28819d2e5ddbc570a6f5f68b44a66d4ac828a4eba40790d7d907ed757c5a4875edea30c2ddf615d5ff4a9a88740549a064f6d2eae31f34415917644526fc9f97bcb04e7f324ae432c509d3904ba8ea20e0964dd3bbda4e069b0668c8879bffdc4591aeb8119d12d7bb23cbc2e6e7b49c709f93d4be1e12b25bea75731546cff0b745dafcac4c5d81e5e0d17351b0a2e132c74b06378ecbe286015bec9decb61351b1d4075bedec7386c4b0de7bc55a9050032319bcf28bdee2083997c6abff9635033beb217231da93f6ef74d31fa45e2bfd1908730b3f1b4db459c6c33131e44a9a7db7d03488cd8c55ccecb46f223c332f4e8fbc493ee3c5345305a3098e234ab81f55c4987d2bc1ce344bfc9530fdaaec004da41edcd0cd32475d698fbea41ccad2c9f44aa06fb0485bb953497112239f1542a1094cf844a28b71cf5c2c741df1cc66c6fc441bf5dc7f996213f7c27e031b8144d9e0bd9c6a6cf6a3aae08894ce6496f42404829b89f2390cca2092129c2563cc576bfe05f0fec77bc70a71d90adcf3a51fe27d6fbef05d9b01b8bdadc5963f814d84c4c9c45d9a5aab504e2f0622d61565c41f61b49df5fb244b16973cca97b7b363267eedae22de787824e1996a43094dfdb65ade436af440b8de2eb590e94b1ab7a20841dfda514c94744b57b59e9a046776fdb637e74ce01e6ea2560ebb6314982d2ca23f847a1c16a8a7fd9b46c2a1e6a91af2851253e22afb8146ffda007b0f2564f4ebbbe0e704c78b49423778c90b3ffbf03ee663d790e4266ffccbb7270db23f07109691b29c632bea8aca422e2fc355146bf74960e4e02a8c7c6cd94bc3c8caad239d5ec0d31f431b31785d094a86b292f6b09c11f4a9b039b9099d84fbdd8989fe6e93553f0e7d425e035ae12d6a489f7973cdc5686f68acf5bf13d9613b94d404165a3a98746dfc44c989657f49ce9d55a84245cc31e57cd9deb1646b5f26ca7c2491fb0191a746f5db34ca8a1f4a49b0940a9215e8c3756d28611c0059a0cf5259b0c4306f2408b23c35a99c9d83d9b4318bf32ec73c975eec2c65e6ed7758a3d4d302f4701f775d69a84f871ff2dc81ba49d4ac66abca1758394e7fc8b2548a4cbe537960ffbc31214d3256a21c5369bfdb84462fc5a452b543b7e458f354b7011795bcdb7fa427cdff3ff49a070cf3c406b4efd093797a46148011f4f8a9190f00d8832e984ae2410557768597fef820328ebe7d0c4469d5973ad917b8faef60405bb511738302ae533ef4ac25e54251b7046763ae9285ff0ca6d9720dd41049cffa3985603512bbbc57f55718146d672a51fc1678887e88a369231bb43a94f85323cd60ff4a13cd02b5e607e9180389efb28d132dcca9c133a0c8901048112b5c1404eef29f681248449a6f18912ded5b6982de35bb47348aba6e6661e1730fdcdb425dcd5f6e7351f18548a2154d9ef81f188cacea0e151d0c76060ca1ff5f33c2f98e00150d21a63604daa7f6be7f8c7632a7168fa67d3b04d45ee3fb2eba0c6ff991877a42ecbaaa2ee10f2a3b03e236035e328d5f8ae1986d213c46906ee01c5c96ce2ec03ce7fa2a2ce77dbc6df12bd405749825e2bc157cdb7a83bad807375649c74f7ce29fa279d508f7e05337d13fdc81704ebad660f034b4367cd4045467924d385cc72e3b6a2f8679cb5aa9b4da6412dda2ec068020bf043cb2cb27fd714032a901db91edefd6aeabeb300947cc7d9ab953b152fe937090e88697de2fc00a568cd004a2600b113089bbdef1c4846d9ae75f7beca9802e431da78727f3ddefda7984d19909043c04b789b654a90d27daa63d1fd8bd50ab121f39de99f9b0bfd2a2c543dfa82cc050bd3609f248abbc046d3e6f3da690a5a9f9506f44bce656b0c9ccdb27d8a15838982cb9ae3a363529e5666f52a098a63ab2fe0f05d7a723d58ff708da69b760fdbd01da438d830861e687f98a67c3dc8172c97bc06a8cd3c1a6b9721413b7992fe343955d4d661bee1905bf9984fb6c2abff9f8e9f3acbe80a83d4efacbfaf740a7fa8388f325fa0bc87f7048403062d9a088cc332de272aff41fa8437d05b8befc5ce45ae67b7d859c7f99156b05a8d09e0b2b8cbf5940019c68a6ef46abb955d3393e9b45926f9ddc8cddaa7bd319e540d38bd82b4ae5a2ada31bd3e1009942b084d2d9240a55785802283abc25b87698afdcd9210a0c72ee7440d5bec43ac416a82991270ddd8c7c63f8e3a8383c0961e9921ef7379d5c6c8086b3d816a836d7e7abd8c69b1b11f8fd5696953f0339aca70995f09803959858b860d7e93abb8751f72e1e63540de3a514145170c401fc1d349d3c1c831e6f082d308f416bd33ff156f1f212a2636724f577e9719b945d9e500556dfed963106bf69c7650a9766c2db2eed52de4cdf331fe668ec373ed116dba0e589f429cc04676b726d17df950d7af80732570ad4d7dcbdc0587f3c78d5631cb02f42cd017e1f3b8e400da0b0f243fccc9bdab04f573e07df7a5fefd2a83e9203d7e0a7f9a4ba1814ab5992b19b7d3fb38f5cc24499a99bf4a104d5f57baccf4b653dff7a3494152a92d46462c9b924a69fa4c6c59fc63f682e55224bad86585132636a5c800559eeba68c6c43fda56a264d285bbe86c30340659c5de5e0e9fb6b6759596c996609ad143bac362fcb2a21873aad2b83075b183fb59f566ebf1dfde35f6d32785bd4112c0813706107d48f820f15dde45d4c034eb6423af3512d848c26b2f434bcd1942a933c1174c8b3b8c08d2fda0585f016ea0bc9675c8b2d511276e43e70e899ec8e9f53fab596823eeebdab0c58fce2e4fee89a910cee584daf4fdc346ecef755987627f0e32b082cc1d5cd2c017a337fb6bcd99a8dc37a98a1b82ee9d510901d7bb07ea553031b7fee3a8276aedfb497784fa1a7dceaa21253f51e2ecdd27a1ac5f0132d9d6924ac9ead97f1349ff1bd263736f8e55787de6a1412e6c8e0dea2184295c8949cbebc0cf40f6392b812c07a0a999501805a087067f28d7bc4e30cd490a4ab03833aa0b2fce97be0353865348db6aa03c1ebdaf8a611f138def3aeb4811011ef712febd6ab159cc0a2ef57e1b216bca2407b5e6558d72e4921eea696bc24bce87fcaef35aba6886dae00c1d7b55dbcaad3d233f21a12bb50030493c29270e8da4e6152a1f0b1458fc60f962cae61373499684a70c5ae2def51f109a232e7bff02c0f7273d5c22b8bed66010eee500d013898f70634e62912adf094192d19074d7c98988d7fab60e84b9f638158c1ec5f516bbab28afad8ed56068605619089575d5dd792f1328bea99d8021e9d8d695f686c28c96eb579e4fd84028721365b38b21145797f0986d736e88491156d19a1c4da3cb68c9e4b152402c869a5145168fcb95fd4a4a18d273b1ef34a23e86f7808498e70ba9022cd42ee65bb7aaa423c4e3be61765000e652f61d900e93bf887749446227c7325f25f8e85e44e0614520c76c876b1076de14c625442f4a215a6d3db32488f084ffe674b250d73fb8d77d505697eaf4595c2bb1b444951e8ef97e83c54b20f2329a153e72bae402ec23f1918fa5986a3828b2b554fcfe46ddb112da09ba936da06d86d7180a44affd4d5b4f16984360efbbf12c4da9fe28465827addbb1f71ae2c4982282df2e5438772d1904a686d9743c5c04af56e9002ad67afab0d177f35a15ae1ef7079369e708467953e0e868ac6f4186d4acf50cbc42ea34ac2fda868ee97774454351fbab02ccd34b86749033d1ac9bb7b181b4ce14c1b1f1d44e2c37f6fa145e4f36d4185c8aca4d82c08abd4c2cef0049ce2739f99c42c95fa2a4bc8ff33c17a1ba6a1d0854620a14a21d015de052008808de30794bc04e720694e8322d44936f4e79fa5a8d1749e2f220af88536dc8fa2b42dff5f53affe1f80907e64b659dfc56973d860b7d402ffd79be3dc80bbc8edb4fcc112ba677e4320b4eca469c1ebfbf4a1565adc0ce6474fbf37a4e93f494601f7aab8b7f8e38396f15efeb3a6877d10cb6eb3f3dd7fabc0b72df2492854cc641c8810eb2c0110068b76a5c6d9fd28565ff2d977121ee2d99ac18eb0f2fe5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1358) 18:01:12 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000001, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x8ea42, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r1, 0x2405, r2) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, 0x0) ioctl$BINDER_THREAD_EXIT(r3, 0x40046208, 0x0) r4 = getpgid(0x0) syz_open_procfs(r4, &(0x7f0000000040)='net/bnep\x00') 18:01:12 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) sendmsg$netlink(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[]}, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/create\x00', 0x2, 0x0) r3 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1003f, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000020000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmmsg(r5, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) 18:01:12 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:12 executing program 3: fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x181) r1 = memfd_create(&(0x7f0000000580)='t\bnu\x00\x00\x00\x00\x00\x00\x00\x00\x00\x8c\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81805) sendfile(r0, r1, 0x0, 0x800000000000de) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sync_file_range(r0, 0x0, 0x0, 0x3) [ 444.389953] binder_alloc: binder_alloc_mmap_handler: 13970 20001000-20004000 already mapped failed -16 [ 444.425879] binder: BINDER_SET_CONTEXT_MGR already set 18:01:12 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x10, 0x3, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) bind$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, 0x6e) perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:12 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 444.443114] binder: 13970:13980 ioctl 40046207 0 returned -16 [ 444.467857] binder_alloc: 13970: binder_alloc_buf, no vma [ 444.477207] binder: 13970:13980 BC_INCREFS_DONE u0000000000000000 no match 18:01:12 executing program 3: sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) unshare(0x6c060000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000180)={{0x2, 0x0, @multicast2}, {0x0, @dev}, 0x0, {0x2, 0x0, @remote}, 'team0\x00'}) 18:01:12 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000040000de3fa3f4ac0000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{}, {}]}) [ 444.493203] binder: 13970:13977 transaction failed 29189/-3, size 24-8 line 3254 [ 444.504324] binder: 13970:13980 Release 1 refcount change on invalid ref 1 ret -22 [ 444.521669] binder: send failed reply for transaction 782 to 13970:13977 [ 444.529970] binder: undelivered TRANSACTION_ERROR: 29189 18:01:12 executing program 0: perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003140)=[{{&(0x7f0000001540)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') preadv(r0, &(0x7f00000017c0), 0x199, 0x0) 18:01:12 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, &(0x7f0000000080)={'bond0\x00', {0x2, 0x4e24, @remote}}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r1, 0x4c80, r2) r3 = syz_open_pts(0xffffffffffffffff, 0x800) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000040)={0x7, 0x6a3f, 0x8}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x7, r0, 0x0, 0x0) ptrace$setregs(0xd, r0, 0x9, &(0x7f0000000000)="f003197395ebd2944aa86f2d161e06eb039df3c68fc4dea842e724b49d0c552d35254ddbaf09e7eeb91d2e054dab5e7b0ee1") 18:01:12 executing program 0: r0 = socket(0x40000000002, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0xfcda) setsockopt$inet_int(r0, 0x0, 0x4, &(0x7f0000000100)=0x10001, 0x4) sendto$unix(r0, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) 18:01:12 executing program 3: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0xa00000000000000, 0x80, &(0x7f0000000000)=@broute={'broute\x00\x00\x00\x00\x00`\x00\x00\x00\x00\x00\x00H\x00', 0x20, 0x1, 0x9c0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000e00], 0x0, 0x0, &(0x7f0000000e00)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'bridge0\x00', 'vlan0\x00', 'sit0\x00', 'teql0\x00', @empty, [], @link_local, [], 0x8b8, 0x8b8, 0x930, [@among={'among\x00', 0x820, {{0xc, 0x414}}}]}}, @common=@nflog={'nflog\x00', 0x50, {{0x0, 0x0, 0x0, 0x0, 0x0, "a600a9e85725d89818472e65aba21d9bbc1b20e8331c6fd24a5aceaeefe102e42a013ac2c00eeb782c34eab997013e0506220c21a44cc58ff5bc83d5e4066c77"}}}}]}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0xa38) 18:01:12 executing program 0: [ 444.746583] binder_alloc: 14033: binder_alloc_buf size 274878185472 failed, no address space [ 444.774668] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 444.786738] binder: 14033:14037 transaction failed 29201/-28, size 137439084544-137439100928 line 3254 [ 444.804088] binder: 14033:14045 BC_INCREFS_DONE u0000000000000000 no match [ 444.820453] binder: 14033:14037 Release 1 refcount change on invalid ref 1 ret -22 [ 444.831073] binder_alloc: 14033: binder_alloc_buf, no vma [ 444.836774] binder: 14033:14045 transaction failed 29189/-3, size 137439084544-137439100928 line 3254 [ 444.855743] binder: BINDER_SET_CONTEXT_MGR already set [ 444.862563] binder: 14033:14037 ioctl 40046207 0 returned -16 [ 444.869001] binder: 14033:14045 BC_INCREFS_DONE u0000000000000000 no match [ 444.869115] binder: 14033:14054 Release 1 refcount change on invalid ref 1 ret -22 18:01:13 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r0) sendmsg$netlink(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[]}, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/create\x00', 0x2, 0x0) r3 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1003f, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000020000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmmsg(r5, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r4, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r3, 0x2405, r4) 18:01:13 executing program 0: 18:01:13 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x10c) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000040)={'syzkaller1\x00', 0x897e}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:13 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000340)) write$cgroup_int(r0, &(0x7f0000000140), 0xffffff35) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x101200, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, 0x0, &(0x7f00000003c0)='y\x00', 0x2, 0x3) bind$inet(r2, 0x0, 0x6a69619d) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x750, {0x2, 0x4e24, @empty}, {0x2, 0x800000000004e22, @local}, {0x2, 0x4e20, @broadcast}, 0x6, 0x0, 0x2, 0x46a, 0xfffffffffffffffd, 0x0, 0x2200000000001200, 0x6, 0xffffffffffffffff}) sendmmsg(0xffffffffffffffff, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) unshare(0x60000000) recvmmsg(0xffffffffffffffff, &(0x7f0000000f00), 0x0, 0x0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000140)=0x1, 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0xa4b}, 0xc) creat(0x0, 0x0) 18:01:13 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$FICLONE(r1, 0x40049409, r0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:13 executing program 2: perf_event_open(0x0, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff, 0x1) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) setsockopt(r1, 0x10e, 0xb, 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000000000700613efe2839a501f1d65ade14678fffc6ab0364e5301d1ff37864e9c54c3f3fe4741ec4fcfc94bc1c21191b3c4b35cbc8c0d34b2784f9179ffbffa2851e52068e02a4c60db6990234f85c"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xfffffef6, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(r2, 0x2, 0x1) 18:01:13 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r0, 0x29, 0x2d, &(0x7f0000000180)={0x5, {{0xa, 0x4e24, 0x0, @ipv4={[], [], @empty}, 0x8}}}, 0x88) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffeff7fffffde, &(0x7f0000000240)={0xa, 0x4e20, 0x2, @empty}, 0x1c) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000040)={@mcast1, 0x2, 0x0, 0xff, 0x0, 0x4d92fc6f, 0x16}, &(0x7f0000000080)=0x20) socket$inet6(0xa, 0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x200002, 0x0) setsockopt$inet_int(r1, 0x0, 0x17, &(0x7f0000000140)=0x1, 0x4) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:13 executing program 0: syz_open_procfs(0x0, &(0x7f00000002c0)='attr/prev\x00') clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x3d) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x3, 0x1}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 445.358445] binder: 14135:14137 BC_INCREFS_DONE u0000000000000000 node 791 cookie mismatch 0000000000000000 != 0007000000000000 [ 445.394448] binder: 14135:14137 unknown command 0 18:01:13 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x84800) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f0000000240)={0x17, 0x43, &(0x7f00000001c0)="e88d79098eb16b24b82e5b99ac283754a8b16b948908913f2a520d3b686daf92a46baa25d97b1d236f11ced1659909110b24c1c682329d93f8d3a968ff6f356a524bcd"}) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x88002, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r2, 0x40345410, &(0x7f0000000040)={{0x1, 0x2, 0x5, 0x0, 0x6}}) perf_event_open(&(0x7f0000000140)={0x4, 0x70, 0x7, 0x5, 0xffffffffffffffc1, 0x3ff, 0x0, 0x3, 0x1008, 0x8, 0x3, 0x7, 0xfffffffffffffe00, 0x351, 0x9, 0xffffffff00000001, 0x2c9, 0xffff, 0x2, 0x9, 0x7, 0x2, 0x835, 0x5, 0x10000, 0x1ff, 0x4, 0x101, 0x10001, 0xffffffffffffe523, 0x3, 0x80000000, 0x253, 0x7, 0xfffffffffffffff7, 0x5, 0x3, 0x88a, 0x0, 0x3ff, 0x0, @perf_config_ext={0x1, 0x1}, 0x1a090, 0x1, 0x7, 0x4, 0x1, 0x400, 0xf0e678d}, r0, 0x0, r2, 0xa) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 445.408277] binder: 14135:14137 ioctl c0306201 200002c0 returned -22 [ 445.436769] binder_alloc: 14135: binder_alloc_buf, no vma [ 445.442667] binder: BINDER_SET_CONTEXT_MGR already set [ 445.448230] binder: 14135:14145 transaction failed 29189/-3, size 24-8 line 3254 [ 445.461784] binder: 14135:14137 ioctl 40046207 0 returned -16 [ 445.482305] binder: 14135:14148 BC_INCREFS_DONE u0000000000000000 no match [ 445.486672] binder: 14135:14162 Release 1 refcount change on invalid ref 1 ret -22 [ 445.489666] binder: 14135:14148 unknown command 0 18:01:13 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffff9c, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x48000210}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@delqdisc={0x34, 0x25, 0x2cda4285ec59ade3, 0x70bd25, 0x25dfdbfe, {0x0, r2, {0xffff, 0x10}, {0xffff, 0xffff}, {0x8, 0xb}}, [@TCA_RATE={0x8, 0x5, {0xa9, 0x45e}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x8000}]}, 0x34}, 0x1, 0x0, 0x0, 0x40}, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 445.516396] binder: send failed reply for transaction 790 to 14135:14137 [ 445.527142] binder: undelivered TRANSACTION_ERROR: 29189 [ 445.529745] binder: 14135:14148 ioctl c0306201 200002c0 returned -22 18:01:13 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) ioctl$KDSETLED(r1, 0x4b32, 0x2) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) r2 = socket$inet6(0xa, 0xa, 0x145975fb) getsockopt$sock_int(r2, 0x1, 0x200000026, &(0x7f0000000200), &(0x7f0000000280)) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x2, 0x0) getpeername$packet(r3, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) syz_open_procfs(r0, &(0x7f00000001c0)='fd/4\x00') 18:01:13 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x13a) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) getpgid(0xffffffffffffffff) r2 = dup(r1) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0) r3 = getpgid(0xffffffffffffffff) syz_open_procfs(r3, 0x0) [ 445.593297] binder: BINDER_SET_CONTEXT_MGR already set [ 445.602474] binder_alloc: 14170: binder_alloc_buf, no vma [ 445.608352] binder: 14170:14172 ioctl 40046207 0 returned -16 [ 445.631531] binder: 14170:14175 transaction failed 29189/-3, size 24-8 line 3254 [ 445.642190] binder: 14170:14183 BC_INCREFS_DONE u0000000000000000 no match [ 445.645148] binder: 14170:14186 Release 1 refcount change on invalid ref 1 ret -22 [ 445.667704] binder: send failed reply for transaction 795 to 14170:14172 [ 445.690253] binder: undelivered TRANSACTION_ERROR: 29189 18:01:14 executing program 5: clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000200)) syz_open_dev$rtc(&(0x7f0000000080)='/dev/rtc#\x00', 0x0, 0x0) ptrace(0x10, r0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000000)) ptrace$getregset(0x4205, r0, 0x2, &(0x7f0000000280)={0x0, 0x6b00}) 18:01:14 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08810001750eeee98432994ae1658513ff65ffd231ef1c67a2d9c3f151a27f2f6335c0fab021ba8948581826643fb45267144225718edb791938b60347daa125b5004f699e4b3de799c60d08ce97f8952f61b3", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0xc68, 0x200) 18:01:14 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x6, 0x61) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:14 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x200080, 0x0) ioctl$LOOP_SET_STATUS(r1, 0x4c02, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x8, 0xa, 0xc, 0x14, "0f8be39057264b8c4d00d90a2a9f90c6139b254303c6985970b9341c31b6c432c1e6550e65d2ba1e17547d44c14c576790a7601afa6fee4fb8c01ea3753b8c02", "b57f14ee2e7a017e0bea2ecc57f58379fed42ce33733dedc8b12922815823773", [0x5, 0xfff]}) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:14 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000340)) write$cgroup_int(r0, &(0x7f0000000140), 0xffffff35) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x101200, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, 0x0, &(0x7f00000003c0)='y\x00', 0x2, 0x3) bind$inet(r2, 0x0, 0x6a69619d) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x750, {0x2, 0x4e24, @empty}, {0x2, 0x800000000004e22, @local}, {0x2, 0x4e20, @broadcast}, 0x6, 0x0, 0x2, 0x46a, 0xfffffffffffffffd, 0x0, 0x2200000000001200, 0x6, 0xffffffffffffffff}) sendmmsg(0xffffffffffffffff, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) unshare(0x60000000) recvmmsg(0xffffffffffffffff, &(0x7f0000000f00), 0x0, 0x0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000140)=0x1, 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0xa4b}, 0xc) creat(0x0, 0x0) [ 446.486258] binder: 14285:14291 unknown command 16810248 [ 446.493957] binder: 14285:14291 ioctl c0306201 200002c0 returned -22 [ 446.503668] binder: BINDER_SET_CONTEXT_MGR already set [ 446.511525] binder: 14285:14291 ioctl 40046207 0 returned -16 [ 446.517726] binder_alloc: 14285: binder_alloc_buf, no vma [ 446.528301] binder: 14285:14295 transaction failed 29189/-3, size 24-8 line 3254 18:01:14 executing program 4: clone(0x18044200, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) tkill(r0, 0x3b) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:14 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 446.543253] binder: 14285:14291 unknown command 16810248 [ 446.549226] binder: 14285:14291 ioctl c0306201 200002c0 returned -22 [ 446.557665] binder: 14285:14295 Release 1 refcount change on invalid ref 1 ret -22 [ 446.581012] binder: send failed reply for transaction 800 to 14285:14291 [ 446.587986] binder: undelivered TRANSACTION_ERROR: 29189 [ 446.642069] binder: BINDER_SET_CONTEXT_MGR already set [ 446.654722] binder: 14306:14310 ioctl 40046207 0 returned -16 [ 446.670752] binder_alloc: 14306: binder_alloc_buf, no vma [ 446.676762] binder: 14306:14308 transaction failed 29189/-3, size 24-8 line 3254 [ 446.693798] binder: 14306:14310 BC_INCREFS_DONE u0000000000000000 no match [ 446.719912] binder: 14306:14316 Release 1 refcount change on invalid ref 1 ret -22 [ 446.720698] binder: send failed reply for transaction 805 to 14306:14308 [ 446.764730] binder: undelivered TRANSACTION_ERROR: 29189 18:01:16 executing program 0: execve(0x0, 0x0, &(0x7f0000000480)=[&(0x7f00000003c0)='\x00', &(0x7f0000000400)='/dev/tty\x00']) r0 = open(&(0x7f0000000180)='./file1\x00', 0x611, 0x0) pwritev(r0, &(0x7f00000003c0), 0x273, 0x0) 18:01:16 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x7, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:16 executing program 4: r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000000)={0xffffffffffffffff, 0x1, 0x10}, 0xc) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0, &(0x7f0000000040)="3b88f406a5cd9f23ac77afd13ad06aa423382547c19630aba8c38151f79dfb663167ac1468b13c27ea724480"}, 0x10) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r0, &(0x7f0000000140)="e16d8a16fb3893121d508b338bdc264b7c61551933287078258b18eb7062228e2bbd8e1489b80116b743698f891ac07f96e5de081cee736ecad7696e318d9418f42184fa15c68ecd99f316a71c8efc5d1be699375e6cea51837f25f09736758c140bfdf74249d10c00b0d85a66b8"}, 0x10) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x25) socket$inet_tcp(0x2, 0x1, 0x0) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xf, r1, 0x0, &(0x7f0000000540)="7406201eccf9c2b76c4a9d1e00d0b91f8604b7a8ac28f0a100c7a7713f4afdd619adcd6ab2f2a455992cdebbe0b4570f5755f042b64b6af9e737cc1392fdd00e95545cfd538c9116d855a6ab5c048598f13fb24b94995bda2527c3e5b2aabd3bbeb27954296ec3e0d838ac365406b4967fcd2e5a7cbdb1ed4e428a2c5419664b6c990bb87e0837cf39c37cf752c2c1a31d41ba506eabe8408e25047041aeb116c61a89dbd2a0010000003371e3a55213d47eaaefd2d0f94d9b7600b5609bed6de17de2c4eb0000000000000000000000000000f7557f9124b2240f") ptrace$cont(0x1f, r1, 0x0, 0x0) 18:01:16 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = open(&(0x7f0000000000)='./file0\x00', 0x20000, 0x4) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r2, &(0x7f00000003c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000100)={0xb0, r3, 0x120, 0x70bd29, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x782}, @IPVS_CMD_ATTR_SERVICE={0x24, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7ff}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x4}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4}, @IPVS_DEST_ATTR_WEIGHT={0x8}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40000}, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00LD'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:16 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/net/tun\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'eql\x00', 0x6002}) preadv(r1, &(0x7f0000000700)=[{&(0x7f00000001c0)=""/154, 0x5f}], 0x2, 0x0) ioctl$sock_ifreq(r0, 0x8914, &(0x7f0000000080)={'eql\x00i\x0e\xa9[\x00\xce\x00', @ifru_mtu=0x1}) 18:01:16 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000340)) write$cgroup_int(r0, &(0x7f0000000140), 0xffffff35) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x101200, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, 0x0, &(0x7f00000003c0)='y\x00', 0x2, 0x3) bind$inet(r2, 0x0, 0x6a69619d) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x750, {0x2, 0x4e24, @empty}, {0x2, 0x800000000004e22, @local}, {0x2, 0x4e20, @broadcast}, 0x6, 0x0, 0x2, 0x46a, 0xfffffffffffffffd, 0x0, 0x2200000000001200, 0x6, 0xffffffffffffffff}) sendmmsg(0xffffffffffffffff, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) unshare(0x60000000) recvmmsg(0xffffffffffffffff, &(0x7f0000000f00), 0x0, 0x0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000140)=0x1, 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0xa4b}, 0xc) creat(0x0, 0x0) 18:01:16 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x40) ioctl$PIO_CMAP(r1, 0x4b71, &(0x7f0000000080)={0x7fffffff, 0xc76b, 0xfffffffffffffeea, 0x80000001, 0x1, 0xfff}) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 448.459833] binder: 14328:14331 BC_INCREFS_DONE u0000000000000000 node 811 cookie mismatch 444c000000000000 != 0000000000000000 [ 448.484257] binder: BINDER_SET_CONTEXT_MGR already set [ 448.489616] binder: 14328:14331 ioctl 40046207 0 returned -16 18:01:16 executing program 0: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x800, 0x0) preadv(r0, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/52, 0x34}], 0x1, 0x0) [ 448.506983] binder_alloc: 14328: binder_alloc_buf, no vma [ 448.517000] binder: 14328:14352 BC_INCREFS_DONE u0000000000000000 no match [ 448.527048] binder: 14328:14349 transaction failed 29189/-3, size 24-8 line 3254 [ 448.547074] binder: 14328:14331 Release 1 refcount change on invalid ref 1 ret -22 18:01:16 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08431040", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 448.548119] binder: send failed reply for transaction 810 to 14328:14331 18:01:16 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) write$binfmt_script(r0, &(0x7f0000000200)=ANY=[@ANYBLOB='V'], 0x1) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) r1 = syz_open_pts(r0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x17}) [ 448.593774] binder: undelivered TRANSACTION_ERROR: 29189 [ 448.618481] binder: 14360:14362 unknown command 1074807560 18:01:16 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x4000000000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:16 executing program 0: r0 = socket$inet6(0x18, 0x2, 0x0) r1 = dup2(r0, r0) sendmsg$unix(r1, &(0x7f0000001700)={&(0x7f0000000300)=ANY=[@ANYBLOB="fb182e2f666900000000"], 0x1, 0x0}, 0x0) [ 448.646601] binder: 14360:14362 ioctl c0306201 200002c0 returned -22 [ 448.667247] binder: BINDER_SET_CONTEXT_MGR already set [ 448.679120] binder: 14360:14370 ioctl 40046207 0 returned -16 [ 448.679151] binder_alloc: 14360: binder_alloc_buf, no vma 18:01:16 executing program 1: r0 = socket(0x5, 0x0, 0x0) recvfrom$inet(r0, &(0x7f00000001c0)=""/12, 0xc, 0x12000, &(0x7f0000000200)={0x2, 0x4e22, @local}, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r1, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) accept$packet(r1, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14) bind(r1, &(0x7f0000000100)=@hci={0x1f, r2, 0x1}, 0x80) sendto$inet6(r1, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r3 = socket$inet6(0xa, 0x0, 0x0) bind(r3, &(0x7f0000000240)=@ethernet={0x6, @random="f528da59fa3f"}, 0x80) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'team0\x00', r2}) bind$inet6(r1, 0x0, 0xffffffffffffffe3) syz_open_procfs(0xffffffffffffffff, 0x0) [ 448.704590] binder: 14360:14372 transaction failed 29189/-3, size 24-8 line 3254 [ 448.719087] binder: 14360:14362 unknown command 1074807560 [ 448.719098] binder: 14360:14370 Release 1 refcount change on invalid ref 1 ret -22 [ 448.719989] binder: send failed reply for transaction 815 to 14360:14362 [ 448.725645] binder: 14360:14362 ioctl c0306201 200002c0 returned -22 [ 448.745342] binder: undelivered TRANSACTION_ERROR: 29189 18:01:16 executing program 0: mkdir(&(0x7f0000004080)='./file0\x00', 0x0) mount(&(0x7f0000000240)=ANY=[@ANYBLOB="9e9b3a3a5d3a2f"], 0x0, &(0x7f0000000100)='ceph\x00', 0x0, &(0x7f00000000c0)='*ppp0vboxnet0keyring*wlan1mime_type\x00') 18:01:19 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)=0x4, 0x4) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0xd8, 0xfffffffffffffffc, 0x118, r0}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) ptrace(0x8, r0) 18:01:19 executing program 2: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f0000000080)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x1ffffff, 0x10010, r2, 0xfffffffffffffffd) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) ioctl$EVIOCGABS2F(r0, 0x8018456f, &(0x7f00000000c0)) 18:01:19 executing program 0: r0 = socket(0x2, 0x2, 0x0) connect$unix(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="82022e2f66696c6530000888882d04cb7c5d3ce2edd7fa3299507d29fb48458b5539268558606c74f4b89ab1541b8a59d7f3fffb26aac57aef80163299ac96a338b43e715e336b664009bff950e591e5442a2c9a9d24ff33672a7c544bb5c89bfa9fe319c20ef6f088d6e6344579763cced80460dfd476fe1c68d17c9e88436432a2a380d9f4b8cc19ed4e0718b3a2c16decef8162315a3d43082729254bc93cb6fb0936ad041de07b2de4da32c666bc78c7acdd13f294b7794c84c8e100135d9943a2fa0bca71ef83e63d2e014934cb4b23ddeebb9d0d2e0400d160c00f5352bba2698004f21d59047fb35acb12a255e3"], 0x1) sendmsg$unix(r0, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x4}, 0x0) 18:01:19 executing program 1: r0 = socket$inet6(0xa, 0x1000001, 0x8000) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:19 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0xa00000000000000, 0x80, &(0x7f0000000000)=@broute={'broute\x00\x00\x00\x00\x00`\x00\x00\x00\x00\x00\x00H\x00', 0x20, 0x1, 0x9c0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000e00], 0x0, 0x0, &(0x7f0000000e00)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, [{{{0xb, 0x0, 0x0, 'bridge0\x00', 'vlan0\x00', 'sit0\x00', 'teql0\x00', @empty, [], @link_local, [], 0x8b8, 0x8b8, 0x930, [@among={'among\x00', 0x820, {{0xc, 0x414}}}]}}, @common=@nflog={'nflog\x00', 0x50, {{0x0, 0x0, 0x0, 0x0, 0x0, "a600a9e85725d89818472e65aba21d9bbc1b20e8331c6fd24a5aceaeefe102e42a013ac2c00eeb782c34eab997013e0506220c21a44cc58ff5bc83d5e4066c77"}}}}]}, {0x0, '\x00', 0x1, 0xffffffdffffffffc}]}, 0xa38) 18:01:19 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x26e1, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0x40086602, &(0x7f0000000340)) write$cgroup_int(r0, &(0x7f0000000140), 0xffffff35) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/checkreqprot\x00', 0x101200, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_opaque(0xffffffffffffffff, 0x0, &(0x7f00000003c0)='y\x00', 0x2, 0x3) bind$inet(r2, 0x0, 0x6a69619d) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f00000000c0)) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000280)={0x750, {0x2, 0x4e24, @empty}, {0x2, 0x800000000004e22, @local}, {0x2, 0x4e20, @broadcast}, 0x6, 0x0, 0x2, 0x46a, 0xfffffffffffffffd, 0x0, 0x2200000000001200, 0x6, 0xffffffffffffffff}) sendmmsg(0xffffffffffffffff, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) unshare(0x60000000) recvmmsg(0xffffffffffffffff, &(0x7f0000000f00), 0x0, 0x0, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000140)=0x1, 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000040)={0xa4b}, 0xc) creat(0x0, 0x0) 18:01:19 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x10, 0x3, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) bind$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, 0x6e) perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) syz_open_procfs(0xffffffffffffffff, 0x0) [ 451.459628] binder_alloc: 14412: binder_alloc_buf, no vma [ 451.479172] binder: 14412:14414 transaction failed 29189/-3, size 24-8 line 3254 [ 451.499295] binder: 14412:14414 BC_INCREFS_DONE u0000000000000000 no match 18:01:19 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000100)="1c671bbf00e61be2b48a7658cd80aea1acaaaa24dd93b168828d4f1e38812692ea3f5b13fda20f1b0196946a3f54cba86b4f5f2c6b80635c002d07010879f42d52676e2d6d7dd84f294380d89a2004e60d29ebc64907f2c7ce94082ecfbf7b1644bca9378cad0db702493243fbecf08e9a8d372598447a0174dee8843f33459d0ac95113eea92642ef26519a5b85627c20563b990f71f86db045e250c12d2a333d8d758d0f2665f1e4a2edf66fa69dac63ac074895599c5a8b45f02b411e8186adda958d7972084ac9300305e082ac7bb5ce202ce6f5a89f4ceda454cddc167361c4aa8dd9fb87b6eaea9f81370bd5b3", 0xf0, 0x41, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 451.509767] binder: 14412:14414 Release 1 refcount change on invalid ref 1 ret -22 18:01:19 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000000)={&(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000140)="d0745879966792cfd96fa5dba441dce9583ac11c87f3f3f0798a301bf06c1d5d9ca763bbcc0495cd54bd7168f64470928465d2e092e5ce269fe178e899434409ef49002ab0d8120149670ca9399f519d2463fd9fde86b85f07a1d891a06e9b7057eaadec4013e2d21aaa815ba408b08cf2b02177d71996e5ef3efd6b95d8e07139389896c69de39bcef2ad3423520f08992b476ccd309a25eae3c09130766bc416ec3fd56659773146d9a9c8a015d61cf66c8d608d9b72f99f9f0817dbdc42b9982f199970ff89819b5ac7120ca72d887a8c0d4eadfcc427a20acb130f05efdee60c1affd4decd", 0xe7, r1}, 0x68) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ioctl$FS_IOC_GETVERSION(r1, 0x80087601, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setopts(0x4200, r0, 0x9, 0x0) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 451.562347] binder: BINDER_SET_CONTEXT_MGR already set [ 451.567986] binder: 14412:14414 ioctl 40046207 0 returned -16 [ 451.568194] binder_alloc: 14412: binder_alloc_buf, no vma 18:01:19 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x10, 0x3, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) bind$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, 0x6e) perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:19 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 451.602579] binder: 14412:14434 transaction failed 29189/-3, size 24-8 line 3254 [ 451.608300] binder: 14412:14414 BC_INCREFS_DONE u0000000000000000 no match [ 451.624335] binder: 14412:14442 Release 1 refcount change on invalid ref 1 ret -22 18:01:19 executing program 1: r0 = socket$inet6(0xa, 0xfffffffffffffffd, 0x80000000) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e21, 0x0, @empty}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4000010}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xb8, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x78, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_PRIO={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_MEDIA={0x14, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x8000}, 0x840) syz_open_procfs(0xffffffffffffffff, 0x0) [ 451.732808] binder: BINDER_SET_CONTEXT_MGR already set [ 451.755156] binder: 14455:14461 ioctl 40046207 0 returned -16 [ 451.755195] binder_alloc: 14455: binder_alloc_buf, no vma [ 451.768272] binder: 14455:14467 transaction failed 29189/-3, size 24-8 line 3254 18:01:19 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) socket$inet(0x10, 0x3, 0x0) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r2 = memfd_create(&(0x7f0000000100)='t\bnu\x00\x00\x00\x00\x85nG\x13g\xa6\x05', 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$LOOP_SET_FD(r1, 0x4c00, 0xffffffffffffffff) bind$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs, 0x6e) perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f00000001c0), 0x7ba27d3a) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:19 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) fstatfs(r1, &(0x7f0000000380)=""/67) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="86f1893b47c0786e9e260242ff03223835eab434bc916b377a1944bbf815db77d4e24213f9ab72f214a4f2899d20f3a859aa5620df29169cf9c72e216fe940420fc369325f63331253c1516fb36df74585b78b342cf92cc48a73a98be3744291a192301bc39ae1556d76f290385cc65f8b3592cb467626cf56cd97ce993531437426b14af9b1ca85b14131092155caeecc00f8ab1b7769592da680dcb3fda41ded51bc3fc553bcd3cd661a08d1e0b0a89c6fac29cd0723c77d062a956032a3cbbd07198fcfdf7f37581c687e808cc5079326f7da31da16a8437754df1b34f1665cb1b36b5be531"], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:19 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = open(&(0x7f0000000000)='./file0\x00', 0x100, 0x80) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r0, 0x54a2) r1 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x30) ptrace$cont(0x18, r1, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r1, 0x0, &(0x7f0000000080)) getsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000040)={@initdev, @remote}, &(0x7f0000000080)=0x8) ptrace$cont(0x1f, r1, 0x0, 0x0) 18:01:19 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'gretap0\x00', {0x2, 0x4e21, @loopback}}) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 451.778138] binder: 14455:14458 BC_INCREFS_DONE u0000000000000000 no match [ 451.794582] binder: send failed reply for transaction 823 to 14455:14458 [ 451.811219] binder: undelivered TRANSACTION_ERROR: 29189 [ 451.876886] binder: 14478:14483 ioctl c0306201 0 returned -14 [ 451.951266] binder: 14478:14499 BC_INCREFS_DONE u0000000000000000 node 829 cookie mismatch 6e78c0473b89f186 != 0000000000000000 18:01:19 executing program 5: ioctl$int_in(0xffffffffffffffff, 0x5421, &(0x7f0000000000)=0x40000000000d0a) read(0xffffffffffffffff, &(0x7f0000000140)=""/250, 0x10000032c) socketpair(0x3, 0x800, 0x0, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000500)=""/231, 0xfffffffffffffffd) openat$tun(0xffffffffffffff9c, &(0x7f0000000b40)='/dev/net/tun\x00', 0x10000, 0x0) pipe2(&(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r2, &(0x7f0000000040)='trusted.overlay.redirect\x00', &(0x7f00000000c0)='./file0\x00', 0x8, 0x3) r3 = creat(&(0x7f0000000300)='./file0\x00', 0x3) geteuid() write$binfmt_script(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB='#! ./file0'], 0xa) close(r3) clone(0xfffffffffffffffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mknod$loop(0x0, 0x0, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/net\x00') socket$netlink(0x10, 0x3, 0x0) execve(&(0x7f0000000200)='./file0\x00', &(0x7f0000000400)=[0x0, 0x0, &(0x7f0000000380)='ns/net\x00'], 0x0) getsockname$inet6(r0, &(0x7f0000000700)={0xa, 0x0, 0x0, @empty}, &(0x7f0000000740)=0x1c) write$P9_RSTAT(0xffffffffffffffff, &(0x7f00000007c0)={0x65, 0x7d, 0x0, {0x0, 0x5e, 0x401, 0x81, {0x0, 0x2, 0x8}, 0x0, 0x80, 0x4, 0x100000000, 0xd, 'security.evm\x00', 0x11, 'cgroupmd5sumeth1\x00', 0x6, 'proc&\'', 0x7, ']%\'em1:'}}, 0x65) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) syz_open_pts(r1, 0x20000) rt_sigprocmask(0x0, &(0x7f0000000240), &(0x7f0000000280), 0x8) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) unshare(0x40000000) setxattr$security_evm(0x0, &(0x7f0000000080)='security.evm\x00', &(0x7f0000000840)=ANY=[@ANYBLOB="0000c4ddb4308ebc5aa7e48336a852df3b13fdd4e3c56e5bdad6f782834e383e49ff9dde172b9e26b80e774e519aeb0eca6842c466b45f475fa38b8dc9cdd57a559639356527f4575bafdb353659f13c94a7d33e1be734ec7eddd9d55b4157737aba76608108633b4dc0d8a315b7a3fa83e389ecebc7abde5f78a8209f000962cdbd1ecffc967e0e1e9609483127aae96f80ba290702bbe7bf46399ecc0dd8537992c0b358bb23e5bb55898162f722a0bcb83f519c914d82435ef046306537c61ec4cbcc8459950fe2d2bfe9296f0db41f91dc972341cf10060c7b54eac792630810588d9cc30358b15451db2e06d88c"], 0x1, 0x0) 18:01:19 executing program 3: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r0 = open(&(0x7f0000000380)='./bus\x00', 0x141046, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000080)=0x0) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x10000, 0x615, 0x4, 0x1, 0x0, 0x6, 0x20, 0x6, 0x3, 0x7, 0x1ff, 0x9, 0x100000001, 0x1, 0x7, 0x6, 0x100000001, 0xffffffffffffff80, 0xc37, 0x100, 0x0, 0x1, 0x4, 0x7, 0x100, 0x0, 0x9, 0x100000000, 0xfffffffffffff719, 0x100000000, 0x3, 0x1, 0x5, 0x100000001, 0x4, 0x5, 0x0, 0x1f, 0x0, @perf_config_ext={0x7, 0x4}, 0x20000, 0x4, 0x8001, 0x9, 0x1, 0xffffffffffffffff, 0x41d}, r1, 0x1, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x400056ff}) r2 = creat(&(0x7f0000000200)='./bus\x00', 0x0) ioctl$int_in(r2, 0x5452, &(0x7f00000000c0)=0x6) 18:01:19 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x0, @broadcast, 0x4e21, 0x4, 'lc\x00', 0x2, 0xff, 0x4a}, 0x2c) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000000)={'lo:\x05\xe6\xff\x01\x00', {0x2, 0x0, @dev}}) 18:01:19 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:19 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x410000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x68, r2, 0x902, 0x70bd26, 0x25dfdbfc, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x6, @link='syz0\x00'}}}, ["", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x40004}, 0x4000080) 18:01:19 executing program 0: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, 0x0, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0x5, 0x0, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x88) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, [], 0x0, 0x0}}, 0x11) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f00000004c0)={'filter\x00'}, &(0x7f0000000540)=0x54) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000580)) clone(0x0, 0x0, 0x0, 0x0, 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x3) geteuid() write$binfmt_script(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB="2321202e76d079ce6530"], 0xa) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000200)={0xffffffffffffffff, 0x3, 0x0, 0x56d}, 0x14) close(r3) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) ioctl$TUNSETNOCSUM(r2, 0x400454c8, 0x0) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, 0x0, &(0x7f0000000340)) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) close(r0) pipe(&(0x7f0000000080)) clock_nanosleep(0x7, 0x1, &(0x7f0000000000)={0x77359400}, &(0x7f0000000140)) setsockopt$inet6_tcp_buf(r3, 0x6, 0x1c, &(0x7f00000003c0)="0de598a89d9bce2fa6e89b6a85506ca67dea35a014eb7e4c0fc22e4a4a372fd1ebf0b4ca5a3c00d70e5c135a0ea3a5d4062276ceb850a7da204f2afbb56c037da45d3ffd5d20048a01e3e0ee80a9b096c2edd0a219fe6a997fabf3184e8b22f790edbb3ba98a189bc7160681d0152729836f6456ef36e88dcd0cf5789dbf7e060a2c921baf8a2a99f65e131e0bd712c37eb6e90da66bb94c3fd116f8c910c1cd513af57b1acb5b6c3c74b41104020284ab7efae726dcbe6e5f09f7d7bbe968ecec9d4be115376462770dd997", 0xcc) 18:01:20 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000080)={{0xffffffffffffffff, 0x0, 0x9, 0x0, 0x9}}) bind$inet6(r0, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @rand_addr, 0xfffffffffffffffe}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socket$inet6(0xa, 0x6, 0x3) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:20 executing program 4: prctl$PR_SVE_GET_VL(0x33, 0xe79c) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:20 executing program 3: getpeername(0xffffffffffffffff, &(0x7f0000000100)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, &(0x7f0000000180)=0x80) getsockopt$inet_mreq(r0, 0x0, 0x0, 0x0, &(0x7f0000000200)) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x1, 0x0) utimensat(r1, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280), 0x100) perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_SET_FPEMU(0xa, 0x0) r2 = open(&(0x7f0000000080)='./file0\x00', 0x40c5, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f00000000c0)={0x1, 0x100000001}) r3 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) write$9p(r2, &(0x7f0000000800)="3b27a4b46ee92b4a59073c369a5e19f9db153c4fdbc76aa2a4bb9f3e5e1aa197a9e97d1016c01813792e50c2692c175aad715d110a892949ccc6e2e54c2d5c8f0b7932b69797f217168b0c1feb128ae34f0daf487a70b5c117acd43725fe17993634f1695dabd7f998cd55e9d5bd911e86aa7a4ad75a574bb9693dd6018b25d942a9544bca1ebb0e8d10c092cdcb85797673972099e4041aaf8d636f66cb1103ef2050ad28fabaed33d6927889d97f4b5ce0de71d3fd832980f4f088d0d824e20549b4bbd906ffa51ce9de54d779eb4de462faac20a3ab0ed9934373ca22cea5454f4c2a740cd461e39956bb5f98df2aebc60cf32623adbffbcc378fa7250b6a3fc863dadcf6d4f8b804bfe70f0796eee6218445dad2811dd6b540ff52efa2f167dd9c1b8b016268d37db430983fefc0645d20614c8df2eb0872c58e09664e672b0b6a9970fec199257e1c606ec3e364c66a0f4d258c74accd43b987c756d602fd8787fed3aa43fd8d84e9656d4a413fa9a423bc54b873583d6d497005e54712fafc71384988d80134fbf84f53fdd74b354848006b8b5b67e7cc5a472475d3ae545ca1fcf7628b873e31ba83a98a7ad5b0cfbe9711b517a9a1388ad0efa2a3b4e22152021d631b731e2e100a9831111db7acce948bb5deeea260463c140ac929e77c58402776caf85d4569a75dde2f64c4491508afb541ed9b2c81fc95c06706235f383e31cf662c95b1e49cfd94871e22720a41535756e419b271276941692bd023dd9ca8bec4f7db1e5c00d8b3be7b8e826a6aadd001edd0dfeb00f8048442b5c48456fd642e629dcb2ff55592665ff491cd832672ce4d999da186db2c3a1f8b6b1f7d3750d7cdb3097954e6e14fb2183ad662c63d4ce8b82dc2487f0fe2ea2827b53a7c6dcced878d2fb29c1d3ff583570e7bc172d1a5c716e0447cb08ce3c468ffdf975da372f3f3eb455aaf5822bc04a51b6cad24a2331369df81c123b009a2381b42e9aeb077f621608d81c12a5f5c6c295d74afd4dd5c051296be0b54c70bf899b347c36bff62f313079983409d7f9cf1242c917985c1b5d0736fe21f8514f63d0369a374c42da40bd5140bc3e602d00c3cb4f8e621863ab47422778d67d72de34753fd72cef80649a1548e4e8dcbcffe4054cc9d8a1f922623a75904cbdaacde768131e587269a4a99d82f7009c1b8ab79aa232a2fd45ad71b60fca627576ba979fa6a87525884b08d721a21400fb1f950b96ead82f408cc4388d3b78fb456616429a520656d5e5a876fd04748498902c86f58d45f4c1b3919eb846a00edf07e7a830bf723e4774f085f15534dd3b5246c0c0970b5ad7bb39b30b156a9430378c5b0aab1261c78d72ac301cd552d5e8dd4b642ec1dc0672745d593bb26d095b5b23576e3cfd6ab580f6e09419d0f0c64250fafaa3759aa1888da48d89c3f7c9454b0b3d0ab40445f5bed4493ef43ab08f31b1345ac4ffd94ad79c9eee53904ed6f572817153190d2e6863f2e39356bb99926419fd314341a536b7e76cae60bf7750a4c29e3f4c7f005530b1d4ee0e25b93b76fcc1108222f0b00de52cf4100e97adfd7b9db1370586ba27e1e183299be00d0df8439c380edf2f79deb441eac59b814b04accdff5e17f02046139f91f0332661676ff506e575f0cb2850bcc9f8666f6d1f69f8f4271cb804a79fccd7016f049d1a494c46a527c437fa0be6d51ec7543d9bd7a2f016194ebe3c99080a6c9b5119863dfe865f8e60cae29f50b67dbfaa0a3c9794d73034485ca1613344c572783db3dfab01b28089c51cda99cefa4c1c881a29e229f04c7e0fd04dc425ae8417852e6e31520c6207e9d4e35285feef2a2cb8a3bceb08a166fa4284a516362621e2c06731a442791f1db063a32cf1f005c914102c7273cb4d7ab1bf567d72f230783d2ea99c43a60e8729132441ee6c5362c33f9b613f84417c3c5549f4e3d9e73c6f83f16c8e57ae22fe5f54515e111fe43ad7c400d214281452bb6141cecad84b23a695f061988d906d03be5d89584634b9e9d9a9b072f8e7cbb47c47719318a2001cafa665dd2c82672d16877ea115bd023fc1975f7c59664bfb06f66a1a5e3f05cb283fb45ea67a2727ee6e10bf35b31fdd03d43ec67b753f6737e0d2f4a5275031595878cefc8f0ca", 0x600) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) sendfile(r2, r3, 0x0, 0x10000) ioctl$KDSETMODE(0xffffffffffffffff, 0x4b3a, 0x0) [ 452.667220] binder: 14478:14558 ioctl c0306201 0 returned -14 [ 452.673540] binder: BINDER_SET_CONTEXT_MGR already set [ 452.679176] binder_alloc: 14478: binder_alloc_buf, no vma [ 452.686516] binder: 14478:14499 ioctl 40046207 0 returned -16 [ 452.693646] binder: 14478:14558 transaction failed 29189/-3, size 24-8 line 3254 [ 452.701830] binder: 14478:14558 BC_INCREFS_DONE u0000000000000000 no match [ 452.709181] binder: 14478:14499 Release 1 refcount change on invalid ref 1 ret -22 18:01:20 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:20 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x200000, 0x0) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000140)=r1, 0x4) ioctl$TCSETAW(r1, 0x5407, &(0x7f0000000180)={0x8, 0x9, 0x81, 0x80, 0x5, 0xabe2, 0x6, 0x80000001, 0x1, 0x5}) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080), 0x10) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, 0x0) signalfd4(r2, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80803) [ 452.715107] binder: send failed reply for transaction 828 to 14478:14483 [ 452.739424] binder: undelivered TRANSACTION_COMPLETE [ 452.747489] binder: undelivered TRANSACTION_ERROR: 29189 18:01:20 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000040)) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 452.768601] binder: BINDER_SET_CONTEXT_MGR already set [ 452.774900] binder: 14561:14563 ioctl 40046207 0 returned -16 [ 452.781413] binder_alloc: 14561: binder_alloc_buf, no vma [ 452.790884] binder: 14561:14565 transaction failed 29189/-3, size 24-8 line 3254 [ 452.799014] binder: 14561:14565 BC_INCREFS_DONE u0000000000000000 no match [ 452.831964] binder: send failed reply for transaction 833 to 14561:14563 [ 452.839023] binder: undelivered TRANSACTION_ERROR: 29189 18:01:20 executing program 5: r0 = epoll_create1(0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) r1 = epoll_create1(0x0) getrusage(0x0, 0x0) r2 = timerfd_create(0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000100)={0x20000001}) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f00000012c0)={{{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@dev}}, &(0x7f0000000240)=0xe8) recvfrom$packet(r3, &(0x7f00000002c0)=""/4096, 0x1000, 0x20000010140, &(0x7f0000001400)={0x11, 0x7, r4, 0x1, 0x6, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x14) ioctl$EVIOCSABS3F(0xffffffffffffffff, 0x401845ff, 0x0) timerfd_settime(r2, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000021ff4)={0x2001}) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write(r6, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b7}, &(0x7f0000000200)={0x0, r7+30000000}, 0x0) vmsplice(r5, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 18:01:20 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000000280)={0xa, 0x4e20, 0x0, @rand_addr, 0x200000000}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000080)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000380)={0xfffffffffffffff7, r1}) r2 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)="a31a2af2c728266e79b55b515da7e20968b701257345c7e623fd6f5cd85a1fcd88059b2077a9e2fde71f314cade5001e5058a9ec935ffa841fc4af12a37e901ed02239c0bd91173393e2f35a9bf2", 0x4e, 0xfffffffffffffff9) keyctl$get_security(0x11, r2, &(0x7f0000000240)=""/63, 0x3f) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:20 executing program 3: mlock2(&(0x7f00004a5000/0x1000)=nil, 0x1000, 0x1) madvise(&(0x7f00002f8000/0xc00000)=nil, 0xc00000, 0x4) 18:01:20 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x8d, 0x0, &(0x7f0000000580)="af432af6d044baa798e1f50f9fb9dc0da32d60a48e1d8282cce33968dc894abd2723adeeb3461292d0bcd3a9389a425d8aaee09a8c12ee02f7e39b3f73a14c8b9ba547cfacb6c4bd34d05e53d93f1f0d115d4f0e30e52efea2a0a81a8104655b2feaec9b06125dbf0c37b441545138e70d94e627465f9ed194efe6a8d61dfc78000130a5c70250a79a86a279fb"}) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f0000000080)={0xc4, 0x8, 0x3, 0x0, 0x0, [{r2, 0x0, 0x2}, {r0, 0x0, 0x1000}, {r2}]}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:20 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001c80)={&(0x7f0000000240)=@newlink={0x44, 0x10, 0xc11, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x10, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'nr0\x00'}]}, 0x44}}, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x8000, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000080)) [ 453.003678] binder: 14589:14592 BC_INCREFS_DONE u0000000000000000 no match [ 453.013549] binder: 14589:14592 Release 1 refcount change on invalid ref 1 ret -22 [ 453.028939] binder: BINDER_SET_CONTEXT_MGR already set [ 453.043053] binder: 14589:14592 ioctl 40046207 0 returned -16 [ 453.044121] binder: 14589:14602 BC_INCREFS_DONE u0000000000000000 no match [ 453.057572] binder: 14589:14592 Release 1 refcount change on invalid ref 1 ret -22 18:01:20 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip6_vti0\x00', 0x0}) socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 18:01:20 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, 0x0) setxattr$security_evm(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.evm\x00', &(0x7f0000000100)=@sha1={0x1, "a469359594befc60b60c0b3fc578f81c28da8087"}, 0x15, 0x2) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000200)={0x0, @local, @multicast1}, &(0x7f0000000240)=0xc) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000280)={@ipv4={[], [], @local}, r2}, 0x14) poll(&(0x7f0000000140)=[{r0, 0x11}], 0x1, 0x80000000) 18:01:23 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x3f, r0, 0x2, 0xfc1) syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x4, 0x2002) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x4) write$UHID_DESTROY(r1, &(0x7f0000000040), 0x4) 18:01:23 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) close(r0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000240)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000000)=0xe8) r2 = geteuid() setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000340)={{{@in=@remote, @in6=@ipv4={[], [], @remote}, 0x4e23, 0x0, 0x4e23, 0xfff, 0xa, 0x80, 0x0, 0x32, r1, r2}, {0x1f, 0x1f, 0x1f, 0x100, 0xfffffffffffffffb, 0x4}, {0x5, 0xdabd, 0x7, 0x34b}, 0xc82e, 0x6e6bb2, 0x3, 0x1, 0x3, 0x3}, {{@in6=@loopback, 0x4d3, 0x3f}, 0xa, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3502, 0x4, 0x3, 0xffff, 0x4, 0x4e5e, 0x2d3d}}, 0xe8) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f00000001c0)=""/11, 0x1be) ioctl$TIOCSETD(r3, 0x5423, &(0x7f00000000c0)) open(&(0x7f0000000040)='./file0\x00', 0x2d00c0, 0x0) ioctl$FIDEDUPERANGE(r3, 0xc0189436, &(0x7f0000000440)={0x8, 0x8, 0x6, 0x0, 0x0, [{r3, 0x0, 0xb4}, {r0, 0x0, 0x2}, {r0, 0x0, 0x674e936c}, {r3, 0x0, 0x3f}, {r3, 0x0, 0x59}, {r3, 0x0, 0x100}]}) 18:01:23 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x800) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x2001f, r0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:23 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip6_vti0\x00', 0x0}) socket$packet(0x11, 0x2000000000003, 0x300) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) bind$packet(r0, &(0x7f0000000040)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @broadcast}, 0x14) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) sendmmsg(r0, &(0x7f0000000d00), 0x400004e, 0x0) 18:01:23 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x40000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) munmap(&(0x7f0000551000/0x4000)=nil, 0x4000) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000340)={0x7, 0x7, 0x40, 0x1, 0x17, 0x8, 0x2, 0x7, 0x1000, 0x3, 0x4, 0x10001}) chdir(&(0x7f0000000480)='./file0\x00') lsetxattr$trusted_overlay_nlink(&(0x7f0000000280)='./file1\x00', &(0x7f00000002c0)='trusted.overlay.nlink\x00', &(0x7f0000000300)={'U+'}, 0x28, 0x2) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000540)=""/194) r1 = getpgrp(0x0) sched_setscheduler(r1, 0x0, 0x0) write$cgroup_type(0xffffffffffffffff, 0x0, 0x6ea) lstat(0x0, 0x0) r2 = syz_open_dev$evdev(&(0x7f00000003c0)='/dev/input/event#\x00', 0x3, 0x2) ioctl$EVIOCGMASK(r2, 0x80104592, &(0x7f00000000c0)={0xffffe, 0x0, 0x0}) socketpair$unix(0x1, 0x100000000005, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) r3 = open(&(0x7f00009e1000)='./file0\x00', 0x8040, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={r3, 0x28, &(0x7f0000000100)}, 0x10) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f00000004c0)={0x7, 0x6, 0x7ff, 0x88, 0xe9}, 0x14) fcntl$setlease(r3, 0x400, 0x0) r4 = syz_open_procfs(r1, &(0x7f0000000240)='net/arp\x00') fstatfs(r4, &(0x7f0000000440)=""/45) get_thread_area(&(0x7f0000000200)={0x4, 0x0, 0x0, 0x80000000, 0x0, 0x2, 0x0, 0x8, 0x8001, 0x101}) rename(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file1\x00') write$eventfd(0xffffffffffffffff, 0x0, 0x0) write$P9_RVERSION(r0, &(0x7f0000000500)={0x15, 0x65, 0xffff, 0x9, 0x8, '9P2000.u'}, 0x15) ioctl$void(r3, 0xc0045c78) 18:01:23 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x11, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000100)={{{@in6=@empty, @in=@multicast2}}, {{@in=@initdev}, 0x0, @in6=@local}}, &(0x7f0000000000)=0xe8) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_TIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:23 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000080)=@get={0x1, &(0x7f0000000040)=""/20, 0xdf}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 455.444840] binder: 14627:14632 transaction failed 29189/-22, size 24-8 line 3117 [ 455.468770] binder: 14627:14632 BC_INCREFS_DONE u0000000000000000 no match [ 455.483141] binder: 14627:14632 Release 1 refcount change on invalid ref 1 ret -22 18:01:23 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x80, 0x1) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x4, 0x0) prctl$PR_MCE_KILL(0x21, 0x1, 0x3) r1 = dup(0xffffffffffffffff) setsockopt$inet_tcp_buf(r1, 0x6, 0x0, &(0x7f0000000040)="7130bc2a78a8f5", 0x7) sched_setscheduler(r0, 0x6, &(0x7f0000000000)) [ 455.504499] binder: BINDER_SET_CONTEXT_MGR already set [ 455.505578] binder: 14627:14644 transaction failed 29189/-22, size 24-8 line 3117 [ 455.510767] binder: 14627:14632 ioctl 40046207 0 returned -16 [ 455.531875] binder: 14627:14644 BC_INCREFS_DONE u0000000000000000 no match [ 455.538089] binder: 14627:14649 Release 1 refcount change on invalid ref 1 ret -22 18:01:23 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:23 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000040), &(0x7f0000000080)=0x10) prctl$PR_CAPBSET_DROP(0x18, 0x14) [ 455.603953] binder: 14659:14662 ioctl 81009431 20000080 returned -22 [ 455.634002] binder: BINDER_SET_CONTEXT_MGR already set [ 455.639974] binder_alloc: 14659: binder_alloc_buf, no vma [ 455.646197] binder: 14659:14662 ioctl 40046207 0 returned -16 18:01:23 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, 0x0, 0x0, 0x1) tkill(0x0, 0x28) ptrace$cont(0x18, 0x0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, 0x0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, 0x0, 0x0, 0x0) [ 455.652704] binder: 14659:14665 transaction failed 29189/-3, size 24-8 line 3254 [ 455.661998] binder: 14659:14662 BC_INCREFS_DONE u0000000000000000 no match [ 455.677340] binder: 14659:14665 ioctl 81009431 20000080 returned -22 [ 455.690409] binder: 14659:14662 Release 1 refcount change on invalid ref 1 ret -22 18:01:23 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r1 = inotify_init() r2 = accept4$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, &(0x7f0000000080)=0x6e, 0x800) dup2(r1, r2) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:23 executing program 2: r0 = open(&(0x7f0000000000)='./file0\x00', 0xf0000, 0x118) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) setsockopt$inet_icmp_ICMP_FILTER(r0, 0x1, 0x1, &(0x7f0000000080)={0x8}, 0x4) perf_event_open(0x0, 0x0, 0x10, r1, 0x3) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f00000000c0)={'nat\x00'}, &(0x7f0000000140)=0x54) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 455.699161] binder: send failed reply for transaction 842 to 14659:14662 [ 455.709405] binder: undelivered TRANSACTION_ERROR: 29189 [ 455.797511] binder_alloc: binder_alloc_mmap_handler: 14684 20001000-20004000 already mapped failed -16 [ 455.820931] binder: BINDER_SET_CONTEXT_MGR already set [ 455.826429] binder: 14684:14687 ioctl 40046207 0 returned -16 [ 455.832560] binder_alloc: 14684: binder_alloc_buf, no vma [ 455.842496] binder: 14684:14688 transaction failed 29189/-3, size 24-8 line 3254 [ 455.866419] binder: 14684:14687 BC_INCREFS_DONE u0000000000000000 no match [ 455.868903] binder: 14684:14696 Release 1 refcount change on invalid ref 1 ret -22 [ 455.884180] binder: send failed reply for transaction 847 to 14684:14687 [ 455.894003] binder: undelivered TRANSACTION_ERROR: 29189 18:01:23 executing program 3: r0 = socket(0x30002000000050, 0x800000003, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f00000000c0)={'ip_vti0\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="2b00000000000000000000fcffffffffffffff00007905da3194ec4fd6e8000000000000c6000000000000003535be4f2078b37773ecb16c89c99ad20a699d486e094330988ee2763eb6764e63587c8bd407858f9d586b4e37bd32be471e84f04281b8bb7acecbf1271c265f938aafc582c35966cb139768490be321cd54f363c0f98fa4b5b7427f34cdbe8c8faa5cd1679ee813ed61692e971f4c3741344f52bc4f5c9e659390bc3e2d4bff1a92684052607ad55db1b59cbd4c43f615f1cffb7818d27016f1b6bb70e797ccffd236c577f1d2983e4bff817bfdc488b9abc0a1164864d1bb9acb"]}) 18:01:23 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) socket$inet6(0xa, 0x80005, 0x2) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:23 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r1 = perf_event_open$cgroup(&(0x7f0000002b40)={0x0, 0x70, 0x80000001, 0x2, 0x6, 0x7ff, 0x0, 0x98f4, 0x1000, 0x0, 0x1, 0x3, 0x0, 0x2027, 0xd35c, 0x0, 0x2, 0x7ff, 0x2, 0x0, 0x4, 0x7, 0x2, 0xc8d, 0xfffffffffffffff9, 0x8, 0x0, 0x101, 0x35, 0x6, 0x8, 0x6, 0x1, 0x24000000000, 0x81, 0xfffffffffffffffa, 0xffffffffffffffff, 0x0, 0x0, 0x7, 0x6, @perf_config_ext={0x800, 0x9}, 0x8, 0x7fff, 0x4, 0x5, 0xcce, 0x1000, 0xa67}, 0xffffffffffffffff, 0xc, 0xffffffffffffffff, 0x8) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000002bc0)={0x3, 0xa2, "2a603d00894dea1566edcf9802844080e87b44cb3af793c7dc3dcc655f50e60b6f39d73bd36ed5a03c8e92e7ab4ad6809239bde3a74ef3ad0e369ddddd8b7e038f3be40a24fae17a70dc3fca0956ace02d3a90d43348e2cbf882f6bf19f361bc827d33468f9089d766f1a96bc4c64aa6faf1e32fa41891c30b22716976cdd61067334b430abade0bec25dad254547ad285de649368084c14f31441e7a534d453107a"}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:23 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:23 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/checkreqprot\x00', 0x400000, 0x0) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000480)) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0xfffffffffffffc27) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x37, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000400)) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @multicast2}, 0xffffffffffffff90) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0xfffffffffffffffe, @dev={0xac, 0x14, 0x14, 0x17}}, {0x2, 0x4e22, @remote}, {0x2, 0x4e20, @broadcast}, 0x0, 0x0, 0x2, 0x46a, 0x0, 0x0, 0x1000, 0x800000000, 0xffffffffffffffff}) sendmmsg(r4, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) ioctl$TIOCGSID(r3, 0x5429, &(0x7f00000004c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$KDDELIO(r2, 0x4b35, 0x8) rename(&(0x7f0000002300)='./file0\x00', &(0x7f0000000040)='./file0\x00') sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c7}}, 0x0) socket$key(0xf, 0x3, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x60000000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r5, &(0x7f0000000e00)=[{{&(0x7f0000000240)=@nfc, 0x80, &(0x7f0000000b40)=[{&(0x7f00000003c0)=""/45, 0x2d}, {&(0x7f0000000780)=""/157, 0x9d}, {&(0x7f0000000840)=""/141, 0x8d}, {&(0x7f0000000900)=""/181, 0xb5}, {&(0x7f00000009c0)=""/98, 0x62}, {&(0x7f0000000a40)=""/73, 0x49}, {&(0x7f0000000ac0)=""/69, 0x45}], 0x7, &(0x7f00000010c0)=""/4096, 0x1000}, 0x1}, {{&(0x7f0000000bc0)=@nfc, 0x80, &(0x7f0000000440)=[{&(0x7f0000000c40)=""/140, 0x8c}, {&(0x7f0000000d00)=""/87, 0x57}], 0x2, &(0x7f0000000d80)=""/120, 0x78}, 0x37}], 0x2, 0x0, &(0x7f0000001080)) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x80, 0xfff, 0x0, 0xf, 0x2, 0x8, "251c88068803793a89c696b9749c73cb995353c3d8df03048e91658ab9906d6556920a3ff64f85cc4275b0a21dcc054cee7d8b61bf6764ff7da833d80fd136f0", "2475f3efa518d2bdc54a3d745ef09dbcebbdb0ff487c27d106851b485d6f8b49d650810fc7be598d6c32ef556c2df29752ba0ac37d82b36b9c926af00ae7e931", "b6f6c0116256f480baa70981af55ee587ffadfec56106feed668d83405f97d50", [0xf6a, 0x8]}) sendmmsg(r0, &(0x7f0000007740)=[{{0x0, 0xfffffffffffffc99, &(0x7f0000002240), 0x100002d3, 0x0, 0xf91485a36376e298}, 0x7fff}], 0x3fffffffffffdfb, 0x100000) sched_setaffinity(0x0, 0x1fb, &(0x7f0000000500)=0x100006) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000540), 0xc) creat(&(0x7f0000000e80)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000300)='threaded\x00', 0x9) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000380)) 18:01:23 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB], 0x10}}, 0x0) r2 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000380)={{{@in6, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@loopback, 0x0, 0x33}, 0x0, @in6=@local, 0x0, 0x0, 0x0, 0x6}}, 0xe8) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r2, &(0x7f0000007e00), 0xb2, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") 18:01:24 executing program 3: close(0xffffffffffffffff) r0 = syz_open_pts(0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x2, &(0x7f0000000240)=0xfff, 0x4) sendto$inet(r1, 0x0, 0x0, 0x20000806, &(0x7f0000001180)={0x2, 0x4e23, @local}, 0x10) [ 456.284881] binder: 14706:14708 BC_INCREFS_DONE u0000000000000000 no match [ 456.305725] binder: 14706:14708 Release 1 refcount change on invalid ref 1 ret -22 [ 456.319456] binder: BINDER_SET_CONTEXT_MGR already set [ 456.325462] binder: 14706:14717 BC_INCREFS_DONE u0000000000000000 no match 18:01:24 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000000)={'ip_vti0\x00', 0x1000}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 456.334917] binder: 14706:14708 ioctl 40046207 0 returned -16 [ 456.346330] binder: 14706:14717 Release 1 refcount change on invalid ref 1 ret -22 18:01:24 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x88000, 0x0) write$P9_RLCREATE(r1, &(0x7f0000000040)={0x18, 0xf, 0x1, {{0x60, 0x2, 0x6}, 0x3}}, 0x18) 18:01:24 executing program 3: openat$ppp(0xffffffffffffff9c, 0x0, 0x200000, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x4880, 0x0) socket$key(0xf, 0x3, 0x2) rt_sigtimedwait(&(0x7f0000000040), 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, 0x8) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000100)) lstat(0x0, &(0x7f0000000a80)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$msdos(&(0x7f0000000200)='msdos\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x0, 0x0, 0x2200000, &(0x7f0000000b00)={[{@fat=@tz_utc='tz=UTC'}, {@dots='dots'}, {@dots='dots'}, {@fat=@flush='flush'}, {@fat=@errors_continue='errors=continue'}], [{@uid_eq={'uid', 0x3d, r1}}]}) ioctl$PIO_CMAP(0xffffffffffffffff, 0x4b71, &(0x7f0000000240)={0x4, 0x1, 0x0, 0x0, 0xfffffffffffffffe, 0x8}) ptrace(0xffffffffffffffff, r0) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002680)={@remote}, &(0x7f00000026c0)=0x8) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f00000000c0)={0x6, 0x0, 0xffff, 0x6b3, 0x0, 0x0, 0x7, 0x7ff, 0x80000001, 0x8}) wait4(r0, &(0x7f00000003c0), 0x0, 0x0) add_key$user(&(0x7f0000002700)='user\x00', 0x0, &(0x7f0000002780), 0x0, 0xffffffffffffffff) [ 456.391586] binder: 14730:14731 got transaction to context manager from process owning it [ 456.412758] binder: 14730:14731 transaction failed 29201/-22, size 24-8 line 3108 18:01:24 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(r1, 0x0, 0x296) sendto$inet6(r1, &(0x7f0000000040), 0x0, 0x8010, &(0x7f0000000080)={0xa, 0x4e21, 0xff, @remote, 0x3}, 0x1c) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:24 executing program 0: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00\xec\bV/\xe8\xb0+CN\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0xfffffffffffffd3c, &(0x7f00000000c0)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_IFNAME={0x14, 0x3, 'ip6_vti0\x00'}, @IFLA_ADDRESS={0xc, 0x1, @dev}]}, 0x40}}, 0x200000000000) socket$inet_icmp_raw(0x2, 0x3, 0x1) [ 456.447116] binder: 14730:14743 BC_INCREFS_DONE node 852 has no pending increfs request [ 456.476628] binder: 14730:14731 Release 1 refcount change on invalid ref 1 ret -22 [ 456.482205] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 456.498655] binder_alloc: 14730: binder_alloc_buf, no vma [ 456.505042] binder: BINDER_SET_CONTEXT_MGR already set [ 456.510859] binder: 14730:14731 ioctl 40046207 0 returned -16 [ 456.521481] binder: 14730:14743 transaction failed 29189/-3, size 24-8 line 3254 [ 456.529422] binder: 14730:14753 BC_INCREFS_DONE u0000000000000000 no match 18:01:24 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@mcast1, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@empty}}, &(0x7f0000000180)=0xe8) connect$packet(r3, &(0x7f0000000380)={0x11, 0x1c, r4, 0x1, 0x4, 0x6, @local}, 0x14) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:24 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet_udp(0x2, 0x2, 0x0) socketpair(0x11, 0x800, 0x10000, &(0x7f00000004c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000580)={0x0}, &(0x7f0000000540)=0x3f2) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x0, 0x0) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) getsockname$inet(r2, &(0x7f0000000200), &(0x7f0000000240)=0x10) wait4(r1, 0x0, 0x20000005, &(0x7f0000000140)) r3 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x28) ptrace$cont(0x18, r3, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r3, 0x0, &(0x7f0000000080)) clone(0x80100000, &(0x7f0000000280)="31374972561c3f28439d0536b70d04b29a1c6bd610b9109cddc77dcefe0896ff4f74d5ff2fc4a112ca2124dab6da42886e26c904975653aa0351e83c854be65bf3bd32f41f690aa3b64bd2109b561e34a8cbed71dad294358b0653797374bf8453de0ad6a0e4c795a4bdc6259c596a01095eeffbc867992d0ee515a4720f0a6671b82534f08033f35b914119787b52199d858b0df89fdf12f1f5cc4e1972dc0570c167cb", &(0x7f0000000340), &(0x7f0000000380), &(0x7f00000003c0)="04fdb53be582f593f13344ac13e544c9233a358c88d9c4") ptrace$cont(0x1f, r3, 0x0, 0x0) setsockopt$inet6_tcp_buf(r2, 0x6, 0x1f, &(0x7f0000000400)="fc573a9c8cd476431df0b882757083bbb298f1ccbdae4fd449ede1cd1827003f727c02494988fc2863e9cbba630a3528b3895f2f5168ddcee41f9b031c4b261a783cd128a3d572325de7623bd7e93f2042a4367ed90599aeee513e83d8433c2a5e256403c558ee5bf562061c96d4937f95b3777cdeae3831899853704f1513f0230ee409", 0x84) [ 456.539293] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 456.583514] FAT-fs (loop3): bogus number of reserved sectors 18:01:24 executing program 0: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x88000, 0x0) write$P9_RLCREATE(r1, &(0x7f0000000040)={0x18, 0xf, 0x1, {{0x60, 0x2, 0x6}, 0x3}}, 0x18) 18:01:24 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) socket$inet6(0xa, 0x0, 0xfffffffffffffffd) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) [ 456.598275] FAT-fs (loop3): Can't find a valid FAT filesystem [ 456.633043] binder: BINDER_SET_CONTEXT_MGR already set [ 456.638629] binder: 14767:14771 ioctl 40046207 0 returned -16 [ 456.647188] binder_alloc: 14767: binder_alloc_buf, no vma [ 456.656748] binder: 14767:14780 BC_INCREFS_DONE u0000000000000000 no match [ 456.666817] binder: 14767:14775 transaction failed 29189/-3, size 24-8 line 3254 [ 456.675338] binder: 14767:14771 Release 1 refcount change on invalid ref 1 ret -22 [ 456.677755] binder: send failed reply for transaction 856 to 14767:14771 [ 456.694484] binder: undelivered TRANSACTION_ERROR: 29189 [ 456.752923] FAT-fs (loop3): bogus number of reserved sectors [ 456.764834] FAT-fs (loop3): Can't find a valid FAT filesystem 18:01:24 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$KDENABIO(r1, 0x4b36) socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) 18:01:24 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(r0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000580)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000000000)=0xe8) getgroups(0x1, &(0x7f0000000180)=[0xffffffffffffffff]) r5 = getuid() write$P9_RSTATu(r2, &(0x7f0000000380)={0x67, 0x7d, 0x1, {{0x0, 0x45, 0x9, 0xf9, {0x82, 0x3, 0x8}, 0x11000000, 0x9, 0x6, 0x8, 0x0, '', 0x0, '', 0x5, '#user', 0xd, '/dev/binder#\x00'}, 0xd, '/dev/binder#\x00', r3, r4, r5}}, 0x67) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a6273d415f924", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040b8e7a1718552f5c2e553a615e14489d5dae35c066cd8fb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0663044001000096ff0933585d067b1ad38387fcccb48b801845ea38d12ac1e07edc9400008bdacac838bae4a87ca5ec79119d6c9d48cce3ca268db867ba47357c619809d82a1a6a1345a5038546e4944e6ecb0ea4cf67508a9b6729530f57aaa0a754ca281ed215b1b82a94f4b3b4cf9825c99d1fd90ec9cf995abdc727759d48172404a15a86d585488b75aa70c5ef355e077f1a971c15bdc13d70d3a64e32a8d645ad3400"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:24 executing program 0: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x88000, 0x0) write$P9_RLCREATE(r1, &(0x7f0000000040)={0x18, 0xf, 0x1, {{0x60, 0x2, 0x6}, 0x3}}, 0x18) 18:01:24 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/checkreqprot\x00', 0x400000, 0x0) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000480)) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0xfffffffffffffc27) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x37, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000400)) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @multicast2}, 0xffffffffffffff90) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0xfffffffffffffffe, @dev={0xac, 0x14, 0x14, 0x17}}, {0x2, 0x4e22, @remote}, {0x2, 0x4e20, @broadcast}, 0x0, 0x0, 0x2, 0x46a, 0x0, 0x0, 0x1000, 0x800000000, 0xffffffffffffffff}) sendmmsg(r4, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) ioctl$TIOCGSID(r3, 0x5429, &(0x7f00000004c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$KDDELIO(r2, 0x4b35, 0x8) rename(&(0x7f0000002300)='./file0\x00', &(0x7f0000000040)='./file0\x00') sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c7}}, 0x0) socket$key(0xf, 0x3, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x60000000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r5, &(0x7f0000000e00)=[{{&(0x7f0000000240)=@nfc, 0x80, &(0x7f0000000b40)=[{&(0x7f00000003c0)=""/45, 0x2d}, {&(0x7f0000000780)=""/157, 0x9d}, {&(0x7f0000000840)=""/141, 0x8d}, {&(0x7f0000000900)=""/181, 0xb5}, {&(0x7f00000009c0)=""/98, 0x62}, {&(0x7f0000000a40)=""/73, 0x49}, {&(0x7f0000000ac0)=""/69, 0x45}], 0x7, &(0x7f00000010c0)=""/4096, 0x1000}, 0x1}, {{&(0x7f0000000bc0)=@nfc, 0x80, &(0x7f0000000440)=[{&(0x7f0000000c40)=""/140, 0x8c}, {&(0x7f0000000d00)=""/87, 0x57}], 0x2, &(0x7f0000000d80)=""/120, 0x78}, 0x37}], 0x2, 0x0, &(0x7f0000001080)) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x80, 0xfff, 0x0, 0xf, 0x2, 0x8, "251c88068803793a89c696b9749c73cb995353c3d8df03048e91658ab9906d6556920a3ff64f85cc4275b0a21dcc054cee7d8b61bf6764ff7da833d80fd136f0", "2475f3efa518d2bdc54a3d745ef09dbcebbdb0ff487c27d106851b485d6f8b49d650810fc7be598d6c32ef556c2df29752ba0ac37d82b36b9c926af00ae7e931", "b6f6c0116256f480baa70981af55ee587ffadfec56106feed668d83405f97d50", [0xf6a, 0x8]}) sendmmsg(r0, &(0x7f0000007740)=[{{0x0, 0xfffffffffffffc99, &(0x7f0000002240), 0x100002d3, 0x0, 0xf91485a36376e298}, 0x7fff}], 0x3fffffffffffdfb, 0x100000) sched_setaffinity(0x0, 0x1fb, &(0x7f0000000500)=0x100006) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000540), 0xc) creat(&(0x7f0000000e80)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000300)='threaded\x00', 0x9) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000380)) 18:01:24 executing program 3: r0 = creat(&(0x7f0000000340)='./bus\x00', 0x0) write$cgroup_type(r0, &(0x7f0000000000)='threaded\x00', 0x1000000e8) fcntl$setstatus(r0, 0x4, 0x44093) io_setup(0x5, &(0x7f0000000140)=0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000180)={{{@in=@local, @in6=@local}}, {{@in6=@mcast1}, 0x0, @in6=@mcast2}}, &(0x7f0000000040)=0xe8) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef555}]) [ 456.969934] binder: 14801:14809 ioctl c0306201 0 returned -14 [ 456.977599] binder: 14801:14809 BC_INCREFS_DONE uc2f5528571a1e7b8 no match [ 456.985976] binder: 14801:14809 Release 1 refcount change on invalid ref -1778384895 ret -22 [ 457.006912] binder: 14801:14811 ioctl c0306201 0 returned -14 18:01:24 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0x4000000000000002, &(0x7f00000000c0)=0x102, 0x4) bind$inet6(r0, &(0x7f0000d1a000)={0xa, 0x4e20}, 0x1c) sendto$inet6(r0, 0x0, 0xfffffd5e, 0xfffffeff7ffffffe, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r1 = socket$inet6(0xa, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000040)={{0xa, 0x4e21, 0x4, @rand_addr="747a81745b6e3b40b2671076c18cfbf3", 0x1}, {0xa, 0x4e24, 0x3, @loopback, 0x7}, 0x6, [0x100000000, 0x18, 0x0, 0x7, 0x40, 0x0, 0x5, 0x100]}, 0x5c) syz_open_procfs(0xffffffffffffffff, 0x0) [ 457.022510] binder: BINDER_SET_CONTEXT_MGR already set [ 457.029013] binder: 14801:14809 ioctl 40046207 0 returned -16 [ 457.037799] binder_alloc: 14801: binder_alloc_buf, no vma [ 457.047025] binder: 14801:14816 BC_INCREFS_DONE uc2f5528571a1e7b8 no match [ 457.056569] binder: 14801:14811 transaction failed 29189/-3, size 24-8 line 3254 18:01:24 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x400000000008, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) r5 = fcntl$dupfd(r1, 0x406, r0) write$P9_RSTATFS(r5, &(0x7f0000000080)={0x43, 0x9, 0x2, {0x2, 0xffffffffffffff00, 0x3f, 0x9, 0x5, 0x202, 0x6b, 0x3}}, 0x43) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 457.075310] binder: 14801:14809 Release 1 refcount change on invalid ref -1778384895 ret -22 [ 457.085968] binder: send failed reply for transaction 861 to 14801:14809 [ 457.099337] binder: undelivered TRANSACTION_ERROR: 29189 [ 457.153491] binder_alloc: 14821: binder_alloc_buf, no vma [ 457.159809] binder: 14821:14822 transaction failed 29189/-3, size 24-8 line 3254 [ 457.179963] binder: 14821:14822 BC_INCREFS_DONE u0000000000000000 no match 18:01:24 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(r0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000580)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000000000)=0xe8) getgroups(0x1, &(0x7f0000000180)=[0xffffffffffffffff]) r5 = getuid() write$P9_RSTATu(r2, &(0x7f0000000380)={0x67, 0x7d, 0x1, {{0x0, 0x45, 0x9, 0xf9, {0x82, 0x3, 0x8}, 0x11000000, 0x9, 0x6, 0x8, 0x0, '', 0x0, '', 0x5, '#user', 0xd, '/dev/binder#\x00'}, 0xd, '/dev/binder#\x00', r3, r4, r5}}, 0x67) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a6273d415f924", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040b8e7a1718552f5c2e553a615e14489d5dae35c066cd8fb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0663044001000096ff0933585d067b1ad38387fcccb48b801845ea38d12ac1e07edc9400008bdacac838bae4a87ca5ec79119d6c9d48cce3ca268db867ba47357c619809d82a1a6a1345a5038546e4944e6ecb0ea4cf67508a9b6729530f57aaa0a754ca281ed215b1b82a94f4b3b4cf9825c99d1fd90ec9cf995abdc727759d48172404a15a86d585488b75aa70c5ef355e077f1a971c15bdc13d70d3a64e32a8d645ad3400"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 457.199160] binder: 14821:14822 Release 1 refcount change on invalid ref 1 ret -22 18:01:24 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(r0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000580)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000000000)=0xe8) getgroups(0x1, &(0x7f0000000180)=[0xffffffffffffffff]) r5 = getuid() write$P9_RSTATu(r2, &(0x7f0000000380)={0x67, 0x7d, 0x1, {{0x0, 0x45, 0x9, 0xf9, {0x82, 0x3, 0x8}, 0x11000000, 0x9, 0x6, 0x8, 0x0, '', 0x0, '', 0x5, '#user', 0xd, '/dev/binder#\x00'}, 0xd, '/dev/binder#\x00', r3, r4, r5}}, 0x67) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a6273d415f924", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040b8e7a1718552f5c2e553a615e14489d5dae35c066cd8fb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0663044001000096ff0933585d067b1ad38387fcccb48b801845ea38d12ac1e07edc9400008bdacac838bae4a87ca5ec79119d6c9d48cce3ca268db867ba47357c619809d82a1a6a1345a5038546e4944e6ecb0ea4cf67508a9b6729530f57aaa0a754ca281ed215b1b82a94f4b3b4cf9825c99d1fd90ec9cf995abdc727759d48172404a15a86d585488b75aa70c5ef355e077f1a971c15bdc13d70d3a64e32a8d645ad3400"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 457.226123] binder: BINDER_SET_CONTEXT_MGR already set [ 457.233176] binder: 14821:14822 ioctl 40046207 0 returned -16 [ 457.235903] binder_alloc: 14821: binder_alloc_buf, no vma [ 457.247603] binder: 14821:14832 transaction failed 29189/-3, size 24-8 line 3254 [ 457.256508] binder: 14821:14822 BC_INCREFS_DONE u0000000000000000 no match [ 457.256520] binder: 14821:14831 Release 1 refcount change on invalid ref 1 ret -22 18:01:27 executing program 1: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(r0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000580)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000000000)=0xe8) getgroups(0x1, &(0x7f0000000180)=[0xffffffffffffffff]) r5 = getuid() write$P9_RSTATu(r2, &(0x7f0000000380)={0x67, 0x7d, 0x1, {{0x0, 0x45, 0x9, 0xf9, {0x82, 0x3, 0x8}, 0x11000000, 0x9, 0x6, 0x8, 0x0, '', 0x0, '', 0x5, '#user', 0xd, '/dev/binder#\x00'}, 0xd, '/dev/binder#\x00', r3, r4, r5}}, 0x67) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a6273d415f924", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040b8e7a1718552f5c2e553a615e14489d5dae35c066cd8fb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0663044001000096ff0933585d067b1ad38387fcccb48b801845ea38d12ac1e07edc9400008bdacac838bae4a87ca5ec79119d6c9d48cce3ca268db867ba47357c619809d82a1a6a1345a5038546e4944e6ecb0ea4cf67508a9b6729530f57aaa0a754ca281ed215b1b82a94f4b3b4cf9825c99d1fd90ec9cf995abdc727759d48172404a15a86d585488b75aa70c5ef355e077f1a971c15bdc13d70d3a64e32a8d645ad3400"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:27 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000140)="d8fbf23104a0109232d041e4aacfe44a4f41c0f5c38de2b9cc0698018eb8caa788ce9e94d4edb872e3d370301b84c5b7908ab9575f36c883f455b46f3b47391197d67a27f7e0c3a2c8dafd7f5bb918ec79194dee0ad2c59ef85a135ca0174170088b8dea67a9c9f43680e1b8fa4a4224d84617") ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:27 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000003000/0x2000)=nil, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000002000/0x2000)=nil, &(0x7f0000000000/0x4000)=nil, &(0x7f0000000000)="56206ac94c00b8dc6e2e76aa844217b644053a6150f1b515f1ba5e4e8fc30a5a95fba466f5acc64a58e98551efc9ff28", 0x30, r0}, 0x68) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) 18:01:27 executing program 3: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = dup(r0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000580)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@initdev}}, &(0x7f0000000000)=0xe8) getgroups(0x1, &(0x7f0000000180)=[0xffffffffffffffff]) r5 = getuid() write$P9_RSTATu(r2, &(0x7f0000000380)={0x67, 0x7d, 0x1, {{0x0, 0x45, 0x9, 0xf9, {0x82, 0x3, 0x8}, 0x11000000, 0x9, 0x6, 0x8, 0x0, '', 0x0, '', 0x5, '#user', 0xd, '/dev/binder#\x00'}, 0xd, '/dev/binder#\x00', r3, r4, r5}}, 0x67) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a6273d415f924", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040b8e7a1718552f5c2e553a615e14489d5dae35c066cd8fb", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0663044001000096ff0933585d067b1ad38387fcccb48b801845ea38d12ac1e07edc9400008bdacac838bae4a87ca5ec79119d6c9d48cce3ca268db867ba47357c619809d82a1a6a1345a5038546e4944e6ecb0ea4cf67508a9b6729530f57aaa0a754ca281ed215b1b82a94f4b3b4cf9825c99d1fd90ec9cf995abdc727759d48172404a15a86d585488b75aa70c5ef355e077f1a971c15bdc13d70d3a64e32a8d645ad3400"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:27 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/checkreqprot\x00', 0x400000, 0x0) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000480)) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0xfffffffffffffc27) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x37, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000400)) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @multicast2}, 0xffffffffffffff90) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0xfffffffffffffffe, @dev={0xac, 0x14, 0x14, 0x17}}, {0x2, 0x4e22, @remote}, {0x2, 0x4e20, @broadcast}, 0x0, 0x0, 0x2, 0x46a, 0x0, 0x0, 0x1000, 0x800000000, 0xffffffffffffffff}) sendmmsg(r4, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) ioctl$TIOCGSID(r3, 0x5429, &(0x7f00000004c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$KDDELIO(r2, 0x4b35, 0x8) rename(&(0x7f0000002300)='./file0\x00', &(0x7f0000000040)='./file0\x00') sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c7}}, 0x0) socket$key(0xf, 0x3, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x60000000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r5, &(0x7f0000000e00)=[{{&(0x7f0000000240)=@nfc, 0x80, &(0x7f0000000b40)=[{&(0x7f00000003c0)=""/45, 0x2d}, {&(0x7f0000000780)=""/157, 0x9d}, {&(0x7f0000000840)=""/141, 0x8d}, {&(0x7f0000000900)=""/181, 0xb5}, {&(0x7f00000009c0)=""/98, 0x62}, {&(0x7f0000000a40)=""/73, 0x49}, {&(0x7f0000000ac0)=""/69, 0x45}], 0x7, &(0x7f00000010c0)=""/4096, 0x1000}, 0x1}, {{&(0x7f0000000bc0)=@nfc, 0x80, &(0x7f0000000440)=[{&(0x7f0000000c40)=""/140, 0x8c}, {&(0x7f0000000d00)=""/87, 0x57}], 0x2, &(0x7f0000000d80)=""/120, 0x78}, 0x37}], 0x2, 0x0, &(0x7f0000001080)) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x80, 0xfff, 0x0, 0xf, 0x2, 0x8, "251c88068803793a89c696b9749c73cb995353c3d8df03048e91658ab9906d6556920a3ff64f85cc4275b0a21dcc054cee7d8b61bf6764ff7da833d80fd136f0", "2475f3efa518d2bdc54a3d745ef09dbcebbdb0ff487c27d106851b485d6f8b49d650810fc7be598d6c32ef556c2df29752ba0ac37d82b36b9c926af00ae7e931", "b6f6c0116256f480baa70981af55ee587ffadfec56106feed668d83405f97d50", [0xf6a, 0x8]}) sendmmsg(r0, &(0x7f0000007740)=[{{0x0, 0xfffffffffffffc99, &(0x7f0000002240), 0x100002d3, 0x0, 0xf91485a36376e298}, 0x7fff}], 0x3fffffffffffdfb, 0x100000) sched_setaffinity(0x0, 0x1fb, &(0x7f0000000500)=0x100006) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000540), 0xc) creat(&(0x7f0000000e80)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000300)='threaded\x00', 0x9) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000380)) [ 459.611625] binder: BINDER_SET_CONTEXT_MGR already set [ 459.619397] binder: 14849:14850 ioctl c0306201 0 returned -14 [ 459.629568] binder_alloc: 14847: binder_alloc_buf, no vma [ 459.635569] binder: BINDER_SET_CONTEXT_MGR already set [ 459.642606] binder: 14847:14852 ioctl 40046207 0 returned -16 [ 459.648803] binder: 14847:14854 transaction failed 29189/-3, size 24-8 line 3254 [ 459.657464] binder: 14849:14850 ioctl 40046207 0 returned -16 [ 459.658298] binder: 14847:14861 BC_INCREFS_DONE u0000000000000000 no match [ 459.667634] binder_alloc: 14847: binder_alloc_buf, no vma [ 459.671829] binder: 14847:14848 Release 1 refcount change on invalid ref 1 ret -22 [ 459.677938] binder: 14849:14850 transaction failed 29189/-3, size 24-8 line 3254 [ 459.686254] binder: send failed reply for transaction 869 to 14847:14848 [ 459.704249] binder: 14849:14850 BC_INCREFS_DONE uc2f5528571a1e7b8 no match [ 459.709770] binder: undelivered TRANSACTION_ERROR: 29189 [ 459.717532] binder: 14849:14850 Release 1 refcount change on invalid ref -1778384895 ret -22 18:01:27 executing program 0: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x88000, 0x0) write$P9_RLCREATE(r1, &(0x7f0000000040)={0x18, 0xf, 0x1, {{0x60, 0x2, 0x6}, 0x3}}, 0x18) 18:01:27 executing program 1: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0xf) sendto$inet(r0, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x10004e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, &(0x7f0000d7cfcb), 0xffffffffffffffef, 0x0, 0x0, 0x0) shutdown(r0, 0x1) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)={&(0x7f0000000000)='./file0\x00', 0x0, 0x8}, 0x10) 18:01:27 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x1a1403, 0x3) write$binfmt_aout(r1, &(0x7f00000001c0)={{0x108, 0x1, 0x670d9187, 0x2a0, 0x385, 0xe5c, 0xe2, 0x1000}, "aebcfc72bd15a2b4ffd0e39ec3f9e3a56df8a1693b7ba6941366afc64bb6bf32c6126d38eec386cf5882cfa3ab0c4f1df41e1620bb61378909c57d81b94d369c2a3093defc137d69d0c868f435e744903c393ffc56d6642abd3b6969cb5ab8e33f0e45ec612bda92bfb46efeddcaa03ee3d1debfad2c55f703bfbe2ef838c471aa661600a61ee8ca4119bb5a65d0bac72e84987b584b6e205c70e50f04009df151a72d5c9761f7fd77136d4e161d293b3e9e6e9b885f57ce6a0a85aee454431d2f707abb3950977c0ed72049e1fa031dff18d49d2f2f7cb984d60f69b3898c", [[], [], [], [], [], [], [], []]}, 0x8ff) tkill(r0, 0x29) ptrace$cont(0x10000000000001a, r0, 0x3, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r2 = openat(r1, &(0x7f0000000ac0)='./file0\x00', 0x10000, 0x10) ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) capset(&(0x7f0000000000)={0x20071026, r0}, &(0x7f0000000040)={0x1, 0xd1de, 0x20, 0x4, 0x74, 0xfffffffffffffffd}) capget(&(0x7f0000000080)={0x399f1336, r0}, &(0x7f0000000140)={0x6, 0x2b6f, 0x7, 0xfff, 0x3e, 0x5}) 18:01:27 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f00000000c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:27 executing program 3: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000d00)=@nat={'nat\x00', 0x19, 0x7, 0xab0, [0x20000240, 0x0, 0x0, 0x20000740, 0x20000978], 0x0, &(0x7f0000000200), &(0x7f0000000e40)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff02000000090000002200000088ca65716c00000000000000000000000000626f6e645f736c6176655f310000000076657468315f746f5f7465616d0000006e6c6d6f6e30000000000000000000000180c200000000ffff000000aaaaaaaaaabb00ffffff00ff0000b0000000e0000000180100007374617469737469630000000000000000000000000000000000000000000000180000000000000001000000010000000000000000000000010000000100000072656469726563740000000000000000000000000000000000000000000000000800000000000000fcffffff00000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff00000000000000006100000000066272696467655f736c6176655f3100006970646470300000000000000000000068737230000000000000000000000000626f6e645f736c6176655f3100000000aaaaaaaaaabb00ffffffffff7fffffffffffff000000ff0000001803000080030000b803000062706600000000000000000000000000000000000000000000000000000000001002000000000000020000000000020008000000ff7f980502000000fdff050700000000000004028000000000000800060000000001fb3ff8ffffff0500ff09040000000008d40101000000010083f10300000004000502ff0000000300ff02010000003f000040f30000000f77051008000000080007c20100000001000100040000000800510906000000de00bcda00800000b800ff1b40ce00000000b6f801040000812c0504090000009d0293ff000000000600830000080000010006ec04000000090005ff00802000ff030205970d0000ff0f020101000000000001b600080000070001e805000000ffff81ff00000000001000070400000020000900ff030000040003db06000000ffff06070600000000100300ffffffff030007f9ffffffff0500a6fbffffff95000077028d040000ff03000633070000a2000503000000002000ffd3ff070000ffff0807fbffffff0100ff010800000020000406e1020000ffff000109000000c00002ff510000000800077f010000001f0009ff0800000001000800ff07000003000402fffffeff0100e100c10700004759040204000000730bff076e00000003000202ffffffff020014ff0900000000000008010400007f00022c01000000080007018100000001000301ff00000003000102b2fcffff0500070235000000080005ff8100000001000000000000804000b103ff0f0000e400000401000000000000000800000000000000737470000000000000000000000000000000000000000000000000000000000048000000000000005a00000003000700ffffaaaaaaaaaaaa000000ffffff000000000000fbffffff08000700ffffffffffffff00ffffff004e224e24050001000100010009000400400a00000400100872656469726563740000000000000000000000000000000000000000000000000800000000000000feffffff00000000736e61740000000000000000000000000000000000000000000000000000000010000000000000000180c200000e000000000000000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000fcffffff020000000300000000000000000076657468315f746f5f626f6e64000000766c616e3000000000000000000000006e7230000000000000000000000000006772653000000000000000000000000075e7916b543430ffffffffff0180c2000001ff00ffff00000000b8000000b8000000f000000069700000000000000000000000000000000000000000000000000000000000002000000000000000e0000002ac141415ff000000ffffffff005f000a4e234e234e224e23000000006172707265706c790000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaabb0000fdffffff0000000005000000110000006001696662300000000000000000000000006e72300000000000000000000000000065716c0000000000000000000000000069706464703000000000000000000000000000000000ff00ffffffffaaaaaaaaaaaaffffff00ff00000070000000e000000018010000736e61740000000000000000000000000000000000000000000000000000000010000000000000000000000000000000feffffff000000006172707265706c7900000000000000e8ffffffffffffff00000000000000000010000000000000000180c20000030000fcffffff00000000646e61740000000000000000000000000000000000000000000000000000000010000000000000000180c20000020000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000004000000ffffffff01000000070000001000000000156e6c6d6f6e300000000000000000000076657468305f746f5f62726964676500726f736530000000000000000000000076657468305f746f5f626f6e64000000ffffffffffffffff000000ff0180c200000e00ffff00ff00000070000000e000000018010000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa150000fcffffff000000006172707265706c7900000000000000000000000000000000000000000000000010000000000000002e741eb1ecbe0000ffffffff000000006d1dde68c0a2d9026d533b516761726b000000000000000000000000000000000000000000000000000000001000000000000000f0ffffff00000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000005000000fcffffff02000000000000002000000000f9726f7365300000000000000000000000687773696d300000000000000000000073797a6b616c6c65723100000000000069666230000000000000000000000000ac7d3f963adcffff000000ffaaaaaaaaaabb000000ffffff000070000000c0000000f80000006c6f67000000000000000000000000000000000000000000000000000000000028000000000000000775787a4663ac5044ac52d1c50b76bcf12d286277319f24fa624c6f5fadda000100000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaaaa0000ffffffff000000001500000020000000001a79616d3000000000000000000000000069666230000000000000000000000000626f6e645f736c6176655f30000000007465716c300000000000000000000000ffffffffffff00ffff00ffff00000000000000000000ffff0000d0000000d00000000801000061727000000000000000000000000000000000000000000000000000000000003800000000000000031f0a010000000000000006ff000000ffffffffffffffffaaaaaaaaaaaaffff0000ffffaaaaaaaaaabb0000000000ffbf23000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000ffffffffffff0000ffffffff0000000028f3ef03156cb5d6606a7bba63ad567b332979d674613d89b25f9255f8338ef18e86414d3362c3f9526fb2e89d27c480838bb2a844faec27a3268862c65e7787c27e12c6a24c38d32aaac65e35e70803b09c59398c2858782887d94b4a748ab909cf96e6d34881756852808385efb04cad4365792f13a352d4423e9920115c257350a00becf1675dad8e42b2867b09e81d2b1c9105b71298781b705b7d70cd4f32e2e91540c32f6a12ba79ce5487af1acbfaf5441914b3097bf0798c833ad899fb418d00feeb32e2f04ac648281ecd15762c4e87b917a8fb779a1632239f93b9a55b9da0655370b420827c1fac59625164d51882920a90a7a4a5e6f6ebca1f9d0ae4f8b7b3f87b3f7a6929c853886bddb5af"]}, 0xc46) prctl$PR_GET_CHILD_SUBREAPER(0x25) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x1b, &(0x7f0000000100)={@mcast2}, 0x20) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000180)='/dev/keychord\x00', 0x10007d, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000040)) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000080)=[0x7, 0x4]) ioctl$RTC_RD_TIME(r2, 0x80247009, &(0x7f00000000c0)) [ 459.988641] binder: BINDER_SET_CONTEXT_MGR already set [ 459.994654] binder: 14870:14874 ioctl 40046207 0 returned -16 [ 460.001514] binder_alloc: 14870: binder_alloc_buf, no vma [ 460.007991] binder: 14870:14879 transaction failed 29189/-3, size 24-8 line 3254 [ 460.017235] binder: 14870:14874 BC_INCREFS_DONE u0000000000000000 no match [ 460.025410] binder: 14870:14879 Release 1 refcount change on invalid ref 1 ret -22 18:01:27 executing program 3: epoll_create(0xbe) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x40000, 0x0) 18:01:27 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$netlink_NETLINK_RX_RING(r0, 0x10e, 0x6, &(0x7f0000000080)={0x6, 0x3, 0xffffffff, 0x7fffffff}, 0x10) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000300)='/dev/binder#\x00') mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000000c0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 460.037472] binder: send failed reply for transaction 875 to 14870:14874 [ 460.047692] binder: undelivered TRANSACTION_ERROR: 29189 18:01:27 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) timerfd_create(0x7, 0x80000) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:27 executing program 3: r0 = open(0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0xffffffff) openat$keychord(0xffffffffffffff9c, 0x0, 0x40, 0x0) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x8) r1 = open(&(0x7f0000000140)='./file0\x00', 0x40c2, 0x0) r2 = open$dir(&(0x7f0000000240)='./file0\x00', 0x8002, 0x0) mkdirat$cgroup(r0, &(0x7f0000000200)='syz0\x00', 0x1ff) ioctl$FITRIM(r1, 0xc0185879, &(0x7f0000000380)={0x7, 0x9, 0x2}) r3 = request_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000080)={'syz', 0x0}, &(0x7f00000000c0)='*system*user]}proc\x00', 0xfffffffffffffffd) ioctl$PPPIOCDISCONN(r1, 0x7439) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000100)={r3, 0xff, 0x9}, &(0x7f0000000180)=ANY=[@ANYBLOB='enc=raw hash=rmd160-generic\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f0000000280)="a1283eb488e5aeda9c225c2ac8a75a52a8185a76ff4d0e7a6d8bf81e18c31bbbc3580e7bf654345612f4256132d784b76c4307a5990219c6b4e592a83a2950d8d3d770d4315036d0e07e873d976035f0759dbbfccfae828b316b2a471333f50d3de13b8d1925958d50cbcc23d05b4ebb6c07a406bde93f52c5e81b8fc5fe9794ac69484e8993844a957415ed86bd4242ad5954a57f24211434353684ae34c76abb3d210ea0fdc41b1ad247e5d0812a995ec6ccddf2303be5c2175ca4207c8d4ddddc5e1aec35780ad9136ef1873f4b29c8b75a12626adc127f390831a4ba53d9b0327f64ff45580fe0d3ba8d", 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) chdir(&(0x7f0000000040)='./file0\x00') sendfile(r1, r2, 0x0, 0x10000) [ 460.136926] binder: 14890:14893 BC_INCREFS_DONE node 881 has no pending increfs request [ 460.166665] binder: BINDER_SET_CONTEXT_MGR already set [ 460.181105] binder: 14890:14893 ioctl 40046207 0 returned -16 18:01:27 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$TCSBRKP(r1, 0x5425, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:27 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 460.183225] binder_alloc: 14890: binder_alloc_buf, no vma [ 460.194869] binder: 14890:14901 transaction failed 29189/-3, size 24-8 line 3254 [ 460.204767] binder: 14890:14893 BC_INCREFS_DONE u0000000000000000 no match [ 460.212946] binder: 14890:14901 Release 1 refcount change on invalid ref 1 ret -22 [ 460.222418] binder: send failed reply for transaction 880 to 14890:14893 [ 460.247134] binder: undelivered TRANSACTION_ERROR: 29189 [ 460.253224] binder: undelivered TRANSACTION_COMPLETE [ 460.266893] binder: undelivered TRANSACTION_ERROR: 29189 18:01:28 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/checkreqprot\x00', 0x400000, 0x0) ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000480)) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0xfffffffffffffc27) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000140)=0x37, 0x4) ioctl$sock_inet_tcp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000400)) connect$inet(r1, &(0x7f00000002c0)={0x2, 0x4e22, @multicast2}, 0xffffffffffffff90) ioctl$sock_inet_SIOCADDRT(r2, 0x890b, &(0x7f0000000080)={0x750, {0x2, 0xfffffffffffffffe, @dev={0xac, 0x14, 0x14, 0x17}}, {0x2, 0x4e22, @remote}, {0x2, 0x4e20, @broadcast}, 0x0, 0x0, 0x2, 0x46a, 0x0, 0x0, 0x1000, 0x800000000, 0xffffffffffffffff}) sendmmsg(r4, &(0x7f0000003740), 0x400031b, 0xfffffffffffffffd) ioctl$TIOCGSID(r3, 0x5429, &(0x7f00000004c0)) ioctl$SNDRV_TIMER_IOCTL_STOP(r3, 0x54a1) ioctl$KDDELIO(r2, 0x4b35, 0x8) rename(&(0x7f0000002300)='./file0\x00', &(0x7f0000000040)='./file0\x00') sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x3c7}}, 0x0) socket$key(0xf, 0x3, 0x2) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000048c0)={{{@in6=@remote, @in6=@ipv4={[], [], @remote}}}, {{@in6=@remote}}}, &(0x7f00000049c0)=0xe8) unshare(0x60000000) r5 = socket$inet_tcp(0x2, 0x1, 0x0) recvmmsg(r5, &(0x7f0000000e00)=[{{&(0x7f0000000240)=@nfc, 0x80, &(0x7f0000000b40)=[{&(0x7f00000003c0)=""/45, 0x2d}, {&(0x7f0000000780)=""/157, 0x9d}, {&(0x7f0000000840)=""/141, 0x8d}, {&(0x7f0000000900)=""/181, 0xb5}, {&(0x7f00000009c0)=""/98, 0x62}, {&(0x7f0000000a40)=""/73, 0x49}, {&(0x7f0000000ac0)=""/69, 0x45}], 0x7, &(0x7f00000010c0)=""/4096, 0x1000}, 0x1}, {{&(0x7f0000000bc0)=@nfc, 0x80, &(0x7f0000000440)=[{&(0x7f0000000c40)=""/140, 0x8c}, {&(0x7f0000000d00)=""/87, 0x57}], 0x2, &(0x7f0000000d80)=""/120, 0x78}, 0x37}], 0x2, 0x0, &(0x7f0000001080)) ioctl$LOOP_SET_STATUS64(r3, 0x4c04, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x80, 0xfff, 0x0, 0xf, 0x2, 0x8, "251c88068803793a89c696b9749c73cb995353c3d8df03048e91658ab9906d6556920a3ff64f85cc4275b0a21dcc054cee7d8b61bf6764ff7da833d80fd136f0", "2475f3efa518d2bdc54a3d745ef09dbcebbdb0ff487c27d106851b485d6f8b49d650810fc7be598d6c32ef556c2df29752ba0ac37d82b36b9c926af00ae7e931", "b6f6c0116256f480baa70981af55ee587ffadfec56106feed668d83405f97d50", [0xf6a, 0x8]}) sendmmsg(r0, &(0x7f0000007740)=[{{0x0, 0xfffffffffffffc99, &(0x7f0000002240), 0x100002d3, 0x0, 0xf91485a36376e298}, 0x7fff}], 0x3fffffffffffdfb, 0x100000) sched_setaffinity(0x0, 0x1fb, &(0x7f0000000500)=0x100006) setsockopt$IP_VS_SO_SET_TIMEOUT(0xffffffffffffffff, 0x0, 0x48a, &(0x7f0000000540), 0xc) creat(&(0x7f0000000e80)='./file0\x00', 0x0) write$cgroup_type(r3, &(0x7f0000000300)='threaded\x00', 0x9) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000380)) 18:01:30 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x100000000001c, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:30 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = gettid() ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000000)={'ip6erspan0\x00', {0x2, 0x4e22, @loopback}}) setsockopt$inet6_buf(r1, 0x29, 0x6, 0x0, 0x4227) ptrace$setopts(0x4206, r2, 0x0, 0x0) tkill(r2, 0x3a) fcntl$setstatus(r1, 0x4, 0x42803) 18:01:30 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$TCSBRKP(r1, 0x5425, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:30 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000100)=[@reply={0x40406301, {0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x18, 0x28, &(0x7f0000000080)=[@flat={0x77622a85, 0xa, r2}], &(0x7f00000000c0)=[0x40, 0x38, 0x28, 0x20, 0x78]}}], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:30 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uinput\x00', 0x801, 0x0) write$uinput_user_dev(r0, &(0x7f00000006c0)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000b40)={'syz0\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfb\xff\xff\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\xfa\xff\xff\xff\x00'}, 0x45c) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x40000, 0x0) getsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000040)=""/11, &(0x7f0000000080)=0xb) 18:01:30 executing program 5: clone(0x2302001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() sched_setscheduler(0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x23) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_opts(r1, 0x0, 0x9, &(0x7f0000000140)=""/177, &(0x7f0000000040)=0xb1) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x4, 0x400000, 0xca}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:30 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f000051cff6)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000140)=0x4) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$TUNSETSNDBUF(r1, 0x400454d4, &(0x7f0000000040)=0x100000001) r2 = eventfd(0x0) writev(r2, &(0x7f0000000100)=[{&(0x7f0000000280)="9f", 0x1}], 0x1) read(r0, &(0x7f00003fefff)=""/1, 0x1) ioctl$TCSETSF(r0, 0x5404, &(0x7f0000000080)) 18:01:30 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$TCSBRKP(r1, 0x5425, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) [ 463.004943] input: syz0 as /devices/virtual/input/input9 [ 463.015939] binder: 14925:14930 got reply transaction with no transaction stack [ 463.026423] binder: 14925:14930 transaction failed 29201/-71, size 24-40 line 3025 18:01:30 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) ptrace$setregs(0xf, r0, 0x9, &(0x7f0000000000)="caf25a02982353cfb9fddfcdd73121b5ae3a73b727d0608bf3c3d24af0f656ffcd13d733d08f01b26aa5af723e45c1e7ea872746a48019a39ebe9d147d9a78cf6b0dffe0ccb411ea2123124d41ced1e33a3b6e404fb72d5e8df513caa053a7ee6c61720499a4765764a7b0b93ca7198b2bfaf28ca2904a980d256dadd6984e4b5bbf27ee242dfa45e004ded58758ac3ac187534d97b574ecb78d56980f5da25791048009dc69476c9161d6f018") r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000140)='/dev/keychord\x00', 0x400, 0x0) openat$cgroup_procs(r1, &(0x7f0000000180)='tasks\x00', 0x2, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) gettid() setsockopt$inet_opts(r1, 0x0, 0xd, &(0x7f0000000200)="790caf26e3a58c6387f3bbecdbaf42f6a47a142027f1d2c7aa7c9b6a33df3796ffc45672f341d1875cb10e7196011e70f8e1b1ab96df4d0aa63d337555c9994f646d3961f19d74e89754f1ef2bf5d26c32d4340ab99d0d560ae3982bb3851a40900f4441d932dac66884134e1aca2f145c62b0bbdd56303b09a578c5fe9c81a2aa2484455b8df786e9704a24e385705b81a7c88edad74808e57ec99c0b44d324c8d9ef5a617d61157e75", 0xaa) syz_genetlink_get_family_id$SEG6(&(0x7f00000001c0)='SEG6\x00') ptrace$cont(0x15, r0, 0x5, 0x0) [ 463.060286] binder: BINDER_SET_CONTEXT_MGR already set [ 463.069165] binder_alloc: 14925: binder_alloc_buf, no vma [ 463.070702] input: syz0 as /devices/virtual/input/input10 [ 463.080405] binder: 14925:14930 ioctl 40046207 0 returned -16 [ 463.085134] binder: 14925:14946 transaction failed 29189/-3, size 24-8 line 3254 18:01:30 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$TCSBRKP(r1, 0x5425, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) [ 463.113272] binder: 14925:14952 got reply transaction with no transaction stack [ 463.144690] binder: 14925:14952 transaction failed 29201/-71, size 24-40 line 3025 [ 463.153602] binder: 14925:14930 Release 1 refcount change on invalid ref 1 ret -22 18:01:30 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$TCSBRKP(r1, 0x5425, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) [ 463.162512] binder: undelivered TRANSACTION_ERROR: 29201 [ 463.168282] binder: send failed reply for transaction 885 to 14925:14930 18:01:30 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl(r0, 0xffff, &(0x7f0000000080)="6d4e93e44d275dd247796a9fa9433f46e6e0b587428fbb3e955242ba0a3c7f557fcfb61307321b2af78c05d4f64f7f00069e176fa618b149a2cf3f7d628dbd24a93bae7051151fbd07ca414cb77c9012a9ada410fba8c3de98f4035540efc86681faf0c48d60dddb942e6b55e0100f0c72d83875e7e6706245f5e7288e93bc6c8e04310eaecc0302b61a4f02641bbe91170fb3a0efd69b72ffd4282fb0fc33ccf2713f360a6356caa4d245d2418c78a9b08b86eff323c6de44ff6594bec45b5b54aa5fe0d1") ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:30 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) socketpair(0xa, 0x3, 0x5, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000140)={0x1f, {{0x2, 0x4e20, @remote}}}, 0x88) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20000000000001f, r0, 0x0, 0x1d3) [ 463.204444] binder: undelivered TRANSACTION_ERROR: 29189 [ 463.227206] binder: undelivered TRANSACTION_ERROR: 29201 [ 463.269280] binder: BINDER_SET_CONTEXT_MGR already set [ 463.277053] binder: 14969:14976 ioctl 40046207 0 returned -16 [ 463.283389] binder_alloc: 14969: binder_alloc_buf, no vma [ 463.292599] binder: 14969:14971 transaction failed 29189/-3, size 24-8 line 3254 [ 463.300864] binder: 14969:14976 BC_INCREFS_DONE u0000000000000000 no match [ 463.318554] binder: 14969:14976 Release 1 refcount change on invalid ref 1 ret -22 [ 463.331233] binder: send failed reply for transaction 892 to 14969:14971 [ 463.349147] binder: undelivered TRANSACTION_ERROR: 29189 18:01:33 executing program 3: openat$cgroup_int(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.mem_exclusive\x00', 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FIBMAP(r0, 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x0, 0x41, 0x0, 0x0) ioctl$sock_TIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000140)) ioctl$UI_SET_PROPBIT(r1, 0x4004556e, 0x16) recvfrom$inet(r1, &(0x7f0000000340)=""/223, 0xdf, 0x40000000, 0x0, 0x0) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000004c0)=0x0) ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, &(0x7f0000000300)=r2) getsockopt$IP6T_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x29, 0x45, 0x0, &(0x7f0000000480)) ioctl$FS_IOC_RESVSP(r1, 0x40305828, &(0x7f00000000c0)={0x0, 0x0, 0xe2e4, 0x20000fff}) 18:01:33 executing program 4: clone(0x2080000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000000)={0x6, 0x70, 0x8, 0x3, 0x1, 0x10001, 0x0, 0xfff, 0x40, 0x4, 0x100000001, 0x2e4000000000, 0x1, 0xfffffffffffffff9, 0x100000001, 0x1f, 0x1000, 0x3f, 0x1000, 0x2294babb, 0x7fff, 0x1171, 0x1, 0x1f, 0x2, 0xff, 0x1, 0x0, 0x5, 0xffff, 0x3, 0x6ed, 0x8, 0x3, 0x40, 0xaa, 0x1, 0x2, 0x0, 0x5, 0x6, @perf_config_ext={0x2, 0x1}, 0x4, 0x10000, 0x7, 0x5, 0x1000, 0x1, 0x6}, r0, 0x3, r1, 0x1) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:33 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$TCSBRKP(r1, 0x5425, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:33 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={r0, 0x10, &(0x7f0000000000)={&(0x7f0000000080)=""/174, 0xae, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000180)=r3, 0x4) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:33 executing program 0: mknod(&(0x7f0000f80000)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) link(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') prctl$PR_CAPBSET_READ(0x17, 0x15) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000c80)={{{@in6=@remote, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@dev}}, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000140)=0x5, 0x4) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x4e23, @broadcast}, 0x10) syz_genetlink_get_family_id$tipc2(0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) shutdown(0xffffffffffffffff, 0x0) setxattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)=@random={'btrfs.', 'cgroup$nodev(cgroupuser@\x00'}, &(0x7f0000000180)='proc$]selinuxposix_acl_accesswlan0vboxnet0trusted\x00', 0x32, 0x1) ioctl$LOOP_SET_FD(r0, 0x4c00, 0xffffffffffffffff) unlink(&(0x7f00000000c0)='./file0\x00') setresuid(r1, 0x0, 0x0) clone(0x100, 0x0, 0xfffffffffffffffe, &(0x7f0000000280), 0xffffffffffffffff) 18:01:33 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) r1 = open(&(0x7f0000000080)='./file0\x00', 0x1, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000000)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000040)='TRUE', 0x4, 0x3) sendmsg$key(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000280)=ANY=[@ANYBLOB="020d00001000000034abea0e000000002edc7d2b030006000200000002000000e000000100000000000000000800120002000200000000007d2200001800000003070000003fff00000000000000001f030000001600000003010000000000030005000000000002000100000000000000000000000000000000000000000000e7cf2d83518821caa2756186a5f12e42d4287197c50216f8"], 0x80}}, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r1) ioctl$TIOCSBRK(r1, 0x5427) [ 466.031950] binder: BINDER_SET_CONTEXT_MGR already set [ 466.040301] binder: 14989:14994 ioctl 40046207 0 returned -16 [ 466.046738] binder_alloc: 14989: binder_alloc_buf, no vma [ 466.053675] binder: 14989:14996 transaction failed 29189/-3, size 24-8 line 3254 [ 466.062318] binder: 14989:14994 Release 1 refcount change on invalid ref 1 ret -22 [ 466.062343] binder: 14989:14990 BC_INCREFS_DONE u0000000000000000 no match 18:01:33 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) ioctl$TCSBRKP(r1, 0x5425, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) [ 466.072070] binder: send failed reply for transaction 897 to 14989:14990 18:01:33 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$P9_RSTATFS(r1, &(0x7f0000000380)={0x43, 0x9, 0x1, {0x4, 0x3ffc000, 0xfff, 0x1, 0x400, 0x6, 0x7fffffff, 0x1, 0x5}}, 0x43) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) fsetxattr$trusted_overlay_nlink(r1, &(0x7f0000000300)='trusted.overlay.nlink\x00', &(0x7f0000000340)={'L+', 0x7}, 0x28, 0x1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uinput\x00', 0x802, 0x0) ioctl$UI_GET_SYSNAME(r3, 0x8040552c, &(0x7f0000000080)) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PIO_UNIMAPCLR(r4, 0x4b68, &(0x7f0000000100)={0x2, 0x5, 0xffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="006340402000e1ffffff0000000000000000000000000000000000000000180000000000000008001b0000000000532af65afdffffff17f4", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000280)=0x3) fcntl$getownex(r0, 0x10, &(0x7f0000000180)={0x0, 0x0}) r6 = getpid() tgkill(r6, r5, 0x20000001a) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0647041d0d7a43f4"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:33 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:33 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x200000000001a, r0, 0x2000000000, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x80000, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 466.107141] binder: undelivered TRANSACTION_ERROR: 29189 [ 466.135297] binder: 15001:15004 got transaction to invalid handle [ 466.142695] binder: 15001:15004 transaction failed 29201/-22, size 115964641280--744411611594752 line 3117 18:01:33 executing program 0: sched_setaffinity(0x0, 0x0, 0x0) ioctl$EVIOCRMFF(0xffffffffffffffff, 0x40044581, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000080)={0x9, &(0x7f0000000040)=[{0x9, 0x6}, {0x100, 0x2bc}, {0x3, 0xfff}, {0x7, 0x4}, {0x9, 0x3}, {0x2, 0x8}, {0x9, 0x5}, {0x4ee}, {0x1ff, 0xfd9}]}) ptrace$setregset(0x4205, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) pread64(r0, &(0x7f0000000380)=""/41, 0x29, 0x0) r2 = request_key(&(0x7f00000003c0)='encrypted\x00', &(0x7f0000000400)={'syz', 0x1}, &(0x7f0000000440)='lo,+/-\x00', 0xfffffffffffffffe) r3 = request_key(&(0x7f00000004c0)='cifs.spnego\x00', &(0x7f0000000500)={'syz', 0x3}, &(0x7f0000000540)='syz', 0xfffffffffffffffc) keyctl$instantiate(0xc, r2, &(0x7f0000000480)=@encrypted_update={'update ', 'ecryptfs', 0x20, 'trusted:', '[%bdev%bdev[bdev!ppp0user\\'}, 0x33, r3) r4 = add_key(&(0x7f0000000100)='.dead\x00', &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$clear(0x7, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_getres(0x7, &(0x7f0000000200)) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) exit_group(0x200) bind$inet6(r1, &(0x7f0000000580)={0xa, 0x4e21, 0x9, @remote, 0x2938}, 0x1c) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r5, 0x40086602, 0x400007) dup(0xffffffffffffffff) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000680)='memory.events\x00', 0x7a05, 0x1700) openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x0, 0x0) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000780)={r5, &(0x7f00000005c0)="735a6eb4483b153088881f4787cca3f8096402067e5310c9168141169ebf1132b2f047aa1b789245d549f967a88760f84b6e3629aeb1594b76571b0214d6725611a8b30b5498dec5cc383a9a4bcedd987cf5741ed8c8dc86209ed1a7b3af184541526706a6ed8bf00d544297a3b609a677fbfac666c582b27cba0cd9b81f38f4f93f", &(0x7f00000006c0)=""/181}, 0x18) write$cgroup_subtree(r6, &(0x7f0000000200)=ANY=[], 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[], 0x200327da) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) io_setup(0x0, 0x0) io_setup(0x9, &(0x7f0000000280)=0x0) request_key(&(0x7f0000000240)='dns_resolver\x00', &(0x7f00000002c0)={'syz', 0x0}, &(0x7f0000000300)='trusted\x7f$[}wlan1user\x00', r4) io_cancel(r7, 0x0, 0x0) [ 466.188440] binder: 15001:15009 unknown command 486819590 [ 466.202452] binder: 15001:15009 ioctl c0306201 200001c0 returned -22 [ 466.231295] binder: BINDER_SET_CONTEXT_MGR already set [ 466.237404] binder: 15001:15009 ioctl 40046207 0 returned -16 [ 466.244482] binder: 15001:15004 got transaction to invalid handle [ 466.251581] binder: 15001:15004 transaction failed 29201/-22, size 115964641280--744411611594752 line 3117 [ 466.270770] binder: 15001:15009 unknown command 486819590 18:01:34 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f00000002c0)) 18:01:34 executing program 3: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$GIO_FONT(r0, 0x4b60, &(0x7f0000000040)=""/127) mkdirat(r0, &(0x7f00000000c0)='./file0\x00', 0x28) fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000100)='trusted.overlay.upper\x00', &(0x7f0000000140)={0x0, 0xfb, 0x1c, 0x1, 0x81, "62fc0451d194ea248d691feff52963a2", "2e1913b0d0f9b1"}, 0x1c, 0x1) r1 = signalfd(r0, &(0x7f0000000180)={0x5}, 0x8) signalfd(r0, &(0x7f00000001c0)={0x5}, 0x8) write$apparmor_current(r0, &(0x7f0000000200)=@hat={'changehat ', 0x4, 0x5e, ['/selinux/avc/cache_threshold\x00']}, 0x3a) ioctl$KDSKBMETA(r0, 0x4b63, &(0x7f0000000240)=0x1) setsockopt$IPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x41, &(0x7f0000000280)={'security\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r0, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)={0x64, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x50, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'bond_slave_0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x40}]}]}, 0x64}, 0x1, 0x0, 0x0, 0x40000}, 0x84) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000480)=0x0) ptrace$pokeuser(0x6, r3, 0x6, 0x400) ioctl$VT_RELDISP(r0, 0x5605) setsockopt$inet_tcp_buf(r0, 0x6, 0x1e, &(0x7f00000004c0)="f8eb8bdee2ac71956710ceea21ba139c4da49681f919c1081b03fdd98bb43a9eda9acbb2cc41699de3fed7154a80d87c547f2f7fcca788127f869c970b77f088c5f3bd8fa415abdfc28b60916a7886e97c44a043", 0x54) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000540)='/dev/uhid\x00', 0x802, 0x0) sched_getparam(r3, &(0x7f0000000580)) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f00000005c0)={'raw\x00', 0x7b, "7e09786848cf05304fce01a2a32566fcaa8ffaee7bf3504470632fc65587af547f7f8bf7a4296108a35ed726658ef436a4877218dbf758daac08f52c46c8da56682365556415fbb238ad76e729612c7603339f229ea2cfe92499a505d5c07b8628b37d9c8c3e78417124e2bae01b08f3a0cb89475e774c987b6414"}, &(0x7f0000000680)=0x9f) ioctl$TCGETS(r0, 0x5401, &(0x7f00000006c0)) ioctl$int_in(r1, 0x5452, &(0x7f0000000700)=0x9) ioctl$FS_IOC_FSSETXATTR(r4, 0x401c5820, &(0x7f0000000740)={0x80000001, 0x6, 0x2, 0x9, 0x3}) sigaltstack(&(0x7f0000ffc000/0x1000)=nil, 0x0) rt_sigaction(0x18, &(0x7f0000000840)={&(0x7f0000000780)="c4e38d5dc50b0fbaa70080000004c4a178ae52fe2e0ff7ee36f246ad400f381d10f30f18d06645d1495666450fe256c3660f2d31", {0x6}, 0x40000000, &(0x7f00000007c0)="c42189dd4e5ddaa2000000003664480fae0c6fc402bdacac8ddb8349f1c4e1756988826c30670f008700000000f30f59a4ed0000000066430f6207c4e17e10b7d264714e660ff7ca"}, &(0x7f0000000900)={&(0x7f0000000880)="f00fab3cabf0430fbb7cfd15c4217ee6326446dfcfc4232502fa0066450f73db00660fd485b4850000c403a92130e8401bf926470f5cf7", {}, 0x0, &(0x7f00000008c0)="f3a73e462889f9c3b0760f380750003644ffc066440f3a441500100002440f2f39660fd673270f381de5da53dbf2ec"}, 0x8, &(0x7f0000000940)) write(r0, &(0x7f0000000980)="4ea7d1e45c8dba3d3d4a16a0a20e2af8822884e58394f7b05bf0c2347094f80213af3202537fd00d3e6190d3e86db928390e051592320eca9dba7bce6c318ff0a8418d2075c36f6b40ece54d5fa7abb6b2e24587e761435c9c39156f7a5eb134714ba3149d504cddd071efdc7703b8b534887c589c28495906c93ac2a2be52839db448e500586d64ae691beab97b8ecd3c47aa40f5aa790abf6c6425929aa01e3d3049de42cfd75ec047577ad88be03c5d2b0449504c1c17447d28a946a4a850122ced209878203814f0f5a6e58a5d8e96225a3b6034c710d2b324fa74b52036f047ecc6ad18ecd3092bc53b525604a646d71e776923a1e7b2", 0xf9) ioctl$KDGKBENT(r0, 0x4b46, &(0x7f0000000a80)={0x3ffc00000000, 0x2, 0x5}) set_thread_area(&(0x7f0000000ac0)={0x1ff, 0xffffffffffffffff, 0x4000, 0x7ff, 0x5, 0x1, 0x0, 0x8000, 0x74, 0x1}) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000b00)={0x80000001, {{0x2, 0x4e22, @broadcast}}}, 0x88) ioctl$int_out(r1, 0x5460, &(0x7f0000000bc0)) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000e00)={&(0x7f0000000c00)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x58, 0x70, 0xfffffffffffff001, {"2b9871f021af1fb813658ed3177bc744276106eb12d1ab8c91d295380157d7cf0d1cd1b9579eb2b44d560acf8e3ffa0ae83cd3966b5ec15b3151adefc08e8fd4e1a5653cc37c05792934604842778a1e36e6550c17"}}, {0x0, "546ffbd6ed7f3b2350cd36b009d8aab0a2382c4499ee8793350dd689649c7e6ea4c3cf3f672fee6f1689080de13e6bfa925b027e940f48085cb17849b32836a6d7efa0eb529c3a46c849da6fe05443a43898578d53a22d162404c98bac3e7bb35f5d7e509cfbb850b04f37a67171339c3fb8f2ef64977fbfa38623cf0bc8f9ac883fd86eb5e000e182cc959741e5a2"}}, &(0x7f0000000d40)=""/152, 0x101, 0x98}, 0x20) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000e40)='/selinux/enforce\x00', 0x88002, 0x0) [ 466.279468] binder: 15001:15009 ioctl c0306201 200001c0 returned -22 18:01:34 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x25) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:34 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0xfffffffffffffdcf, 0xee6b, 0x75ce, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x2, 0x81}, 0x0, 0x100000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) futex(0x0, 0x81, 0x0, 0x0, 0x0, 0x0) 18:01:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="4663054001100000"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:34 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f00000002c0)) [ 466.391744] binder: 15040:15044 unknown command 1074094918 [ 466.398181] binder: 15040:15044 ioctl c0306201 200001c0 returned -22 [ 466.425793] binder: BINDER_SET_CONTEXT_MGR already set [ 466.433582] binder: 15040:15044 ioctl 40046207 0 returned -16 18:01:34 executing program 5: r0 = add_key$keyring(&(0x7f0000000540)='keyring\x00', &(0x7f0000000580)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$restrict_keyring(0x1d, r0, &(0x7f00000005c0)='id_resolver\x00', &(0x7f0000000600)='vmnet1\x00') socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='io.stat\x00', 0x0, 0x0) readv(r3, &(0x7f00000004c0)=[{&(0x7f00000000c0)=""/3, 0x3}, {&(0x7f0000000140)=""/230, 0xe6}, {&(0x7f0000000240)=""/104, 0x68}, {&(0x7f00000002c0)=""/234, 0xea}, {&(0x7f00000003c0)=""/73, 0x49}, {&(0x7f0000000440)=""/86, 0x56}], 0x6) fcntl$addseals(r1, 0x409, 0xc) r4 = socket$inet6(0xa, 0x2, 0x0) close(r4) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x2, 0x0) r5 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) ftruncate(r5, 0x200004) sendfile(r4, r5, 0x0, 0x8000fffffffe) 18:01:34 executing program 0: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$sock_void(r0, 0x1, 0x1b, 0x0, 0x0) sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1200}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x80) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000000c0)=0x1, 0x4) fcntl$getownex(r0, 0x10, &(0x7f00000001c0)={0x0, 0x0}) perf_event_open(&(0x7f0000000140)={0x3, 0x70, 0x8000, 0x4, 0x80000001, 0x2, 0x0, 0xfffffffffffffffa, 0xc0000, 0xa, 0x3ff, 0x3, 0x1f, 0x1, 0x0, 0xa3f4, 0x5, 0x0, 0x5, 0x6, 0x6, 0x1000, 0x81, 0x2, 0x90, 0x6, 0x2, 0xffffffff, 0xfffffffffffff801, 0x7, 0x1000, 0x20, 0x40, 0x6, 0x1, 0xffffffffffffffff, 0xffffffffffff4daa, 0x400, 0x0, 0x20, 0x0, @perf_bp={&(0x7f0000000100), 0x1}, 0x8, 0x2, 0x7fff, 0x6, 0x1, 0x401, 0x2}, r1, 0xa, 0xffffffffffffffff, 0x3) fchmod(r0, 0x10) ioctl$RTC_PLL_GET(r0, 0x80207011, &(0x7f0000000200)) r2 = fcntl$dupfd(r0, 0x0, r0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}, &(0x7f0000000280)=0x10) fcntl$setownex(r2, 0xf, &(0x7f00000002c0)={0x2, r1}) syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x10001, 0x2000) r3 = socket$inet6(0xa, 0x3, 0x7) getsockopt$inet_mreqn(r2, 0x0, 0x0, &(0x7f0000000340)={@loopback, @loopback, 0x0}, &(0x7f0000000380)=0xc) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f00000003c0)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, r4}, 0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000400)={r4, 0x1, 0x6, @dev={[], 0x23}}, 0x10) write$binfmt_aout(r0, &(0x7f0000000440)={{0xcc, 0x800, 0x7fff, 0x1fc, 0x36, 0x901e, 0x216, 0x800}, "ca9a6f941a07dd9b139c841b081f738c91d1c33264c7973fe2b5ee9b725a6c6d69cacdbaa2aac9d50aa3d72e0889e5d0c90492512142f2f8d7ff3e3badf4adb49fc66a91cea46fb02833a53a05a1e4969687daaa8d264bb098def3ae83ba03966f6776c3dfdad60ac3efcec3686abd5c238eb0441e27faf802131388e55553f4c9588a29df1742930f779d791310dac1160c45c8e80a1a9a04cded3dcbd99de3713a99ce5d6777c7d6fb70843a0ac48b7c6d94ac15b2003020afd2f40ddbe17f824484d7dfb6490ab4a5c59b7d84e4cc11d8efdae30cc85ad48d0ef586e617be3236e59fa4f5a2adf7b83b3224ef47137a2faa2d5e5dc8de7148f968fbcc"}, 0x11e) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f00000005c0)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r2, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x30, r5, 0x4, 0x70bd2a, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x7}, @SEG6_ATTR_DST={0x14, 0x1, @local}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f00000006c0)={0x4, 0xffffffff, 0x2, 0x0, 0x0, [{r2, 0x0, 0x342c}, {r3, 0x0, 0x1}]}) ioctl$TCSETA(r2, 0x5406, &(0x7f0000000740)={0x6, 0x7fffffff, 0x2, 0x5, 0x1b, 0x800, 0x3, 0x9, 0x0, 0x60}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000780)={'nr0\x00', r4}) umount2(&(0x7f00000007c0)='./file0\x00', 0x1) r6 = open(&(0x7f0000000800)='./file0\x00', 0x40, 0x90) preadv(r2, &(0x7f0000000940)=[{&(0x7f0000000840)=""/122, 0x7a}, {&(0x7f00000008c0)=""/4, 0x4}, {&(0x7f0000000900)=""/18, 0x12}], 0x3, 0x0) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r2, 0x6, 0x15, &(0x7f0000000980)=0x3, 0x4) ioctl$TCSETA(r6, 0x5406, &(0x7f00000009c0)={0x40, 0x3186a569, 0x4, 0x10001, 0x18, 0x10000, 0x2a, 0x4, 0xffffffff00000000, 0x8}) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000a00)={0x7, 0x15988957}) getsockopt$IPT_SO_GET_INFO(r6, 0x0, 0x40, &(0x7f0000000a40)={'filter\x00'}, &(0x7f0000000ac0)=0x54) prctl$PR_SET_PDEATHSIG(0x1, 0x1000) 18:01:34 executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xe, 0x4, 0x4, 0x8}, 0x2c) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$inet(0xffffffffffffffff, 0x0, 0x0, 0x800) read(r1, &(0x7f0000000200)=""/250, 0x50c7e3e3) link(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='./file0\x00') syz_open_procfs(0x0, &(0x7f0000000500)='net/bnep\x00') bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x2004e23, @broadcast}, 0x10) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000040)=""/8, &(0x7f0000000080)=0x8) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x7e0}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$packet(0x11, 0x0, 0x300) clone(0x0, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4}, 0x1c) setsockopt$sock_int(r3, 0x1, 0x2b, &(0x7f0000f59ffc)=0x1, 0x6e) socket$inet6(0xa, 0x2, 0xffffffffffffffff) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000300)={0x2, 'team_slave_1\x00', 0x1}, 0x18) recvfrom(r2, &(0x7f0000000380)=""/72, 0x48, 0x3, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) openat$cgroup_procs(r2, &(0x7f0000000400)='cgroup.threads\x00', 0x2, 0x0) bind$inet6(r2, &(0x7f00000004c0)={0xa, 0x4e20, 0x0, @ipv4={[], [], @dev}, 0x4}, 0xff8f) getitimer(0x0, &(0x7f0000000480)) getpid() mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6001, 0x1) creat(&(0x7f00000007c0)='./file0\x00', 0x0) unlink(&(0x7f0000000340)='./file0\x00') sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)='ip6_vti0\x00', 0x10) shutdown(0xffffffffffffffff, 0x1) bpf$BPF_PROG_ATTACH(0x9, &(0x7f0000000040)={r0, 0xffffffffffffffff, 0x40000000000004}, 0x10) 18:01:34 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f00000002c0)) 18:01:34 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) r1 = socket$unix(0x1, 0x7, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) openat$pfkey(0xffffffffffffff9c, &(0x7f0000001500)='/proc/self/net/pfkey\x00', 0x400, 0x0) lstat(&(0x7f0000001540)='./file0\x00', &(0x7f0000001580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$unix(r1, &(0x7f00000017c0)={&(0x7f0000000000)=@abs={0x1, 0x0, 0x4e22}, 0x6e, &(0x7f0000001700), 0x0, &(0x7f0000001780)=[@cred={0x20, 0x1, 0x2, r0, r2, r3}, @cred={0x20, 0x1, 0x2, r0, r2, r4}], 0x40, 0x4000000}, 0x400080f) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x6, 0x0) [ 466.449996] binder_alloc: 15040: binder_alloc_buf, no vma [ 466.457401] binder: 15040:15051 transaction failed 29189/-3, size 24-8 line 3254 [ 466.471713] binder: 15040:15044 BC_INCREFS_DONE u0000000000000000 no match [ 466.484083] binder: 15040:15056 unknown command 1074094918 [ 466.489814] binder: 15040:15056 ioctl c0306201 200001c0 returned -22 18:01:34 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) getpeername$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000b40)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, [], r3}, 0x14) timer_create(0x7, &(0x7f0000000040)={0x0, 0x18}, &(0x7f0000000600)=0x0) timer_getoverrun(r4) socket$inet6_tcp(0xa, 0x1, 0x0) 18:01:34 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000280)=[@register_looper], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="04000018cd4aeeabfdbd00000000000000000000000000c646f2c3faac30c51d738ef068e7181a8c2543437be286f475086fb862567441a950ea347b4bc5e6dc1d72baf8c278d4d35f38ec0eb9d32844effa76ca59415addf8ffffffffffffff4ace6e3215fd619335bfcaff672ca4fcc5135933004464472489671977eab7aed9a17d5a5c2068cbe905760f4589c0a473205f9de536d891e92e1daa71becf9f5c3e29d056e62f75b04acf6ebf0b931934c07d9198cfd39fabbbecebf3f07ce24fd3b3cbcf7f343906c14f3e16f5db37323ad0450f0692e36c553bd39c5fa1813e48694b1aa221674eb70a7dd980a040c0c05499a7163ef4e236dc3c2b932a6557ecd289d4b75bcc26b4aee6cd30e1eaeec6d354adba807203b6fffedaa4d3cbfbf75c59188c2ba99672eb35f715f694e157fc372f6b978f7e400500000000000009ebe12458090ecd055012ff769befd3b2586eba2a0bd142b1cf4b63d49b87ec4b8f96a44324184e602a6f24bd86650d4407e46ec8478daf2d020e8dc8cc8ccf259746bc6df806e36f0ca6e1703f85026fd4bc1e935a75b7df1d3dfbb7778d31b7aa01a5f3f64e277d51a4f51e498596c038f78555b4458cd951d3e1311f003dabaa1fec71c4f8d6142fe20dec428223e9198effd6d64ee327a18c738974eeccfd6bda69949100f7603ee5bfb892b4cb2437a0b660a4fd0cdae29f87153439766c2a31bc2d4db7461a265cc8be1c4421ebece8017edf23f275d00600c94bbf2f3cb86261562e5c97ba896387d6d46fb29d0b97da771a2348b7f80dcb2b89cdcf6b75d76b26"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:34 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = dup(0xffffffffffffffff) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0)) [ 466.498344] binder: send failed reply for transaction 905 to 15040:15044 [ 466.509461] binder: undelivered TRANSACTION_ERROR: 29189 18:01:34 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x111802, 0x158) epoll_wait(r1, &(0x7f0000000040)=[{}, {}, {}, {}], 0x4, 0x7) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 466.553595] binder: 15070:15074 ERROR: BC_REGISTER_LOOPER called without request [ 466.580748] binder: 15070:15074 unknown command 402653188 18:01:34 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = dup(0xffffffffffffffff) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0)) [ 466.601869] binder: 15070:15074 ioctl c0306201 200001c0 returned -22 [ 466.617973] binder: BINDER_SET_CONTEXT_MGR already set [ 466.627315] binder: 15070:15088 ioctl 40046207 0 returned -16 [ 466.639343] binder_alloc: 15070: binder_alloc_buf, no vma [ 466.645959] binder: 15070:15074 transaction failed 29189/-3, size 24-8 line 3254 18:01:34 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) getpeername$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000b40)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, [], r3}, 0x14) timer_create(0x7, &(0x7f0000000040)={0x0, 0x18}, &(0x7f0000000600)=0x0) timer_getoverrun(r4) socket$inet6_tcp(0xa, 0x1, 0x0) 18:01:34 executing program 1: openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r0 = dup(0xffffffffffffffff) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0)) [ 466.660249] binder: 15070:15088 ERROR: BC_REGISTER_LOOPER called without request [ 466.669986] binder: 15070:15088 unknown command 402653188 [ 466.677197] binder: send failed reply for transaction 910 to 15070:15074 [ 466.686136] binder: undelivered TRANSACTION_ERROR: 29189 [ 466.692229] binder: 15070:15088 ioctl c0306201 200001c0 returned -22 18:01:34 executing program 5: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2, 0x100000002132, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0xc812, r1, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x63, &(0x7f0000000000)={'icmp6\x00'}, &(0x7f0000000040)=0x1e) futex(0x0, 0x85, 0x0, 0x0, &(0x7f0000000180), 0x0) tkill(0x0, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f00000000c0)) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000100)) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000140)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0), &(0x7f0000000200)=0xc) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000002c0), &(0x7f0000000300)=0xc) r2 = getpgrp(0xffffffffffffffff) r3 = getpgrp(r2) ptrace$cont(0x2, r3, 0x0, 0x80000) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000080)) fstat(r0, &(0x7f0000000340)) mknod$loop(0x0, 0x0, 0xffffffffffffffff) syz_execute_func(&(0x7f0000000240)="672667f3470f5b2fc401fc510c68442548a9c2d7470f8c00008020410f29870c000000c4227d59597bc423216c8bffefffff700fd4770ac4427d18db2e2e66450f3a429700000000be") 18:01:34 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'ah\x00'}, &(0x7f0000000080)=0x1e) [ 466.773110] binder_alloc: 15103: binder_alloc_buf, no vma [ 466.776030] audit: type=1400 audit(1553623294.483:45): avc: denied { map } for pid=15105 comm="syz-executor.5" path="socket:[37133]" dev="sockfs" ino=37133 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 466.778928] binder: BINDER_SET_CONTEXT_MGR already set [ 466.810433] binder: 15103:15106 transaction failed 29189/-3, size 24-8 line 3254 [ 466.816097] binder: 15103:15104 ioctl 40046207 0 returned -16 [ 466.824509] audit: type=1400 audit(1553623294.533:46): avc: denied { getopt } for pid=15105 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 466.828914] binder: 15103:15108 Release 1 refcount change on invalid ref 1 ret -22 [ 466.860605] binder: 15103:15106 BC_INCREFS_DONE u0000000000000000 no match [ 466.868976] binder: send failed reply for transaction 915 to 15103:15104 [ 466.881081] binder: undelivered TRANSACTION_ERROR: 29189 18:01:35 executing program 3: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0) futex(&(0x7f0000000080), 0x8c, 0x1, 0x0, &(0x7f0000000140), 0x0) mmap$perf(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x9, 0x100030, r0, 0x200000000000000) 18:01:35 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) getpeername$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000b40)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, [], r3}, 0x14) timer_create(0x7, &(0x7f0000000040)={0x0, 0x18}, &(0x7f0000000600)=0x0) timer_getoverrun(r4) socket$inet6_tcp(0xa, 0x1, 0x0) 18:01:35 executing program 5: r0 = perf_event_open(&(0x7f0000000080)={0x2, 0x70, 0x34d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x4, 0x0) ioctl$EVIOCGMASK(r1, 0x80104592, &(0x7f00000001c0)={0x17, 0xb0, &(0x7f0000000100)="7b30bb1a170b0fd877913f1fd4da186e62298d093ca2f873c2ee3045aa703a64c2c8957c375a9a46896027c562197ded58ecd189faa4a4a8c96ad14f18abc1741c0aa1d42445750b2f4db9f486fdf0a5ad100a2d56e06026a8850a33cca047a84f3a9304f4411ec863e007c2a05e802b45dfbfc5dadba852d219bff9e833817e889dc86022b5a9ab7f6e4eb10c5a33f3f37b75a4ee7c8480e21be1d54b5e40bd1a4115477fd4cfccb584ffbf7abec52c"}) ioctl$RTC_AIE_OFF(r1, 0x7002) write$P9_RAUTH(r1, &(0x7f0000000040)={0x14, 0x67, 0x1, {0xfc, 0x1, 0x1}}, 0x14) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000380)='cH\x05\xe8Kp\xedM\xe8\xf9E\x888\xdd\xea61\x7f>\xfb\x9b$[\xb4\xa1Cj\xffB\x89\xe1\x19n\x1b{\x8c\x96\xc6\x99*\x8bV\xa67\x1c\x99\x8d\xaf\xde\xaeJH\xb4b\xfd\xd6\xec\x93p\xee5PgH\xa1\xb6P\xfdo`\xb3\x1b\x9e^\x95X\xcb\xf4\xbc\xa1\xc8\x13\xba\x06q\xf3\xca\xdc\x19,0\xf90\x1fx\xfa\xcf\xf6\xf6\x9d\xea\v\x06\xe2s\xa6\xca+\xf4P\x8b\xc3o\x94\xa3\xb2\x03\xddG]\xffk\xac\x8f\xf8\x9d\x1f@\x86R\xc4\xc6\xd2\x8b\a.\tD\xafE\xc2\x8b\xdf\x99Q\x8b?\xce\xbd\xae\xd03UOVv\xd0C)q+s&\xf249X$\x01l\xf8\x95K\xcf\x00L0v\xc2\xf1c\x9e\xe6B\x8bV\xbc\xa2\x0f\xd0\xbd8\xeb\xa8\xb9\x12O\xf5q\x91\xd6`A\xb0\x9e\xfb\xabW\xd4G{U\x06.\x9b\x8eW,\xf6\xb8\xc2\x0e\xe6uQ\x82\xb7\xd4\x00dfa\x89\xf0\xecMq\x9fFQ\x96)\x03\xacd\x15\xa3%!\xeaL\xf0\xcf\xdc\xe8x\x06\x8b\xaa^O\v\x87\xb6\xc6Q\x8b\xc9p\x8e{\x91.\xbd\xafUT\xa0') ioctl$UI_DEV_CREATE(r1, 0x5501) fallocate(r0, 0x1603bf1c6d3d88fa, 0x7fffffff, 0x0) 18:01:35 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) tkill(r0, 0x3e) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x1, 0x0) prlimit64(r0, 0xd, &(0x7f0000000000)={0xaf4, 0x890}, 0x0) 18:01:35 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0663044801000000"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:35 executing program 3: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x40000001, @multicast1}, 0x10) syz_emit_ethernet(0x423, &(0x7f0000000cc0)={@link_local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x415, 0x0, 0x0, 0x0, 0x200000000000011, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x1, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}, "b441d632cdbbcb211363807aec73d3883762a61dc02d349bfa3ac974b987aa7fb97eb324d594fbbb77bab759418aa8d451d921e8f5d2cf2b08292111701192e97cac366dd3eb2e0fb039e58314ef4709c5f3556db6a1ab6b4fb2bdd83cdc26e8395ec4984ec3faf71a611d1569545d654cded93be827a85188b803c19c1b56aab522862a718b81e512b49690994d3425e33bd93f0e744c66a083c1f9f1bd7bb8f9e123c08f3f041ed3fdc058136cf0071a47cc0e38720a12e11e842a7b5b26dff07f578fdb9a7b14662a625c1ee76c41ccb2b1fc6376aa718e1067b9e4af511ef5b360dbfad326108bb033db193dab27974eb8c462739eaee51d87f31c516e7e391073770da3202e02c41a7277c847df24bd5b0a7ab6e252f3c8ebf00688cc55311d887e8bfd95a7f4c6a126af3fe26714ddb869c66d18f870631bbd497e8a06881b754ecdcdd0dcffc51cd52a6b560f8d64b63a1674745edc5f53b18a8ffcc5c2fbc4d2bbcc2faf3c189d9b36c0655d1394f5c127ec86b8a764a87b546c2b6ac37d0a8ec3edd7cda6f930570763dbdc0640d219749bd57c7c89eaadfdae41d654a46b17be069a32a7d94d29b612fbe61b8bd11a2d10ba5d4ac7014fc0465c3f144598bd1f913343e7293711040eee0ae8df1e49f04ed1037d4b742aed0e932116060aaf6b985238d2e10fb5b11d19d7801befed4833287d96a85a7cdd9e211a672760335655576fc0fa0336621c2b2b1018ef71bb5077c67ee5fa8d479d6776013363e98b1f1213712be7e47549b6035459008c509f0f983130a451531381ee3c1ab9e1cbb8e558b56ca1a70939389addc5f9632b37ff3f634abb504bb0be0a51649683f6e29588c15cda40255e173328681884ffef6729e9058c5623e1401fdcc7b8cb5623a8fd725fbeea05fc417c44e46500619218dff7c70aa068994c58883cada505a2aa85b6620dfe9c45b707c9aa1222b86972eae564b28a05ddfa3545df231fde2707d4bf67dc6ba41daba91dee8081e5c7e2bcfbebebd42d5ab8a32d6e098fd57233e3b813dc0d772134775def451823b7fef2bc93da01722cd613b9a3db7e2d4c51fb7b56006ee9cea53b62343599a56167388d45247f9289fb1cab67a7cb0c3665ddf1e1411875b4de3428b32fc6603691a023d8e4cb93c667acb7b535fb5f77af9a49640cbe8ffe3a193cf4df1b556a67cb753c60bdf978b871aa513c07074c6602037ebc32199290e3c7ac6f103ad9358951ad4de0c8f1b34951b0e6a48295975cf08b2c3c95064855fc95317e386f1c18608d1d08699003c998b93332cd316f17a5139d350cbfa9dabc3f77c4197a0186e50913978e980a7a028e7ccdeee718af028200e94a6b3a0ec93ba14b0c64dfaf3967e230d8cf876f26287d436ebc9588b52b43f2380836bfe3"}}}}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="2000000005000000000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="2152bdfd4e9f2f84c300ff894671be4774494f655b17f7dbcfb82d82dd60942473f5f5725c6fda4e2702ccd97335b266005dcb658739cd01c62f7ae78e0362de35d77cb0a6b230d4964ec53d62a8d03d8359626cacc389a1e6feca0edc01a2618b3867d863ea2794f2c822ef8ad75dc88e56ae6208a110dc15eecf1e25a7414c3e6a580e9e0ea70f646895e166608cf23fa5c392c91b00099929d71f34b7c1ac3aebd6ffb871cc6fda1c5b25bf38e2d3afece492bce01e2de98e7232bda83277d65b26f34da8e80aa3b162fba362f5817a2c7c748a7936e80b1ebfd24f85b30b7422a3380439f49223bc31d4586723c7357e27c2"], 0x20}}, 0x0) syz_emit_ethernet(0x0, &(0x7f0000000280)=ANY=[], 0x0) [ 467.366394] binder: 15117:15120 unknown command 1208247046 [ 467.373568] binder: 15117:15120 ioctl c0306201 200001c0 returned -22 [ 467.383491] binder: BINDER_SET_CONTEXT_MGR already set [ 467.391910] binder: 15117:15120 ioctl 40046207 0 returned -16 [ 467.398443] binder_alloc: 15117: binder_alloc_buf, no vma 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) getpeername$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000b40)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, [], r3}, 0x14) timer_create(0x7, &(0x7f0000000040)={0x0, 0x18}, &(0x7f0000000600)=0x0) timer_getoverrun(r4) socket$inet6_tcp(0xa, 0x1, 0x0) [ 467.409978] binder: 15117:15128 transaction failed 29189/-3, size 24-8 line 3254 [ 467.418174] selinux_nlmsg_perm: 967 callbacks suppressed [ 467.418184] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pig=15131 comm=syz-executor.3 [ 467.436335] binder: 15117:15134 unknown command 1208247046 [ 467.437091] binder: 15117:15133 BC_INCREFS_DONE u0000000000000000 no match [ 467.453011] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pig=15137 comm=syz-executor.3 18:01:35 executing program 1: r0 = socket$packet(0x11, 0x0, 0x300) r1 = dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:35 executing program 3: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x0) write$P9_RREAD(r1, &(0x7f0000000200)=ANY=[], 0x5aa78d33) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_genetlink_get_family_id$tipc2(0x0) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, 0x0, 0x0) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000180)={&(0x7f0000000040)={0x3c, r2, 0x0, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6e}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1299}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x10001}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x81}, 0x84) fallocate(r1, 0x1000000, 0x0, 0x10fffe) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000100)={0x0, r1}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c) 18:01:35 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0xfffffe93, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) wait4(r0, &(0x7f0000000040), 0x20000008, &(0x7f0000000140)) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xe, r0, 0x0, &(0x7f0000000000)="a27d74bcf6803018996d28dfeff567da6a8a6d3b1069fb08bf818501e320627d27386796d010545c4de86ed6") ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:35 executing program 1: r0 = socket$packet(0x11, 0x0, 0x300) r1 = dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:35 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) r1 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000000)) [ 467.453470] binder: 15117:15134 ioctl c0306201 200001c0 returned -22 [ 467.481779] binder: send failed reply for transaction 920 to 15117:15120 [ 467.495024] binder: undelivered TRANSACTION_ERROR: 29189 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) getpeername$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000b40)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, [], r3}, 0x14) timer_create(0x7, &(0x7f0000000040)={0x0, 0x18}, &(0x7f0000000600)=0x0) timer_getoverrun(r4) 18:01:35 executing program 1: r0 = socket$packet(0x11, 0x0, 0x300) r1 = dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:35 executing program 5: r0 = open(&(0x7f00000003c0)='./file0\x00', 0x141042, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE(r1, 0x40084504, &(0x7f0000000000)=[0x0, 0xffffffff80000001]) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x2e7) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000000)={0x3, 0xc, "fba36f89b23e1405aa72088b"}) pwritev(r0, &(0x7f0000000040)=[{&(0x7f0000000100)="d863a13b22fd7821b1cdb671d02b0927d4296efe3bf3bb5e8ed8f786b3fea8e43962a2ff3e7056245ccdd299817c7a9beccb2e59106ff9dc16783581eefccebb4ebca9f367f8995be0f57f36b57c5c92b8fb088197cdde37f4df80aeca94444429e0d4e098b1873228a4a111236571385ec824193423295ef5a729e7dfec6e35e7a1b802f41ddea89127d55ef0f2823dd79fead1622c500259da8d6a17ac9b9c7400f150dca1b4e22277804c840f5d320bfadd13", 0xb4}], 0x1, 0x0) r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0x0, 0x0, [{r2}]}) 18:01:35 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="00000000000000007470ace034dba1c1b0726656b25233a646104ef5950d75613f8f7572ca76b5944888e9b6a00839361b8227de2374fddfa3e9b6603696d7cff8bc5592ef96ec4a6617aec462877c860877a34032f6c62cb2f36e2888708956e26ad0ab2bb5b305a5847667adfeb5ad97fe6e0fdd7e8c930b5e4b6ebc21c0ad90363d0a1360b6a0c7ccd13d704577a325e7f09fc09742389eec6658f584c1ef63ec43f345abd1fded0d0ce8434b45f530eb6844e3fad98a6fb077b06ba55d117fa2d06af900229fc3634dccd4a355a462e71b39a0dd29"], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) getpeername$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000b40)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, [], r3}, 0x14) timer_create(0x7, &(0x7f0000000040)={0x0, 0x18}, &(0x7f0000000600)) 18:01:35 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = dup(0xffffffffffffffff) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0)) 18:01:35 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='memory.current\x00', 0x0, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={@local, @loopback, 0x0}, &(0x7f0000000080)=0xc) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000140)={r2, 0x1, 0x6, @link_local}, 0x10) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) getpeername$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000a40)={{{@in6=@loopback, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f0000000b40)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe, [], r3}, 0x14) [ 467.799444] binder: BINDER_SET_CONTEXT_MGR already set [ 467.820625] binder: 15174:15181 ioctl 40046207 0 returned -16 [ 467.820653] binder_alloc: 15174: binder_alloc_buf, no vma [ 467.850549] binder: 15174:15190 transaction failed 29189/-3, size 24-8 line 3254 [ 467.851127] binder: 15174:15181 Release 1 refcount change on invalid ref 1 ret -22 18:01:35 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = dup(0xffffffffffffffff) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0)) 18:01:35 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = open(&(0x7f00000003c0)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r1, &(0x7f0000000480)=ANY=[], 0x2e7) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000000040), 0xa198) ptrace$setopts(0x4206, r0, 0x0, 0x0) gettid() tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) getpeername$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000007c0)=0x14) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) 18:01:35 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0681240881ae76959b118d18fc35f9f3ae63044001000000"], 0x0, 0x0, 0x0}) fcntl$setflags(r1, 0x2, 0x0) [ 467.858326] binder: 15174:15177 BC_INCREFS_DONE u0000000000000000 no match [ 467.883113] binder: send failed reply for transaction 925 to 15174:15177 [ 467.894650] binder: undelivered TRANSACTION_ERROR: 29189 18:01:35 executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = dup3(r1, r0, 0x0) chdir(&(0x7f0000000080)='./file0\x00') r3 = syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, 0x0) accept$packet(r3, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'caif0\x00', r4}) unshare(0x0) r5 = getpid() sched_setscheduler(r5, 0x5, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = inotify_init() write$P9_RREAD(0xffffffffffffffff, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, 0x0, 0xfe) r7 = open(&(0x7f0000000100)='./file0\x00', 0x141042, 0x0) socket$inet6(0xa, 0x0, 0x0) dup2(r7, r6) sendmsg(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000002000)}, 0x0) sendto(r2, &(0x7f0000000040)="12d5df96501a7e053d328c5100e14164b6c30ac9909e2991f28aefb63d3caeb004b1", 0x22, 0x4008884, &(0x7f0000000200)=@nfc={0x27, 0x1, 0x1, 0xd90769cd35bfdef9}, 0x80) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x4) sendmmsg(0xffffffffffffffff, 0x0, 0xfd8b, 0x0) 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') r1 = openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000540)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000280)={0x25c, r2, 0x100, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x74, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x1, @ipv4={[], [], @broadcast}, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x7ff, @local, 0x3}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x910}]}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffffff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}]}, @TIPC_NLA_BEARER={0x94, 0x1, [@TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffe01}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6gretap0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_DOMAIN={0x8}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_NET={0x4c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x92}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA={0x90, 0x5, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x13}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffc}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}]}]}]}, 0x25c}, 0x1, 0x0, 0x0, 0x8000}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) [ 467.962322] binder: 15203:15206 unknown command 136610054 [ 467.972272] binder: 15203:15206 ioctl c0306201 200001c0 returned -22 [ 467.982724] binder: BINDER_SET_CONTEXT_MGR already set [ 467.995743] binder_alloc: 15203: binder_alloc_buf, no vma [ 468.002207] binder: 15203:15206 ioctl 40046207 0 returned -16 18:01:35 executing program 5: r0 = socket$netlink(0x10, 0x3, 0x4) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000080)={0xfffffffffffffff8}) r2 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x10000, 0x0) setsockopt$inet6_tcp_buf(r2, 0x6, 0x21, &(0x7f00000002c0)="6b2938c94a8ad1e7ae090c26ffc63642282c927582dbc408e1cc05c09f831d4436c0c8920b3f02b236a683ca746f712c8c4e889fbf63209a98b65cc08e0334e9016d21b05618a76bbc9607b38c05b12282861d91da00d0ae6f8b12ebbea6e68151616212b17793bfcd6382bc5a8a34edff2060c5033feea71a132ee09f5c3a6580b70d8288f66e53127483de64ec7a52953c74f3aa469617ab08c79a5c931c96b160a7c606a8d637afedffa8320377efcbf7da020430ad410b9045712d3d34516191287611e752ce2783496be9179b8be139c741ccdd60c6a4306ddb6c5af1ca404ae96f18b9a81776008a", 0xeb) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYRESOCT=r0, @ANYRES32=0x0, @ANYBLOB="00008000000000000c0001d300aaaaaaaaaa00000008001b00000000b3c27e9824ada30a9545b747cc32b4b62cfe8468a85d2ff7b4e2386d80538fe8e8d2a93eb2e8ca32f49dc0acb2f789b7ad6af871d328aa274e9b553af20d434e960e4a3d0c28e97fef3a770ff2f5e7c45b9f02cbd824ccae83851f6c29dd867644c6d20a0fd58ae863a0ff1d15e53212dcb6794c62b4f6167cfea22a0fbf91caaf84da2a33b5d6fc0c9d23ee64551d45eec22b86c5cfcf4dd31b710e87041d7670bfa1bced6c2ece85df41e8af688314c14c7e8eada99f0e75cd6cb51f143233d0188a8f5138ee135d6754b175c6ead500893bce8e1e8f76c12cd65b15d12627f5569a28b2467106ab64408395ed6790"], 0x3}}, 0x0) 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) 18:01:35 executing program 1: socket$packet(0x11, 0x3, 0x300) r0 = dup(0xffffffffffffffff) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r0, 0x541b, &(0x7f00000002c0)) [ 468.009738] binder: 15203:15212 transaction failed 29189/-3, size 24-8 line 3254 [ 468.030790] binder: 15203:15219 unknown command 136610054 [ 468.037005] binder: 15203:15218 BC_INCREFS_DONE u0000000000000000 no match [ 468.038458] binder: 15203:15219 ioctl c0306201 200001c0 returned -22 18:01:35 executing program 4: clone(0x4008000, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() r1 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000140)="edc6bb4aaf8be38064c3df404c6bf86a", 0x10) select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x2070) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ptrace$setopts(0x4200, r0, 0x2, 0x40) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 468.058201] binder: send failed reply for transaction 930 to 15203:15206 18:01:35 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000080)=ANY=[@ANYBLOB="05020a000000076200724aea0666e6fb79aa60486e398dfa854fe438fa68e1121954a331514a85770cf036aa8916056c0dbfc5ecbbf9afdb55361a7263894b41ebf0b8b12eaf0ee2907fd6a4edbd6d42cbfb9d6656dd891fecf2d9383ac1eee80cb954acefee4922e16663c128bba828a446edf67d2bc6b82bd6b5e0"], 0x7c, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:35 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) [ 468.085178] binder: undelivered TRANSACTION_ERROR: 29189 [ 468.123418] binder: BINDER_SET_CONTEXT_MGR already set [ 468.129127] binder: 15232:15233 ioctl 40046207 0 returned -16 18:01:35 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) [ 468.145765] binder_alloc: 15232: binder_alloc_buf, no vma [ 468.156051] binder: 15232:15234 transaction failed 29189/-3, size 24-8 line 3254 [ 468.165772] binder: 15232:15234 BC_INCREFS_DONE u0000000000000000 no match [ 468.173703] binder: 15232:15233 Release 1 refcount change on invalid ref 1 ret -22 18:01:35 executing program 0: syz_open_procfs(0xffffffffffffffff, &(0x7f00000005c0)='net/ip6_tables_targets\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) 18:01:35 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x1, 0x0, &(0x7f0000000000)='='}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:35 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) ptrace$cont(0x18, r0, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f0000000040)=0x8) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 468.192053] binder: send failed reply for transaction 935 to 15232:15233 [ 468.199150] binder: undelivered TRANSACTION_ERROR: 29189 18:01:35 executing program 3: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000013c0)={{{@in6=@remote, @in6=@ipv4, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0xffffffffffffffff, 0x32}, 0x0, @in6, 0x0, 0x0, 0xfffffffffffffffc, 0x5, 0x0, 0x5}}, 0xe8) connect$inet6(r1, &(0x7f0000000140)={0xa, 0xffffffffffffffff, 0x0, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x18}}}, 0x1c) sendmmsg(r1, &(0x7f0000000240), 0x0, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000000)=0xffff) r2 = fcntl$getown(r0, 0x9) sched_getparam(r2, &(0x7f0000000040)) 18:01:35 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) [ 468.260747] binder: BINDER_SET_CONTEXT_MGR already set [ 468.269681] binder_alloc: 15245: binder_alloc_buf, no vma [ 468.276576] binder: 15245:15247 ioctl 40046207 0 returned -16 [ 468.287120] binder: 15245:15251 transaction failed 29189/-3, size 24-8 line 3254 18:01:36 executing program 5: ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = creat(&(0x7f0000000840)='./file0\x00', 0x1) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000880)=0x1000) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) sendto(r0, &(0x7f0000000340)="120000001200e7ef007b00005380a79a9e58d2f57901", 0x16, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000007c0)=[{{&(0x7f0000000080)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000000000)=[{&(0x7f0000000100)=""/167, 0xa7}], 0x1}, 0x2}, {{&(0x7f00000001c0)=@generic, 0x80, &(0x7f0000000680)=[{&(0x7f0000000240)=""/110, 0x6e}, {&(0x7f0000000380)=""/245, 0xf5}, {&(0x7f00000002c0)=""/45, 0x2d}, {&(0x7f0000000480)=""/236, 0xec}, {&(0x7f0000000580)=""/238, 0xee}, {&(0x7f0000000300)=""/12, 0xc}], 0x6, &(0x7f0000000700)=""/139, 0x8b}, 0x23a}], 0x2, 0x0, &(0x7f0000003700)={0x77359400}) fsetxattr$trusted_overlay_nlink(0xffffffffffffffff, 0x0, &(0x7f0000000040)={'L-', 0xffff}, 0x28, 0x0) 18:01:36 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) 18:01:36 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f0000000080)='em0em1##\x00') ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) accept4$packet(0xffffffffffffff9c, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000240)=0x14, 0x800) bpf$PROG_LOAD(0x5, &(0x7f0000b7a000)={0x3, 0x4, &(0x7f0000346fc8)=ANY=[@ANYBLOB="1800040000000000000000000000000061105000000000009d00080000000000"], &(0x7f00000003c0)='GPL\x00', 0x1, 0xfb, &(0x7f0000000100)=""/251, 0x0, 0x1, [], r2}, 0x48) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) [ 468.323214] binder: 15245:15262 Release 1 refcount change on invalid ref 1 ret -22 [ 468.328414] binder: 15245:15261 BC_INCREFS_DONE u0000000000000000 no match [ 468.332653] binder: send failed reply for transaction 940 to 15245:15247 18:01:36 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) 18:01:36 executing program 4: clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() select(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000140)=0x4) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x28) sendmsg$nl_route(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@ipmr_getroute={0x1c, 0x1a, 0x0, 0x70bd2d, 0x25dfdbfd, {0x80, 0x20, 0x10, 0x40, 0xfd, 0x6, 0xff, 0x3, 0x1000}, ["", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x40000) ptrace$cont(0x14, r0, 0x7f, 0x28000) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x500, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f0000000040)={'team0\x00', @broadcast}) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x118}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x1f, r0, 0x0, 0x0) [ 468.368040] binder: undelivered TRANSACTION_ERROR: 29189 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) 18:01:36 executing program 3: clock_gettime(0x0, &(0x7f0000000000)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) utimes(0x0, &(0x7f00000000c0)={{r0, r1/1000+30000}, {0x77359400}}) 18:01:36 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$FIONREAD(r1, 0x541b, &(0x7f00000002c0)) [ 468.408509] binder: 15277:15279 ioctl c0306201 0 returned -14 [ 468.425346] binder: 15277:15279 ioctl c0306201 0 returned -14 [ 468.446734] binder: BINDER_SET_CONTEXT_MGR already set 18:01:36 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind(r0, &(0x7f0000000000)=@caif=@rfm={0x25, 0x20, "08746072762f7eb94c0d0282089dab92"}, 0x80) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000d40)={0x1, &(0x7f0000000cc0)=[{0x64, 0x0, 0x0, 0x8000}]}, 0x10) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) [ 468.461651] binder: 15277:15284 ioctl 40046207 0 returned -16 [ 468.471515] binder_alloc: 15277: binder_alloc_buf, no vma [ 468.475917] binder: 15277:15296 BC_INCREFS_DONE u0000000000000000 no match [ 468.477107] binder: 15277:15279 transaction failed 29189/-3, size 24-8 line 3254 [ 468.501242] binder: 15277:15279 Release 1 refcount change on invalid ref 1 ret -22 [ 468.512185] binder: send failed reply for transaction 945 to 15277:15279 [ 468.519535] binder: undelivered TRANSACTION_ERROR: 29189 18:01:36 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7c, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/snmp6\x00') preadv(r0, &(0x7f0000000480), 0x10000000000001f5, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) 18:01:36 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f00000002c0)) 18:01:36 executing program 3: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000)='/dev/uhid\x00', 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000001080)={0x0, 'syz1\x00', 'syz1\x00', 'syz0\x00', &(0x7f00000000c0)=""/11, 0xb}, 0x120) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x400, 0x0) ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000100)={0x4, 0x8, 0x1, r2}) 18:01:36 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TIOCGWINSZ(r0, 0x5413, &(0x7f0000000080)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x400, 0x0) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) 18:01:36 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000040)={@dev, @loopback, 0x0}, &(0x7f00000000c0)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000100)={'team0\x00', r3}) connect$inet6(r1, &(0x7f0000000080), 0x1c) setsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="000066775d2e8f881b000000000000"], 0x8) r4 = dup2(r1, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x20002102001fff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_opts(r4, 0x29, 0x37, 0x0, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x14) [ 468.624602] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.628962] binder: BINDER_SET_CONTEXT_MGR already set [ 468.637433] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.640955] binder: 15316:15320 ioctl 40046207 0 returned -16 [ 468.650099] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.650117] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.660258] binder_alloc: 15316: binder_alloc_buf, no vma [ 468.671141] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.676042] binder: 15316:15324 transaction failed 29189/-3, size 24-8 line 3254 [ 468.678241] binder: 15316:15329 Release 1 refcount change on invalid ref 1 ret -22 [ 468.695555] binder: 15316:15328 BC_INCREFS_DONE u0000000000000000 no match [ 468.712166] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 18:01:36 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f00000002c0)) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x0, 0x0, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x48) 18:01:36 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000000)={'veth0_to_bridge\x00', {0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xf}}}) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 468.720402] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.725771] binder: send failed reply for transaction 950 to 15316:15320 [ 468.739521] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.746459] binder: undelivered TRANSACTION_ERROR: 29189 [ 468.755424] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x0, 0x0, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x48) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x0, 0x0, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x48) [ 468.784308] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.796873] hid-generic 0000:0000:0000.0001: unknown main item tag 0x0 [ 468.819224] hid-generic 0000:0000:0000.0001: hidraw0: HID v0.00 Device [syz1] on syz1 [ 468.839777] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.848303] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.865073] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.873495] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.881702] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.888815] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.896625] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.904062] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.913645] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.925707] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.933415] binder_alloc: 15338: binder_alloc_buf, no vma [ 468.939415] binder: BINDER_SET_CONTEXT_MGR already set [ 468.945474] binder: 15338:15340 ioctl 40046207 0 returned -16 [ 468.951809] binder: 15338:15345 transaction failed 29189/-3, size 24-8 line 3254 [ 468.961510] hid-generic 0000:0000:0000.0002: unknown main item tag 0x0 [ 468.961526] binder: 15338:15340 BC_INCREFS_DONE u0000000000000000 no match [ 468.969701] hid-generic 0000:0000:0000.0002: hidraw0: HID v0.00 Device [syz1] on syz1 [ 468.983360] binder: 15338:15345 Release 1 refcount change on invalid ref 1 ret -22 [ 469.032112] binder: send failed reply for transaction 955 to 15338:15345 [ 469.039062] binder: undelivered TRANSACTION_ERROR: 29189 18:01:36 executing program 5: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40a400, 0x1) r1 = accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0}, &(0x7f0000000080)=0x14) bind$packet(r1, &(0x7f0000000100)={0x11, 0x17, r2, 0x1, 0xc0, 0x6, @broadcast}, 0x14) setsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f00000000c0)={@multicast1, @remote, r2}, 0xc) 18:01:36 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(0xffffffffffffffff, 0x541b, &(0x7f00000002c0)) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x48) 18:01:36 executing program 3: pipe(&(0x7f00000000c0)) r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket(0x10, 0x0, 0x0) pipe(0x0) r2 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') r4 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r4, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) ioctl$PPPIOCATTCHAN(0xffffffffffffffff, 0x40047438, 0x0) sendto$inet(r4, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x1000000004e23, @local}, 0x10) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f00000002c0)=0xda8, 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$binfmt_elf64(r4, &(0x7f0000000100)=ANY=[@ANYRES32, @ANYRES16=0x0], 0xff5a) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$selinux_attr(r2, &(0x7f0000000340)='system_u:object_r:usbmon_device_t:s0\x00', 0x25) recvfrom(r4, &(0x7f0000000640)=""/69, 0xfffffffffffffecb, 0x10000, &(0x7f00000005c0)=@pppoe={0x18, 0x0, {0x0, @local, 'bridge0\x00'}}, 0x9bac3803f786a29d) connect$netlink(0xffffffffffffffff, &(0x7f0000000440)=@unspec, 0xc) sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000240)={&(0x7f0000000140), 0xc, 0x0}, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f0000000300)={'syzkaller0\x00', {0x2, 0x702b, @dev}}) preadv(r3, 0x0, 0x0, 0x0) write(r1, &(0x7f0000000480)="220000001e00070700be5bcea13e07010af000a3baf9d825d08ced685bf41e00", 0x20) ioctl(r0, 0x1000008912, &(0x7f0000000340)="0adc1f123c123f3188b070") bind$netlink(0xffffffffffffffff, 0x0, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) clock_gettime(0x0, &(0x7f00000001c0)={0x0, 0x0}) setitimer(0x1, &(0x7f0000000200)={{}, {r6, r7/1000+30000}}, &(0x7f0000000240)) 18:01:36 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x0, 0x40, 0x1e7, 0x101, 0x17, 0xfffffffffffffff7, 0x9, 0xa2, 0x7, 0x1}) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0xfffffffffffffdc8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) [ 469.129121] binder: BINDER_SET_CONTEXT_MGR already set [ 469.135880] binder: 15371:15374 ioctl 40046207 0 returned -16 [ 469.150313] binder_alloc: 15371: binder_alloc_buf, no vma [ 469.156804] binder: 15371:15375 transaction failed 29189/-3, size 24-8 line 3254 [ 469.170078] binder: 15371:15374 BC_INCREFS_DONE u0000000000000000 no match [ 469.178086] binder: send failed reply for transaction 960 to 15371:15374 [ 469.186710] binder: undelivered TRANSACTION_ERROR: 29189 18:01:36 executing program 4: r0 = getpid() capset(&(0x7f00000fc000)={0x20019980330}, &(0x7f0000000180)) r1 = syz_open_procfs(r0, &(0x7f0000000000)='personality\x00') openat$cgroup_int(r1, &(0x7f0000000040)='pids.max\x00', 0x2, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000080)) sched_setaffinity(r0, 0xfffffe4d, 0x0) 18:01:36 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x48) 18:01:36 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, 0x0) 18:01:36 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000580)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x3, 0x40, 0xffffffff, 0x1000, 0x3, 0x3e, 0x10001, 0x318, 0x40, 0x2ad, 0x8c52, 0xb52d, 0x38, 0x2, 0xf4, 0x2, 0xffffffff00000000}, [{0x6474e557, 0x9, 0x1, 0x8001, 0x0, 0xdf, 0x1}], "", [[], [], []]}, 0x378) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r2, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:36 executing program 5: clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) exit_group(0x0) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) exit_group(0x4000) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40, 0x0) ioctl$BLKSECTGET(r0, 0x1267, &(0x7f0000000040)) 18:01:37 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) write$UHID_CREATE(0xffffffffffffffff, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$EVIOCGBITSND(0xffffffffffffffff, 0x80404532, 0x0) bind$inet6(r1, &(0x7f00001fefe4)={0xa, 0x4e22}, 0x1c) listen(r1, 0x37) sendto$inet6(r0, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0xa, 0x4e22}, 0x1c) r2 = socket(0x0, 0x0, 0x0) getsockopt$inet_int(r2, 0x0, 0x1a, &(0x7f00000000c0), &(0x7f0000000100)=0x4) sendmsg$IPVS_CMD_DEL_DEST(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, 0x0) gettid() sched_getattr(0x0, 0x0, 0xdd, 0x0) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0xfffffffffffffe84) set_thread_area(0x0) close(r0) accept4(r1, 0x0, &(0x7f0000000000), 0x0) recvmmsg(r0, &(0x7f0000008d80)=[{{&(0x7f0000004b80)=@nl, 0xfe64, &(0x7f00000003c0)=[{&(0x7f00000002c0)=""/212}], 0x0, &(0x7f0000006140)=""/105, 0x69}}], 0x8000000000003bf, 0x2, 0x0) 18:01:37 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffffffffffe}, 0x48) 18:01:37 executing program 5: readlink(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=""/41, 0x29) clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) rt_sigaction(0x21, 0x0, 0x0, 0x1f9a8905de9ca7a1, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xbfffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x669, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f00000004c0)='\'\xc4\'\v\xec\xe4\t\xc5r\x12-\x90\xda\x9a\x94\x02\xec\xea\x10\x90\x03\xcb\xf8\x1b6\xa5t\xd6\xd3\x93\xd3\xdf\x85P\x19G7Q\v\xdcHv\x03Qa\xf3\xd4\xfc(\x83\xfb\xf8C\xf6\x8a$\xb1\x90\xeb\'~\xa0\xd8\xc8\xe8\x94#\xcd\xd5Kp\xbf\xc0\x8d7\x1b?A(\xe8^\x9c\xff\x0f\x1ck\xbc\x95\x05\xcd\x17\xf7\x15o\xd4\xdc4\x84uw\xa6w\x0f\xea`1\xec\xb4\x04\xd5\r\x8d\xde\x1f]\x15\xe5\xe8\xd00\xe5\x8d\x9c\x9ec+\x02\x1d\xffa5\x94\xab\xddNe\xfe\x8c\xc4q\xbb#f\xc1\xb9\x81W\xa4$)!\v\x9b\xa7\b\x91\xe5\xeb\x88\x1c\x0f\xb2.Tr\xe4\x99\x9e\x03\xb4\xd2\xf9KW\xce\xd1cC\xd5\xcf\x97\xa9\xeab\xda\xd6:\xa91q\xf7\xc5\xc0C\xd1\'\x89\xee\x84T:\x88x\xe2\x83\xf2r\xf4&t@\x9e\xa4qf\xdf\xf4\xb5\x01\\a\x85\xd3\xe0\xb7\n\xe7\xed\x84Q\xd7s\xcd4B\xcbQ\xa4\x9f[\x99\xdfJ%\xa8\xfc\xe3`\xc1\x0fy\x12\x181\xa5|8\xc8\xe7\x9f@\xeb:\nJA\xc9\xbc\xd4~}\xce\xe8\xfejH\x8fb\xdd\xbcJ\vk\'\xe7Q\xfd\xaaA`\xb5\xa1\xe4\xf8\x9eG\xcfb\xe8@\x04\xe1\xf8\xacU)(S\xed\xffA\xfaqt\xb6$e\n\xc7\x9b\xb0X\xb6\xd4\t\x99^^\xc2>J\x16\xd0\x8c\xecy*\xa0\a\xe9Ar\xa6\xb4n9j\xe5\xba\x8a\n\xce2\xcf_\x1b.t)\x8d09A[-\xf6\xe7\xe8\x1f\x92>\xb8\xd4>-\xacY\x9e\x88\x96\xa7\xfa\xdaoL\xa6\xec\xe8\xd5\xbfaf\xd7\xfc\x03\x91w)\xcd\x1f\xbe\xc9R\xcfz\x03\xec\br\x83\x8bM-\xf8X\xfd\"\xb4RV\x7f\xda\xd3\xd4h\x1c\xdb\xbe\xa4U\xec\xcd\'\xbc\xd22\x85{,\xe6-,6\x9d\x85\xb4fL\b\x98\xe9@\xee\xc2.\xb3\xd6w\x10\x94\xb5%D\xe8\r\xfe\x98G\x82\fx,\xa2J\x12\x03ec\xd5e-\x1f6\xe7\xb6\xd9\xcf0J\xed\xb7\x9b\xfd\xfc\x00EQ\x1f\x00D\xc95\xdeG +\x1bp\xf4\t\x94\x87\xf1ZbO\xa6\xe9\f`u\xda\xb3\x1d\xf9\x94\x80\xc1\x17\xde(_\xa7\xe7\x11\x9a\xac\x8c\xb1\xd71\xc5\xe9\xd3n\xc2\xa4\x98P\x9aF\xc2\x93\xad@\xa9h\x96\x1b]2\x88\xf3\xd8\xc798\x8c\x9f\xd4W4\xf1}\aD\xa0\xd8\xda\xf4\x1bEx(t|\xf4Y\xfaJ\xc2GS\xc9R\xb5\xda\xa8\x9b\xaa\x01\xe2~\xd8f.#\x94\xbf\x85z\xbf\xa0x62L\x1f\x91\xd2\x1e%\x88\x1f\f\xabb\x8ds\x93\x9e\xed\xd2\xdb\x02\x0e\xcf\xf5\xaf\xc8>+\x03e\xb7\xba\xb9}\xca\xfc\xe8\xed\x9b\xa2\x9ey\bMv\x8f\x8a8\xfd;\x9a5J\xee\x9a\xae\x83>$\x8a6\x05P\x8c\x05\xb8\r\xcf\xdd\x15/\xa9\xa1\xd4\x87{\xc9I4\xe3 i\xa4\xc5\xe5l\x03?\xfdM&\xc0a9}h\x8ef\x10!\xf0\x99\x80\xb72\xcc\x06\'+\xf0\xa1\a\xeeSGH\x12\x068S7s\xd3\xdaT\"\xa9jk\xed\xa2IyM\xa3&t\xfeA\xa9\"\xb4\xec\xdex\x00\x80`p\x91\x84\xbfK\xb6\x00\xa7\xa2\x06\xce\xc8X\x7f\xd1@\xf1\xcf\xdf\xae\xdb\r\xf6h\xdf\xc6+\xac\r\x9f\xc2D\xdf\xd6\xde`\xa4\xf4\xbe#\tH\x06;a(`\xdcw\x1dc_\v\x046j\xf9`\r\xc0\a\x8d\x12:l\xc7j3E\xd7\xcaX\x97\xad\x93\xea\x99\xca\xd7m\xb8\x1e1\xb6Nz\"U/\x0eP\b=\x01W\xcd\xf1x\x85\xf4&\xe7\xf9W\x06\xa4\xf8&\xbc\xf4\xd0\xd2\xd1W\xee\x9a\xdd\xdbu\x0e\x9aV\xe2\xc5\x84`Bu\x12\xa8/=\x17\xc4F\x11\xdfm-)\xd9hc\xba\xb7\x91\xd9\x11\x9a,\x19\xf4]\xa7Y@B\x1f]\x97\x9f\xc2') r2 = creat(0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x2000107c) socket$nl_generic(0x10, 0x3, 0x10) ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000000)) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@multicast2, @in6=@local}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, 0x0) exit(0x8) socket$nl_generic(0x10, 0x3, 0x10) ppoll(&(0x7f0000000200)=[{r0}, {r2, 0x498}, {r1, 0x20}], 0x3, &(0x7f0000000340), &(0x7f0000000380)={0x7}, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="0000b9000800"], 0x1}}, 0x0) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='proc\x00', 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_getscheduler(0x0) mkdir(0x0, 0x8) tkill(0x0, 0x3) nanosleep(&(0x7f00000000c0)={0x0, 0x1c9c380}, 0x0) ioctl$TCSBRK(r2, 0x5409, 0x4) timer_create(0x7, &(0x7f00000002c0), 0x0) 18:01:37 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, 0x0) 18:01:37 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b ', 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x14) [ 469.314249] binder: BINDER_SET_CONTEXT_MGR already set [ 469.324996] binder: 15384:15398 ioctl 40046207 0 returned -16 [ 469.340932] binder_alloc: 15384: binder_alloc_buf, no vma [ 469.346539] binder: 15384:15388 transaction failed 29189/-3, size 24-8 line 3254 [ 469.355352] binder: 15384:15398 BC_INCREFS_DONE u0000000000000000 no match [ 469.366286] binder: send failed reply for transaction 965 to 15384:15388 [ 469.376508] binder: undelivered TRANSACTION_ERROR: 29189 18:01:37 executing program 3: r0 = accept4$unix(0xffffffffffffff9c, &(0x7f0000000080), &(0x7f0000000000)=0x6e, 0x80800) recvmmsg(r0, &(0x7f0000008e40), 0x164, 0x40000003, 0x0) r1 = socket$inet(0x2, 0x80003, 0x3) sendto$inet(r1, 0x0, 0xfffffe4b, 0x0, &(0x7f0000000040), 0x3e7) recvmmsg(r1, &(0x7f00000004c0)=[{{&(0x7f0000000400)=@ethernet={0x0, @dev}, 0x0, &(0x7f0000001680)=[{&(0x7f0000000140)=""/217, 0x4a}, {&(0x7f00000002c0)=""/135}, {&(0x7f0000000380)=""/67}, {&(0x7f0000000500)=""/133}, {&(0x7f00000005c0)=""/4096}, {&(0x7f0000000240)=""/4}, {&(0x7f00000015c0)=""/136}], 0x0, 0x0, 0xfffffffffffffd31}}], 0x6fdaec, 0x22, 0x0) clock_gettime(0x0, &(0x7f00000055c0)={0x0, 0x0}) recvmmsg(r1, &(0x7f00000054c0)=[{{&(0x7f0000001700)=@x25={0x9, @remote}, 0x80, &(0x7f0000002ac0)=[{&(0x7f0000001780)=""/100, 0x64}, {&(0x7f0000000100)=""/40, 0x28}, {&(0x7f0000001800)=""/107, 0x6b}, {&(0x7f0000001880)=""/240, 0xf0}, {&(0x7f0000001980)=""/163, 0xa3}, {&(0x7f0000000280)=""/4, 0x4}, {&(0x7f0000001a40)=""/86, 0x56}, {&(0x7f0000001ac0)=""/4096, 0x1000}], 0x8, &(0x7f0000002b40)=""/252, 0xfc}, 0x3f}, {{0x0, 0x0, &(0x7f0000002c40)=[{&(0x7f0000000480)}], 0x1, &(0x7f0000002c80)=""/4096, 0x1000}, 0xe7}, {{&(0x7f0000003c80)=@rc, 0x80, &(0x7f00000040c0)=[{&(0x7f0000003d00)=""/250, 0xfa}, {&(0x7f0000003e00)=""/145, 0x91}, {&(0x7f0000003ec0)=""/218, 0xda}, {&(0x7f0000003fc0)=""/93, 0x5d}, {&(0x7f0000004040)=""/5, 0x5}, {&(0x7f0000004080)=""/54, 0x36}], 0x6}, 0x3}, {{&(0x7f0000004140)=@xdp, 0x80, &(0x7f0000004480)=[{&(0x7f00000041c0)=""/174, 0xae}, {&(0x7f0000004280)=""/224, 0xe0}, {&(0x7f0000004380)=""/78, 0x4e}, {&(0x7f0000004400)=""/83, 0x53}], 0x4, &(0x7f00000044c0)=""/4096, 0x1000}, 0xde}], 0x4, 0x12001, &(0x7f0000005600)={r2, r3+30000000}) 18:01:37 executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0xd, 0x3, &(0x7f0000000000)=@framed={{0x5, 0x0, 0x0, 0x0, 0x0, 0x69, 0x10, 0x88}}, &(0x7f0000000800)='GPL\x01\x80\x00\x00\xbfw-\xa0z\xe8.vY\n6\xf6I\xb2d\xc3\x17<>\xc1\xab\x91\xb3\x97\xe4*\xbf\x1e\xa6\xcd\x8c\xd7t\'\xfc\x9a\x9e+qe\xf5+A\a\xbf\bP\xd8\x99\xdcRf\x90x\x84\xdb\x1b/F <*\x05\xb7\"\xe3>Uo\xb2\xe3\xf3\x9a<\xde\x1f\xcaSd\x037\xec\x95aF\xbd\xbf\xcb\x11Pp\x19V1\xde5\bq\f\x9ec\x8c+\xdbx\xa5\x01\xcaKn\xa3\x13\xd8%h\xf98,\xfd\xa5\x90\x0e\x00U\xf2\xd3\xd1\xca\xf9RR\xec,?o\xab\xa6\xb4\xeeTy;N\xd2m\xae>R\"P\xc9\xd2*\xc0\x00\x7fwuL?#\xce\xda\x98\t\xb9\xa9hJ\x94\n\xbc\x97S\x99\xfb\x1d\x01\xf0\xac\xac\x93\xeb\xaa\x8c\xfc\xc7\x13>\xc4\"\xe9\xc88\x881\x8dA\xe9\xa4\x93\xf0\x19_\xe2Y\x96Q\xb8\x95\x04\xf5\xdb\xa1F%\xce#\x84\xf3=\x95\xdb\xa9/\x86ry\xca\xa0\xfah\xd7g\xceQ6\xb9\xd0\xd1\x96lI\x9c\xb6\xbf4\xc2\x98\x86f\x97\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xfad\x8dN\\\xb33\x80\x80(\xd5\xd6\x92s\xbf\xc1\x87\x04\xec\xb3X\xfcSl]\x93|\x1e\b%\xb5nN\x1a\xa9\xb7\xb7\x1d\xaf\xd3Z\xfa\xfb\xbe\xbaeF4\x84\x92\xe2S\xb1\x18r|\x9d\x1d\x1d\x97\xa0\x14\x8d\b\xbb\xad\xd0l\xe4\f\xb3\xed\xab\x86DY\xf3X\xab\xdd6e@\xfa\x85:\xa5\xd6}\xae\xbeuW=(\x8d\xdd\x04\x8b\xf7\xf9$\xc7\xecv\x01\xf9k\xc4\xe9\x99\xd7\x15\xc4H\x13\xcaW\x11A\xdc\xb6q\xfd4\xcd\xb7\xe8\xa9x\xa2\xb5MB\xd5\xd1\r\x8d\x854\xd6Z\xd3Q\xaf\xaaI\xb6A\xd7\a\xc1\xbb|\xf3\xa9_k?\xad{\xb6a{\x93\"w\xebDS\x9a\a0l\x9af\xbb\x87\xbbsB2\x80J\x9d[Hjv\x01\xb6\xbbP&KP\x89\x14\xcb\x16\xf8Vq\xb7N\x13\xfe\x10 ~Q}\xfe\xab\x85\xb1\x14\x01\x98bhD\xcb\x96q\x18\x98\x90sB\x8c@\xf4\xe2\xcd\xe3d\x97\xba\x82\xf7\xcfJ\xcaLo\xa6\xe75\xa8\x84\x94@bfK\xf5\xf1\xaf3T\xff\"\xe4H\x9b '}, 0x14) 18:01:37 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) r1 = dup(r0) syz_emit_ethernet(0x46, &(0x7f0000000300)={@link_local, @local, [], {@ipv6={0x86dd, {0x0, 0x6, 'D\t_', 0x10, 0x0, 0x0, @mcast2, @rand_addr="57d9233a356dc613b6bc6d8877075dc9", {[], @icmpv6=@ndisc_ra}}}}}, 0x0) ioctl$FIONREAD(r1, 0x541b, 0x0) 18:01:37 executing program 2: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000540)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1000001, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="000044000000d4ca8e540233ec3f5b2c1700004914bf9ce00976823d38099ae44a279999c7dd2d0ba19121960238f35b770173284f"]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="000000000000ed6fbd9d9decb77c2c282235b3bd0000"], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="84631fc7b0ff754001004bfbabe34ba39af3364760eae0ae0fa7ff9cd9000000003d8bf7de00000000"], 0x0, 0x0, 0x0}) fcntl$setflags(0xffffffffffffffff, 0x2, 0x0) 18:01:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x20000000000002, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mmap$perf(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0x1050, r2, 0x0) recvmmsg(r2, &(0x7f0000001580)=[{{&(0x7f0000000140)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000001480)=[{&(0x7f0000000240)=""/127, 0x7f}, {&(0x7f00000002c0)=""/112, 0x70}, {&(0x7f00000000c0)=""/33, 0x21}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/148, 0x94}, {&(0x7f0000001400)=""/64, 0x40}, {&(0x7f0000001440)=""/15, 0xf}], 0x7, &(0x7f0000001500)=""/95, 0x5f}, 0xffffffffffff7fff}], 0x1, 0x40010040, &(0x7f00000015c0)={0x77359400}) sendmsg(r1, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="240000001e0007021dfffd946f610500020000001f00000000000800080009000400ff7e280000001100ffffba16a0aa1c0900000000000f12000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 18:01:37 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000040), 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x5f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000002c0)) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000340)) clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = memfd_create(&(0x7f0000000000)='#}\x00\x9a\x1b\xc2_R\xea\xd3\xddT\xd0\xec;\xa4\x9dV>\xa4\x11\xa4\xac\x9e\x1e\xac\xaaT\xd5\xd3\xf8<\xd7Yb\x04I\xdct,&\xe90\xa8\xaf\xff\xd3\xcd\xcd-\x90\'\xa2v\xbal\xa3l\"\xa0G\xebD\x1d\x8c\x8e\x15\x8d``\xb2\xdb\x9e\'\xef_\xde?i\xacl\x03\xaa\xdc(\x96\xbed\x9b\x1d\x95\x13\xbe\xe7\xb8\xa3\x13>\xdd}\x87\xc7Y\xf1\x92\xe3BIky\xe8\x85\xe9^\x1d\xb2\xd2Ycn\x9d\xafQ\xb1\x02\x99z\x81\xff\xc2\xdd)\xfe\'\xb8\"X@\xd6,\xb5\xa6\xa2\xe1:\xecG\x1d\xfe\x86\x85\xe7\xd4\xf6!C\xa3\xcf\xf3S\xeaA\xd7\x11\xc9O\x8e+\x94\x8c\x1f\xd6\x88\x97\xd0\xdd*\x90)\"\xda', 0x2) r5 = gettid() r6 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) ftruncate(r4, 0x40001) mkdirat(r6, &(0x7f0000000200)='./file0\x00', 0x84) sendfile(r2, r4, 0x0, 0x100000000002) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fcntl$addseals(r4, 0x409, 0x8) ptrace$pokeuser(0x6, r5, 0x9, 0x3) pipe2(&(0x7f00000000c0), 0x4000) dup2(r4, r3) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000), 0x4) signalfd4(r0, &(0x7f0000000240)={0x4}, 0x8, 0x80800) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 469.952934] ------------[ cut here ]------------ [ 469.958440] kernel BUG at drivers/android/binder_alloc.c:1130! [ 469.998727] binder: 15423:15435 BC_INCREFS_DONE u0000000000000000 no match [ 470.000506] invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 470.011175] binder: 15423:15435 unknown command -954244220 [ 470.011683] Modules linked in: [ 470.018194] binder: 15423:15435 ioctl c0306201 200001c0 returned -22 [ 470.020523] CPU: 1 PID: 15431 Comm: syz-executor.2 Not tainted 4.14.108+ #38 [ 470.020531] task: ffff88819cf00000 task.stack: ffff8881a3398000 [ 470.020570] RIP: 0010:binder_alloc_do_buffer_copy+0xc7/0x500 [ 470.020576] RSP: 0018:ffff8881a339f5d0 EFLAGS: 00010212 [ 470.020586] RAX: 0000000000040000 RBX: 0000000020001000 RCX: 00000000000003a5 [ 470.020592] RDX: ffffffff82237477 RSI: ffffc90003348000 RDI: ffff8881d2d2ff58 [ 470.020598] RBP: 0000000000000020 R08: ffff8881a339f8b0 R09: 0000000000000028 [ 470.020605] R10: ffffed1034673f06 R11: ffff8881a339f837 R12: ffff8881d6625918 [ 470.020611] R13: 0000000000000028 R14: cad4000000440000 R15: ffff8881a339f8b0 [ 470.020620] FS: 00007f0e71dbb700(0000) GS:ffff8881dbb00000(0000) knlGS:0000000000000000 18:01:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x20000000000002, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mmap$perf(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0x1050, r2, 0x0) recvmmsg(r2, &(0x7f0000001580)=[{{&(0x7f0000000140)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000001480)=[{&(0x7f0000000240)=""/127, 0x7f}, {&(0x7f00000002c0)=""/112, 0x70}, {&(0x7f00000000c0)=""/33, 0x21}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/148, 0x94}, {&(0x7f0000001400)=""/64, 0x40}, {&(0x7f0000001440)=""/15, 0xf}], 0x7, &(0x7f0000001500)=""/95, 0x5f}, 0xffffffffffff7fff}], 0x1, 0x40010040, &(0x7f00000015c0)={0x77359400}) sendmsg(r1, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="240000001e0007021dfffd946f610500020000001f00000000000800080009000400ff7e280000001100ffffba16a0aa1c0900000000000f12000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) [ 470.020631] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 470.031505] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 470.034367] CR2: 00000000026d3978 CR3: 00000001c719c001 CR4: 00000000001606a0 [ 470.034377] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 470.034392] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 470.034397] Call Trace: [ 470.034424] ? binder_alloc_do_buffer_copy+0x1ef/0x500 [ 470.034442] binder_get_object+0x90/0x190 18:01:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x20000000000002, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mmap$perf(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0x1050, r2, 0x0) recvmmsg(r2, &(0x7f0000001580)=[{{&(0x7f0000000140)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000001480)=[{&(0x7f0000000240)=""/127, 0x7f}, {&(0x7f00000002c0)=""/112, 0x70}, {&(0x7f00000000c0)=""/33, 0x21}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/148, 0x94}, {&(0x7f0000001400)=""/64, 0x40}, {&(0x7f0000001440)=""/15, 0xf}], 0x7, &(0x7f0000001500)=""/95, 0x5f}, 0xffffffffffff7fff}], 0x1, 0x40010040, &(0x7f00000015c0)={0x77359400}) sendmsg(r1, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="240000001e0007021dfffd946f610500020000001f00000000000800080009000400ff7e280000001100ffffba16a0aa1c0900000000000f12000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 18:01:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x20000000000002, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mmap$perf(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0x1050, r2, 0x0) recvmmsg(r2, &(0x7f0000001580)=[{{&(0x7f0000000140)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f0000001480)=[{&(0x7f0000000240)=""/127, 0x7f}, {&(0x7f00000002c0)=""/112, 0x70}, {&(0x7f00000000c0)=""/33, 0x21}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/148, 0x94}, {&(0x7f0000001400)=""/64, 0x40}, {&(0x7f0000001440)=""/15, 0xf}], 0x7, &(0x7f0000001500)=""/95, 0x5f}, 0xffffffffffff7fff}], 0x1, 0x40010040, &(0x7f00000015c0)={0x77359400}) sendmsg(r1, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="240000001e0007021dfffd946f610500020000001f00000000000800080009000400ff7e280000001100ffffba16a0aa1c0900000000000f12000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) [ 470.068839] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 470.074206] binder_transaction+0x1e2d/0x5640 [ 470.074250] ? check_preemption_disabled+0x35/0x1f0 [ 470.074260] ? binder_inc_ref_for_node+0xba0/0xba0 [ 470.074273] ? perf_trace_lock+0x11e/0x4e0 [ 470.074287] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 470.074306] ? HARDIRQ_verbose+0x10/0x10 [ 470.121004] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 470.126192] ? __might_fault+0x104/0x1b0 [ 470.126208] ? lock_downgrade+0x5d0/0x5d0 18:01:37 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000040), 0x0) r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x5f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f00000002c0)) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000340)) clone(0x13102001fef, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='cgroup2\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = memfd_create(&(0x7f0000000000)='#}\x00\x9a\x1b\xc2_R\xea\xd3\xddT\xd0\xec;\xa4\x9dV>\xa4\x11\xa4\xac\x9e\x1e\xac\xaaT\xd5\xd3\xf8<\xd7Yb\x04I\xdct,&\xe90\xa8\xaf\xff\xd3\xcd\xcd-\x90\'\xa2v\xbal\xa3l\"\xa0G\xebD\x1d\x8c\x8e\x15\x8d``\xb2\xdb\x9e\'\xef_\xde?i\xacl\x03\xaa\xdc(\x96\xbed\x9b\x1d\x95\x13\xbe\xe7\xb8\xa3\x13>\xdd}\x87\xc7Y\xf1\x92\xe3BIky\xe8\x85\xe9^\x1d\xb2\xd2Ycn\x9d\xafQ\xb1\x02\x99z\x81\xff\xc2\xdd)\xfe\'\xb8\"X@\xd6,\xb5\xa6\xa2\xe1:\xecG\x1d\xfe\x86\x85\xe7\xd4\xf6!C\xa3\xcf\xf3S\xeaA\xd7\x11\xc9O\x8e+\x94\x8c\x1f\xd6\x88\x97\xd0\xdd*\x90)\"\xda', 0x2) r5 = gettid() r6 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) ftruncate(r4, 0x40001) mkdirat(r6, &(0x7f0000000200)='./file0\x00', 0x84) sendfile(r2, r4, 0x0, 0x100000000002) open$dir(&(0x7f0000000180)='./file0\x00', 0x0, 0x0) fcntl$addseals(r4, 0x409, 0x8) ptrace$pokeuser(0x6, r5, 0x9, 0x3) pipe2(&(0x7f00000000c0), 0x4000) dup2(r4, r3) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000000), 0x4) signalfd4(r0, &(0x7f0000000240)={0x4}, 0x8, 0x80800) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) [ 470.126217] ? lock_acquire+0x10f/0x380 [ 470.126226] ? __might_fault+0xd4/0x1b0 [ 470.126245] ? __might_fault+0x177/0x1b0 [ 470.165937] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 470.168736] ? binder_thread_write+0x512/0x1f90 [ 470.168758] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 470.168773] ? binder_transaction+0x5640/0x5640 [ 470.230662] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 470.233868] ? HARDIRQ_verbose+0x10/0x10 18:01:37 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x20000000000002, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mmap$perf(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x8, 0x1050, r2, 0x0) sendmsg(r1, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="240000001e0007021dfffd946f610500020000001f00000000000800080009000400ff7e280000001100ffffba16a0aa1c0900000000000f12000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) [ 470.233895] ? lock_downgrade+0x5d0/0x5d0 [ 470.233904] ? lock_acquire+0x10f/0x380 [ 470.233915] ? __might_fault+0xd4/0x1b0 [ 470.233933] ? __might_fault+0x177/0x1b0 [ 470.262788] ? binder_ioctl+0xd48/0x14ea [ 470.266874] ? binder_poll+0x230/0x230 [ 470.270780] ? __lock_acquire+0x56a/0x3fa0 [ 470.271571] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 470.275036] ? perf_trace_lock+0x11e/0x4e0 18:01:38 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet(0x10, 0x20000000000002, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg(r1, &(0x7f0000001780)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000001c0)="240000001e0007021dfffd946f610500020000001f00000000000800080009000400ff7e280000001100ffffba16a0aa1c0900000000000f12000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) [ 470.275050] ? check_preemption_disabled+0x35/0x1f0 [ 470.275067] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 470.275080] ? check_preemption_disabled+0x35/0x1f0 [ 470.275107] ? binder_poll+0x230/0x230 [ 470.317827] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'. [ 470.326431] ? do_vfs_ioctl+0xabe/0x1040 [ 470.326449] ? selinux_file_ioctl+0x426/0x590 [ 470.326456] ? selinux_file_ioctl+0x116/0x590 [ 470.326469] ? ioctl_preallocate+0x1e0/0x1e0 [ 470.326486] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 470.326504] ? __fget+0x1ff/0x360 [ 470.326523] ? lock_downgrade+0x5d0/0x5d0 [ 470.326529] ? lock_acquire+0x10f/0x380 [ 470.326537] ? __fget+0x44/0x360 [ 470.326556] ? check_preemption_disabled+0x35/0x1f0 [ 470.326581] ? security_file_ioctl+0x7c/0xb0 [ 470.326596] ? SyS_ioctl+0x7f/0xb0 [ 470.326614] ? do_vfs_ioctl+0x1040/0x1040 [ 470.400512] ? do_syscall_64+0x19b/0x4b0 [ 470.404693] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 470.410104] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0d 04 00 00 48 8b 6d 58 48 29 dd e8 33 33 0d ff 49 39 ed 76 07 e8 29 33 0d ff <0f> 0b e8 22 33 0d ff 4c 29 ed 49 39 ee 77 ec e8 15 33 0d ff 41 [ 470.429579] RIP: binder_alloc_do_buffer_copy+0xc7/0x500 RSP: ffff8881a339f5d0 [ 470.438757] ---[ end trace 93e82a6ccb48fef7 ]--- [ 470.444236] Kernel panic - not syncing: Fatal exception [ 470.450241] Kernel Offset: 0x1d800000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 470.461338] Rebooting in 86400 seconds..