: 29201 [ 473.886841] binder: 8771:8775 Acquire 1 refcount change on invalid ref 0 ret -22 [ 473.900027] binder: 8771:8775 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 473.912595] binder: 8771:8775 transaction failed 29189/-22, size 0-0 line 3013 [ 473.921426] binder: undelivered TRANSACTION_ERROR: 29189 [ 473.963400] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=8777 comm=syz-executor4 [ 474.133993] IPVS: Creating netns size=2536 id=71 [ 474.269996] IPVS: Creating netns size=2536 id=72 [ 474.516195] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 474.530431] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 474.615828] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 474.629969] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 474.689593] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 474.704425] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 474.719582] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 474.736248] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 475.408672] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 475.443564] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 475.449686] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 475.457732] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:14 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x47, &(0x7f0000000040)="0a5cc80700315f85714070") r1 = memfd_create(&(0x7f0000000100)='\x00\x00\x00\x00', 0x0) open(&(0x7f0000000000)='./file0\x00', 0x4000, 0x0) ftruncate(r1, 0x40001) r2 = open(&(0x7f0000000080)='./file0\x00', 0x200, 0x4) ioctl$KDGETLED(r2, 0x4b31, &(0x7f0000000140)) sendfile(0xffffffffffffffff, r1, &(0x7f000000a000), 0x2) sendfile(r0, r1, &(0x7f0000000180)=0x8000000000, 0x3ff) 03:36:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:14 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:14 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:14 executing program 7: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:14 executing program 6: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000300)={0x0}, &(0x7f0000000380)=0xc) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000100)=r0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f00000001c0)={0x3, 'syzkaller0\x00', 0x1}, 0x18) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/create\x00', 0x2, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) syz_open_dev$sndseq(&(0x7f0000000280)='/dev/snd/seq\x00', 0x0, 0x200) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000580)={0x1, 'syzkaller0\x00', 0x1}, 0x18) unshare(0x40020000) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000500), &(0x7f0000000540)=0x30) epoll_create1(0x80000) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000180)) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f00000005c0)={'mangle\x00'}, &(0x7f0000000780)=0x54) setsockopt$inet6_group_source_req(r1, 0x29, 0x2c, &(0x7f00000003c0)={0x4ab1a9bb, {{0xa, 0x4e23, 0x100000000, @mcast2, 0x3ff}}, {{0xa, 0x4e22, 0x6b29, @dev={0xfe, 0x80, [], 0x15}, 0x8}}}, 0x108) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000640)={'filter\x00'}, &(0x7f00000006c0)=0x54) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000200)={'nat\x00'}, &(0x7f00000002c0)=0x54) [ 475.734447] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9157 comm=syz-executor1 03:36:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:14 executing program 5: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) unshare(0x400) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = dup3(r2, r0, 0x33c86985cccced46) write$cgroup_type(r3, &(0x7f0000000040)='threaded\x00', 0x9) connect$inet6(r0, &(0x7f000000cfe4)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000), 0x4) 03:36:14 executing program 7: r0 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$fiemap(r0, 0x40086602, &(0x7f00000000c0)=ANY=[]) fallocate(r0, 0x0, 0x0, 0xfffe) write$tun(r0, &(0x7f0000000000)={@val={0x0, 0x8848}, @void, @llc={@snap={0xab, 0xaa, "e8", "c79daf", 0xe887, "1f86f761850aa644315ab70eefcb45e3916858df5cb64a74354ca383e77bb4aac00dc498b8283ba8ae740d07b8f4dbf9f5315b3f6278026f554d0b99a58459fe1374c81032340b53ef55d67392588a899edc8854731c20b82c1379fc26066227e0ba98"}}}, 0x6f) [ 475.808753] binder: 9162:9165 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.813530] binder: 9158:9168 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.813882] binder: 9158:9168 IncRefs 0 refcount change on invalid ref 0 ret -22 03:36:14 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db10", 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 475.813895] binder: 9158:9168 transaction failed 29189/-22, size 0-0 line 3013 [ 475.814106] binder: undelivered TRANSACTION_ERROR: 29189 [ 475.817385] binder: 9160:9167 Acquire 1 refcount change on invalid ref 0 ret -22 [ 475.818395] binder: 9160:9167 got transaction to context manager from process owning it [ 475.818407] binder: 9160:9167 transaction failed 29201/-22, size 0-0 line 3004 [ 475.818614] binder: undelivered TRANSACTION_ERROR: 29201 [ 475.853192] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9170 comm=syz-executor4 03:36:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 475.866882] binder: 9162:9172 got transaction to context manager from process owning it [ 475.868002] binder: 9162:9172 transaction failed 29201/-22, size 0-0 line 3004 [ 475.925855] binder: undelivered TRANSACTION_ERROR: 29201 03:36:14 executing program 1: r0 = getpid() r1 = syz_open_procfs(r0, &(0x7f0000000040)='comm\x00') writev(r1, &(0x7f0000000080)=[{&(0x7f0000000140)='-', 0x24c}], 0x1) 03:36:14 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 476.024407] binder: 9178:9183 Acquire 1 refcount change on invalid ref 0 ret -22 [ 476.035725] binder: 9178:9183 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 476.035865] binder: 9177:9184 Acquire 1 refcount change on invalid ref 0 ret -22 [ 476.036225] binder: 9177:9184 got transaction to context manager from process owning it [ 476.036236] binder: 9177:9184 transaction failed 29201/-22, size 0-0 line 3004 03:36:14 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 476.036466] binder: undelivered TRANSACTION_ERROR: 29201 [ 476.082508] binder: 9178:9183 transaction failed 29189/-22, size 0-0 line 3013 [ 476.092824] binder: undelivered TRANSACTION_ERROR: 29189 03:36:14 executing program 5: sched_setaffinity(0x0, 0xfffffffffffffcbf, &(0x7f00000000c0)=0x8000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000180)='./file0\x00', 0x0) socketpair(0x0, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(0xffffffffffffffff, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000002c0)=0x14) mount(&(0x7f0000000080)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000040)='ramfs\x00', 0x0, &(0x7f000000a000)) chdir(&(0x7f0000000000)='./file0\x00') r1 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) ftruncate(r1, 0x3) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0}, &(0x7f0000000480)=0xc) getresgid(&(0x7f00000004c0), &(0x7f0000000500), &(0x7f0000000540)=0x0) mount$fuseblk(&(0x7f0000000200)='/dev/loop0\x00', &(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000300)='fuseblk\x00', 0x2880, &(0x7f0000000580)={{'fd', 0x3d, r0}, 0x2c, {'rootmode'}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@max_read={'max_read', 0x3d, 0x7}}, {@default_permissions='default_permissions'}, {@blksize={'blksize'}}, {@blksize={'blksize', 0x3d, 0xc00}}]}}) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000340)={{{@in6=@loopback, @in=@loopback}}, {{@in=@dev}, 0x0, @in6=@dev}}, &(0x7f0000000140)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000680), &(0x7f00000006c0)=0xc) lstat(&(0x7f0000000700)='./file0\x00', &(0x7f0000000740)) lstat(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000900)={{{@in=@multicast1, @in6=@dev}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000880)=0xe8) write$FUSE_LSEEK(r1, &(0x7f00000001c0)={0x18, 0x0, 0x3, {0x2}}, 0x18) sendfile(r1, r1, &(0x7f0000d83ff8), 0x2008000fffffffe) 03:36:14 executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000300)={@mcast2, 0x0}, &(0x7f0000000340)=0x14) sendmsg$nl_route(r0, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)=@delneigh={0x38, 0x1d, 0x0, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, r1, 0x60, 0x80, 0x1}, [@NDA_DST_IPV6={0x14, 0x1, @local}, @NDA_DST_IPV4={0x8, 0x1, @dev={0xac, 0x14, 0x14, 0x15}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000091}, 0x4000080) sendmsg$nl_route(r0, &(0x7f0000000000)={&(0x7f00000002c0), 0xc, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYRES32=r1], 0x1}}, 0x0) stat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000640)) lstat(&(0x7f0000000080)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) flock(r0, 0x8) setfsgid(r2) flock(r0, 0x800000002) 03:36:14 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db10", 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:14 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 476.153305] binder: 9189:9192 Acquire 1 refcount change on invalid ref 0 ret -22 [ 476.161995] binder: 9189:9192 got transaction to context manager from process owning it [ 476.167529] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9191 comm=syz-executor4 [ 476.183969] binder: 9189:9192 transaction failed 29201/-22, size 0-0 line 3004 [ 476.193390] binder: undelivered TRANSACTION_ERROR: 29201 03:36:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 476.222522] IPVS: stopping backup sync thread 28209 ... 03:36:14 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 476.265784] binder: 9195:9200 Acquire 1 refcount change on invalid ref 0 ret -22 [ 476.289556] binder: 9199:9202 Acquire 1 refcount change on invalid ref 0 ret -22 [ 476.380226] binder: 9205:9210 Acquire 1 refcount change on invalid ref 0 ret -22 [ 476.422757] binder: 9211:9215 Acquire 1 refcount change on invalid ref 0 ret -22 [ 476.430545] binder: 9213:9216 Acquire 1 refcount change on invalid ref 0 ret -22 [ 476.439882] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9212 comm=syz-executor4 [ 476.457002] binder: 9205:9218 got transaction to context manager from process owning it [ 476.457016] binder: 9205:9218 transaction failed 29201/-22, size 0-0 line 3004 [ 476.544381] binder: 9211:9215 got transaction to context manager from process owning it [ 476.552645] binder: 9211:9215 transaction failed 29201/-22, size 0-0 line 3004 [ 477.172945] binder: undelivered TRANSACTION_ERROR: 29201 [ 477.207792] binder: undelivered TRANSACTION_ERROR: 29201 [ 480.863664] pktgen: kernel_thread() failed for cpu 0 [ 480.868803] pktgen: Cannot create thread for cpu 0 (-4) [ 480.874228] pktgen: kernel_thread() failed for cpu 1 [ 480.879386] pktgen: Cannot create thread for cpu 1 (-4) [ 480.884917] pktgen: Initialization failed for all threads 03:36:19 executing program 6: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000300)={0x0}, &(0x7f0000000380)=0xc) ioctl$TIOCSPGRP(0xffffffffffffffff, 0x5410, &(0x7f0000000100)=r0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.effective_mems\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f00000001c0)={0x3, 'syzkaller0\x00', 0x1}, 0x18) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/create\x00', 0x2, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00005befdc)) syz_open_dev$sndseq(&(0x7f0000000280)='/dev/snd/seq\x00', 0x0, 0x200) setsockopt$IP_VS_SO_SET_STOPDAEMON(r1, 0x0, 0x48c, &(0x7f0000000580)={0x1, 'syzkaller0\x00', 0x1}, 0x18) unshare(0x40020000) r2 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) getsockopt$IP_VS_SO_GET_DAEMON(r2, 0x0, 0x487, &(0x7f0000000500), &(0x7f0000000540)=0x30) epoll_create1(0x80000) ioctl$FIONREAD(r1, 0x541b, &(0x7f0000000180)) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f00000005c0)={'mangle\x00'}, &(0x7f0000000780)=0x54) setsockopt$inet6_group_source_req(r1, 0x29, 0x2c, &(0x7f00000003c0)={0x4ab1a9bb, {{0xa, 0x4e23, 0x100000000, @mcast2, 0x3ff}}, {{0xa, 0x4e22, 0x6b29, @dev={0xfe, 0x80, [], 0x15}, 0x8}}}, 0x108) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000640)={'filter\x00'}, &(0x7f00000006c0)=0x54) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f0000000200)={'nat\x00'}, &(0x7f00000002c0)=0x54) 03:36:19 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:19 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:19 executing program 5: mkdir(&(0x7f0000001500)='./file0\x00', 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x0, 0x0) mount(&(0x7f00000000c0)='./file0/bus\x00', &(0x7f0000027000)='./file0\x00', &(0x7f00000002c0)='proc\x00', 0x0, &(0x7f000000a000)) add_key$user(&(0x7f0000000100)='user\x00', &(0x7f00000001c0), &(0x7f0000000300), 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40020000) r1 = creat(&(0x7f0000000240)='./file0/bus\x00', 0x2) ioctl$int_in(r0, 0x8005452, &(0x7f0000000200)=0x9) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000300)) lgetxattr(&(0x7f0000000280)='./file0/bus\x00', &(0x7f00000003c0)=@random={'system.', 'vmnet0@#mime_typef/ppp0bdevwlan0eth1securityppp0)ppp0cpuset\x00'}, &(0x7f0000001740)=""/112, 0x70) r2 = request_key(&(0x7f00000015c0)='.request_key_auth\x00', &(0x7f0000001600)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000001900)='$\x00', 0xfffffffffffffffc) add_key(&(0x7f0000000480)='blacklist\x00', &(0x7f0000001540)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000001580)="5eee2a0c56d5d36c55872fdf7588e9d2428a0747405c6099fb76f34a8c2b8debc041e440614f2e9f8567d7928d320757f24ae83d76ee", 0x36, r2) syz_mount_image$iso9660(&(0x7f0000000380)='iso9660\x00', &(0x7f00000004c0)='./file0/bus\x00', 0x67474366, 0x1, &(0x7f0000001640)=[{&(0x7f0000000500)="a73dbe03dc84f766d76e21af919f317fca92106655a075d08e96a6ca267d53288358059fbda849f338d0c1dc5bf0b8595901366b4e92fceda5a94f890fc99436ee9b51757c07e54d6d8e93305a408a75a511d6b658fcef33e230b87b3928d4e3772ef2fa5fa054e008a939824ff0ca1db23abfc29c95959f16f8bb56f49b6acdd2502fa991302189cb95109819a1e8f6d19ace3e05a6c78f55b5f839eb224d032c4611bd1dcde5bb16a746e0d0432c428dc982d21636a740f75efce24e17f8b2727ce57910933c1dd15f39bdd3cc31928b6ac69768ae16c04ea70324ae98fd913f5bfa17963c72cc03079d6a45db67d2af79ed882b20babcd4db3be56a1f1f906bf4e086fc20d02c0433638d9fd7781d2cd88ffe6dc0f867fda20dc4621eb33f43e4068182691125e5a8e4125dfd710c2abce3a74c911a9ee585567dbdc59af6f754cd0851fee7aa45d437ac43485facede46e63ad727f51f250db9c5eb2c6cbbec6c1d068973e960461e491cf23f87c85c1dd0af34eb998dc67726202b52a7eb567a7a7f4a1fbed0a0b9549220eb860be6cfefaae17ecddd3a08559424b59505ee02077375081558281d5b785b5bacaed4cd803447e33d15679f5fc68fe770d3d948a390d2eb92408a6c5dccd332641f3d990427172dc41f3e3ed0be94f33011830dd9c5feca263fe03b1fa47b76c1fe6035d0131e8e69c662c4e9a68c6428f5c3cd0d15dce9ce254f45ff722743712a093efc3237a3a8e62a16457b2903a5588518e686a526f3a865a6dccf3fbeffb8c2f7c5d252abc4dbe9d0991c860631258a7b78f8f24110bc817a6ef8ce293849b7b7ef8450156061ec5538e57920806e9ace74be7a5d856bf14ff6d3b9031915ecf2d1770de67cc2daa2b0b0f234b7bd58b619ab23d41f1689d43ce52bb0f8380ecd3f53af18fa0975a95a512b644a6fc10e17b0193655a6c67d1e09accc1fe6235967973268464853bfc0fe05a9832f9e04738a3985e3c7b90fc45ed331b2947fd5627cea2cdcf1cc4fdb9773801f9912283227392fca8d6047c07acd146059be76ee242267cf819f63c9c1c94ba9966f7c17bce16a3fc44ac0d1fdd9408d058de0fe608050f944151d6ae0f1a26a98e860d005760980cee9c5f3723e423c5c04fe8f7168113bee18a7e1b64f18d2e578746139998f7c0545b084e6c2f32128c462fe3b049e1e6e703fc110fac72fe797b017a18152d5b3a8153f265cfaf34de78aa550bdf0cd6f9ccd9618befcf75756450af8182044c7511bc8908812f7638b933ae2ccddb2776bf1b0093edb206d84df525f3229bd475ce06d8ee7263318a6b738fed81e458aa48033092619880c42305fe10b2bd88c56acdcc32d9d61ef4d6ea3a865d313ba3eef3fffa17b2d191efa54ac9c990d8dab20d1fc73099bf658f1d31395f70d0495c5ebe530622a4e5bc5ea532c37bfe79efadc252d75fa8e53ffb05f902e8fa7639a9751e55a24664e3181c15c129183a062da4e1355b19831fc87f7234a28befdca8488756e53cf59deb48e4b9e511c19284c6d2d1117332b48977fb7f345eeca3f67015afbf8e4f5d188db14c2c35da47fa1f8546bf1392693f25f453a490fd9ed80583a02537866de115a87a1993316699cd5d7aea5ca4f2c175da3dcfc2e97ea285ea6c94881df048c2d23ed8a33e1caea8e326724d8156453a264a28ba9ac85d5d6af6784ddd72b65a34c6d7a46ca9b53fc0c4f2f64ff23a76dd777eea33f175dcef7e55acaa55719d77c74e9ad9e6bc46ba099b32be65e4df3b596a28336f5720d50cd696d0460b1fc49fb9dc371a3cf88b140585d97b35d2ccb727013976ff8e1ceb0a58882c789f9e583e638a727e96a9397fea44bb0be6bee39146dc38c0a5dce22fed3c06413b126fdc79906ce3541acd5b8023647f2e6e60b1ff07fe2fa15a8d6a786bf42f588e9e7c780afac2d4051e7f186d5e442192c1e16e87b1f5093aacf04e999f6997868d5f932c5cd6fbe9a765e5866f64f797bb38fb1eb081fdbfeaa941e3ea055a0dd1fe241ef2cd0eb51c7e21cf4dd3f80bb324c0a63b2ebe545525ebc982d05e5054a5633bedbbc32d1a2a57c688c8c23a409dd171460b412e9039685aa0a1bcf9e1c3f4fbf07b7d5e1ff58d66dd039e6a52eec559f4e750336d0f737fb38ad801d72ee0f739484692393d610143d5f9a0a9f764243b4acf5a2394caa8df7a45848940ed6b06423267f309fe2f7366fefcd093e1517e7179ae5b0b10d9e906d5b04fbc6bf8e95788d576a2947d5a387b9b823f26d5ee2a365b3d71403c820ab2f2ea5f2beeb5c08178b93550b766f9285a7698f2b2b470e029a764e4fb857a59e3bcd91b75b455d73f96c6746d621fdccb28194f6fd4a55d52cfe35b8372b749b17dccfa8ea37654ced05edbf56c6200da422feac81463e3bd74abce7ee8da854538e9ff07a15ab3041469b75508a8c5b2f4e4a20214f33f635252b1c4a79d703c54d4ce370a1369bc18ecdd5a1b167bf9c8a3ad739e7565e9f2a7137daf9fd6dc43f52de2089dca77a5ba91c9c5eeb1222a91c8a95496b23c0b861bd3b89e09bf784d640dda7a0b934c19e4bce35657bd037373dfe0e332b1bc9fb454a011ddc64b6a6cc80ec42c82498dca76bec9422f1b77efdb50092d94ab0c72da8879fc1a555f774012e7b64b60c24bbc7254d66a19ec99a1ee43dc6d8312be7c2f05988198da2365314a191aa891a99f076c393c7402b554355a32ba6e83027aaf9e314ca8a2a9bb5229bf2aad5007c002a025a9627cd4f8bd44d1e23949c9d025c5f09f56ba3ae58ae868013d8c192cc2096d4626a670b0fdab945ff5620356bfa02e52118711ffd80fdde6c937d920299f352c7550f27eb907d254655acfc86076244cf7edc2a041ad2a826814776050a7ab8a01049b6810c6f2209c9183149a243e05c78dcdb66417c3cd67624ca39c7ad94a5c49beaa191ba99bccb574855d9f4f3981f76f635a5e4151a6490691583f7b30b510c461af5ef89992bc0d7d0096cb195dfb6e2823969b66d20c0eb5b0811aa611b984b28be141dae02a6b2b37b7d960aa07579fe420aad076814131e32e0269147a2ba1d7aaf87426b96b93a5dd1d88f8dffa9fabbe2fa85c02005db22a39b48cce7798e68985fd9cee8c89cab59210098d6b89b83fbd8a18890030ca4e1f6738496dee556b12106621889ea71cec2920421b2506d4ea2a2569d065769c6b576b61f7e6a43562acca24ba4cd77250b2f870de95f50ed6a2b241503c2b6150677ce2b5d603246b9f2d37925f3bd6ede473010b3dc2c3cb068a53e78cbc5fd633ea6a90e1a9a47a161f1827f3410cb72d1f2b81c8bd83d8c287aa108f9bd99918dd2f6b0dd8c04834f9b9c7b5312e1bbf25e3f2cdfe7ad59d542486d36cb2b8f5ab26a4c3bfd6d2a6ecede0c654ba4192f375c75f2d96748ef4c4e64e818e74ddd41de6388316d167702ad6e242c1f54dd481423966032d4202f030295ce70c3800e8ba4ba8d852dbb4cedd88d7af458e14030f89809dd4e5bfe7abfedea01facfca22f59cc95ac409dd606303662cfb8415bae9e386e86bba20fc1900be058602bd696517f388e59ad28e47f03a8e814f9151c490f645f10fcd1e4bdecfd1cb32ecc689cdac6f00fec7c1175011c00a721b6c740bf6c25a82b46635569a81c148ae3b109e85723c0688daaa62ceab2e8bafb6968f1878a434df938509276382d7d11aa3ad08fd73e1c57737005c02691059fcfacbb0342b148701a185ddcb91dc3c14b0393f09b712fd73821f8aab7808379dc09da83a33a0938917c412d049edcb220e07bd6324144684a44eed1c8f6d543814197c56878b176bc2e21bef1aa5e98e2f2975e9dc0ff0f6e31bf27016a336f10dee2443f24e7c3848d0af156564899b69a6ac177b5102a13e2b6b801cab453421379776623c2de07e95f38cbe4336dfd864831e2ad740da2676d286951402675420faee1eb5cad8597aa3d5d74e271ae03d39461fbff895baf737f0d2641995621db97510899edacdbc3218338f08fa41dacd17c8ccab3e50b7155d23c57a608b8ddd381492938f3204398411e49b1e10e9e5333556808450fc3e328319d5ba79f48a732897f6c939ed25627a274bb76d3d026a270e8dbd056ee4ac02c1ecffe0ec75ff625c51664f481cfdda1ea135a86ae5599c352302cd289f95b24c95d7bdd635398b9ec54f7e61d88e9a52540515901dffa6131792bed5d3d7e178e5165e16d6dfcf1e486e3dae3781dad90d832d0b4b5eb2c12c889d8474b8449cc0ff8e331df506b7af77995712b95d5e79a8cc52a4bdfd64e98c14aab5486a06675a664897574e59da536ff4f7a616a39fb721e1b628995b93a365c46efcb7178f2fa2ea0a87a20e3aa88394f932c09c870f223b788d7eedf9f1de33e93dac5949f2ddd8b328c1e9c8b43f1eccab6fd12eef887f06c2c2f720db7f6c92cad3a3466fbf172fd6330264dc6320de09656fe06f7816539b71e0691e295bbd2fd49583cfb353ff6cecdb64c3039ff0b5f4b10d0d8e665ea1f5eb36fbd91de33b7989d547c4b0e3898e7bc8b81bf48c126d83673974c6d3b91b5105fc5fda6441aef44f5ec0c5c449043d24c9188ca165a41d8d954f9d209df2cc91ca7db859bf8a1266de20d5357eff564a345cb064ce960fcecf073ba632094d3c43b686639216a1868dc238a92c3904c0bc7e2089dffe53849683ec2263673f50cd6f52750e494d94ad954635a8771593ec7404e9c46130a2e8c65f0185d8a4bf78c3ff1515de05d0a846c9a1dac9acde7897d1b0a770d329225750f6ee0012c3ff2b11a551bf72488300836d15789ddf8a4623426a18fabe26acf86d3f962ba81fc39b11a06d8f05427d319b642500bb26da6b73f0bedd8fd59a807bc8298819c57a28fd148b6f21888b6b9e7344897a690012a2052014a7e621a9f428d01f0019b44a371f3c334dd13e0f49fc51122a4fe9753cee68eaabbc8bd32ffb4781ea2a280d38a427811d7e71b58c82ea4432d1128aa633de3b580f49062ed1b41259175cec46171b3be77ca54c7531c0ce8cbaa59f04fde47ab69c2dd0285f4f50977f8241f86b48d369e2ad6acbf181af9d8e7b96d44fd746d0c1a8e094e86993ae2170f8cd2e613230312bd454083d781c58cfd6a8726457bead0afb77af3fb328e3135d2a2aade83d9f6afeb83537da6623e412b7bc055f396a64c6ac06711c31455eb5200981981a6110a7700f4dd0d42bb4ccdde24ce48e277df5cf0a521f02995ac399104a08c05dae4da94db1e24c58d436c45cf5aa5eba07922e617a6564f9d592dd75b8768466fd5180372b44eb733a82439c8f1ca2c5f781aabbecba2043aba6a51173ecaa6f108b301cc6bc44fdca28b32d65349e9be4d067827e21300bff05c62fbda3831cc02c9fad4d7cda651be90ea3aa72756c4378f58082d6caec9519d0b3e233c97761f2193c8c7419b00c23b7ac88d678b98fcdf8bebe137a1b46d5466e624e24f196de5f944eb3c7fae1d5c7633e3001376cc2065d4579bbd2df2378cf23eae570d5b417a0a4006f9703ad2d187e327ec18b8d621f6498a7d5766920f0f9a9fcdea09a6f132c04f8b54a3889914a2480e0c0123d58b40d49a81ad9d2abf81d9cd4e12fc088a72087aa7b1b6b19f3732b27be953ba95075d1676a899873df3e3d5f3d74b7a6ff49efbb1d17fce670669d215f5a812662d354bf1e5c22a11b846f100782f5cfcca7e10aaf1f9763ef03b244ef8c4369a4e071bf1", 0x1000, 0x401}], 0x6008, &(0x7f00000016c0)=ANY=[]) ioctl$UI_DEV_DESTROY(r1, 0x5502) setsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f00000016c0)=0x374, 0x4) fchmodat(r0, &(0x7f0000001680)='./file0/bus\x00', 0x20000000000009) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000180), &(0x7f0000000440)=0x4) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x10, &(0x7f0000001700)={0x7}) mknod$loop(&(0x7f0000000340)='./file0/bus\x00', 0x20, 0x1) write$P9_RRENAMEAT(r1, &(0x7f00000017c0)={0x7, 0x4b, 0x2}, 0x7) 03:36:19 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:19 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x11, &(0x7f0000000240)=0xffffffdffffffffd, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f00000000c0)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000180)=0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ppp\x00', 0x800, 0x0) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000280)) perf_event_open(&(0x7f0000000100)={0x2, 0x70, 0x5, 0x4, 0x10001, 0x5, 0x0, 0x0, 0x80000, 0xc, 0xa7, 0x7, 0xf8, 0xdc, 0x4, 0x5, 0x1, 0xffffffffffffaebf, 0x4, 0x4a70, 0x8, 0x7f, 0xb6, 0x9, 0xfffffffffffffffd, 0xcde, 0x6, 0x20, 0x8, 0x10000, 0x1, 0x200, 0x2, 0x4, 0xd54, 0xf277, 0x859a, 0x3, 0x0, 0x80000001, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x10000, 0x4, 0xffffffff, 0x7, 0x8, 0x51c, 0x7}, r2, 0x10, r3, 0x2) sendmmsg(r1, &(0x7f0000007e00), 0x136a88c83115738, 0x0) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/status\x00', 0x0, 0x0) ioctl(r4, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") 03:36:19 executing program 7: r0 = socket$inet6(0xa, 0x1000000000005, 0x1) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000140)={0x0, 0x0, 0x4, 0x10000}) ioctl(r0, 0x8912, &(0x7f00000002c0)="0a5cc80700315f85715070") r1 = perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000b32fff)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd}, 0x0, 0x0, r1, 0x0) r3 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x200002) ioctl$EVIOCSABS0(r3, 0x401845c0, &(0x7f0000000100)={0x7, 0x10000, 0x7, 0x8, 0x40, 0x2}) exit(0x2) dup2(r2, r1) 03:36:19 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:19 executing program 0: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 481.061125] binder: 9231:9238 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.073246] binder: 9233:9239 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.077787] binder: 9232:9240 Acquire 1 refcount change on invalid ref 0 ret -22 03:36:19 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:19 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 481.107092] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9244 comm=syz-executor4 [ 481.182722] IPVS: Creating netns size=2536 id=73 03:36:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 481.238177] binder: 9253:9260 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.266144] binder: 9253:9260 got transaction to context manager from process owning it [ 481.276965] binder: 9253:9260 transaction failed 29201/-22, size 0-0 line 3004 03:36:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:19 executing program 1: r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f00000001c0)=0x2, 0x4) getsockopt$inet6_buf(r0, 0x29, 0x6, &(0x7f0000c86000), &(0x7f0000000000)=0xfffffd62) mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0) signalfd4(r0, &(0x7f00000000c0)={0x4}, 0x8, 0x80000) openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pktcdvd/control\x00', 0x100000400, 0x0) 03:36:19 executing program 3: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(r0, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 481.277159] binder: 9257:9264 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.294466] binder: undelivered TRANSACTION_ERROR: 29201 [ 481.307014] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9263 comm=syz-executor4 [ 481.419470] binder: 9267:9270 transaction failed 29189/-22, size 0-0 line 3013 [ 481.429020] binder: undelivered TRANSACTION_ERROR: 29189 [ 481.443427] IPVS: Creating netns size=2536 id=74 [ 481.495869] binder: 9272:9275 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.506250] binder: 9272:9275 got transaction to context manager from process owning it [ 481.515081] binder: 9272:9275 transaction failed 29201/-22, size 0-0 line 3004 [ 481.524635] binder: undelivered TRANSACTION_ERROR: 29201 [ 481.545855] pktgen: kernel_thread() failed for cpu 0 [ 481.551031] pktgen: Cannot create thread for cpu 0 (-4) [ 481.556925] pktgen: kernel_thread() failed for cpu 1 [ 481.562243] pktgen: Cannot create thread for cpu 1 (-4) [ 481.568518] pktgen: Initialization failed for all threads [ 481.575289] binder: 9274:9279 Acquire 1 refcount change on invalid ref 0 ret -22 03:36:20 executing program 6: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x10000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x9) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000003c0)='./file0\x00', 0x80, 0x600) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f00000046c0)=""/4096) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r2) renameat2(r2, &(0x7f0000000400)='./file0\x00', r2, &(0x7f0000000440)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000004c0)={0x80000000}) r3 = open$dir(&(0x7f00000005c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x101000, 0x20) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000280)={0x8, 0x3, 0x0, 0xc8}, 0x14) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r3) sysfs$2(0x2, 0x5, &(0x7f0000000340)=""/13) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="240000001900000626bd700000000000209d"], 0x1}}, 0x0) mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000640), 0x0, 0x0, &(0x7f0000000680)={0xa, 0x4e22, 0x67, @dev}, 0x1c) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000240)={0x0, 0x7, 0x3}) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x1, 0x0) r5 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r5, r4) 03:36:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 481.678174] binder: 9283:9286 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.679374] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9285 comm=syz-executor4 [ 481.700161] binder: 9283:9286 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 481.707892] binder: 9283:9286 transaction failed 29189/-22, size 0-0 line 3013 [ 481.717139] binder: undelivered TRANSACTION_ERROR: 29189 03:36:20 executing program 1: socketpair$unix(0x1, 0x800000c, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x8040, 0x0) fcntl$setlease(r1, 0x400, 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000000)='./file1\x00') 03:36:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 481.855540] binder: BINDER_SET_CONTEXT_MGR already set [ 481.861438] binder: 9291:9296 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.874018] binder: 9290:9295 ioctl 40046207 0 returned -16 [ 481.881196] binder: 9291:9296 got transaction to context manager from process owning it [ 481.890072] binder: 9290:9295 Acquire 1 refcount change on invalid ref 0 ret -22 [ 481.890472] binder: 9290:9295 got transaction to context manager from process owning it [ 481.890484] binder: 9290:9295 transaction failed 29201/-22, size 0-0 line 3004 [ 481.890744] binder: undelivered TRANSACTION_ERROR: 29201 [ 481.925727] binder: 9291:9296 transaction failed 29201/-22, size 0-0 line 3004 [ 481.935893] binder: undelivered TRANSACTION_ERROR: 29201 03:36:20 executing program 7: syslog(0x8, &(0x7f0000000000)=""/200, 0xc8) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/cgroup\x00') 03:36:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:20 executing program 5: mkdir(&(0x7f0000001500)='./file0\x00', 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x0, 0x0) mount(&(0x7f00000000c0)='./file0/bus\x00', &(0x7f0000027000)='./file0\x00', &(0x7f00000002c0)='proc\x00', 0x0, &(0x7f000000a000)) add_key$user(&(0x7f0000000100)='user\x00', &(0x7f00000001c0), &(0x7f0000000300), 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40020000) r1 = creat(&(0x7f0000000240)='./file0/bus\x00', 0x2) ioctl$int_in(r0, 0x8005452, &(0x7f0000000200)=0x9) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000300)) lgetxattr(&(0x7f0000000280)='./file0/bus\x00', &(0x7f00000003c0)=@random={'system.', 'vmnet0@#mime_typef/ppp0bdevwlan0eth1securityppp0)ppp0cpuset\x00'}, &(0x7f0000001740)=""/112, 0x70) r2 = request_key(&(0x7f00000015c0)='.request_key_auth\x00', &(0x7f0000001600)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000001900)='$\x00', 0xfffffffffffffffc) add_key(&(0x7f0000000480)='blacklist\x00', &(0x7f0000001540)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000001580)="5eee2a0c56d5d36c55872fdf7588e9d2428a0747405c6099fb76f34a8c2b8debc041e440614f2e9f8567d7928d320757f24ae83d76ee", 0x36, r2) syz_mount_image$iso9660(&(0x7f0000000380)='iso9660\x00', &(0x7f00000004c0)='./file0/bus\x00', 0x67474366, 0x1, &(0x7f0000001640)=[{&(0x7f0000000500)="a73dbe03dc84f766d76e21af919f317fca92106655a075d08e96a6ca267d53288358059fbda849f338d0c1dc5bf0b8595901366b4e92fceda5a94f890fc99436ee9b51757c07e54d6d8e93305a408a75a511d6b658fcef33e230b87b3928d4e3772ef2fa5fa054e008a939824ff0ca1db23abfc29c95959f16f8bb56f49b6acdd2502fa991302189cb95109819a1e8f6d19ace3e05a6c78f55b5f839eb224d032c4611bd1dcde5bb16a746e0d0432c428dc982d21636a740f75efce24e17f8b2727ce57910933c1dd15f39bdd3cc31928b6ac69768ae16c04ea70324ae98fd913f5bfa17963c72cc03079d6a45db67d2af79ed882b20babcd4db3be56a1f1f906bf4e086fc20d02c0433638d9fd7781d2cd88ffe6dc0f867fda20dc4621eb33f43e4068182691125e5a8e4125dfd710c2abce3a74c911a9ee585567dbdc59af6f754cd0851fee7aa45d437ac43485facede46e63ad727f51f250db9c5eb2c6cbbec6c1d068973e960461e491cf23f87c85c1dd0af34eb998dc67726202b52a7eb567a7a7f4a1fbed0a0b9549220eb860be6cfefaae17ecddd3a08559424b59505ee02077375081558281d5b785b5bacaed4cd803447e33d15679f5fc68fe770d3d948a390d2eb92408a6c5dccd332641f3d990427172dc41f3e3ed0be94f33011830dd9c5feca263fe03b1fa47b76c1fe6035d0131e8e69c662c4e9a68c6428f5c3cd0d15dce9ce254f45ff722743712a093efc3237a3a8e62a16457b2903a5588518e686a526f3a865a6dccf3fbeffb8c2f7c5d252abc4dbe9d0991c860631258a7b78f8f24110bc817a6ef8ce293849b7b7ef8450156061ec5538e57920806e9ace74be7a5d856bf14ff6d3b9031915ecf2d1770de67cc2daa2b0b0f234b7bd58b619ab23d41f1689d43ce52bb0f8380ecd3f53af18fa0975a95a512b644a6fc10e17b0193655a6c67d1e09accc1fe6235967973268464853bfc0fe05a9832f9e04738a3985e3c7b90fc45ed331b2947fd5627cea2cdcf1cc4fdb9773801f9912283227392fca8d6047c07acd146059be76ee242267cf819f63c9c1c94ba9966f7c17bce16a3fc44ac0d1fdd9408d058de0fe608050f944151d6ae0f1a26a98e860d005760980cee9c5f3723e423c5c04fe8f7168113bee18a7e1b64f18d2e578746139998f7c0545b084e6c2f32128c462fe3b049e1e6e703fc110fac72fe797b017a18152d5b3a8153f265cfaf34de78aa550bdf0cd6f9ccd9618befcf75756450af8182044c7511bc8908812f7638b933ae2ccddb2776bf1b0093edb206d84df525f3229bd475ce06d8ee7263318a6b738fed81e458aa48033092619880c42305fe10b2bd88c56acdcc32d9d61ef4d6ea3a865d313ba3eef3fffa17b2d191efa54ac9c990d8dab20d1fc73099bf658f1d31395f70d0495c5ebe530622a4e5bc5ea532c37bfe79efadc252d75fa8e53ffb05f902e8fa7639a9751e55a24664e3181c15c129183a062da4e1355b19831fc87f7234a28befdca8488756e53cf59deb48e4b9e511c19284c6d2d1117332b48977fb7f345eeca3f67015afbf8e4f5d188db14c2c35da47fa1f8546bf1392693f25f453a490fd9ed80583a02537866de115a87a1993316699cd5d7aea5ca4f2c175da3dcfc2e97ea285ea6c94881df048c2d23ed8a33e1caea8e326724d8156453a264a28ba9ac85d5d6af6784ddd72b65a34c6d7a46ca9b53fc0c4f2f64ff23a76dd777eea33f175dcef7e55acaa55719d77c74e9ad9e6bc46ba099b32be65e4df3b596a28336f5720d50cd696d0460b1fc49fb9dc371a3cf88b140585d97b35d2ccb727013976ff8e1ceb0a58882c789f9e583e638a727e96a9397fea44bb0be6bee39146dc38c0a5dce22fed3c06413b126fdc79906ce3541acd5b8023647f2e6e60b1ff07fe2fa15a8d6a786bf42f588e9e7c780afac2d4051e7f186d5e442192c1e16e87b1f5093aacf04e999f6997868d5f932c5cd6fbe9a765e5866f64f797bb38fb1eb081fdbfeaa941e3ea055a0dd1fe241ef2cd0eb51c7e21cf4dd3f80bb324c0a63b2ebe545525ebc982d05e5054a5633bedbbc32d1a2a57c688c8c23a409dd171460b412e9039685aa0a1bcf9e1c3f4fbf07b7d5e1ff58d66dd039e6a52eec559f4e750336d0f737fb38ad801d72ee0f739484692393d610143d5f9a0a9f764243b4acf5a2394caa8df7a45848940ed6b06423267f309fe2f7366fefcd093e1517e7179ae5b0b10d9e906d5b04fbc6bf8e95788d576a2947d5a387b9b823f26d5ee2a365b3d71403c820ab2f2ea5f2beeb5c08178b93550b766f9285a7698f2b2b470e029a764e4fb857a59e3bcd91b75b455d73f96c6746d621fdccb28194f6fd4a55d52cfe35b8372b749b17dccfa8ea37654ced05edbf56c6200da422feac81463e3bd74abce7ee8da854538e9ff07a15ab3041469b75508a8c5b2f4e4a20214f33f635252b1c4a79d703c54d4ce370a1369bc18ecdd5a1b167bf9c8a3ad739e7565e9f2a7137daf9fd6dc43f52de2089dca77a5ba91c9c5eeb1222a91c8a95496b23c0b861bd3b89e09bf784d640dda7a0b934c19e4bce35657bd037373dfe0e332b1bc9fb454a011ddc64b6a6cc80ec42c82498dca76bec9422f1b77efdb50092d94ab0c72da8879fc1a555f774012e7b64b60c24bbc7254d66a19ec99a1ee43dc6d8312be7c2f05988198da2365314a191aa891a99f076c393c7402b554355a32ba6e83027aaf9e314ca8a2a9bb5229bf2aad5007c002a025a9627cd4f8bd44d1e23949c9d025c5f09f56ba3ae58ae868013d8c192cc2096d4626a670b0fdab945ff5620356bfa02e52118711ffd80fdde6c937d920299f352c7550f27eb907d254655acfc86076244cf7edc2a041ad2a826814776050a7ab8a01049b6810c6f2209c9183149a243e05c78dcdb66417c3cd67624ca39c7ad94a5c49beaa191ba99bccb574855d9f4f3981f76f635a5e4151a6490691583f7b30b510c461af5ef89992bc0d7d0096cb195dfb6e2823969b66d20c0eb5b0811aa611b984b28be141dae02a6b2b37b7d960aa07579fe420aad076814131e32e0269147a2ba1d7aaf87426b96b93a5dd1d88f8dffa9fabbe2fa85c02005db22a39b48cce7798e68985fd9cee8c89cab59210098d6b89b83fbd8a18890030ca4e1f6738496dee556b12106621889ea71cec2920421b2506d4ea2a2569d065769c6b576b61f7e6a43562acca24ba4cd77250b2f870de95f50ed6a2b241503c2b6150677ce2b5d603246b9f2d37925f3bd6ede473010b3dc2c3cb068a53e78cbc5fd633ea6a90e1a9a47a161f1827f3410cb72d1f2b81c8bd83d8c287aa108f9bd99918dd2f6b0dd8c04834f9b9c7b5312e1bbf25e3f2cdfe7ad59d542486d36cb2b8f5ab26a4c3bfd6d2a6ecede0c654ba4192f375c75f2d96748ef4c4e64e818e74ddd41de6388316d167702ad6e242c1f54dd481423966032d4202f030295ce70c3800e8ba4ba8d852dbb4cedd88d7af458e14030f89809dd4e5bfe7abfedea01facfca22f59cc95ac409dd606303662cfb8415bae9e386e86bba20fc1900be058602bd696517f388e59ad28e47f03a8e814f9151c490f645f10fcd1e4bdecfd1cb32ecc689cdac6f00fec7c1175011c00a721b6c740bf6c25a82b46635569a81c148ae3b109e85723c0688daaa62ceab2e8bafb6968f1878a434df938509276382d7d11aa3ad08fd73e1c57737005c02691059fcfacbb0342b148701a185ddcb91dc3c14b0393f09b712fd73821f8aab7808379dc09da83a33a0938917c412d049edcb220e07bd6324144684a44eed1c8f6d543814197c56878b176bc2e21bef1aa5e98e2f2975e9dc0ff0f6e31bf27016a336f10dee2443f24e7c3848d0af156564899b69a6ac177b5102a13e2b6b801cab453421379776623c2de07e95f38cbe4336dfd864831e2ad740da2676d286951402675420faee1eb5cad8597aa3d5d74e271ae03d39461fbff895baf737f0d2641995621db97510899edacdbc3218338f08fa41dacd17c8ccab3e50b7155d23c57a608b8ddd381492938f3204398411e49b1e10e9e5333556808450fc3e328319d5ba79f48a732897f6c939ed25627a274bb76d3d026a270e8dbd056ee4ac02c1ecffe0ec75ff625c51664f481cfdda1ea135a86ae5599c352302cd289f95b24c95d7bdd635398b9ec54f7e61d88e9a52540515901dffa6131792bed5d3d7e178e5165e16d6dfcf1e486e3dae3781dad90d832d0b4b5eb2c12c889d8474b8449cc0ff8e331df506b7af77995712b95d5e79a8cc52a4bdfd64e98c14aab5486a06675a664897574e59da536ff4f7a616a39fb721e1b628995b93a365c46efcb7178f2fa2ea0a87a20e3aa88394f932c09c870f223b788d7eedf9f1de33e93dac5949f2ddd8b328c1e9c8b43f1eccab6fd12eef887f06c2c2f720db7f6c92cad3a3466fbf172fd6330264dc6320de09656fe06f7816539b71e0691e295bbd2fd49583cfb353ff6cecdb64c3039ff0b5f4b10d0d8e665ea1f5eb36fbd91de33b7989d547c4b0e3898e7bc8b81bf48c126d83673974c6d3b91b5105fc5fda6441aef44f5ec0c5c449043d24c9188ca165a41d8d954f9d209df2cc91ca7db859bf8a1266de20d5357eff564a345cb064ce960fcecf073ba632094d3c43b686639216a1868dc238a92c3904c0bc7e2089dffe53849683ec2263673f50cd6f52750e494d94ad954635a8771593ec7404e9c46130a2e8c65f0185d8a4bf78c3ff1515de05d0a846c9a1dac9acde7897d1b0a770d329225750f6ee0012c3ff2b11a551bf72488300836d15789ddf8a4623426a18fabe26acf86d3f962ba81fc39b11a06d8f05427d319b642500bb26da6b73f0bedd8fd59a807bc8298819c57a28fd148b6f21888b6b9e7344897a690012a2052014a7e621a9f428d01f0019b44a371f3c334dd13e0f49fc51122a4fe9753cee68eaabbc8bd32ffb4781ea2a280d38a427811d7e71b58c82ea4432d1128aa633de3b580f49062ed1b41259175cec46171b3be77ca54c7531c0ce8cbaa59f04fde47ab69c2dd0285f4f50977f8241f86b48d369e2ad6acbf181af9d8e7b96d44fd746d0c1a8e094e86993ae2170f8cd2e613230312bd454083d781c58cfd6a8726457bead0afb77af3fb328e3135d2a2aade83d9f6afeb83537da6623e412b7bc055f396a64c6ac06711c31455eb5200981981a6110a7700f4dd0d42bb4ccdde24ce48e277df5cf0a521f02995ac399104a08c05dae4da94db1e24c58d436c45cf5aa5eba07922e617a6564f9d592dd75b8768466fd5180372b44eb733a82439c8f1ca2c5f781aabbecba2043aba6a51173ecaa6f108b301cc6bc44fdca28b32d65349e9be4d067827e21300bff05c62fbda3831cc02c9fad4d7cda651be90ea3aa72756c4378f58082d6caec9519d0b3e233c97761f2193c8c7419b00c23b7ac88d678b98fcdf8bebe137a1b46d5466e624e24f196de5f944eb3c7fae1d5c7633e3001376cc2065d4579bbd2df2378cf23eae570d5b417a0a4006f9703ad2d187e327ec18b8d621f6498a7d5766920f0f9a9fcdea09a6f132c04f8b54a3889914a2480e0c0123d58b40d49a81ad9d2abf81d9cd4e12fc088a72087aa7b1b6b19f3732b27be953ba95075d1676a899873df3e3d5f3d74b7a6ff49efbb1d17fce670669d215f5a812662d354bf1e5c22a11b846f100782f5cfcca7e10aaf1f9763ef03b244ef8c4369a4e071bf1", 0x1000, 0x401}], 0x6008, &(0x7f00000016c0)=ANY=[]) ioctl$UI_DEV_DESTROY(r1, 0x5502) setsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f00000016c0)=0x374, 0x4) fchmodat(r0, &(0x7f0000001680)='./file0/bus\x00', 0x20000000000009) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000180), &(0x7f0000000440)=0x4) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, 0x0, 0x10, &(0x7f0000001700)={0x7}) mknod$loop(&(0x7f0000000340)='./file0/bus\x00', 0x20, 0x1) write$P9_RRENAMEAT(r1, &(0x7f00000017c0)={0x7, 0x4b, 0x2}, 0x7) 03:36:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:20 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") socket$netlink(0x10, 0x3, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e23, 0x101, @local, 0x80000001}, 0x1c) socketpair(0xa, 0x805, 0xed2, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$input_event(r1, &(0x7f0000000140)={{0x77359400}, 0x13, 0xe7, 0x10000}, 0x18) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000f68000)={@loopback, 0x800, 0x0, 0xff, 0x1}, 0x20) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f00000000c0)={@loopback, 0x0, 0x0, 0x3, 0x3}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f000088c000)={@remote, 0x0, 0x0, 0x2000ff, 0x41}, 0x20) ioctl(r3, 0x79eb, &(0x7f0000000180)="fbb94a0e749ffa40ce30a1a64072c1284ec63365d81d63e1bd39a8abd844796dea5f317cde1925f1c49193478535b58c5f11df67c7db571a64629206584174861a507309fe37c5d67a0d4e09e5a7c9acf44480216c90235802df0e1afe47e95b9b65be22") socket$inet6(0xa, 0x2, 0x3) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000040)={@loopback, 0x800, 0x2}, 0x20) 03:36:20 executing program 6: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x10000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x9) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) faccessat(r2, &(0x7f00000003c0)='./file0\x00', 0x80, 0x600) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f00000046c0)=""/4096) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r2) renameat2(r2, &(0x7f0000000400)='./file0\x00', r2, &(0x7f0000000440)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f00000004c0)={0x80000000}) r3 = open$dir(&(0x7f00000005c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x101000, 0x20) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000280)={0x8, 0x3, 0x0, 0xc8}, 0x14) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r3) sysfs$2(0x2, 0x5, &(0x7f0000000340)=""/13) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000540)={&(0x7f0000000580)=ANY=[@ANYBLOB="240000001900000626bd700000000000209d"], 0x1}}, 0x0) mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000640), 0x0, 0x0, &(0x7f0000000680)={0xa, 0x4e22, 0x67, @dev}, 0x1c) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000240)={0x0, 0x7, 0x3}) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x0) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x1, 0x0) r5 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) dup2(r5, r4) 03:36:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 482.023022] binder: 9304:9307 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.034055] binder: 9304:9307 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 482.041844] binder: 9304:9307 transaction failed 29189/-22, size 0-0 line 3013 [ 482.051945] binder: undelivered TRANSACTION_ERROR: 29189 03:36:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 482.065426] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9308 comm=syz-executor4 [ 482.085430] binder: 9306:9310 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.093961] binder: 9306:9310 got transaction to context manager from process owning it [ 482.102919] binder: 9306:9310 transaction failed 29201/-22, size 0-0 line 3004 [ 482.112503] binder: undelivered TRANSACTION_ERROR: 29201 03:36:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:20 executing program 7: r0 = socket$inet(0x2, 0x1, 0x0) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x10, 0xffffffffffffffff, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000500)=ANY=[], 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000004bc0)={@mcast2, @mcast1, @mcast1}) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000100)="70d1c7d104090328e9130b1d06066a") bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000400)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xb}}, 0x10) write$binfmt_script(r0, &(0x7f0000000440)=ANY=[@ANYBLOB="04"], 0x1) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) ioctl$EVIOCSKEYCODE(0xffffffffffffffff, 0x40084504, &(0x7f0000000680)) r2 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000005000/0x2000)=nil, 0x2000, 0x1000000, r2) write$cgroup_subtree(r1, &(0x7f0000000300)={[{0x2b, 'memory'}, {0x2f, 'rdma'}, {0x2d, 'cpu'}, {0x2d, 'pids'}, {0x2b, 'pids'}, {0x2f, 'rdma'}]}, 0x25) syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x2, 0x400002) sendto$inet(r0, &(0x7f00000004c0)="a6", 0x1, 0x0, &(0x7f00000003c0)={0x2, 0x0, @remote}, 0x10) stat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000180)={',o\x00', 0xfffffffdfffffffb}) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000580)={0x0, 0x0}) mremap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000001000/0x4000)=nil) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000540)={'veth0_to_bridge\x00'}) read(r0, &(0x7f00000001c0)=""/244, 0xf4) write$binfmt_script(r0, &(0x7f0000000480)=ANY=[@ANYPTR=&(0x7f00000007c0)=ANY=[@ANYBLOB="4956939438c2b4d0a26fbdc3f294060cb8da595a90a2a94649e2c913b4b60b39ae89c120dcf5563ba67a20785d7986f08a0fe93b62400a7b4ff96e6ad73d4e69cea15d6c735975ee68ecc2b05cf87f57550941460add2593ba72bc6fedacf69c79abf1075f0176b0606499140f89812c6c87a7f930ecb053ff43113468fe8e87c231a36165ebdbefc5475606657f4050ac10e08ad07fb615e27d7bf40af9fff1817d8d8a53343bff8d7da3e2885ce6afde6405ba945828e195a11844e51ac92b", @ANYRESOCT=r5, @ANYRESOCT, @ANYRESHEX=r3, @ANYRESDEC=r0]], 0x8) r6 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x8000, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r6, 0x29, 0x1, &(0x7f0000000080), 0x4) readv(r0, &(0x7f00000017c0)=[{&(0x7f0000001640)=""/94, 0x5e}], 0x1) [ 482.155682] binder: 9311:9315 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.166110] binder: 9311:9315 got transaction to context manager from process owning it [ 482.174611] binder: 9311:9315 transaction failed 29201/-22, size 0-0 line 3004 [ 482.184254] binder: undelivered TRANSACTION_ERROR: 29201 03:36:20 executing program 1: r0 = socket$inet6(0xa, 0x202000000802, 0x0) pwritev(r0, &(0x7f0000000440)=[{&(0x7f0000000040)="a27ce2ae425c1290c28436a5cd85cf2e4b645ad838df6977bfc77be37d71b2e52aec6d0e07d016110313bed3d3e91a5f4293e4aafb7d5063a27c82443b4a9558d7c1f28842e946c6c48787d02fbf4f9f2036216fb92a33918f2e26355d84f77e47d78c3ffa62809a0f3059b973a0095e", 0x70}, {&(0x7f00000000c0)="85b25e64a82c13e80a2de766c979a70e1136cd76a02b", 0x16}, {&(0x7f0000000100)="eaf0fb5079c94f05377f4ddc42d78cc105e8a1c9e5f45f33694ef68415603845f64ee31d570cc19d8ba8c0acc06fe175d9ef9b6f38c8c3eed6a6a6527accbdc500999a2d74642ea13d935caa5711799df0b388d33cafec25a6c9a3106a1cad307a709f30e40e663d850505dd4ff0b7994a8a0af66030bc994e84c09846c32655c78a23be1e3699a8671955cd982a0146fb80cccba45a495e835104939972216ece8f6eda724a2f00c319dc53fe14246f66240b5df6480cbb4198361ab2bdbdd116376a8fd0ca7a327ed512109c6357d2266eb17ec26510d6e329", 0xda}, {&(0x7f0000000240)="cce146ec5f341e32fa723eb020557b973ee8d5e8b7988eff52779f625242bdec8b1fce477be0da3f7c85bf9a698dc77332ba1837a3ac481338216cc2d99e6fe04376897f15c0bd1d4d8cc3d232f746186185acfb9c717763f1dbeea89e00350bdcbfbef15f3cd8e1ab9cc37d39e41b464dbb9bed66a6da0def9db2f5d5a36b7a0e39cfb3459b8bcc4daa994b5722a8bc365ce13ec3", 0x95}, {&(0x7f0000000300)="d5e5706d781dedcde1356a551a2c50e24b6ae64a0d0c5783f75d1c3d34a4d16fcb88ca2ade298986e5f0f02de054167e14b5fff5af1ca5694f8037e661e7ce750828ed7b5470a56ac30f7adabec9e0c6aaa251f92c238a6e850d74d3aeeb1c2c350072475ce1c03125a05ee78e77f4f480ac0dca6bae1c091c0d8ba9c2d0dda6d017245facbf272591a941fb94bb8a82a95f950b830c4ec00e4f2e9b508cb72b70985346b123ac760d39f742a007d36b98b358578e3292c8a271d2a5afb57344b49c95634f122d5ac7b271b605b4101280c2bff2735bfd64dd38efa7c81f46a3a25b52abd5b3065abb72ca9685dd61f753d73ea2ea", 0xf5}, {&(0x7f0000000400)="7fae529afad49be76571c1addd039a4ea6bd1c6fa1d88ca7df4ce1a70df821de998d", 0x22}], 0x6, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) r2 = syz_open_procfs(r1, &(0x7f0000000500)='net/snmp\x00') ioctl$GIO_UNIMAP(r2, 0x4b66, &(0x7f0000000540)={0x4, &(0x7f00000004c0)=[{}, {}, {}, {}]}) sendfile(r0, r2, &(0x7f0000000200)=0x1000000, 0x807ffffffe) setsockopt$inet6_MRT6_DEL_MFC(r2, 0x29, 0xcd, &(0x7f0000000580)={{0xa, 0x4e24, 0x1, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x21}}}, {0xa, 0x4e21, 0xfffffffffffffffb, @ipv4={[], [], @broadcast}, 0x8}, 0x9, [0x1ff, 0x5, 0x8000800, 0x2, 0x7, 0x3, 0x1000, 0x4]}, 0x5c) 03:36:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 482.242961] binder: 9319:9327 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.254278] binder: 9319:9327 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 482.261937] binder: 9319:9327 transaction failed 29189/-22, size 0-0 line 3013 [ 482.270554] binder: undelivered TRANSACTION_ERROR: 29189 03:36:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 482.293151] binder: 9325:9331 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.305934] binder: 9325:9331 got transaction to context manager from process owning it [ 482.314646] binder: 9325:9331 transaction failed 29201/-22, size 0-0 line 3004 [ 482.324204] binder: undelivered TRANSACTION_ERROR: 29201 03:36:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout', 0x3d, 0x2f}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 482.363416] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9332 comm=syz-executor4 03:36:20 executing program 6: r0 = open(&(0x7f0000000040)='./file0\x00', 0x90000, 0x18) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000080)={0x3b, @loopback, 0x4e24, 0x2, 'sed\x00', 0x2d, 0x0, 0x65}, 0x2c) r1 = socket$inet(0x2, 0x80003, 0x2000000084) sendmmsg(r0, &(0x7f0000003300)=[{{&(0x7f0000000140)=@in={0x2, 0x4e21, @rand_addr=0x5d2}, 0x80, &(0x7f00000011c0)=[{&(0x7f00000001c0)="3b6c50f643c3dff6673b9b4097526b0f0d60f1df84b10c3933567a57295e23ec586618db4ce5dd9cd2e4a82e13bee18c0eaaacf1dbf67dbc04b64b57bdafaec8babf9124f569a89b0ee1d721ff8ffe915f0a56089ecf0970595bda780e33feabd164213947b1feb39c012e07a53b2c06c7eea5befd9d9855a95a252e4ae7d8a2c855125dfea72aa3db2bd61dd929b71055deb98bf5ebc4ac6e7160a4aaa0c2447a1eba0022e2fd2f44576eefcf17d19519efffa2586de809588ab23efa0682414df07cfe8795813b112050d088257103d5264190badb98ddae62b22d405f32d66d384aa397a6c41211a701b94e9ccacfd89a646a6001d8079a3922c4b44c4f37b531ab8ba99432c112c20621cd822d4fe11d22dcc97e5bc0e5dcdabd5fdbbdb22b8aeaef92277b55a8832135283cfd48553020841b4b5c7d0aa8fa4b65af004ed32f057fc4cccb7f746a331bb0519daab40a2a0775f7365f456218a951ab605008eed4b89ea2eee53ee2bfa5d6413dd10b2d0ac1e03a97eef07ac3414ee721a2b51ac44a68f74c83a45b06800b8d8e61197be3a9191f06ba3c3f29677321fdedceed54a0151cd1aa2a1ef040ff2464b520e6d89bf1533f8d6272536728d154cb41094fe3873e6c0d0acbed834b029c0b72a892f6294dc076a94b6605522d4844984d75bd444e229d6b96e3a4bd786a27a7a9ae2a6938fa5833647e0115d8db0f67dd871c240408092249f0a954321902fec1e3677a3b833ced6ef9d976a1dd3003db467872cb98d0200d272cdd19ed03185a21308503f34f35e407a45ac8172aa8e24d91057181b35718b3ae708abcf581febf6f319264ff91349a32f9fdc8d81705006dcb54ee9e9ae1a3b0fcbdbb6eb1facd596aabdb213bb83ae904fa2e9638230857a6bed769d299a9d7ff3073304c620ba040e5b4503aefb3c430ba554820aaa0d812c1bb159b136028f772b25df824f5f26f1f8c2b060597fe73fed0351a421f204cf006db8e9079f9a354d71cb9e7c74d811f9415682ffa386b23a464618405919d54f19ca17f69402f093d9d2352d96aa908fb900ecc3b8e4580bce54562aad00d67673fafa1544d19e76ef5fe677fe08a0d0d6193d487ebafd67466f27abf6afdfb77955c3e3f82fee7a5b356446c01540ba84733d33b678c10f05b3b63fdb8d74a1604f6379d55412497efc40c4dae93dd781bec7add68fbbfc271272d896904635377c2985668b5274daaf539e1c9eb2615d47a759e028bb96fe6f99bea6080e50084a55dee6325014283c758a724a2033be112cce40f87ff7f466052e2d06c0b6529bb6e0b6316cd640a524ab215d049210177b4bdb1d458c2bb4bcddd94955d04ca0ec6aa6d40b1d0db622403ff5be4def75651d1c7e0c5f78d367e312f45cda338716eaf05c5f984bee0442e1fb1a40e2ddbcbe7dd612df60c8b78f2ef867bb325afff0d3bb2a936ddcb1efd9b244cf4c9b103097c1f6db2affe4e4b071ff61b172d8158d3ed4ce1e70f8571e9b7be7120e1c34491af462c3d01cb02b15077a814de1777f9e0f6379704e98e67f1d2a249697538b32e1d33ffcd4c2971b29ce69b64dc24319a14c1c0330a9403a5889f41e5bb71cc09925750863cb2549584f736e2a1a27c1c79bd88411acc6f6474343568ac01482b3c2bea6514eaad9524b693fac57b559943f5014420c11362d10bf75d55a00461dea57b1052b87d6abee7bbe21b65ba6f90c674b619264740707e3f8348afae676e4809ff6a7baabe324eb090ff29d1f854f643f0411f7115f91ede272433dfbf1b41a568811c41e16cb9aa403bf4de4f148aef30816a620e13a6ba2a46fe803983de5020eb3f4a8b2a28825a2afcacd1f78a6c96c59bcd27b30b834727b9c3f792b1436b15170e3da85a13a04a04749aede44f90da36abb94b07b7e11aa5bc799ddc7dfaaeba9cce581151ebbec3519a9c1232674d2cb37ebffd7970ecc8d3080f7bb43bf37491fe1c1dfc80243e70b3ae45ae95f23e075f3dcc2a091d082e8c0cd5f8ec3fd3a3ba7a782b6d0502436dc32cf0f6b3c37d8a0e40a20ed82e76155bb51d2ecd89c677b648cd8fb4bd552cae889bb5f11ca3a480936130811ef173df77bf10a079a62c40f5249c71acd5b0aaf20f62a78f1eadfa14617d750fb0d1789b5696d2118b7d7a22d94c328849ad242694f01a97ed8a026d315ffeedc93612d0d5bc0e1600bf12deb481d5b43f320a5e407424ea9a2e6a227ed42cf2dd72c884c0ebc7f5e09bcbeb7df2f62d7fbd7c5092879a34c8b34cd535de882866a191f96fc883c9bd266d70b7b7ee555865b07aa79cf74adee9c322c354f43ae2bf4c4c1080b2544ba99ad72bfbc9bfb620eaf68a3aacdc2c4f703dffc0c5b6eeb7dfec467a97a38e7e0852aa418016e924c4a4dae27aa6c4755cc4e2a0a5b83061a0c2f93c1f25751a70aaa47f320ac88bd71ce927c2d12e4e17f82e890180c7e784fe0ed86846b2289bb67503d2fd3a6b3167b8dadc10dd1a61765dd09eb9d712dc9458244c542443648d0f26f9cba8f4c679df7657e6745d8971802fec37e92852a036e7a89801ac72bd4f4cc4b85c59fd8687eee25556713e5261fd30831cae7b135eabf0cea9cd7d1bb37efdfdeb32680c74020a390bdab9a912a225d6ed9bff21b913a4db15356cf61671d367787b2b802af132e5d7d0cd279bfeb66f8fdb43009b92db42d60911457ded51a10cd949b8e2d61b7f7cfeb51d1e53b48db649d12d62a052bb1ad5a984de49c53950db9c2f7c21b0435dd986c033c4e73d908601419e899c17751d87aeafa063f752cc73d3294768d3a33517ea1b91480612d8068c58dc9c54d04b6c147853c87233752d329301166fa5f0f4c5bf920c018946402a54f7ad80cb58938ce363d2e2269b3fcc8a0be7cade3383069ce85570e004aae3a7adff1e5e2aa5570134ec426397b1ed5528044c3c813fd4eed06bb62c3bd0bc9728688982976663efd2a90634c6a08a76053a0f7ca3e2de98288dadce63cdbea2461496b786fc92f5452a6e8311c19312d3aa916617a29e56155f9c9e8a4b013c380733a5eaaf81a970b2f5a2993a8475bf7d7670412b8f1aa9e02f13d45d0aa3aaccfb1a47e9330f1580344a329963b4fcd41a6e67abdf6267722bdae2d50cf7ffea6d6aca4a3d78221a3fa24000a8de96d37b0038404a03a3db45b79e188453dc9bb37d3e0d42e6e450fe26fcce91c605b9c9a340896bd53e09b629136174ac2ba4a5edae429f073fa9f5254deb1a0ccf9e72f6271c752c891b0343c75e3808aa305ce44fde2886cef21dfbb821930b6a7e2e6d7523d4e102b4b42ae896c0c5be6eb674d737b4d8c1cea5215da38897733846a3e30dc3338d8c8018105af9afc3595f53e031f20591f436a295dcac34fa2d88f340f87dc1e27c1396d6b1f87bba6bac3dd9d5f2eb1bcdbbf59b11d3f01f8e5da4e43c107edaf4cfa41dad982f668e2644ee5cde0e17a6cc617ce1d20daee3d7d5d4f0fcd534ec6ecf4a54537759d7ea4fdb5dc25036ceeaa6066300fd2ae5c23e37f2e63b2e91a91ae6419c3bb9d8aa84117ebe385445e71f0057fb5b6e5b18b2325b2b959a710747f82a303118c1d39e4dc567b59a775a92c643de955d6f027f746f7663ee7c3a7b268f89a3a9e613907dd6cb1690816ed0b79a8780717dd492fc3af9b9ced505f50244796fa8be4e7ad98a9c27a974e829571a29c1dc2d14a6699df747e4c257ec6287f88044f4049e3770f1260670b31c57dde504968d3892d6e7cdda5a01d43a4c79845a34198bb39898f9b1ae24e0ab47c407207f07a82e7cadc4c356d1faf7c658a8fb58a810f40a472be327e0289644a7239d69760aca26ccf4079cc5752f2e3b841921449a5ed266e642ffa3707f91de662621eb3e01f279b4d7afd26c75f2089f39055e8aacedb99b57ee243343546ab75bb93049ebafa19867198359bc7d0bfba5276a765f9c666b4116cfbc39e15cdf2c06332f3a492c28ce27c6523d67d23bde80cad9ccc9b1e7987e2e1f7b7ccf6d207724e64cd1c8d96ff1d6380de83ced641c25fa129f3f20dd0acdfb02c4940a7f2871628f03455fda315f9efc8bccc75566811bc3e808a436f0d9e8a5d77c94c71eb7ea2cbaad9d7b4209b47a7a90e69035f3728771fe6e9ccc78fd8c5ce085eed9638601d66d79fc66624fc9410789c58f357c7f6631868691fbf3579b4eef1c349e4bf402ce7ab96fa8f939f13d57e6f7c8c9ebfb18d286fbd2670a0cdb6f7f46a937db565028c9bf1339463189592092ce2917d7e464cfa56bc70887c5f8bec763026ee9fd38754bbdc850f1ec991deae07437478eafb00ee5e4d59e4f18a989ff404a50993b9f2d849e068e34d33804f0830b980c7d5e9d126d59a067cf66c3420811bfb0ed1629274905bc180b27f821a9f8ca8f002eb5d9f53964e4975cc034d72d6ecbd5bb4f1114f42cf4c62340fc10af546bfbfa528cf164406a6124c468008f325f6c93b32b550f3461203eae3148680286c32dfdb1d96b150210570e0a856fc16ab83d71d26effd0d64f2dad28de608b729422714f8ca6e36bc866f3a4dbe51c5d786a48e9e755df94cf3411383c8364f4f5812a23c55116d742ed742f5ba0d3c8f32c88d00db4839035a498d25dd0735001d7ee9fbf800a38aad8283afda6c59ca8baa09f638e602fc05067d8580db615e1605674540df8158a0394f5aa9b043c954b7583141310226939ed245d13b136db3b429d0430e4f45bf52342f275844ce32d3009875f613fa0d4c44eeff5cb5a07db3a5d6b9e6f7374c457410d589963f719b20e957245608abfc736937493d90cec8a0b4bf5500b21cc5670375adc7d3a23c1a4c959377c48e1ef9e35ca4119f7eac1d2a6d1dfa1819763947e1931dcf6b50335bec2a703662d7c091d25aee148c20a6dd43293db55789f0fb8e1a6eb4dc682104c1873abc12fe70f67c4eec0946944318ebfd1745bedebfc64f730016f388ade9d3fe2fc6778e0e7b7cd9e4164c0a4855c6994087f0f081fd3333ded4d683a3d68018894fe3a0ea4ba64d74b223ab694f7ffdd4f4cf4efb2cc5adb31ce51094fad454b4ffc81cc5de0a5b4d6c2901edd8d21ee80a2b0e32500b463da009a4f7ce435ba3d15eec34c59ca5ae91c8899f8110e2559fe6838c7bdd8f303d0539903ae5c8a09915fa5cb7854e7491305ff97e333c25d0913be0881e30dcf793a702911da2a234325bdd97bd0665adbd7352efe69c106e20c24f7aff47b2e2f21120bd863eaeac879b90c8c48a8310bab8ef96f23a63f60266154368cf0849d97d41e6100265afe9675b0bf0d4da1e69f5274758c82d4d08597e79f99235b5448949941c321f2b20a1f3365667df42f6ce96449b341f354758366567937577ed59212852d40e4362c37e67f5fa6d20fbfb8c6e44c6d50faf1deea8ad6c14fb56b239de9d693ac845e2d2b36314ed1b2f874cea1c41c8e3d70b127fdb46ea7034b612b9110b124253a8240f5730465b1ee3a0efcee6e64163d28c1f21e6602a3bd27fd86723ee6aa654090d473edd46327c8ed10a671150c25544f677d917c95898813aaf4562b97f7381c1b321ae80abbd87559f5ce85186767af4f001d4a880be1bc8e5fa962dba75a13ed7a4f830a6a7e7da948d65faf20bbc66526ac9f4bbdb9246cb48331fe275df4c9ca65fc7027a22014b10b47265506ad0a9c8a88c4a7431bcdac08cbb6bf23ccb2e0b31b46161a3b6b2064a289159f9e4d964373a933a2a826f1b6a820d1", 0x1000}, {&(0x7f00000000c0)}], 0x2, &(0x7f0000001200)=[{0x20, 0x112, 0x9, "955dd53befc8254af3"}, {0x18, 0x111, 0x5, 'E'}, {0x70, 0x11f, 0x1, "91236633be093cd7120e83c184061e5868f49cf5d367a8d0bd95261930332d595674326052ceec2ba30f85836d9f24e1e325ca6a883d59511efc63c28bdb99180deab0a4bc266d7676335bf66d96d88334f51b53530db3661535"}, {0x90, 0x108, 0x2, "0d1a825938bcab1433e474dcb4c17aa9e939d22104f3cbb3b9a7ca136e18ece07e20d6a36d2dda345168be54ec341a4c6fbfa54b559d582e128d45bc2fded8d699de37e050b4fb3ed44f6ce32f817e71f66560fad541848eb3ebd7dab6d3c12d0fe33c5821f39e560b2d1c42212ce6f6c84e1e382c11cbcd3016cf8125b62d"}, {0x80, 0x3a, 0x5, "73082cd286fafd15c63193eb064491612cc8b417c9a0dfd2d3ec9e4e93de757eadfdf9baa3bff8a05b632bf3a020c64f7615f98a85aee12cf374a9faba56ebd50a4f5c6b13d9b51b05701186b210ef7dd57d5f7d0e6bb9e71a1ff460f73bf5900f46e908c54e3e398157b5"}], 0x1b8, 0x4091}, 0x4}, {{&(0x7f00000013c0)=@ipx={0x4, 0x7ff, 0x6, "d5e4be09bc68", 0x64}, 0x80, &(0x7f00000019c0)=[{&(0x7f0000001440)="e0e0ac8cf6fa1e8a650999640d0aa4428bd9b5e2479f917dd34c495e8e12a453b1abc905482d5f0092ae5aa9857dd84b11f3bfa49a0f56aaaac9c4edb7d4937e819bbb7f7141b763a12df08e9232eea44e10b0194dbbd6ca3b75b5ba4dd70887529396140cd85d98c64ffe2e3e2c76ef809278f91fba10bb5572b29a5d32809097879e8bd8d706d3f09a2ce288d7e47b8192ee1902b989ffffd92137129858f1553b140496cd9b", 0xa7}, {&(0x7f0000001500)="7cf896e6792b10b43cac0efdec60ff6ff46b", 0x12}, {&(0x7f0000001540)="985bdbfeff0f9e02e08b9167e8ab565f60c2bde4513dd319911255f64080aab64399e8b572", 0x25}, {&(0x7f0000001580)="948cad499bfcd3f05236b0f51dde372bff6f2c751f4017f0c78db531450d27b2aa345f78ba2e87186e0380c3714a69e9e648191bee279574fe25188ff23096dc4fbe15c4d9cabae0371147996f05ffd6b9af43949807a73624a2b5a9ca1e0e41fed2cc01beddad38ca6b960e286bd58da0753582175bd5bba2004ada85cc3087bdbbe8b1ff8ddd730f390c", 0x8b}, {&(0x7f0000001640)="c2523b5f6275b5c7d8dc43eb6e0b4ec51a71b0da706e0bfa2ac21f7e8db4fe018eecfe85ae198b62a38504bd3faba5a990752b7224ad27550a073e7934c43fe71d8a323dc2df66944293c7170c2f588c3d34c4fda590c76be3fd983bab9358f1c531a28909251cf393b15f6d2801a190b83ddc21ad6f87d3a43d7a645a03928910d5237e35ad73991111cd7ad7e592221153e025b9c5184b2a90745bdb666a4c4a7d38395d444ff590ace6957d6f39aa8b6a5d4ade830fabfd6e7e7cc37457c874874b778bd55013c3fe9828389230fd325c9e", 0xd3}, {&(0x7f0000001740)="a8697a55a1db95e1b4617eafdd17fe6707781b3827cfd5681376efd4f7cc88bfff9a8cb0bfe2c64743d6b43baf77264e39bcfd48eb6b86b38dbdcf9cc79b68be620764218262c0c4b91d4284bf0bc0301b18d4bf1879f4120b369abc0d5d3f3c12bab953321836abe3f9b659aac3e649efe89c0ac5551682bb17d27d31970a9a5ba6b69371d2f38dfbafea0537547e0d61e63a1e7d5acabb", 0x98}, {&(0x7f0000001800)="df8f51097990dd15b61f76393752a482347ed13f96aaad6e61f5db4f12bc4b58ce9d156bf11afcbff091", 0x2a}, {&(0x7f0000001840)="46a6e899cecf2051cc86b9350db792b50cb6b7656a5ce88019c4efac38a1e60b46583a548ae85f84ee5d337a4f2ba825c216ac2ac9c0001bd724d4714de7b450cfd92eb00f355d5b0e720ec7aa924669684a12f96fa561884b5edfc1a7a25095d3562b85c158bede14a1daedc22125bd08ded636064a17fe353c131287b729237dcd4dfcc2cf73804bab52fa0e0c58a704766d833b50c6bdde8c32daf682f8e2e58b2033a16f4aadd275bf29168f0ed519808668c6e7e0677ecffaee75797ed58f22a58fd924b990f98050227e93d65d40ffdcc1ca5cb511c4ed185b10fd3dfbe77fba3eb8cb8ed7b7931c3fb93c243378e2f74d13aaa944", 0xf8}, {&(0x7f0000001940)="d1027869335584d7fc337658cf532ed18191028459be0575fe74d703931df65d4e24180a4fcd61a00ea92b9bff718a3ee1e33fe900533448facb0cc8c580325de4071f", 0x43}], 0x9, &(0x7f0000001a80)=[{0x90, 0x0, 0x8, "5085986e825fb52e28b46b50c263168315d48a59f13a06a245cfb55f43edde9be690aed5515389e513438fd6102cb608bd98b085eb31a0a1817d359eaa8d968e890b8d27d68550515b10fe4b2f1e6db919f315cd50b0e7ee88b8d8eb331967c525e6044d121e52ce4af9010f08993cd36cd20f4cd9d572d41c5c563aa3755e"}], 0x90, 0x20000040}}, {{&(0x7f0000001b40)=@in6={0xa, 0x4e23, 0x8, @loopback, 0x414ccf64}, 0x80, &(0x7f0000001cc0)=[{&(0x7f0000001bc0)="42e006ed1b2876320df3b654fbc629cd14ca4dd593ec545ade5bdcaea7be6e908d522c6d0d3ebe49d73fefceb1a8efdaed8a77372473564d4c0125e97a0e57122b57438842966519899ecaee397ca4790267549803b52238a5d8ca2e4add075c2bdfcc46fcfadcb8c9cb1e77d2500ad5994d4488ff", 0x75}, {&(0x7f0000001c40)="fbd4104e391fe2b4e209ce09971083f01358fc341fbb2c6df75fd63ce776375ed03e4e971abf70b0a465f11200b1945662b82da7ff5faaa96eb35e7cda0e8ad61f2a89c00d808c7a7b2b27bac05f971a50399ab2479195", 0x57}], 0x2, &(0x7f0000001d00)=[{0x38, 0x11, 0x3, "767ec367c678507547c0d26dff937ab3f3925d85ba749444caca12b0608462d2d619a244"}], 0x38, 0xc801}, 0x8}, {{&(0x7f0000001d40)=@ipx={0x4, 0x9, 0xfffffffffffffffc, "c34573fc42d3", 0x5}, 0x80, &(0x7f0000002180)=[{&(0x7f0000001dc0)="65c4a2958826ec5f8741a1e78b134e6b7dcfc9f36a39e95b3eadf6cafad1964c29c2f04530201cff44b3548580914d9943dc83bac7535c0c1ea70ed427e99b1a9d26ded9f4226b9ffce245b030506090c6fe95cfa2a339a71ade460c59e85c71d384253cb200aa4057f322a25f5151b367a65fbabb9ef73541b97cd0778b93183819a3e284f0e3024af8318c57a1d5286163e39e4429faf34bccff39c3b9fed495d98370960f8f4fb681acfa65395f1feefaf6346f308943d3d9faff7a48c769b44d8fef1dcf35e926ccac030da114f8e8913deb1b49fda0d1f1a0", 0xdb}, {&(0x7f0000001ec0)}, {&(0x7f0000001f00)="73d02148c0b1593bffe36ea647a88b30b2e67ab072d6d36d2d07c2cc1bc3e35655bf3c30f10019e0cf521fcd39d676dfca329f6717f48fdca4eb7f7702cc909c6a4bf2fb6ab38c8844e3f2f1f8bf92f28f6947097aada562fc0531cf7dfcb39f404f97d749e39567265af33afa2981c7f6f64bcd9c4784afbecb6af0836f7927a08094af3dbf7d91c31f5102ba62a6355e97bcff3394c52b0183e036b90779daef7e56dfdc5f34a05f8ad9bd32f3af316ce2676381eae01cc2cf91f52c68106ba046d83633a919c34737d3cc2891bf8e0e23cff9662579195e594e9130ea78", 0xdf}, {&(0x7f0000002000)="540db522a266905f80ba50325e4a861501cf0cffa0c23526fc267e4059705942a0e8f1e8948afc5c1dac002b6f20dc6934dea1d53a2d8463baa3cd3e61f8c5cb642e0b451489f871d5b3b32fcfe908cdd483a4f669508e278f258dcc", 0x5c}, {&(0x7f0000002080)="29d25c8f25228b89d3a66ffe2fd8862f627284ed369a8cbf5a299a7ab38fa0b9a0810dc1b616c2f4a8d7b602a2e3885970cc68a75b1dbde0d83a1abe58dbbc975d2dbb98e156c234e437ff6d527b97bde5", 0x51}, {&(0x7f0000002100)="49871977a8d8d071161bfd8bf8f25e2088022f54b0c46fb4d766b74a54121dcc0210a62fbb40be0698ade41b8fcacf92c14058a3568018a51441267cc9a0319fdca8d9d7e3c1dd257edf2511ee316193480cac66cfb970517cf0f1813b2cf902b4c870c09a9cd119fc8bc7bdf162bf", 0x6f}], 0x6, &(0x7f0000002200)=[{0xc8, 0x10d, 0x5, "d5e12f98bba5838735118e7d47291ce5c3e46df57242b74f38e4ca7d3ae4669e3377c117b3c55a637b769dcccb4bd0b22d779652bc1a6372c2c69f3ab4f43c299b6de14a1263997a416c8929a5981097308966a23293ccaee8f3c8be3e9841c25b1bd16b87fbbe338cea3022af9a831d65c7dfaf300998985b369eaf2b5ae7f72f519b618fcc23b0d5e59fd9d0b7776f1f0c332830976ab43aa6ffedbbc2620edb8f7e885ba62a03b0d5b6adcaa18355626aea"}, {0x1010, 0x1, 0x0, "9bb24092d666e386c01a605d88dc53144c839598b19fa46920c54e1a685669a6e02e273942cb464cc81e937ca07191d13d508835f86a5b2baa4fe19027a561f927aad62e7f76ef5d452692269c720c469411155b1be64cd0df93dcb7304fd5d6b51af5457783727c18423c1d74b1fe28d688759688ac091d6cc17b7c05e206fd4c869c021077feac538c26631385fbc636db737c830bc723eafa55820fcb68e64751983b065066cfd61135a1e915782b78e2657f2353e09dcfb507044816e2a2f8624db3ed4ecfac83b3ae8f02acc5c63f50e8b4c4817a6dbe1ef2453c5eb94549cee74ff64e6ea6ac1dce0541fa0029883676f2ae942fff951d5c41c5a57d8e64cd4367ddbcdbb6fd0910c109d414d1fc590b1b4f6ec3104159fbb61fbcc18a13b9d5112f6e8549d96a4c6891112f3918f64a24c53abea56d5120c2d15135018615b640804c7d79f7ad6088bfe2e620ffbf58bb4a0e40bef00667eacaf2f225eba8533bd7e5867d6fbb3bb58e1310b2fb34fa1b5765b4d410614ee883446b6e7a53796717c4d8031f2089ec3da07fd816491263bf01dabddbf83eb753964b7be6658e495eb2a382c96d818a949e49af0f64375c207446d9128e606e86b392b30fdf8099f6e56b94622a18827ae6e2aeedc8147b2b83a18cc6e6267155a2e679ba7b798321a6cb8dd1579934b1c6885ede596617d95cf1a13a78cbb6f909b93ec1c9f8d10d8000b6fb5451e92bf6c72c29e8eba82ebc6b0cc096a26bf7a8833f2ce4513b6debcf52dd640ad19cbe9691418b29f41d6396b5e1431e870e91feebfc7b0426b343c31a4b9754d09787fe00a2096a19ab6ae2e02d9bf954c456c581d240522f212d9401d85064efc71e073fa9804004db7c4fa743bed5a30cf8baf1e1236d3ce79eb17df2a3deef591515a9bf038871d273f0835301b0b0919f99a682ed7891daae5f20e46e1fdb2960dcdf8cfbc0aa2faa838216a624b2da6974feca04aaaedf93f15e1b4eabd52084db693c857508450002d755dea61e6481e32f348aca25f3292ff518ec4a39f651681d542ef7fc8ee9cab68727daa8ff1aaccfb076956c683f2bc8b2701ab4cc7135312127481c25ee1dd06c025899ff0d98c08f779bd8f7fd69eebf6f25a417bc6ec28f149815bce8598d71cfaa462f5504df6028da1f438c0942d3b0495f810fbb8621726db3bbe3435937a8d81a75141663cde67148d58721e0e93d5c0328d827c2dade5ca19de43dd55bd40783ab88a81bf97f92707260c628128f2667b43b32d2e72c473377a5431ecf1365af418f179bbf764309be4fece731b38a6f9377bf9965daa9c2a01b6c4f264b58eace1c86c888e036988fb628f23e525bb3c5ea1b6f32c5200113946701c069362f198cf355bdb5ec8dcd1e0322f7dfcae4bee459fa7946ee8a27cee70bed57a49ed041cd4e82e37755af326b932309b26e4749cabb34e7d2b5e0ae183d5613dea1685f254411a1c13f01918280fa8485d27fe2bb8688a4f2c65b988a2fd5e5e07b46fe36293d0997babb88752be50a035c0db7b4e238c640b47c352e43bb9f6642693b4d7d4f19447a33bb9a3ead889203103d413f4bb88fa0054093e2768ba954abab1754a62b19c98d6c371a3a65a5a442421aeaa62274b0d30916a86b301735f9b3262e4dec52fb763bbf8eb523e4fd37408fb9a52a8fee74a0301a832a074ec559f992d9b709caf0341d45a08a3a2008d55c2f49c9e41214de5e6bb114f567ac80dcfc92a002079fc5125aa59e5990452e35b2584626be01bda25623a8905c83588adce7f2d8c83986eecb790d32cefead215a4a438da60032b5813a48bb8cd7bb4794c0de96b249d20d348c02e8fe2543c961c987aa073f0369d85ea1a3ea546312f01053c9e6ef8b8da21c1f1fd7ccaf1c8b57350526a3853efd52bfb30376b9876459cd33a9f4a8fde0b3d65333b49e6c6ea598356a69518c064005229211a8fdd0b6e690869d6e2f52519c30c111196ea7683e41d6b2e6f9a9eae4acd5f947217a138142b73cdc4ce958b4909944b43948a1ba9f0edfb994f7378e3d5a114da35da01672657595801958df2d2f27ed1bd4703659a6af2d0a781aa80ee6a9b1f055aedb395672db0670fbd87caaa3de52c329dad379ade2e4e16e0b4d9a1f5ccaf5289c4fe50eeea5d309ae1723d443f2efb791b478e4a5d61416d2f700eb8475a93a81db1c5d2925f3d395fc8077f22b7a5ae1e0aa46b1d4cd9ec232018b19998616b6157725432661b8298561cead5d8c37feddf0b4d7967bf9c0bdef1999fe9f6ece8bb5580e196206042dfa4c4075bc4c2b8314570de654f49277bc92d9e27e1066d837fcebd1868bc6d8a274cd2e8674a9acec1f279d0538321777bf4843abb000f8fd5e2812deb4ee40b98cae2a59405435bfec6a200788bff7f9d492318961e635d3ca79f8417fc9914d97528dee162fb778a60977f7a50134d9db3e42c1ff8affe613e74845dec04c5128c49c9778228b0d60898372a0120d755ec90ca0af7bd64ab46c719a05520884daaf166f1fb88bc3853e0828fd11fcdd7ccdd5cca7c05ba5ad01eb769f51f200d547b4be731e93f0fbbb95d608c9fda80053efbd1b5ce87f6f590b796cf7527730c0cbf2cc3d741634c8994a09488609ba5889457e0fc71677a2a20f892c8fbc9c3af448e2fb758be70d9053aac19104b694d5369ae2ddcce665417257dc909d005b3aac05ba6d183b66c430272eb02c0587bd3ed93e8f9c78adcaba255709e426dbd49ae1b5269c839c25649e67f2b7731413832773fd2a67ea4bd4dedcf2ab984101d62297509f2456803947a25ba3f5952344d4a7b654e6d55bc993d6c245f349e5ab004161b2cd0c9032298a954698493eaf18bbdac8eaac72dc2731ac52299811ad5b4f8ab5044963a82842ac1ad27d0cb686921d0159065860082b4023cb98a2460200670bd2b87a051ead379cb1c69d629aac7506cc012b90ae8474a08653171898efd69562533b7985b99272d4fab6f48f1b228204d99ba3f8216c5a4dac4741d63387abbc4db6b9e1812c7a4112e42ec9bd18d2b50c0063e9a74209f6e10f30177a8c247dba33df3589de1bb69ae251621a31935b61c77c59ad907ed96214f43db72f43730f29c47be347227e247b42696c6a7eaa9cff2c69cb623ff8e9d05fafab8855374d3f3f66559884847bbf113dfbce4d8bf6dc0bff1f44d070241c98ed8193d67c84db94fbaa4d828d36f595abf93fbfdadfeb44216a4422f4c3a37f034e7ac7320ab4fb9b1f2b80e45b2173939123542ffc8ae371b990446d5f6c23e63d0ac30ad0fdfe623c051c620e5aa2d101e67af21bfd58c66bff60604d5d158526b9d58f4f74cca3bcf9d26a93f3c7946e398b02d4ed40cc8d3e6d21ea6ad5ac1adfa8c10d0299b4f5ffe9282278ee0232d835ada8c3560ad48102c2f5d1574d5cae138d4ae3082de64f435ce69f2b8cfffafb7d89339fd788010edc828cae8ed731665bf4abd0c5e0b74ad663a8920304cda6e5161fb2f00a9fe45d726d5d3edff8528c3af0a9edfbd019d4ce1f6b418d786eba78c0961cf7f398e0bf27c4ccaa1309b34f26043aaf4b49572d63f5d67c1d0c83473e00eb048e735e61d1d74bd295c25c004489ac1322b7360747caf30078e2b17ede92d78dcac3c1e631440ae43047aaaf35d285cd5c86da90a340ca9d92f099659990d42582f86648b95ae332b4b487824e26e25bb198aa9ffd76d15feea381022c9cfd4f0e226a7c404f161e243ed4667c158379a710eb2ea1f067ca1b38ae196e0ac5f518ca81ca697aef693dabed27aee204427133c85f576b04c2637a15b9db918ca187d69673fe371a62955d4fb903b95869fad60892761ccab159353ff698a3f2313a04f71ea47ec58bb08af39ccf01331c85e0f642a0361b57b2ad5f8c9eda513004c7fae3fe36e6cdb1f628ed58f520fa13a932c2108adffd3d6f6b7acc80b1ca2d25ac6b21a0ac06bf911cac0bbae333270c98d9a43b43b651405f5b2cae550f521aa10666f7767b56af2ff0be45e870124f3e81f76e3fd931bb3d86bb35f1c99dccaaf62891c15e730f7574fa943a21a7102f5bdd655422f28e9473c76f91277da55b4d1e01c44c2621ae35fdc7bb28d0f27d8cefd4e03972543a5f49eecf13bd14705751882e718d2509ab17d047ca117bd8db6c3b7cd6e42fc6ea7f744d03a2d1812675dc92be97f2ca8a857f4e8674f1698a3a92a653ed98313df9d04697d61bc172682336a9591b4341904c98f11a63276f0da6b09ec15d32b7f2d9d6b51f47d5c799ed93c96a40f84295ccc0a17360ad990e8b36e0c92f7f5c8d2f7d2208f02bbf719f6210649864164b92606815048854fe25a57aaca5a73b5efbc48317857f0636e31a3b09dd7b4f051aa9252826e9c072a884eee91028f087da3cdb09f30e6646c41953e3e50a648bf5e43c13f5fa0eebff0ddf6bf756b474e599c995067200332937eae54e8fd8fc7383b3dfb3ada31812023d2ed8a08dc8d55585eb92d9afd0fab910811c037031cfbc2c9997a514981b25c162268ba23bebf6cac277c39236506d308a6cb2141162cffe9b4d707f9c473b816219f4f62682cf5ca8df6eaada51b0cb91c2feae537c49eea7c14a6263cfed52e20734b14c5541b1bc9c2e90eafc10ed49ae85e09af61b47e8e8a72d339eb0f64480f9d4d4226d48770ad4abd129edcc3e19e88315e69877f81182a2dc3b50bb46a38ffcba3dc39b6c0c232dd3c4b15504a041763d92184a630dc71f3c523acce9686a1a2a564aadec220ae7f7587535e412fe80e5a7d44f843cb61ff125c256c24e5fd7e43cbf1262c0611cae9805cd7087a3626e5818c0d62edf163b76e0892b44aabb865282d5ce80ba149a8f8d58ed5ec85ed2b04667d52a13d01e10d3eacbbea3bfa5229959f9448dcea5597a99d0d79b8537760c9ddaf1d3a1f78b735fbf1edf7a84a3894da4f79b8f80619362a2104ff2bee1ab9f4f266b5d7eba8b231fcc21479d2390060318189beb92417b78ebb34c82941f522d95779bcb67d2f51d0f990554e8fabe186a0e1d0ac55c48e90e0a7e5322a8e23ae0950f3e787ddb646f57e2535c7d6f93ba84ebc612e5aad689e51f48532fdeff947c30d4836272b3375834501347389239d4610dd01ba50ce2ab00e6ebf8bd0e99bc19732e393f65646e8bb062cadd3fb0fc27be533526ef2664ab6944a5d417eb145f425413b27318c2025d33db2f45553416fa55b2e966a694b0d53077abfcb8402dbc1e7d7768154e50380e8b4f5be49059953763b7d0d6232eb48a5fac4ef35279ceb339e590278c106bd13fa2a34cf206cb2f7658ae4ef7dced07576801529bb3a1829ec13a429d17c81367973128d53c5838ca0c40233d5217594f299ea82cb0b71153a4a2038eef37785ee2caf027aeeb39975d61d024ab6724e7960c89e9ab644546be61de053001227f51c1a88b6f61ef440e9d621daa5f9c4a2430dd1ce7bbb465c7b20b3a32748a05eb7b2d24662ce571ac213817f32b6b5a30203a6708ffbdc7602505b67f2354336fc8e3458e4260fa77594de7847149dac3eec253d8620f0f7cca7e221fe92de012e13a18e723f3a91853b58eff94767d3f3d0d75716835229c51d1c0be0720de63ce069f388532546289679633f80d5e108c1103827f578d26052fae076b739dc16caf100112d480aa6c3489fa68849216d083632d7cabb8a19c590a7e2e70dc26e9bc6635422fdb8b1f03a16fc70e7a3cc145f9f34c2c"}], 0x10d8}}], 0x4, 0x0) sendto$inet(r1, &(0x7f00000000c0)="582f090000003326ed53710900395f0003", 0xfffffffffffffcc7, 0x0, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) [ 482.418094] binder: 9334:9337 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.428935] binder: 9334:9337 got transaction to context manager from process owning it [ 482.440520] binder: 9334:9337 transaction failed 29201/-22, size 0-0 line 3004 [ 482.450992] binder: undelivered TRANSACTION_ERROR: 29201 [ 482.531712] binder: 9341:9347 transaction failed 29189/-22, size 0-0 line 3013 [ 482.540621] binder: undelivered TRANSACTION_ERROR: 29189 [ 482.554059] IPVS: Creating netns size=2536 id=75 [ 482.591731] binder: 9345:9349 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.612295] binder: 9345:9349 got transaction to context manager from process owning it [ 482.622044] binder: 9345:9349 transaction failed 29201/-22, size 0-0 line 3004 [ 482.633669] binder: undelivered TRANSACTION_ERROR: 29201 03:36:21 executing program 5: r0 = epoll_create(0xe6) flistxattr(r0, &(0x7f00000000c0)=""/45, 0x2d) r1 = syz_open_dev$usbmon(&(0x7f0000000500)='/dev/usbmon#\x00', 0x3ff, 0x2500) ioctl$BLKBSZSET(r1, 0x40081271, &(0x7f0000000780)=0x3) r2 = gettid() process_vm_readv(r2, &(0x7f0000000200)=[{&(0x7f0000000280)=""/199, 0xc7}, {&(0x7f0000000400)=""/217, 0xd9}, {&(0x7f0000000140)=""/70, 0x46}], 0x3, &(0x7f0000000380)=[{&(0x7f0000000580)=""/186, 0xba}, {&(0x7f0000000640)=""/166, 0xa6}], 0x2, 0x0) ioctl$sock_inet_SIOCSIFNETMASK(r1, 0x891c, &(0x7f00000007c0)={'ip6_vti0\x00', {0x2, 0x4e21, @rand_addr=0x1}}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) add_key(&(0x7f00000003c0)='syzkaller\x00', &(0x7f0000000540)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000700)="256be49d484aeee5ef48730a801463c2b217f4acd8b3b22403734fa4b3fab41fe433d5665bd4fe19c8cb66c362e637005ae577e593ffa2bcef971bf02a3ffc093a53df0c0a73b00a6c06aa62e1be", 0x4e, 0x0) add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000100)="09d56faf4eb0ab3e00000000000038be2422360000c4000000000000", 0x1c, 0xfffffffffffffffb) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) process_vm_writev(r2, &(0x7f0000000800)=[{&(0x7f0000000900)=""/226, 0xe2}, {&(0x7f0000000a00)=""/202, 0xca}, {&(0x7f0000000b00)=""/224, 0xe0}, {&(0x7f0000000c00)=""/162, 0xa2}], 0x4, &(0x7f00000012c0)=[{&(0x7f0000000cc0)=""/70, 0x46}, {&(0x7f0000000d40)=""/229, 0xe5}, {&(0x7f0000000e40)=""/71, 0x47}, {&(0x7f0000000ec0)=""/45, 0x2d}, {&(0x7f0000000f00)=""/209, 0xd1}, {&(0x7f0000001000)=""/195, 0xc3}, {&(0x7f0000001100)=""/204, 0xcc}, {&(0x7f0000001200)=""/144, 0x90}], 0x8, 0x0) setsockopt$inet_buf(r3, 0x0, 0x29, &(0x7f0000000840)="7f8c379d198da3dba2db85c59a22ad644fe99d257e3dd15b4e8b923d6b7ddf91b4742ebff0b3aee4e3a3a8f722711ba316594358a08bdb98c6f807989633428577bd33b4f6db7153f2a61df74ba9f8214b955d935878119d17558cd5c3b279d3a6583516c04b01f0f4d59569d1ce11a6d388c6a130a6e96317d1692e4d003190498d5445237834c1502d602b99227d3391f717dd18298e52f2115a7d40ce1a2cb64ac6366c500ad22e4e66d996593fecdcfc232ce978e8d2", 0xb8) 03:36:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:21 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x2, 0x3, 0x1, 0xf, 0x30, 0x0, 0x70bd2d, 0x25dfdbfe, [@sadb_x_policy={0x8, 0x12, 0x0, 0x1, 0x0, 0x0, 0xfffffffffffffff9, {0x6, 0x6c, 0x8, 0x7f, 0x0, 0x8001, 0x0, @in=@local, @in=@local}}, @sadb_x_sec_ctx={0xc, 0x18, 0x2, 0x41e, 0x55, "41bcbbe1ae8ba0226a915364175cf11c58be492cdf18b927bb05be318346d3886e877bef68dc6558dce77a7643a66d7b28b997b5516b715c5226eff6c29a6397a7f8ae6d4536b623f1ce499460021eecf65c2dcd15"}, @sadb_x_filter={0x5, 0x1a, @in6=@mcast1, @in=@rand_addr=0x2, 0x0, 0x10, 0x4}, @sadb_x_sec_ctx={0x9, 0x18, 0x400000000000, 0x0, 0x3a, "b1ba84c09b1e87454e0e4c9f31d4d2e19ba328404fd523d5f1425670417281eff494a7f5c8baa3a8f0cc70244f359360f037c0d2b6050590f9bd"}, @sadb_ident={0x2, 0xb, 0x8, 0x0, 0x6f}, @sadb_x_policy={0x8, 0x12, 0x4, 0x0, 0x0, 0x6e6bb5, 0x1, {0x6, 0x33, 0x6, 0xa2, 0x0, 0xffffffffffff73aa, 0x0, @in=@broadcast, @in6=@remote}}, @sadb_spirange={0x2, 0x10, 0x4d6, 0x4d6}]}, 0x180}}, 0x4000) sendmsg$key(r0, &(0x7f0000cd0000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000f85000)={0x2, 0x4000000000013, 0x0, 0x2, 0x9, 0x0, 0x0, 0x0, [@sadb_x_sa2={0x2, 0x13, 0x80, 0x0, 0x0, 0x70bd28}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}}]}, 0x48}}, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = socket$key(0xf, 0x3, 0x2) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x4c, 0xfffffffffffffffd, 0x80000000, 0x4}, {0x6, 0x0, 0xfffffffffffffffe, 0x1000}]}, 0x10) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000001980)=@get={0x1, &(0x7f0000001900)=""/123, 0x9}) fcntl$setownex(r2, 0xf, &(0x7f00000001c0)={0x3}) sendmmsg(r1, &(0x7f00000045c0)=[{{&(0x7f0000001c40)=@can, 0x80, &(0x7f0000001840)=[{&(0x7f0000000100)="7b648edd7c657679c597928ab4d6957ec184d01797666afbc1b977a4de7708f057ea06866ade1a546083b380a2ca2d", 0x2f}, {&(0x7f0000000440)="4a3eebc1f4f4bd5362bfa3f070ab67518d5253bc560e21d983c7e715c3f94638bdb25527c53f04d899f5b2191ca0bf0dce597398e0dfdeda19b527ac48f624745a7582143e28dfa517df648892263de789bb31e101b7ac0d27678cb77471ff277b40c3610473d5264154c51522a4dbaebf3a55bd49b657928860cb7cb159052c304728b4e768869c967c78de04901c080d7a4013036f50bba54f75e37768b2d03a457d42dab288092355d3de59823cc89fc5d4c12595705696de812ce852d780b92457639bc1b529d49ff358404d62d62b", 0xd1}, {&(0x7f0000000200)="fcc228a2adf17c14d29938fb016ea95fc2ea43f79e43ebde052358882c09cd9c3d27786a5b979f4555153f82045899c9947fdd03c4268a4a4a952c9a905cd901dcaf681f0b07285be161d61c77f46a6b9d48316355523cbdf5859a4b36f977554652847a442313a239a0b4314d77cb2f090e04f1d4ad91fe8896cba28a6e69f4c22c452840dd5023f3c89f71afb756e765e296", 0x93}, {&(0x7f0000000540)="8b7b27be424f939683dbcbd2ccd6c47808e3c8a18ca907c8e4c153d9f1c48e11fcce0c92edd4650933c5397a6dfef4967ee5b949861442de602e48ad81039845226b8e49a44198dc4d42abd37f7142beca35836c565bdd3a217e07cf7f060337d39e92d69134cee8f08bec2967a4c5dd12e8aa105f47b718739150425f30b1629e01754f836a9771482da4a861e93e505d609babf5693f73cb21b5482aa0cfe74c8affa67d60c4a1d62cbf86de0647b9dcc25de2426aad21e0d0c40cd917a85280dac0e1dd90528005d2e6d014c2f6fae7ddf0948a035bcf06100fbbb14d4634bcc8f11a42910c1b54fd360e23", 0xed}, {&(0x7f0000000640)="75872d34c8b50b9decc95a2be9b7ea988a008041949e2ff1ff010b133d740370fdb57290ebb888875049d8029011d0ae5e6ebbfde5414cb7d622585934b9cf9ea8c6247a55891149c07eb6da77a24da30b75e26d4b70c3fbcc99911049642d11bfadaf2202baa468141c10a4af46549784138f4ba61132099c75763c5086d7988b979f1a43309760fe301940d492ee415b5a8bc6afa07b4fc592b4a554b1afec56b113e4edb7363ad2b7c56f7e5beaf362a6303ef42d3231df399fe3dbdd9af665c6ceb7e8f954e07dc62e8f5a48942f1c58cf1a9e2fa440d85574cc87347bc49acf95ac5a1ad892c0296494d1130b603ae6c6e214ec1330649ca24e36341ba9ded4021d0759c59565b41d92b5eb27268b00d277c9f44f9cfac6ca37da52d7f5a0b35c61a26abaa6e5696ca95b6fd858c3397368168503be81c89e1f55158c14d27111f49e9a739a2ea151616739aba44b3ac4ac11202b9cb829737906bdcb8e805c99d636ebe173b32381f7f3e0de1b9c3ad46e65524e3becefe7e270860bcda068dc30d84f18faee5ec9502d1415e8955aa331081896a094c46993aed28685bf4113d44cc3e259b0f4da61265849f50fc13f5d892f501288146298eef09ea8bd972a9d95500a6c535d406f62e1e1d1ca0458a4481dc73dd009b258f7ff0e71420403e079e5e7bdb46aa6b72bb8e5de629b45e430c4b24adaeece0df6ba525cbe9a8171d87e2c87fc8652ea78d60303f568d4a89a671d666b9174a471bb33e0034e5eb4b934a2717cca8ad610f2fa2a767a733e3f33bc3aacb8503cbd1d65d340a02a07f21ae0d3c591d75ad1a35bc1d09a622b372fa68eef2bd75f85ca9e212c786e8d611cbd186512555d30f156568f019d2d7465dce074be36be6cf650dcd00fcbc026edd99f84c4f278f44034693c5b65c2722407ee1c47b7fd0afdb2bdafb9d5f8ba1961561f4b9ee136fb7692faa2af5f4510bfaef3410524c6546909a3bfe442172d98652f99b812df438723bc4ce3d0afc759a7e2ca9991f639796c68691e9cd5e07dc56dea4987eae6406acbcecbb280f435ac4f680ffb69dba43c8f7680329c66ff84019f5d4d69e0aeb403efd9769f0ab00bc09c692dc813cd69cac320bca1ef489b2d9a20cfed05eb5039d368fce35e757bc6f196110b8cb694f90b27cd5817c57c64114c2250c97e9fb907833ff3064b457067e00d8eec4c3995d2b86a85fcc40b430dbe8d4bacf02a21fef03882b0b8b8de304930af07e6f609eb6340972e0cc24ae067922d444f13154377e24529ac5a6723e4478d815407da4e50045ce5bf35906ea91f36b6a1fef87465e619e6b6198092c4a59e018af7ee9379e54a268372d27439f804a56f0644772d499466688455177c2998ea10288b987dbb20c7c24805ac1ac7a60b220ec70c9b26b46b801289d67df759706b00acdfa31776634ee6a02aca3653b2d1b3fecfd30962ed79889864384c3d07896b4c2e8c6fc6aa770369010bcc0ea9e5976d226868da682c19a4e0f218cffc762e543cb3e1e2ca1c29e56da8c2caf16a19303ef057920b619f6b321e43dda2263c3a3b795bbd208d47ccc25258e492f042a2697b53d2a363309cb7b12f497e8df4787fb2aa6d2422358268075a22aa315d707c29a2735469b87a9b1d25b0931790b4404a6afd25fd71ec3e7db5ebe84225a23d7987330374ae6168ce2fe9d4d7cd776701c602d7fe1b2cd5eff596f45819f88cc1ed4b2707f7310832a5ee55824015103853376e05ed49478f7169cd544d83f15af0df27b6de90bda925c459c9d2c89c05564015c19f5d28b7b4f3d00365a35b3ee82735124128a64f918abdbb7472e312eb37fa52a82151771890c52a45b82ffe3b3620515acd0393010688164e018bbe3e48572e9903ee67ddfe0f6742fc20ef33d618776b92f568119d6e2efa8fb0718dbe918f633fc87f87248b57292b14b118666d2c4ee335f01b6cb1fbba06c2261c421a3f90cbbd869f3434cec7c7e07c9609e29fe826187a12e7d83e2b68974a82b938d1cec9c7be6dee2e33d197377f3e70486b6dd9cc4c0ca23722d8f85aa8ff84f80fb7bb1ff519dcdafff9cb679f8377bb8fdc4c76059ffc7deb61045bcc591c58ea52d8989a60ea3e6898838df27d7de3c96c102d8f1df2bed52e9bd3f5b7d69f5d474d39dce0db6557c1462d831e3cf72f413222ce56b67dc7f2f91c41890faba8e4b5619e5337fac300ec9f2ca7519f7ea7c09d7b0f02a1edb6de36ea1f03f8695706e8ca390d2997dd5a9cb273aac96ab87081e5c04e691013219f37659724fe18965d2bbbc46e222cca63bad37a381a28c87815bd8fadf7a357b88378c2dd719650ef02fec4514968dd6e2a00856f34e370bed5559cab6223047ac25e61250c8556cfdb440452f16f6a59efdd8d1bd83c01e80b9b10146a6e0c10933c5ffd9037302c25319e9379c44273ae7aa3e729ab6e6d4e3f9869ce77797e120ca89af0114553d127492eda5cde2dfe40ad861064eef5bd4af401ce1dd8cef7f0a37a55b6ab8ee37a0535e4776c155b29ba4a4dbeaf1b68c6b5b233ce2848f485f63a125c172217644a0e96c07eba0a8db016a2d9ece8068da8b93ad91024f36315568cc8ef4f0ee4dd56ee71a83826ca47bad7f914af0d8f92d6fb5f7a60f3f3896b69c7e12735d89151cfb46f60885f9baa6526bee5efb67880e2940fdc4ff1cdcde13b7a3f90a582baf3afd256f4ba9914383f99e3f10887db9f4af49cad7358b40937d1d89bd46503ee5f43f3ae9976d8919f7abee178b3324d811fdbe6ae6f1c7e170581702f27673e9582bd28f9aa8b4b746d204791e39a4d7f86698ff195e278f469f50d827367319658f5141bef4782172abf66b800885a43f329afb7787e54da2cac63ac7927d26554570d67380ee82e82f89b85b2270edcd21514e021c90109dda53444a0b4acff36c8cc6c4185175fd21cc114e136709a1c4b1327e59a697a718749f1cc1151be6603a17047dfc39df57f6c01a3b2858a459ef0fc69a4012432f190e8f4e998418cfd7f2feab8ad9be9af7deb555943c9d1b0e9970a438e1b885d3926b13c80cf343c83a0904c74a1d9f54f92477070d1e5bd76f7b2026b3e27641cfe311eb9fae7a70f573dc26c79b8b799e93e761610ff7b5946be75f127fca67aa6e7d55e17e5d9af61e68944468f1b3effdc1e0a954d0536ebd71b229c636f1f0be32d032aeeb16a1560c9c5e9b23f4ba92ed68a35101a537640fbccd9e705046a0bf2f7c49ce3063dd250bb55c3374873c0e395de76e8946c65c845185aa72a3a182bec504f8090b8c74b7570772ce4ccae6f2b257e48d5740631975cb2a3440b43bc924ec81a8bc1adf6ff57702fd23df29a2e298c5df344eb9d956e2bd9fa72378729f29fa0c7aa46b763b1409bb7459b28b8c1898183756afd15c5bd0013c8faec19c284dc3d99aead1c7b038feae2dfeb1590f328a099f71d1464f1e8da2ce935e1190a0c87bdb28afb80ee35f3aed52d7d345bda9a98c3a68a4ea1ed8f2a3b0e2b857087dbf4f0239caf0deb5cf326ca6a6ef334cb7d2ec7c4be8620c1c0bad0ceddec41bfcfff0f5bbb7f5578a6e78377f7c79b25c2c96a0197c14e13b1ac1c36ce28bfb4ca4ed19b4797c87eb79c587417a0839175595168c0d633666fdafe79189c9ee13ff8b13db338a1390dd466ab72badf71269a403fdf6684ae5834df05831a9364c4bc8948c21b185c45939dff867778d2034002d02c03d3db4b65c500838199c52c53d3cb1867c75fac9a4564fb07b481e97447c0405774df58f94728ee8956edc5fb815ce7e27f15f5fe6a87360d9703223417288e034c80b6f431a97c949498e779baba0ae45ee97ddf6fbf26b7fa08f162b4af2e717e1de8986e6e0931da0a8451714174fd1fd9e5837fd7fc36591ee5387e3f240d47120d30a7999eaa77d45bcaa3699db3d5b308312ba1b39b623972d16b4d82209b54aac4a07e5f9fd6f3628536e3b94e5a385127c32c354a8105723f40f997ed126e668cfb6f59f14fe477fe9e98f8db1533438ee594c61ed289b95a1a4da12358ad1c3bd8919a2324f5d1ef5f2af21eb12ddd2fbf15169e6d09a4c088622fc8208367378b629c697eb5a554fb5894634c469c2ffaa4766b16062af598ec26bf910177d88696b37b976c4834eab8376c3b418ec7256ca6375ecaf4f693dd0f8b268a58b190b84f509858b019336f98bed58a7351235b36d987d984840e29e6e4ded1210508615fc77ea54fa8c565efc929c3b911502ff88bb55074826636ff7510e8d3d19d415bd974f3cd9355fa43b3f829f1f945388dc64b11cc79df075a858d029c3e1344acc02220ebfdcdeb3cb7134a2ad742d4d93a396fb608108485a7de84735f52499dbc2576f596dbf007834a069531f66a638dbccd123fc35d1e189cd6ed135cc28008dea289c9b6d6ccf69bfe95a0b2d0583648e7bf3bf1f7eb403162daf9658d3ed5523857765bd0faf846d71fc0aba3021ffbf30ff6bcbc2fc7cabb219ba81341154d55ffdb324c25c8f99fd6de84f95093edbe068974c91ebc1b94756ecca886399b23867d3f55f927e76c1df5b11630c7239c98b3ea5f736c9921ef3852a6dcd09fb32c58502691ae438b6b666904691348681a976806bc64a981bd00393fb94e787a4bf5de4e187f8a06e63d58d34ef3dc9628e5bbe3fd8f33af1d23a3c1cc215f328a8634eaebb86f0be10bfe3afba6c81383a0adfc5dbad5fbe298464b06b444bec1274a8482a480c308f2374f80f7db0bae74d500fd4e9558363ccb9515db621897b6a86111f3cba50718b5105de3415173f41738f6684b46c3351e126f2f29ab6cf51faa464679838a9e269ad8bfdac478976ff3bd0d67ad641b2f0594520473f2ad8fb49744fb0e4906306e31149e07b01928d36f7d7516daae6f1e1d7588bead66b366e8d0eaf8c33483e247f44240e40fe06f1d19aa4fa3a9584d80ae7dc8f1940b7ec3bfb23650eaddc812f2d7c9a8c54477e622afbb63f2fd1d800180919c044fa072f8a63748e26ddf7617196c71dfd3edd93f09e2b877f6a824e74c8db05b5454a1d31aa600417eda9b53fae3b799b01bceca899010e96d5d017a4c17bc48059cc6867e8e0c33c73fd7bc04b840285d4af9928c5395a5349228f4eba99f036e18b3f57887527b74585c60ec2e9176bd03e79ff668e31a5c61d080042d4e41df53f00ab2751e050af84ca99fdfb37d7aa45124cbede3dde8c457fe36d05a548777760813fcde5a859392511f17b2b50badcd341ae821a5c9b1770fb627d066f0f5ca0b7b0bb68d7ec855665c47fa9f5e9fa71a33c5f228c2c1b8992d9ab63fe0da6764f0ca0f4f4c5b6c7ba28cbfad503a458e7ad3d1f8fd1fdd6048d6a5da11693fdfc28699e8eb4eb06dbf871b11ce6d5d8e8c1ca6158bf419123ba0eab134cc15c1ab27d8698e26704784e5409abbc7c03bf409df52e75aaa3b07263c08bf41c91155f5f77aeed7714ae266ae244fc2016f083b8f4672808e4f3750ae1f7676c983997391ee788285058b138e5ae76ca8e7a496aaf53d4079bb9376b5c560a9bb56aad774e1545808999487cefb3d3d0dc606950e645111ac90676007fe01fc49d2e8d4e01a2d68bb330ae444305485c50c614938aaf09a6ef569b7cd5b161ca198d92201d7b62694b9602a1be89fe75d15513e40d59fedf77e11c93d1a49a4e6209dbd6319c39b81935ea53226339ee7cf1154e63f55e1ad71ee943a4e62e87e409cc4da01672e33", 0x1000}, {&(0x7f0000001cc0)="f8efceae80e7b5f69d34090709c3392c6dedcf77b63e4787505129f8d2e85b5220b0ca2051e5c0104ed030b60fd5ed1075794b187f87737245f3bd1bfa4d8104afec807fa66478ccb9e7f5976ed8f1dc7f6afec5c2bba8a7511dfc26e998a7bca82f820d50b5d26651eb87969d6ad2923b6fe2af893fc28da5d728d0d994749f4a0f65e02e7345e7bbc1e13e56d254b150d0d39803c48b5513c8d5a428cdb149a8886548fa8fd6267d7914ac565ca6dca9e8b248077a3d93b3c5ac024cfb5b23fb2d8a5efdbb9701bc3d5d3986a798e7af6bfb3b8ff1108a70444bcdec96965ec546b8bf9bc8b10e809b4cdd1b99b763b9f9ba9daaa6facbf0af6cd2e732cd88a14a45fc2f1c9929be6aa3b2de3ee9a4385fe0c3788b62c0ad2ab2d15c6f1f80260c4b6e1fd0710c7a7814eab06c16f6085f90a588b6d68b209e1d8b238a777ad023c9865d0d0147433df0dcf85a9658aa8afdeabe8626fe65a1d34347db9779f890396c225048c44d66a9f03ffbd448a75a644e221260fa3eba79ad06e4efb7d2d52aaa6fc533cb6df7be837a149b9bdb53cfa7a940c93adf35afb8b0a1b4ba60751f969a73ccc7e4593b5632780502f8c8ffdb127e2949b76cf297325be8b96b03d01ff1ee1fd33ea902ed7c078ed1d9c08e341a54666f759e91b5411f3c1fb5aba8384956f7a598d5955c7a7cfef766c347b4086eb185ee9ac9b5994ea49ca8e94e3f62b60744039a9f0741dd9c8455fc60629dc8f6bb2a9520ca47979f13bf20fec7208ddda10182caa0c9db80e8be4156f0553f6e2f70933caf6c43cabb282f932e8d57c72b715ff3fe3994790cb51f85b1059ea9c62145a51f0f75c18e4878387ed1737cc3336ea8dd0680070566c708efaa6ad79815775e7bd99b4df4f8717ab634e323afcb6f718983f4f564301eeda931e23779bf2a12b8d1fc194a875cd3760b220c8222d4cd1e91a27e34255e3be152421a1ee5e17f24efd934ae327ad55090e5e47a343e028f0104ed23294db2595eb37cc4aa6779dc81f1a7d9e13fa1bca85f3c223057dde88896d08cf08843acfcd5ab0b6e6e79bd2a2cc6a780cb0c4244df942fff02471f113f2b4d855b3256baa04abb09af9deb029c0097b2e05a5e1e35c9b3f888cea772e07f4f7fbb5b8eb931184ee64c50b637603a452f7600f2b9074eefcabc71574924a784b5e2cc3dd58822b8dbdd32db30061c1a56fb1bb5ce9ec86730c4f8835ef919faed283bb009343429eee640054c26012e11b23627c01b7751112a620fe7ef9156548917036c0b6e434ee8fb9413fb6fc587faa44bb7332a7bb6b0060b136754c3d5844691fc32217223f61714f9291b76c45eca5e329a0668848ed2bf20c422dc0896c9f862f1df2335aeec0974f1bcc0f853f8221e927fe9bb69eaf3f11c8c822cb1e64bfd719a1b58df108d8a3c5130020f1fdd1fc99c9064a9c5ab362f2ebf6f80a71ec16d284c9bf1997a7af9f99651557a2445d97388640b9d19f3906eda58401475b385a43f518a3e10c7aeff34fa28f4a4e4b0d6b0237ba9cb333657a009762a09606a8c3c8a94720aa5edc14f6d03222ff3ddcc25527ae474b8cc8b7216b75db97dc55af2fc518f401bfe0dd91aecef5c3ee7d635acb88609e1cd0fbf7068a28b672f4be7e54dd9ce53b2abba85e7b8a45a3337e0a341e634298c0724e40dacaaea60f94bc15bd01680d5f69c3b0d03180578f555e1ccd31e95012e823dcd4e75c809321cdfe309ac5a6eb81b4d824cfedb85a0aa93a6376ffd6955ecdfe6fd2a05560b3f13ce22bcf00b6614dfff27f26e09f3bcf025fea12f0871768f3df1711f3ae78171e4cdb5856bdd603945d03803a6e75d8a9e819b7e681d22e404afd8d7c19d1ef0dde81e0a9a695019fafdbdd4efa7d4962e73c6a6983bf0bd3dd4f1798fbc441f9c39d3f7f9ded76c15b96fe8f4998c3ed1b3834ad13b46aba05adccf3e98d5d5ef66e710b9643d5371167cee4778537bcbf801209a4d8c94767aa88d5635bc82fc6ebe691b133e36705a5b92b51e16a457a423f2fb36619d52258d2c7deb12bed61d163b46a75e1fffc27b48b2c82a10b9df2f109acfe4c577be0d4c3aa2e43b21d220459730403473f40f91405b444641f3f19cecc40da46485b80949c9ee928e3b4b6a6d2edde78431b45d2fd1c2ef1ada352345ce3b9925912424907b17b30839f7ca4b7f35d55a9c230b26a26c0f44a4ee79a747e5f7033d3329e3c91d0c77a7f58c3a291576dc26ce6a57ab5887dad1da3a971d96020045fa2e6e0bffb4a6bcfd03f7c93dffdc1bf4ba161f20ede4486f0225b84e5813347adc1140357ed84c2e7d44678c9c25c49fb543c6fce172095a777f93bd7d67e6c9019286c9ddb9dbbfaf20ce47b5881b5e59630759372bc7a1f5c1bc1cb5607abac61ff1a9aa16624a11b34aa465bf81196af8a33e8da34ad6e3c6b9be167db84040a3a5c57b9ff9fb2d1e73e9d0b4d3fcf4226f4e9cc22ab3ed5557a0a8d7fe5b3edc274191200f46a347a74af55c08e0ec40296c3078c265d8729113eb932e1c15577a921dc0315b0a1ae20a499c3e979d1ae55de48727cff9f9cdbd0223cf652d3e43814f18f0fe5c31c39568430118b9c98d5dc444e6a55ee22709fb74072b247696bf27aa97c2e5a1abfc952af2b403212bfb25b248eb06746d587bf14e3b2ea2979105bb9acedbdf86f293284c3820c46fcbd3ff73cb979a664c904bfe9c605261b6d9c99113f5e0cfadb77a24bbb9a9671cf851808157ea108b85897994ed15a826f671febf9bd39929326ecf63af60ab2f7a5d9aac1b4cfaf644bf9c505702cd792ef48a5b9048030c2f2df9a787b8f6209073a01a967aab075f4a5d61522adff14b0b8194cf00948d11023391105df2cc9936440241d9a9449c1aea355dd853e8424d8ffdac7fd1b112ad0e77cede828b4cfdef42f5dafea78207a98ad13ffe207eb6a76c6629390231f73261a5898289c243098ceb213f67f9eefc0b6282b820eb008f51128dc00e8e2d29645af53886d902e0bb07b3dd4522274e17447f38de045faa133786aa42b317145a62d10ea6d6a9a9137622c57df6d05c751beae17b427bf50006c1b0dd28b61968f40cabe991aba3cbab1377d1adfd75532ac5a91cc3b44f837821281068a17e34ab0d36960b3ee101e45421f13d67e9ac75f0952908c78c18f083d8961b095e51931effafec374e01da2405807416f6fb3a0d82d3da6b334f3a65c260907aa8b7c45983171d12ad76558b1c49ee8bbcf9b002069ce3fb8155b68c7d0e041d33542d0117e08b8d2473c3653de72fcbed4f1a73a3fd2a46f91c6068c3ce5c55039ead418e9ae3a96994c2bdcae1da3052703ecdcb14aad289acd4926b34c402cee94c8cefe899ad6568c3a4a0aba2bc493ebcd58856460b5debd5e9be26e161bfeb3229dc1d652b2ea40c0543ad66837c4198a5525ebfc6a8064539b72dc1f7e8153fa947a5c0292053e32dcaac512fe23ddf8bcbd394296d896c57100cfba0b1787455c1cece0ca055f8e679a301b6dcadd7429f3c51a50cbce16b46b519899f0a70e4bb69297b9223b357cf69e119a5bfa4f5d4d9797d4b44e2aad1bcfb99d2b0a4a12a7a255aed8b3a4bf148ea0a0f96cd6d8079881bd14849eeb44fb8beef6b5a5b3281fa7ea89da2b082c2cea06e8a57fb7a45d415e8b4bbc7716d152872740710943371cb608f970b702318bab656c88c33d9a6643d3995564bdbe30dc163ce3099644beed4cb867dd7074fae382cc19f74313629ab11e79555b358b134181c3e61d454364d52c5d391402e8aec902b304a5bd30d9895ce460774a498e421cb1b2f15a1c953942784a0b11bbd034b97f7c933a64f7a33e1a33c58d97a943d331711a5d574e4743d499c33344ab8f5f8ad34c52d791fd7dca2292cbb16103e7ee5e975e5fbb982dfa6e83c8575febbf55160fee41e7c98e46434f81ffb8299cc4fde66841d48f757597c7fba70ecfc754dbdee2e74de66ac625b59e9683fbaa403038cb86a1cb69c6be0f1b6a16a645bf0853a48869699207b479ecb2cf102a856aa667d2317c2d8c148e5840c24ad8289e46e9fa51b9bf45a6c009ec1717bb04ca450ec53da93c4b29f3967a0077166d4cd7d5fcc448b57038cdb258202652dd97fffbf5a9c6f77257d847e46004e8cc03c8c1b4d52adbb89a1ed96322999d2bacb2d043da15a539827e1a4f70922ef9630d9e72b76272693b964b4eaa650d787df63e00cb83ed7814edf1523b95113bc6d58b0325fb95efb707d94f336ea1fd5ca9af05b1d2cdc204f90af3858a9e4d044a83c8e02febc96d4a9346e8b3d643cf7212704725fc6af108628023861249722728ff1a6b54e676678206be96152361b8cfacecad64d26065c10c61516fd433f5532c527fd21e320fa7a56abda491759afb6daa94af0f0e429b771ec95f77d2f23e4c967f96daa7d447e56bcc84ead0309c98d3056e6e5a2560bae573fe931c62c6bbe9b2482790157f7570b62cc9855c7fb086ae63bdac65a7b930d5a61a81e5414a70f5836e89292adf1bb075f20f4ae577bdceab92bacbaa84d88f22605937191427636b09e740bef655bd85388fa7cc8bcf6fca5fe9a0812ec1668ef4bb9168c8c1d9fd32d34a7914a3bd5907491c18efe85248cf03c9e088084611a69309ea789f1eb72e495f429945a23c513e6e6718f2229825c48ef6738b922342e709e71a13853020308ea00bd3f6c79363df7e77366e3ffea9a9bc2d861e20e86fc480619a6a6787753c272210594fce6b92551eb4806a40a1fa66f7911a12caa153dce32738eae25e803243a0bb8e5d6e4b4402dc0be53e92938b56a5332160c9b327da7f4ddb8413f8cbf4a69fb43ecbd7f978874388f626ab8f962bc675252d29e4d92a18a61837891876d95b6b10b0e9c772b6ae8197fcd179ed29e3e91448f94547317d144252c4b7b1ac9393fca557fc56cd53be850d8dbabf7d7c1ac20065a490d474d0032d9c08a155244416f4a787128fc95c550b2b3ed9199c796cd00ac0fe1ac40ae2eded2d03119561be69635dc48e444849ac63aeb33b649b9f6edcd11e7b749bc3bc1fcd90d8890aa149150aa29df0fd451e21e0eb90e5228e78fee2a462dc5de70672e8ef8c380b8d920eda4234682c6c80702fbcacae965418ef5b353e9049d78b45414fbb675dd24cb3c424092393ebfab10055d9c3050084974a5e6e20e26b9614aa39ecba56931989501477e4103bf9e4f53d561663f8242ef44be86961bb05ce50ea53c067fab018979f7dc927a46ac300374038d34e12ff365de25d79297c34c6e5a9aedeb954d592184c9fdb6e77c37f9d359b26a05f7c13d609058b4eaa8cf33b759a35902e70162b3f48328c68d55549870b3ec60c35f1f8180327d58e260a5a999f8e88a7b5828ebcc656b5ae9861f5923405caf582877527f94e3f8a5b69f460b0ad2b472b58a08e35d475744d4e9f07677dc632b1dddc8c8b33d09f873684a8f9fc6b9a81eecaf6bb9b51a0e6fae135adeeae878c876950fb9675bbc309755ee90fd4b270085d57d6c60e5671b8cce1deba44dc23cde7a94943d46a9abcd45c915678dff30e80ccae2f8c15524220581da2c657a9eafa7eef7b85682117058695e4cf8a893db8cc52aa13b56cc5e1f4669b094e9cfbbec868bb76349d16b0e2de96318957020259d79c0bccf78b7c28db1f986c8cb011562823ef6733b8262cf9c9f28858f49b29920bb1fa2a231ef1eabf62ca03594043d5606a05814", 0x1000}, {&(0x7f0000001640)="4e21bffbfc3b8b896999b24b6f803244e72b3c781ecfcb3fbd108b98a664a0e992620bb12f1d944d8e68e5bbd450ad7707b72ad80ebbc3d155e4902118ceea3b34b8e727db9c46d95d8d03efbce6050112256cc766b80098ef19e894eddfa1c86a76c4811d54115ada93532d95a7634e9fa786ea1939e73d1e3aa822e24129145fc700359e6d65be8a69e61f64b865dc97f2fcf67b297715d1a8525fefe31ce68539b44d521fc2f52ab4bfc0597ddc3b42ce9fdbee5ce7c49063a255906bc71595248e7cd12b104e26c44a63744f2e073f7df1ad8c3b570233c332220672178367f6e2921bc9127f5765", 0xea}, {&(0x7f0000001740)="45c611e4c90e1fe118c94ed049b5d11804b1476ef59e57f8b6192d7196b89cb3d15b89c7778202eeee611ab161fb307598dddbcc31d2c08ad13f54943c74f708d09f38f99bfc6803736d7e25a542528e8b0707071a61b912da716eb7547eaa1d766c675aee2119ab86fa1dc70cdae6e64f61909efafaafe8208ea3ccfe5b74d11a0d38c509c6261da995a790efbe8bf8e335ee6e58715cf8a0a341cb9a6592ecf6cb32a08c3b2b2b537c352e71c772df93cd02f47b5eaca51468d9e3cf87c361cf9ef777c46f222c15c9b5d2ae91107cf0f0d3cacc3f1ac7db74316431", 0xdd}], 0x8, &(0x7f0000003140)}, 0xfffffffffffffffe}], 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000019c0)='/dev/sequencer\x00', 0x200800, 0x0) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f00000018c0)={0x4, &(0x7f0000000140)=[{0x1ff, 0x6f3d, 0x9, 0xce}, {0x100, 0xff, 0x200, 0xff}, {0x5, 0x1, 0x4, 0x81}, {0x4, 0x9, 0xfffffffffffffff7, 0x1}]}, 0x10) 03:36:21 executing program 1: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000440)='/dev/loop-control\x00', 0x0, 0x0) creat(&(0x7f00000005c0)='./file0/file0\x00', 0x1) accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000780), 0x800) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000007c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) dup(r0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000240)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000000)=0x40) syz_mount_image$vfat(&(0x7f0000001680)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000dfff, 0x1, &(0x7f0000000040)=[{&(0x7f00000016c0)="eb64c86d4f66732e66617400020441000500077008f8", 0x16}], 0x0, &(0x7f0000000300)=ANY=[]) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)) mknod(&(0x7f0000000500)='./file0/file0\x00', 0x0, 0x0) request_key(&(0x7f0000000540)='encrypted\x00', &(0x7f0000000580), &(0x7f0000000480)='vfat\x00', 0xfffffffffffffffc) timer_create(0x0, &(0x7f0000000180)={0x0, 0x0, 0x0, @thr={&(0x7f0000000540), &(0x7f0000000200)}}, &(0x7f00000003c0)=0x0) r3 = perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000001c0)=0x9) openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) timer_getoverrun(r2) stat(&(0x7f0000000080)='./file0/file0\x00', &(0x7f0000000280)) pwritev(r3, &(0x7f0000000b00)=[{&(0x7f0000000880)}], 0x1, 0x0) umount2(&(0x7f0000000140)='./file0\x00', 0x0) ioctl$KDGKBLED(0xffffffffffffffff, 0x4b64, &(0x7f0000000100)) 03:36:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:21 executing program 6: r0 = socket$inet(0x2, 0x840000000003, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_int(r1, 0x0, 0xc8, &(0x7f0000000000)=0xfffffffffffffffe, 0x4) setsockopt$inet_int(r0, 0x0, 0x40000000000c9, &(0x7f0000000080), 0x4) [ 482.703494] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9353 comm=syz-executor4 03:36:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 482.753716] binder: 9355:9362 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.761836] binder: 9358:9365 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 482.761849] binder: 9358:9365 transaction failed 29189/-22, size 0-0 line 3013 [ 482.762036] binder: undelivered TRANSACTION_ERROR: 29189 [ 482.787150] binder: 9355:9362 got transaction to context manager from process owning it [ 482.795403] binder: 9355:9362 transaction failed 29201/-22, size 0-0 line 3004 03:36:21 executing program 1: r0 = socket$inet(0x2, 0x3, 0x2f) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") r2 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x7fffffff, 0x1) ioctl$TUNSETTXFILTER(r2, 0x400454d1, &(0x7f00000000c0)=ANY=[@ANYBLOB="01000700aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaffffe9f0fd063723aaaaaaaaaaaa000000000000"]) sendto$inet(r0, &(0x7f0000000100)="74613dd1120770b6", 0x8, 0x0, &(0x7f0000000040), 0x10) 03:36:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 482.803842] binder: undelivered TRANSACTION_ERROR: 29201 03:36:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:21 executing program 6: socketpair$inet6(0xa, 0xa, 0x7fff, &(0x7f0000000800)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000880)={'ip6gretap0\x00', {0x2, 0x4e23, @rand_addr=0x7ff}}) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pipe2$9p(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) write$P9_RUNLINKAT(r2, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) getresuid(&(0x7f0000000980), &(0x7f00000009c0)=0x0, &(0x7f0000000a00)) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f0000000a40)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@version_u='version=9p2000.u'}, {@cachetag={'cachetag', 0x3d, 'version=9p2000.u'}}, {@access_any='access=any'}, {@version_9p2000='version=9p2000'}, {@mmap='mmap'}, {@mmap='mmap'}, {@version_L='version=9p2000.L'}, {@msize={'msize', 0x3d, 0x8}}, {@access_uid={'access', 0x3d, r3}}]}}) write$P9_RREADDIR(r2, &(0x7f0000000b40)=ANY=[@ANYBLOB="99ffffff29e8d90000000000000000007b0700512f66696c65300000000000000000000000000000000009e9dd7e626e56a82230ab37a14be6dc64eae724d41ee5b8d6e8221bf67e0a0b96cab14dc1b81905ee846fd402b67929bbb63ce9f321080551"], 0x2a) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vga_arbiter\x00', 0x80000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(0xffffffffffffffff, 0x40505330, &(0x7f0000000600)={{0x7ff}, {0x40}, 0x0, 0x7ccdf13147df7b60}) write$P9_RGETATTR(r2, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) fchmod(r1, 0x140) r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x80002, 0x0) ioctl$KDGKBLED(r4, 0x4b64, &(0x7f0000000400)) getsockopt$sock_cred(r5, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000440)=0xc) perf_event_open(&(0x7f0000000740)={0x3, 0x70, 0x3, 0x7fff, 0x1000, 0x3, 0x0, 0x8cf, 0xce4618ee8b66b075, 0x2, 0x7fffffff, 0x6, 0x8001, 0x6, 0x4, 0x70d7490c, 0xffff, 0x3, 0x5, 0xffffffffffff83b6, 0x0, 0x63, 0x8, 0x8, 0x9, 0x1000, 0xfffffffffffffffc, 0x5, 0xfff, 0x7fffffff, 0x3, 0x2, 0x620000000000, 0x0, 0x80000000, 0x0, 0x9, 0x6, 0x0, 0x2, 0x4, @perf_config_ext={0x0, 0x6}, 0x4008, 0x1, 0x6, 0x6, 0xffffffff, 0x100, 0x3}, r6, 0x8, r5, 0x8) mount$9p_fd(0x0, &(0x7f0000000540)='./file0\x00', &(0x7f0000000580)='9p\x00', 0x1000, &(0x7f00000006c0)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}, {@uname={'uname', 0x3d, '9p\x00'}}, {@cache_loose='cache=loose'}, {@loose='loose'}, {@nodevmap='nodevmap'}, {@mmap='mmap'}]}}) write$P9_RMKNOD(r4, &(0x7f00000008c0)={0x14, 0x13, 0x2, {0x90, 0x0, 0x4}}, 0x14) ioctl$IOC_PR_REGISTER(r5, 0x401870c8, &(0x7f0000000180)={0x4e3, 0xffffffffffffff6b}) ioctl$sock_inet6_tcp_SIOCATMARK(r4, 0x8905, &(0x7f00000005c0)) mount$9p_fd(0x0, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='9p\x00', 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB=',posixacl,version=9p2000,version=9p2000.L,version=9p']) umount2(&(0x7f0000000500)='./file0\x00', 0x0) [ 482.865516] binder: 9371:9372 Acquire 1 refcount change on invalid ref 0 ret -22 [ 482.874113] binder: 9371:9372 got transaction to context manager from process owning it [ 482.882738] binder: 9371:9372 transaction failed 29201/-22, size 0-0 line 3004 [ 482.892167] binder: undelivered TRANSACTION_ERROR: 29201 03:36:21 executing program 7: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x101000, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r1, 0xc08c5335, &(0x7f0000000140)={0x3, 0x4, 0xfffffffffffffffe, 'queue0\x00', 0x40}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r2 = socket$inet6(0xa, 0x1, 0x0) readv(r1, &(0x7f0000000780)=[{&(0x7f0000000200)=""/97, 0x61}, {&(0x7f0000000280)=""/225, 0xe1}, {&(0x7f0000000380)=""/246, 0xf6}, {&(0x7f0000000480)=""/92, 0x5c}, {&(0x7f0000000500)=""/231, 0xe7}, {&(0x7f0000002040)=""/4096, 0x1000}, {&(0x7f0000000600)=""/129, 0x81}, {&(0x7f00000006c0)=""/172, 0xac}], 0x8) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r3 = userfaultfd(0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000800)) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r4, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@local, @rand_addr}, 0xc) setsockopt$inet_tcp_int(r4, 0x6, 0x10, &(0x7f0000000900), 0x4) close(r4) ioctl$EVIOCSMASK(r1, 0x40104593, &(0x7f00000000c0)={0x17, 0x40, &(0x7f0000000080)="802623906502bfa624543f7272522a3300c3b1509fd9132b4c9a3298ad016f11be1f6e310ec9836fac741e2ceb199c861a558a19ca378b746c630ffdd212e2ae"}) dup3(r2, r3, 0x0) ioctl$SG_SET_COMMAND_Q(r4, 0x2271, &(0x7f0000000000)=0x1) 03:36:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:21 executing program 5: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/autofs\x00', 0x200000, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='coredump_filter\x00') sendfile(r1, r1, &(0x7f0000000140), 0xd7) add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffffb) add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0), 0x0, 0x0, 0xfffffffffffffffb) r2 = add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440), 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f0000000340)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, r2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000240)={0x101, 0x3, {0x2, 0x3, 0x5, 0x0, 0x3f}}) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f0000000500)) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000180)='./file0\x00', 0xe000, 0x0, &(0x7f0000000040), 0x10, &(0x7f0000000240)=ANY=[]) getpid() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r3, 0x1) accept4$packet(r1, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000002c0)=0x14, 0x80000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000480)={'bridge_slave_0\x00', r4}) timer_create(0x7, &(0x7f0000000880)={0x0, 0x1c, 0x1, @thr={&(0x7f0000000780)="3aea1594d2a6eb7d14df05a7f6a956e40dc007e8a597fbbccc429623c0", &(0x7f00000007c0)="08b30f6cc7ae5d715f1bc4ac9867d2905536eafd6810ab37189c8341ada86202044a123e536c5df650d94d6cf618260348f91c65edff1d8dfcde122615adf496073aa4101e822728fde3accd80d3431f8412e27c3813256c625ee4177a0317a1a8bc92bb4afc22fa0149ad97b3284edb14db4803815e31625e41ba87f4a1b3078b6f948d87af41de41"}}, &(0x7f00000008c0)=0x0) timer_gettime(r5, &(0x7f0000000900)) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000740)={0x2, &(0x7f00000006c0)=[{}, {}]}) lseek(r3, 0x0, 0x2) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f00000000c0)={@multicast1, @dev={0xac, 0x14, 0x14, 0x16}, 0x1, 0x2, [@empty, @remote]}, 0x18) r6 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) ioctl$FS_IOC_RESVSP(r3, 0x40305828, &(0x7f0000000680)={0x0, 0x3, 0x6, 0x8}) r7 = open(&(0x7f0000000000)='./bus\x00', 0x0, 0x0) sendfile(r3, r7, &(0x7f0000002780), 0x8000fffffffe) ftruncate(r6, 0x4) 03:36:21 executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$random(0xffffffffffffff9c, &(0x7f0000000100)='/dev/urandom\x00', 0x8340, 0x0) sendfile(r0, r1, &(0x7f0000000140), 0xb421) r2 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000040)=0xffff, 0x4) syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, &(0x7f0000000080), 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='overriderockperm,iocharset=cp850,cruft,uid=', @ANYRESHEX]) accept(r0, &(0x7f0000000300)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f0000000380)=0x80) getsockopt$IP6T_SO_GET_ENTRIES(r0, 0x29, 0x41, &(0x7f0000000180)={'raw\x00', 0xe5, "c9830848ee2657b82509e240762a1f410d256cf69f34db80d287676e6ca8da631497784437fc1d7eba7d83faf98d587598d0a588f226022fda758fe246c646e105959b95c72f5f8a9e808c7a427f718bc9eb9874d78ac876e79fbaeacfb52c476d826e6785b85b5d725820415c0339fe3bc82edc57c10035202d7a8fe18aa4bc64858605abca1e6edaaa1c15f820eb6ff904e52e937627391e9857c3dad46a1e736ecc10c1d988b285b82a080d9dbe2887cdd2330e50867496ca8bd083d90da14861d4923c55a71879f9ce1f4e5b84cd901a43aba95d342265f5d727850d8504be63ad5f14"}, &(0x7f00000002c0)=0x109) [ 482.958547] binder: 9378:9381 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 482.967077] binder: 9378:9381 transaction failed 29189/-22, size 0-0 line 3013 [ 482.975778] binder: undelivered TRANSACTION_ERROR: 29189 [ 482.991892] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9382 comm=syz-executor4 [ 483.046015] binder: 9387:9391 Acquire 1 refcount change on invalid ref 0 ret -22 [ 483.057682] binder: 9387:9391 got transaction to context manager from process owning it [ 483.066480] binder: 9387:9391 transaction failed 29201/-22, size 0-0 line 3004 [ 483.076003] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.083225] binder: 9390:9392 Acquire 1 refcount change on invalid ref 0 ret -22 03:36:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 483.091969] binder: 9390:9392 got transaction to context manager from process owning it [ 483.100301] binder: 9390:9392 transaction failed 29201/-22, size 0-0 line 3004 [ 483.109554] binder: undelivered TRANSACTION_ERROR: 29201 03:36:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:21 executing program 1: stat(&(0x7f0000000280)='./file0\x00', &(0x7f0000000200)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$IOC_PR_CLEAR(r1, 0x401070cd, &(0x7f0000000080)={0x8}) ioctl$RTC_ALM_SET(r1, 0x40247007, &(0x7f0000000000)={0x2e, 0x2a, 0xc, 0x2, 0x2, 0x1, 0x4, 0xf1, 0x1}) ioctl$sock_proto_private(r1, 0x89e6, &(0x7f00000000c0)="14f4a715ec8f07658f631aa5cbcd99a3bf0389a84ba126eec53d8b0dd5dce098dddb4b500171fce9f3451d4be0b921cfa530f93253477dedf9444e2039c15fcbbcecb6098a1736e5092c55cf6fa42919337c8ee5781f01ee56a1d3676b625fc07d2eb25ef9c4934e31299c1880220b2dad1fac780fda8ded00f6c389170c210c71682da05403664fb02ef7223112c0d28ef064525b68316c2262c610") setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x60, &(0x7f0000000040)={0x0, @empty, 0x0, 0x0, 'dh\x00', 0x0, 0x200000}, 0x325) [ 483.199774] binder: 9396:9403 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 483.208198] binder: 9396:9403 transaction failed 29189/-22, size 0-0 line 3013 [ 483.219594] binder: undelivered TRANSACTION_ERROR: 29189 03:36:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 483.271274] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9408 comm=syz-executor4 [ 483.289704] binder: 9407:9412 Acquire 1 refcount change on invalid ref 0 ret -22 [ 483.304642] binder: 9407:9412 got transaction to context manager from process owning it 03:36:21 executing program 7: r0 = socket$inet6(0xa, 0x802, 0x0) ioctl(r0, 0x100008912, &(0x7f0000000100)="025cc80700145f8f764070") r1 = socket$packet(0x11, 0x3, 0x300) r2 = getpgid(0x0) sched_getaffinity(r2, 0x8, &(0x7f0000000080)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'syz_tun\x00', 0x0}) r4 = fcntl$dupfd(r1, 0x406, r1) connect$l2tp(r4, &(0x7f0000000140)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x5, @dev={0xac, 0x14, 0x14, 0x11}}, 0x4, 0x2, 0x3, 0x2}}, 0x26) bind$packet(r1, &(0x7f00000000c0)={0x11, 0x0, r3}, 0x14) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000000)=0x2, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) 03:36:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 483.322828] binder: 9407:9412 transaction failed 29201/-22, size 0-0 line 3004 [ 483.334874] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.340430] binder: 9410:9415 Acquire 1 refcount change on invalid ref 0 ret -22 03:36:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 483.340972] binder: 9410:9415 got transaction to context manager from process owning it [ 483.340985] binder: 9410:9415 transaction failed 29201/-22, size 0-0 line 3004 [ 483.355720] 9pnet: Unknown protocol version 9p [ 483.393674] binder: undelivered TRANSACTION_ERROR: 29201 03:36:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:21 executing program 1: r0 = socket$inet(0x2, 0x200000002, 0x0) r1 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) r2 = request_key(&(0x7f0000000180)='user\x00', &(0x7f00000001c0)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000200)='/\x00', 0xffffffffffffffff) keyctl$link(0x8, r1, r2) setsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000080)={@multicast1, @local}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000000)={@multicast1, @local, 0x0, 0x1, [@local]}, 0x14) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r3, &(0x7f0000000040)={0x2, 0x0, @local}, 0x10) sendto$inet(r3, &(0x7f0000000180), 0x0, 0x0, &(0x7f0000000140)={0x2, 0x4e23, @multicast1}, 0x10) 03:36:21 executing program 6: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer\x00', 0x80000000000046, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000140)) r1 = perf_event_open(&(0x7f0000000340)={0x3, 0x70, 0x100, 0x0, 0xff, 0x4, 0x0, 0x0, 0x800, 0x0, 0x0, 0x3f, 0x5, 0x0, 0x52e, 0x7e5, 0x4, 0x45, 0x80000000, 0xba, 0x10001, 0x6, 0x40, 0x0, 0x0, 0x401, 0x0, 0xffff, 0x81, 0x401, 0x100000000, 0x1, 0x7fffffff, 0xfffffffffffffffd, 0x7, 0x0, 0x9, 0x8, 0x0, 0xe35, 0x0, @perf_config_ext={0x7fffffff, 0x4}, 0x8800, 0x0, 0x85db, 0x0, 0x24, 0x8001}, 0x0, 0x3, 0xffffffffffffffff, 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000080)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f79805854fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x20, 0x4800000000000000, 0x0, 0x2, 0x1e, 0x1, "c946b95330b93f1fc0324abe03c3c62022b0c11c7c37e95d5248de034c0e2f4be28acb36f799dbfcdc510cc98759b3d4b9ab5c8d85923042a80cbafd035363b7", "49e3c1b0970fde7907740091c92dc861e9299d7e380ed17a26721fe6aad363362352fe33428f53bf444bc19f16de9ff9b1b3a6bb30fb2e0227bad64777509d24", "919ff2c466aa6d1768b25e900bd84739a65ae40527d758d77e6b676d58f7b249", [0xc5, 0x2]}) sendfile(r0, r2, &(0x7f0000000000), 0x2b428a52) r3 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0xfffffffffffffffc, 0x8000000000800) pread64(r1, &(0x7f00000003c0)=""/138, 0x8a, 0x0) sync_file_range(r0, 0x6, 0x8, 0x2) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d") ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r3, 0xc0605345, &(0x7f0000000200)={0x5, 0x3, {0x0, 0x3, 0x9, 0x1, 0xa5}}) perf_event_open(&(0x7f00000002c0)={0x2, 0x70, 0x0, 0xef, 0x100, 0x9, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffff9, 0x3, 0x0, 0x1, 0x0, 0x7, 0x9e16, 0x0, 0x1, 0x0, 0x90c, 0x0, 0x9, 0x8001, 0x6, 0x6, 0x0, 0x5, 0x46f8, 0x100, 0x8001, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5, 0x80, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000001c0)}, 0x400, 0x147, 0x1, 0x6, 0x0, 0x3f, 0x6}, 0x0, 0x3, 0xffffffffffffffff, 0x9) setsockopt$inet6_tcp_TLS_RX(r0, 0x6, 0x2, &(0x7f0000000100), 0x4) getitimer(0x0, &(0x7f0000000080)) [ 483.441091] binder: 9417:9420 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 483.456488] 9pnet: Unknown protocol version 9p [ 483.462271] binder: 9417:9420 transaction failed 29189/-22, size 0-0 line 3013 [ 483.475123] binder: undelivered TRANSACTION_ERROR: 29189 03:36:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@rq={'rq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 483.534849] binder: 9426:9430 got transaction to context manager from process owning it [ 483.543894] binder: 9426:9430 transaction failed 29201/-22, size 0-0 line 3004 [ 483.552866] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.554579] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9427 comm=syz-executor4 03:36:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 483.584977] binder: 9429:9431 Acquire 1 refcount change on invalid ref 0 ret -22 [ 483.594883] binder: 9429:9431 got transaction to context manager from process owning it [ 483.603429] binder: 9429:9431 transaction failed 29201/-22, size 0-0 line 3004 [ 483.614908] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.689404] binder: 9433:9437 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 483.697156] binder: 9433:9437 transaction failed 29189/-22, size 0-0 line 3013 [ 483.705898] binder: undelivered TRANSACTION_ERROR: 29189 [ 483.793639] binder: 9440:9446 got transaction to context manager from process owning it [ 483.808706] binder: 9440:9446 transaction failed 29201/-22, size 0-0 line 3004 [ 483.817784] binder: undelivered TRANSACTION_ERROR: 29201 [ 483.845835] binder: 9445:9448 Acquire 1 refcount change on invalid ref 0 ret -22 [ 483.855080] binder: 9445:9448 got transaction to context manager from process owning it [ 483.863839] binder: 9445:9448 transaction failed 29201/-22, size 0-0 line 3004 [ 483.867584] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9447 comm=syz-executor4 [ 483.888303] binder: undelivered TRANSACTION_ERROR: 29201 03:36:22 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x26, &(0x7f0000000200)={@dev, @loopback, @multicast2}, &(0x7f0000000240)=0xc) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000340)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x108) ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, &(0x7f0000000140)="c9d2650e6de26702e6875b60855cdfc713cf207c7598fa7143512c0c9058c5201494413fca03bb6e9d6478c2c3d0f1cf694875c403188ecea86ec6c44e7e01a7797d2851a71201e8dafcbda0827f6e4f52ebdb74d52c55c24af0c19a13921486b8f7eee4e03d1d0b9d210f63c8c5f6cccf4dda2d89758ae31e17dc20123db6731d51d6bef59ba3c813") set_robust_list(&(0x7f0000000280)={0x0, 0x8}, 0x18) r1 = socket$inet6(0xa, 0x4, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setrlimit(0x4, &(0x7f00000002c0)={0x23b6, 0x8}) fcntl$getownex(r0, 0x10, &(0x7f0000000300)={0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000480)={0x0, 0x0}) tgkill(r2, r3, 0x22) sendto$inet6(r1, &(0x7f0000000000), 0x0, 0x0, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c) fcntl$getownex(r1, 0x10, &(0x7f00000004c0)) r4 = socket$inet6(0xa, 0x804, 0x80000001) ioctl$FICLONE(r4, 0x40049409, r1) 03:36:22 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x2000000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1000000000002, 0x20000000000000) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$l2tp(r2, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000000)=@fragment={0x0, 0x0, 0x800, 0xda0, 0x0, 0x8f8, 0x67}, 0x8) sendmmsg(r2, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x80, &(0x7f0000005b00)}}, {{&(0x7f0000005b80)=@l2, 0x80, &(0x7f0000005c40), 0x1f4, &(0x7f0000005c80), 0x3a00}}], 0x3e8, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x28841) ioctl$RNDADDTOENTCNT(r4, 0x40045201, &(0x7f0000000280)=0x4) setsockopt$inet_tcp_int(r4, 0x6, 0x0, &(0x7f0000000300)=0x7fff, 0x4) ioctl$TUNGETIFF(r4, 0x800454d2, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x9, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0e630c40000000002a"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f000000cf68)=[@enter_looper], 0x0, 0x0, &(0x7f0000000680)}) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, &(0x7f0000000200)={'mangle\x00', 0x4, [{}, {}, {}, {}]}, 0x68) write$P9_RAUTH(r4, &(0x7f0000000140)={0x14, 0x67, 0x2, {0x0, 0x1, 0x7}}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x1, 0x0, &(0x7f00000001c0)="10"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000000)=[@dead_binder_done], 0x0, 0x0, &(0x7f0000000100)}) 03:36:22 executing program 6: r0 = socket$inet6(0xa, 0x2000000802, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000f68000)={@mcast1, 0x800, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x21, &(0x7f000089b000)=0xffffffffffffffff, 0x4) connect$inet6(r0, &(0x7f000000cfe4)={0xa, 0x0, 0x807}, 0x1c) socket$inet6(0xa, 0x1, 0x0) ioctl(r0, 0x4000008913, &(0x7f0000000100)="295ee1311f16f477671070") sendmmsg(r0, &(0x7f0000006380)=[{{&(0x7f0000000080)=@nl=@unspec, 0x10b, &(0x7f0000000600), 0x0, &(0x7f0000000640)=[{0x10}], 0x10}}], 0x24c, 0x480c0) 03:36:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:22 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x9, 0x9, 0x7, 0x9}) sendmsg$nl_xfrm(r1, &(0x7f000000b000)={&(0x7f000000f000), 0xc, &(0x7f00005a6ff0)={&(0x7f0000451ccc)=@updsa={0x110, 0x1a, 0x1, 0x0, 0x0, {{@in6=@dev, @in=@loopback}, {@in6, 0x0, 0x2b}, @in6, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in=@local}, @mark={0xc}]}, 0x110}}, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x10) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r1) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x8001, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380) 03:36:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 484.122721] binder: 9455:9459 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 484.130441] binder: 9455:9459 transaction failed 29189/-22, size 0-0 line 3013 [ 484.139209] binder: undelivered TRANSACTION_ERROR: 29189 [ 484.146242] mip6: mip6_rthdr_init_state: state's mode is not 2: 0 [ 484.151638] binder: 9454:9465 Acquire 1 refcount change on invalid ref 0 ret -22 03:36:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 484.152307] binder: 9454:9465 got transaction to context manager from process owning it [ 484.152319] binder: 9454:9465 transaction failed 29201/-22, size 0-0 line 3004 [ 484.153282] binder: undelivered TRANSACTION_ERROR: 29201 [ 484.155549] binder: 9456:9462 got transaction to context manager from process owning it [ 484.155561] binder: 9456:9462 transaction failed 29201/-22, size 0-0 line 3004 [ 484.155844] binder: undelivered TRANSACTION_ERROR: 29201 03:36:22 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/sequencer2\x00', 0x0, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$FIDEDUPERANGE(r2, 0xc0189436, &(0x7f00000000c0)={0x6, 0x7, 0x7, 0x0, 0x0, [{r0, 0x0, 0x8}, {r0, 0x0, 0x1}, {r0, 0x0, 0x9e6a}, {r1, 0x0, 0xc3e5}, {r0, 0x0, 0x5}, {r0, 0x0, 0x401}, {r2, 0x0, 0x2}]}) dup3(r0, r2, 0x0) 03:36:22 executing program 6: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x7ffe, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000040)=0x16, 0x4) ioctl$TCFLSH(r1, 0x540b, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0xffffffffffffff30) keyctl$set_reqkey_keyring(0xe, 0x1) fsync(r1) [ 484.258899] mip6: mip6_rthdr_init_state: state's mode is not 2: 0 03:36:22 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='veno\x00', 0x5) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) socketpair(0xb, 0x3, 0x7, &(0x7f0000000240)) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='clear_refs\x00') ioctl$BLKFRASET(r1, 0x1264, &(0x7f00000005c0)=0x80000000000001) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000180)) r2 = dup(0xffffffffffffffff) read$eventfd(0xffffffffffffffff, &(0x7f0000000600), 0x8) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000400)={0x4, 0x7}) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x18, &(0x7f0000000100)=0x6, 0x4) stat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)) getgid() sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) inotify_add_watch(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x20000002) 03:36:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 484.448157] binder: 9476:9488 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 484.460080] binder: 9480:9491 got transaction to context manager from process owning it [ 484.460093] binder: 9480:9491 transaction failed 29201/-22, size 0-0 line 3004 [ 484.460483] binder: undelivered TRANSACTION_ERROR: 29201 [ 484.472781] binder: 9479:9492 got transaction to context manager from process owning it 03:36:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 484.472793] binder: 9479:9492 transaction failed 29201/-22, size 0-0 line 3004 [ 484.473109] binder: undelivered TRANSACTION_ERROR: 29201 [ 484.508755] binder: 9476:9488 transaction failed 29189/-22, size 0-0 line 3013 [ 484.519526] binder: undelivered TRANSACTION_ERROR: 29189 [ 484.688553] binder: 9499:9504 got transaction to context manager from process owning it [ 484.713143] binder: 9499:9504 transaction failed 29201/-22, size 0-0 line 3004 [ 484.723861] binder: 9500:9506 got transaction to context manager from process owning it [ 484.723873] binder: 9500:9506 transaction failed 29201/-22, size 0-0 line 3004 [ 484.724157] binder: undelivered TRANSACTION_ERROR: 29201 [ 484.787581] binder: undelivered TRANSACTION_ERROR: 29201 03:36:23 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = inotify_init1(0x0) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f00000001c0)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000200)={@in6={{0xa, 0x4e24, 0xfff, @loopback, 0x4}}, 0x5, 0x1, 0xffff, "f68fb10f4ae61c30e65fca81ac625551882dd3b43262f68dfec9b057b66061b87903ab790f043be588aa87da1f8534b7e62497521e8a0378c0d773c9ee00f1d98d068e1d5ff1fbe0c241f83a04b7c05d"}, 0xd8) r4 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400, 0x0) r5 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pktcdvd/control\x00', 0x0, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) ptrace(0x4207, r2) clone(0x0, &(0x7f0000000100), &(0x7f0000000040), &(0x7f0000000080), &(0x7f0000000200)) ptrace$getsig(0x4201, r2, 0x0, &(0x7f00000000c0)) 03:36:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:23 executing program 6: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x6000000000000003, 0x6) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='tunl0\x00', 0x10) sendto$inet(r0, &(0x7f0000000100), 0x0, 0x404c0c0, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040)='IPVS\x00') sendto$inet(r0, &(0x7f0000000080), 0xfe7a, 0x0, &(0x7f00000001c0)={0x2, 0x0, @rand_addr}, 0x10) 03:36:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:23 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0x0, 0x2000000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) socket$inet6(0xa, 0x1000000000002, 0x20000000000000) r1 = socket$inet6_udp(0xa, 0x2, 0x0) r2 = socket$l2tp(0x18, 0x1, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$l2tp(r2, &(0x7f00005fafd2)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) setsockopt$inet6_opts(r1, 0x29, 0x37, &(0x7f0000000000)=@fragment={0x0, 0x0, 0x800, 0xda0, 0x0, 0x8f8, 0x67}, 0x8) sendmmsg(r2, &(0x7f0000005fc0)=[{{&(0x7f0000005680)=@sco, 0x80, &(0x7f0000005b00)}}, {{&(0x7f0000005b80)=@l2, 0x80, &(0x7f0000005c40), 0x1f4, &(0x7f0000005c80), 0x3a00}}], 0x3e8, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x28841) ioctl$RNDADDTOENTCNT(r4, 0x40045201, &(0x7f0000000280)=0x4) setsockopt$inet_tcp_int(r4, 0x6, 0x0, &(0x7f0000000300)=0x7fff, 0x4) ioctl$TUNGETIFF(r4, 0x800454d2, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x9, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0e630c40000000002a"], 0x0, 0x0, &(0x7f0000000f4d)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f000000cf68)=[@enter_looper], 0x0, 0x0, &(0x7f0000000680)}) setsockopt$IPT_SO_SET_ADD_COUNTERS(r4, 0x0, 0x41, &(0x7f0000000200)={'mangle\x00', 0x4, [{}, {}, {}, {}]}, 0x68) write$P9_RAUTH(r4, &(0x7f0000000140)={0x14, 0x67, 0x2, {0x0, 0x1, 0x7}}, 0x14) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x1, 0x0, &(0x7f00000001c0)="10"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f0000000000)=[@dead_binder_done], 0x0, 0x0, &(0x7f0000000100)}) 03:36:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:23 executing program 1: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000000)) getpid() r0 = getpgrp(0xffffffffffffffff) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) r2 = getpgrp(r1) r3 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, r2, 0x0, 0xffffffffffffffff, 0x0) rt_sigtimedwait(&(0x7f0000448000), &(0x7f0000d31ff0), &(0x7f00007adff0)={0x77359400}, 0x8) ioctl$PERF_EVENT_IOC_DISABLE(r3, 0x2401, 0x0) r4 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000240)='/dev/pktcdvd/control\x00', 0x1, 0x0) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r4, &(0x7f0000000400)={&(0x7f0000000280), 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x88, r5, 0x303, 0x70bd2c, 0x25dfdbfa, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x24}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_DEST={0x50, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7a}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x80000001}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7c30}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x88}, 0x1, 0x0, 0x0, 0x40}, 0x40010) get_robust_list(r0, &(0x7f00000001c0)=&(0x7f0000000180)={&(0x7f00000000c0)={&(0x7f0000000080)}, 0x0, &(0x7f0000000140)={&(0x7f0000000100)}}, &(0x7f0000000200)=0x18) [ 485.095928] binder: 9511:9518 got transaction to context manager from process owning it [ 485.096527] binder: 9512:9517 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 485.096538] binder: 9512:9517 transaction failed 29189/-22, size 0-0 line 3013 03:36:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 485.096787] binder: undelivered TRANSACTION_ERROR: 29189 [ 485.119746] binder: 9515:9523 got transaction to context manager from process owning it [ 485.119758] binder: 9515:9523 transaction failed 29201/-22, size 0-0 line 3004 [ 485.120050] binder: undelivered TRANSACTION_ERROR: 29201 03:36:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:23 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) accept4(r0, &(0x7f00000001c0)=@hci, &(0x7f0000000100)=0x80, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x2, &(0x7f00000000c0)=0x201, 0x4) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22}, 0x1c) listen(r2, 0x8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000180)='veno\x00', 0x5) sendto$inet6(r3, &(0x7f0000000280), 0xfffffffffffffedd, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x5400, @empty={[0xe00000018020000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd9050000]}}, 0x1c) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)={0x5c, 0x0, 0x2, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x29}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e21}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x8}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) fsetxattr(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="a91e"], &(0x7f00000002c0)='keyring+%\x00', 0xa, 0x1) r4 = gettid() timer_create(0x0, &(0x7f0000000000)={0x0, 0x12, 0x0, @thr={&(0x7f0000000340), &(0x7f0000000180)}}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x1c9c380}}, &(0x7f0000040000)) tkill(r4, 0x401104000000016) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)="62627200127a7befb1aecd9d343c125105380d534d033390f728a1d423f4e7de0e284f4e76cd331830592dd776c542f5279a821f624aa22dc8d441c18a0f716a6df525e17304091496afcbc5bb1fdeb3a2b1669c2de799359c50b894", 0x5c) [ 485.199481] binder: 9511:9518 transaction failed 29201/-22, size 0-0 line 3004 [ 485.219864] binder: undelivered TRANSACTION_ERROR: 29201 03:36:23 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='veno\x00', 0x5) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) socketpair(0xb, 0x3, 0x7, &(0x7f0000000240)) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='clear_refs\x00') ioctl$BLKFRASET(r1, 0x1264, &(0x7f00000005c0)=0x80000000000001) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000180)) r2 = dup(0xffffffffffffffff) read$eventfd(0xffffffffffffffff, &(0x7f0000000600), 0x8) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000400)={0x4, 0x7}) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x18, &(0x7f0000000100)=0x6, 0x4) stat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)) getgid() sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) inotify_add_watch(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x20000002) 03:36:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 485.353130] binder: 9530:9534 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 485.361426] binder: 9530:9534 transaction failed 29189/-22, size 0-0 line 3013 [ 485.370251] binder: undelivered TRANSACTION_ERROR: 29189 03:36:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 485.444775] binder: 9535:9541 got transaction to context manager from process owning it [ 485.454757] binder: 9535:9541 transaction failed 29201/-22, size 0-0 line 3004 [ 485.465051] binder: undelivered TRANSACTION_ERROR: 29201 03:36:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 485.509978] binder: 9539:9544 got transaction to context manager from process owning it [ 485.519667] binder: 9539:9544 transaction failed 29201/-22, size 0-0 line 3004 [ 485.528721] binder: undelivered TRANSACTION_ERROR: 29201 [ 485.624408] binder: 9548:9552 unknown command 25349 [ 485.629499] binder: 9548:9552 ioctl c0306201 20007000 returned -22 [ 485.648280] binder: 9548:9552 IncRefs 0 refcount change on invalid ref 0 ret -22 03:36:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 485.673909] binder: 9548:9552 transaction failed 29189/-22, size 0-0 line 3013 [ 485.685558] binder: undelivered TRANSACTION_ERROR: 29189 03:36:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 485.741745] binder: 9555:9559 got transaction to context manager from process owning it [ 485.765629] binder: 9556:9560 got transaction to context manager from process owning it [ 485.765642] binder: 9556:9560 transaction failed 29201/-22, size 0-0 line 3004 [ 485.766915] binder: undelivered TRANSACTION_ERROR: 29201 03:36:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 485.836036] binder: 9555:9559 transaction failed 29201/-22, size 0-0 line 3004 [ 485.863487] binder: undelivered TRANSACTION_ERROR: 29201 [ 485.871080] binder: 9563:9564 unknown command 25349 [ 485.876391] binder: 9563:9564 ioctl c0306201 20007000 returned -22 [ 485.900511] binder: 9563:9564 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 485.927142] binder: 9563:9564 transaction failed 29189/-22, size 0-0 line 3013 [ 485.953873] binder: undelivered TRANSACTION_ERROR: 29189 [ 486.024747] binder: 9565:9566 got transaction to context manager from process owning it [ 486.033263] binder: 9565:9566 transaction failed 29201/-22, size 0-0 line 3004 [ 486.041624] binder: undelivered TRANSACTION_ERROR: 29201 03:36:24 executing program 7: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getgid() r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x1, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x6, 0x1, 0x80000001, 0x1, 0x6}, 0xc) r1 = gettid() syz_open_procfs$namespace(r1, &(0x7f0000000140)='ns/pid\x00') 03:36:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 486.144895] selinux_nlmsg_perm: 5 callbacks suppressed [ 486.144904] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9570 comm=syz-executor4 [ 486.219016] binder: 9571:9574 got transaction to context manager from process owning it [ 486.227765] binder: 9571:9574 transaction failed 29201/-22, size 0-0 line 3004 [ 486.235233] binder: 9572:9575 unknown command 25349 [ 486.235243] binder: 9572:9575 ioctl c0306201 20007000 returned -22 [ 486.240707] binder_alloc: 9572: binder_alloc_buf, no vma [ 486.240726] binder: 9572:9575 transaction failed 29189/-3, size 0-0 line 3136 03:36:24 executing program 1: read$eventfd(0xffffffffffffffff, &(0x7f0000000140), 0x8) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = add_key$keyring(&(0x7f0000000100)='keyring\x00', &(0x7f00000003c0), 0x0, 0x0, 0xfffffffffffffffb) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x0, 0x0) ioctl$RTC_PIE_OFF(r1, 0x7006) write$P9_RMKNOD(r1, &(0x7f0000000200)={0x14, 0x13, 0x1, {0x0, 0x3}}, 0x14) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)) openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x101000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0xa, 0xee40) r2 = add_key$keyring(&(0x7f00000000c0)='keyring\x00', &(0x7f0000000300), 0x0, 0x0, r0) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r3, 0x0, &(0x7f0000000280)="025c3f0a00145f8f764070") socket$key(0xf, 0x3, 0x2) clock_settime(0x0, &(0x7f00000000c0)={0x77359400}) keyctl$unlink(0x9, r2, 0xfffffffffffffffd) syz_genetlink_get_family_id$team(&(0x7f0000000440)='team\x00') utimensat(r1, &(0x7f0000000380)='./file0\x00', &(0x7f0000000400)={{0x0, 0x7530}, {0x0, 0x7530}}, 0x0) getsockname(r1, &(0x7f0000003b80)=@hci, &(0x7f0000003c00)=0x80) 03:36:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:36:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 486.242325] binder: undelivered TRANSACTION_ERROR: 29189 [ 486.274709] binder: undelivered TRANSACTION_ERROR: 29201 [ 486.332437] binder: 9577:9580 got transaction to context manager from process owning it [ 486.340696] binder: 9577:9580 transaction failed 29201/-22, size 0-0 line 3004 [ 486.349601] binder: undelivered TRANSACTION_ERROR: 29201 03:36:24 executing program 6: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x10000, 0x0) mknodat(r2, &(0x7f0000000080)='./file0\x00', 0x0, 0x400) r3 = dup(r2) sendmsg$nl_generic(r3, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x40002400}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x3e, 0x400, 0x70bd25, 0x25dfdbfe, {0x2}, [@typed={0x4, 0x49}]}, 0x18}, 0x1, 0x0, 0x0, 0x8000}, 0x10) r4 = socket(0xa, 0x3, 0x1) r5 = creat(&(0x7f00000001c0)='./file0\x00', 0x2) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgid(r7) ioctl$sock_inet_udp_SIOCINQ(r4, 0x541b, &(0x7f00000002c0)) r8 = fcntl$getown(r3, 0x9) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000300)=0x0) r10 = fcntl$getown(r1, 0x9) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000b00)={0x0}, &(0x7f0000000b40)=0xc) r12 = getpgid(0xffffffffffffffff) sendmsg$netlink(r4, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000340)={0x220, 0x3b, 0x0, 0x70bd2a, 0x25dfdbfb, "", [@nested={0x30, 0x69, [@generic="f0e001463c00b664ef407dddfbc9b2c606728153a41f6554ef50de88321dda75c4c79e", @typed={0x8, 0x41, @pid=r8}]}, @typed={0x8, 0x18, @pid=r9}, @nested={0x150, 0x80, [@typed={0xc, 0xb, @u64=0x9}, @typed={0x1c, 0x34, @str='/proc/self/net/pfkey\x00'}, @typed={0x8, 0x1e, @u32=0x400}, @typed={0x8, 0xa, @fd=r1}, @generic="46eb565e3436e43a9120ab6abee9b315ce571008ca432b17157b5bb73e76a356a7dcda502cd0a1b9da83354aada38d619e8d55a6877bd4f4568ead73e66cb0579f298c6f6154673e8db37bd67fd3483dd9a740667f0f79a99407836ab61a18025992b6ffd7b8b1c4c3f6547ea92523a7a10df1e6401954dff7", @generic="97505fce1eb349def86e6f91e6fc20e4cad8b4ebdfa34e711fec92707a37d67c1beaaa1d3c2adbd79c6d8db30237036e99c3852f012bc054081fd758264a1977406fa1e866428bba88b0369f6068ba8c3717b17a78404c80a4950f51f9433b9ac463a023dcaed4d1019a5a42fc10a9c8b6fce4c68cff7f48f7f14db0a9bec3161b250291569dca290b8daa35e79b67cd728c", @typed={0x8, 0x8b, @fd=r2}]}, @nested={0x84, 0x10, [@generic, @generic="3a531917113a09d6fe72f8703f99deb70b64b376e72cc59d96967702eabbb2ecc9617f581ea99e7e08db46700a5878b3d6eee66f52b46f5cd7c0dc7eb4af226189622f55eae558dc33792a829c7c991fc4d11d5518426e94615cf17726fc352490a5ef1effbe4df9fe234963c3417cb608aa51bdcb8b1f", @typed={0x8, 0x6c, @uid=r6}]}, @typed={0x4, 0x2e}]}, 0x220}, {&(0x7f0000000580)={0x10, 0x30, 0x10, 0x70bd27, 0x25dfdbfe, "", [@generic]}, 0x10}, {&(0x7f00000005c0)={0xf0, 0x31, 0x920, 0x70bd2d, 0x25dfdbfe, "", [@typed={0x14, 0x8d, @ipv6=@ipv4={[], [], @local}}, @nested={0x14, 0x3b, [@typed={0x4, 0x1b}, @typed={0xc, 0x4c, @u64=0x4}]}, @generic="444e388bdda1296d22dbacafda20b8b209f2219b21f6b941987b8c770cf8c45bdab3830d4e73dbc5437508d3b4ed16d791b6c3379d8a04b4c762bc3aa003d8f1fa106661d72db9d732c43584acd4330505d2c647c25233bce36de8f50f36514805d3701b9140fd8e488b2eaf4d6661d7163e17fb8a51e72b640bf29e885389048eec8498a56284ba952f4a661ec8ec23a0c99249245e070e922557c80c1a389400ce12a18473327e36348b77fadf7e86733d222e5bf3e9fc"]}, 0xf0}, {&(0x7f00000006c0)={0x104, 0x2d, 0x2, 0x70bd2c, 0x25dfdbfd, "", [@nested={0xec, 0x88, [@generic="5e5dd826a978a7b41f39152cc520657c02f8a3d67d0d1015d8ba8fd1a5aa5b2d6b9332e5406077cc0c140673ce8e740f62668feac9ed16ef87c268b66ca224a3a028d06170cc093dc023870fde62a59704b72dacf64181f59a44f817849e7de3b7f587454dc77fa7998a208c9cf9f2e5eced5fc8e19387a1b4f144cb113b9b33f7a545729ee389d2ac75c91ae8a80b7e8c87383b03b8c03a7d11991c38e709378a93d76c2f8ff1eee970c03adfd468c95f65d23eb3b04d0efbd5b76e9fed0c7de0494a88a039e9571a41b4205000b9b925fd915e9135f3a3477391313d832d899b444341c7ef"]}, @typed={0x8, 0x2f, @pid=r10}]}, 0x104}, {&(0x7f0000000800)={0xd0, 0x30, 0x900, 0x70bd27, 0x25dfdbfe, "", [@nested={0x1c, 0x56, [@typed={0x10, 0x3f, @str='\\%md5sum\x00'}, @generic="347cc8326cf2"]}, @generic="f0d872c5119c444665aeb94ae1aa23a0872f91e47ca16986a61dbad2b4679a7acc8130d4038a0af3a955f20d7401c4a2f2ac22556ff48a30aada2faac1fe32daa5a4161a1e6443de5f66a6beeb7554af584e65c07faac865b761967420187751e213ef87c60fad58d7dd9140bbbe25a16b6823f2c68f78ed25879d9c0e09cc3857cd4f1a11253bb5adea33d572b952134e4f5a6681aba94efd988d39f6c9f0764697"]}, 0xd0}, {&(0x7f0000000900)={0x1fc, 0x24, 0x10, 0x70bd2c, 0x25dfdbff, "", [@typed={0x14, 0x27, @ipv6=@mcast1}, @nested={0x90, 0x13, [@generic="5606cce9a97090fe6221de8a210538788fb5c6b955302d4afdf13364bca6b5e728e2fe370eed43fcf3a5d5db8f6ebb8ef08d676647fe0c5d9a0e65c7a7c46279e5b125685bf8a7c90735b510303f07", @generic="a738989cda7eb26c3d1f4fb65f3e51498f41eadc4499c54e004e3adf95f687330c9a217c0891a47969a3ba2465c1c56f", @typed={0xc, 0x40, @u64=0x7ed}]}, @generic="fd3fce507496c43b0c24cfa4fdd955707c6053a56f5b7b0f2472b3ade6b92fa39960199879c1818f81fbf72c003960d6bbc5178080bf25ce08695f9786ed33e3382d217269e64098b8825028b24a4ff33bce967d603bc1c6a3bd0fc7684ae972cdd4ef3cfab8e92943e5b23ead7f3d", @nested={0xc4, 0x7a, [@generic="d7f640b541c4b2451eb32297434602cad620ebba5c9ca4bf7b3a7560ee57eaf929efd1f262e69af3b17b8c9af37436ba600a07f8b05ba22e2e4a3069730af7c97c3d117099524c3782398dae2e703bbdf36de453f3b01b957e8bb1e9f5b959cefe652a2091fed2232463d9169060d08a58efeac68727b18559d6e55c48a5c756993734a3c94eec8c5a4d16ea75842c2554a2ae971067c5756d2e6979a2a79f9b262dae58fb8654fcfb6169f011e915a659090e9f972490c473a96c438eb4"]}, @typed={0x14, 0x61, @ipv6=@loopback}]}, 0x1fc}, {&(0x7f0000000b80)={0x19c, 0x10, 0x800, 0x70bd2b, 0x25dfdbff, "", [@nested={0x94, 0x76, [@typed={0x4, 0x96}, @typed={0x4, 0x29}, @generic="c6ca7cba0e325dc161ea12afddacec186033bd49610921", @generic="e1a69a38a6a7dcde540553a9cebc71dea7730871f511e75ee302481fa81b2f5bf301e52f44b88ce7594dd04926bae12950ae5860c3aeb466e8ca73b9263a8320", @typed={0x8, 0x2, @fd=r0}, @typed={0x14, 0x6c, @ipv6=@loopback}, @typed={0x8, 0x77, @pid=r11}, @typed={0xc, 0x8e, @u64=0x1000}]}, @typed={0x8, 0x80, @pid=r12}, @generic="df9dda65a4301ba0b5343ddc4c2668f4759b0c62445e2561aa3842f0f2de9de2822a80005cabf25c520670993b678580d4d10c91114d77558e96cad601a0ef397545335e2fd6101bde3cd64627d7f22a3c1e436cd35514496844797208dc80266103a7411696ee835d7b961d44a59bb15c6f93b1fd5d0bd6bd41e15cff4965eba5bd4f3c1b9b90601ba12cf19b39f79a9d9082852c552a3dbffaff8a3dbc20f8a6314411ff677e", @typed={0x8, 0x5b, @u32=0x808000000000}, @typed={0xc, 0x85, @u64=0x100}, @typed={0x8, 0x5b, @ipv4}, @typed={0x2c, 0x8b, @binary="119718759bea182f39e2e9a89b2e4fbe8cb7653a74613b4fcef74f8064039395437289d1e3560fd6"}]}, 0x19c}], 0x7, &(0x7f0000000dc0)=[@rights={0x38, 0x1, 0x1, [r3, r4, r5, r1, r2, r2, r1, r0, r1]}], 0x38, 0x24000000}, 0x10) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000e40)) openat$dir(0xffffffffffffff9c, &(0x7f0000000e80)='./file0\x00', 0x141c01, 0x98) clock_gettime(0x0, &(0x7f0000000f00)={0x0, 0x0}) futex(&(0x7f0000000ec0)=0x2, 0x1, 0x1, &(0x7f0000000f40)={r13, r14+30000000}, &(0x7f0000000f80)=0x1, 0x2) r15 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001000)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f0000001100)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x614062}, 0xc, &(0x7f00000010c0)={&(0x7f0000001040)={0x5c, r15, 0x800, 0x70bd26, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DEST={0x4}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6f}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xffffffff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x39a}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40001}, 0x84) timer_create(0x7, &(0x7f0000001140)={0x0, 0x12, 0x1, @tid=r10}, &(0x7f0000001180)=0x0) timer_gettime(r16, &(0x7f00000011c0)) r17 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001200)='/dev/ptmx\x00', 0x4200, 0x0) ioctl$GIO_SCRNMAP(r17, 0x4b40, &(0x7f0000001240)=""/160) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f0000001300)=0x7fff) setsockopt$inet_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f0000001340), 0x4) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000001380)) socket$inet6_udp(0xa, 0x2, 0x0) 03:36:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:24 executing program 5: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='veno\x00', 0x5) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) socketpair(0xb, 0x3, 0x7, &(0x7f0000000240)) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='clear_refs\x00') ioctl$BLKFRASET(r1, 0x1264, &(0x7f00000005c0)=0x80000000000001) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000180)) r2 = dup(0xffffffffffffffff) read$eventfd(0xffffffffffffffff, &(0x7f0000000600), 0x8) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000400)={0x4, 0x7}) sendto$inet(r0, &(0x7f0000a88f88), 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23}, 0x10) setsockopt$inet6_tcp_int(r2, 0x6, 0x18, &(0x7f0000000100)=0x6, 0x4) stat(&(0x7f0000000440)='./file0\x00', &(0x7f0000000480)) getgid() sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) inotify_add_watch(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', 0x20000002) 03:36:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:36:24 executing program 7: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r2 = open(&(0x7f0000000ac0)='./bus\x00', 0x100, 0x10) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket(0x0, 0x3, 0x2) syncfs(r1) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) ppoll(&(0x7f0000000040)=[{r0, 0x8002}, {r2, 0x2010}, {r3, 0x101}], 0x3, &(0x7f00000000c0)={r4, r5+30000000}, &(0x7f0000000240)={0x20}, 0x8) ioctl$LOOP_GET_STATUS64(r1, 0x4c05, &(0x7f0000000140)) pwritev(r2, &(0x7f0000000680)=[{&(0x7f0000000280)="ebf34bd064407b113677fb24438c6c12f2e836f0f8967aecc4adbb2735a12e727551eef8e770427e6a3be4015c1ffe8cef60125ab3195bd313a0eee8f56c24943ed10b42dfb96bb5fcb6aa76a5a2240c12c7456f72a55332fceab12bb9354a4cfa0427e0db092dc119657f680fe0f1ddf0722b4f878b00e92a368e364c9dc1633fe90bee4b3c56e22bae53735e33d33124bd35393c103640affe07bf6af15455522b04d50f188cc2c6a394b37738921ddc462da7470eefa08d2b993d40d4fd4bceb994cd5161caaf5216224814ee9abe3bf2a226f46d045220e0dcbd45f4adb2b542c4e8d5d14b50f84a1fa6", 0xec}, {&(0x7f0000000380)="a799f3fe5403eceedc02f90ae7d6af101d6d8d49e9d9dd6cd75d966fea20675c9188f6e371858f3818a8d4c46b49043c0e14292f979f8a842e3a9db3a1f480d62fc7ce88b4c9cc55658076e26dab7288e5b14ef576a819547d04a17df5afd2ce2ccb46dc9d9dbc80de2492b2c9281a342560cee492f0d0c2e4e59999068922a0352fd7e3efc61078c4ebb15927e830ccba0f2557c4fbc969a87d7a5b4583bea15affc2096112f3de34a1b3e2287d50b9b564c35086a7ebe5e54d3bc9fdc0ac722ce67760ffafa112bca0d8dc06584bfc78d3f3f403a3f213fb6e4d370e69e82a", 0xe0}, {&(0x7f0000000480)="df90170c1a2a48058de569f0713823f83873607ade98118b581c654a7f6688a6743d7a91ead653e2d82ab882647af93458e5b39962749045e2d3c2448798d9", 0x3f}, {&(0x7f0000000540)="c2d2f3c3f79a105dc4bac460dd996d08e1e25617c16ff89e30a7f2545becbf82da3b5a220b36d85863a35d2a91936fa29b047a9228b39940957e2fd7e4735388643bfeb02a2015ad33989b1094ba18bf91ad02de3791149c8dd60db58647174904d58b874aaea99355c13b2a5013ab81c6dbd63652f62e26955b84072f58a96f37b17714243dbb1d68433bf0e23699d0cd4b41cb5f9431575d59cd2074c6c72b08bff94d3e18e137edf4b7f5f7be26ea9f", 0xb1}, {&(0x7f0000000740)="b8ced3d505574516393cda68451f438b2ef2fd26a5db6d5b06a98eed28eb7f6348700c74b3e158c724456947b56eac9c8b14d9c18a5fdbd03bd3bcdbd2791289aa779819866ddd30bbf797d67b868cfba751141d717b11021984e4a728469024548da7ec277f0ccfb3fa9cd460ab08d7c41c148fd87aeeede7020da20246c2112b6e5c2e23770a923ed22a866df69ff1696e2aaca4276b2e40f551019c713d196b8788b684985400f7a21db0fb31163c3bf7df66d908d7db49c39b7147e0a4600fb6854c5c344941125a18e133368fa82b9cd26d109440cd0ced", 0xda}, {&(0x7f0000000840)="9fe5dfcacc9229df38131816091cae7c766e6b07c2a98326e32085730245d594acbef98fbc3224b17b3e7616572b279509da6650527dba842f2d4076e2f34bffc00a1a0df5d66f7781ea5e2bfc61a850f68afe73417c12bf57db5ea981daa92d973c1697827061158b8720884267ba343cd128b49b661771f68cc6292c33ca8bca7e297e0fa3bf615480e4f92dc7c4c3384052aa4e9d9234d190707e07d6f3d447c026e66fd5a7", 0xa7}], 0x6, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000640)='/dev/rfkill\x00', 0x0, 0x0) 03:36:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 486.447188] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9590 comm=syz-executor4 [ 486.466788] binder: 9587:9594 unknown command 287493 [ 486.473826] binder: 9587:9594 ioctl c0306201 20007000 returned -22 [ 486.483714] binder: 9587:9594 IncRefs 0 refcount change on invalid ref 0 ret -22 03:36:24 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 486.492751] binder: 9587:9594 transaction failed 29189/-22, size 0-0 line 3013 [ 486.501483] binder: undelivered TRANSACTION_ERROR: 29189 [ 486.509366] binder: 9591:9596 unknown command 25349 [ 486.516236] binder: 9591:9596 ioctl c0306201 20007000 returned -22 [ 486.530861] binder: 9591:9596 got transaction to context manager from process owning it [ 486.539892] binder: 9591:9596 transaction failed 29201/-22, size 0-0 line 3004 03:36:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000000c00)=[{{&(0x7f0000000400)=@l2, 0x80, &(0x7f0000000480), 0x0, &(0x7f0000000000)=""/117, 0x75}, 0x7}], 0x1, 0x0, &(0x7f0000000cc0)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) tee(r1, r0, 0x1, 0xc) r3 = dup(r2) ioctl$TIOCEXCL(r3, 0x540c) bind$inet6(r2, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$BLKGETSIZE(r3, 0x1260, &(0x7f00000002c0)) sendto$inet6(r2, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0xfffffffffffffffd) readlinkat(0xffffffffffffffff, &(0x7f0000000140)='./bus\x00', &(0x7f0000000200)=""/110, 0x6e) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000180)="2e65747640e17b") ftruncate(r4, 0x80003) sendfile(r2, r4, &(0x7f00000000c0), 0x8000fffffffe) recvmmsg(r3, &(0x7f0000003440)=[{{&(0x7f0000001840)=@ax25, 0x80, &(0x7f0000001d80), 0x0, &(0x7f0000001e40)=""/169, 0x42}}], 0x21b, 0x2000, &(0x7f0000003500)={0x0, 0x1c9c380}) sendmmsg(0xffffffffffffffff, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000003c0)}}], 0x1, 0x8000) ppoll(&(0x7f0000000280)=[{}, {}], 0x2, &(0x7f0000000300)={0x0, 0x989680}, &(0x7f0000000340)={0x5}, 0x8) [ 486.548868] binder: undelivered TRANSACTION_ERROR: 29201 03:33:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 486.619929] binder: 9598:9604 got transaction to context manager from process owning it [ 486.628924] binder: 9598:9604 transaction failed 29201/-22, size 0-0 line 3004 [ 486.637711] binder: undelivered TRANSACTION_ERROR: 29201 03:33:20 executing program 6: r0 = socket(0x10, 0x3, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000140)="64d36f7af61170fff103405ed5202fbcc55e474cffe701ea87cdcbb75a0376a940f12a22b23e55d3c80eef36fdc8be870999337862fe37bf8f4a266059dcf98633e8146072e9a8a732707f3daf222ae8a059f67938c1e4b00cd9695ff42f0a97219343c669a78981f9afd7ae420ada63d8cf348edbd0c0f96847c3b96f5e172d5040d49bc96424217a683221969cad9f22aa57e37952a3d2a1fa7cf3f9f42a23601a0da20a4bfad069bb0528d3c8a092dd7d05cff3678c9d3e0f82d4ee695192422b68aee983578191ac7df6b94771b785c76bfdacb48b27603400d371586a20571e9822776d1bd85c3447ffc705cbb1d86a11876dec28b13962c297e7dc38eb") sendmsg$nl_generic(r0, &(0x7f00000000c0)={&(0x7f0000000000), 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0x14, 0x14, 0x201, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) 03:33:20 executing program 1: r0 = socket(0x3, 0xb, 0x20000000000000) r1 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r1, &(0x7f0000000000), 0xfdb0, 0x4008080, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c) dup2(r0, r1) 03:33:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 486.723429] binder: 9612:9617 unknown command 287493 [ 486.729267] binder: 9612:9617 ioctl c0306201 20007000 returned -22 [ 486.729946] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9616 comm=syz-executor4 [ 486.736902] binder: 9613:9618 unknown command 25349 [ 486.736913] binder: 9613:9618 ioctl c0306201 20007000 returned -22 [ 486.748851] binder: 9613:9618 got transaction to context manager from process owning it 03:33:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 486.748865] binder: 9613:9618 transaction failed 29201/-22, size 0-0 line 3004 [ 486.749098] binder: undelivered TRANSACTION_ERROR: 29201 [ 486.774541] binder: 9612:9621 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 486.774555] binder: 9612:9621 transaction failed 29189/-22, size 0-0 line 3013 [ 486.802000] binder: undelivered TRANSACTION_ERROR: 29189 03:33:20 executing program 7: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, 0xffffffffffffffff) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)="2f007e574d000330809022cfde26555dc9ecfe1974406edad38364782d63b6612854b9e49dbdcaef718197e37e870a308b1e3a798fa788a46d3025ef933e51828ab675064e2adbe9126423b4a73d68fbe99c6db2f160d49cb6cce76c27289a4f9d097354aaa5860d2383df87526baa184d90bb7729366c17bc33d765e9bc2f882a13f3a9c1f60660bd4fd2fa31d2c0a775242289bce062d10d24ded5406918a66b2c75c43fe1ff458ae5cd9fec63039ba5a7b66a60ede5ccdabc7ee77660ef2358ccdff02226021384b0c235f114ed9ade92767aecc256acdeb610df42e7169f240357f735ae5fe29017e51e27252f48b95bfbbb3a865535298bdc36d71db635f41c57771db77aeaff883feb3dc3cc24bd3c036e396ad3af37945058839e812270bc40901fa654e7cc3292a82fc80c374dc07142a1c2e9d3e2528e4fdac32bcaefe910ebd3b948a3bfebef5fa8d82473c7fbf3ec", 0x0, 0x0) getdents(r3, &(0x7f0000000400)=""/135, 0x74) close(r3) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/commit_pending_bools\x00', 0x1, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x3}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) dup2(r4, r0) 03:33:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 486.866630] binder: 9622:9625 got transaction to context manager from process owning it [ 486.875038] binder: 9622:9625 transaction failed 29201/-22, size 0-0 line 3004 [ 486.884006] binder: undelivered TRANSACTION_ERROR: 29201 03:33:20 executing program 5: r0 = socket$inet6(0xa, 0x803, 0x6) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x5}, 0x1c) recvmmsg(0xffffffffffffffff, &(0x7f0000000c00)=[{{&(0x7f0000000400)=@l2, 0x80, &(0x7f0000000480), 0x0, &(0x7f0000000000)=""/117, 0x75}, 0x7}], 0x1, 0x0, &(0x7f0000000cc0)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x400000000001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) tee(r1, r0, 0x1, 0xc) r3 = dup(r2) ioctl$TIOCEXCL(r3, 0x540c) bind$inet6(r2, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$BLKGETSIZE(r3, 0x1260, &(0x7f00000002c0)) sendto$inet6(r2, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r4 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0xfffffffffffffffd) readlinkat(0xffffffffffffffff, &(0x7f0000000140)='./bus\x00', &(0x7f0000000200)=""/110, 0x6e) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f00000001c0)=0x1fe, 0x4) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, &(0x7f0000000180)="2e65747640e17b") ftruncate(r4, 0x80003) sendfile(r2, r4, &(0x7f00000000c0), 0x8000fffffffe) recvmmsg(r3, &(0x7f0000003440)=[{{&(0x7f0000001840)=@ax25, 0x80, &(0x7f0000001d80), 0x0, &(0x7f0000001e40)=""/169, 0x42}}], 0x21b, 0x2000, &(0x7f0000003500)={0x0, 0x1c9c380}) sendmmsg(0xffffffffffffffff, &(0x7f0000007e00)=[{{0x0, 0x0, &(0x7f00000001c0), 0x0, &(0x7f00000003c0)}}], 0x1, 0x8000) ppoll(&(0x7f0000000280)=[{}, {}], 0x2, &(0x7f0000000300)={0x0, 0x989680}, &(0x7f0000000340)={0x5}, 0x8) 03:33:20 executing program 6: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x40, 0x0) poll(&(0x7f00000001c0)=[{r0, 0x4000}], 0x1, 0x81) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x800400200) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090c0000000000000000000000020013fe0000000002000000e0000001000000d7ef509495fa4a6900000000000000000200000000030005000010000002000000e0000000000000000000000000000000000000000000000000"], 0x60}}, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000200)) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) 03:33:20 executing program 1: ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)=0x0) ptrace$getsig(0x4202, r0, 0x4, &(0x7f0000000040)) r1 = openat$md(0xffffffffffffff9c, &(0x7f0000000080)='/dev/md0\x00', 0x4000, 0x0) sync_file_range(r1, 0x3f, 0x3, 0x5) prctl$setmm(0x34, 0x0, &(0x7f0000ffd000/0x3000)=nil) 03:33:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 486.986481] binder: 9630:9637 unknown command 25349 [ 486.991920] binder: 9630:9637 ioctl c0306201 20007000 returned -22 [ 487.002745] binder: 9630:9637 got transaction to context manager from process owning it [ 487.011210] binder: 9634:9640 unknown command 287493 [ 487.011217] binder: 9634:9640 ioctl c0306201 20007000 returned -22 [ 487.016556] binder: 9634:9640 IncRefs 0 refcount change on invalid ref 0 ret -22 03:33:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 487.016569] binder: 9634:9640 transaction failed 29189/-22, size 0-0 line 3013 [ 487.016794] binder: undelivered TRANSACTION_ERROR: 29189 [ 487.046568] binder: 9630:9637 transaction failed 29201/-22, size 0-0 line 3004 [ 487.056905] binder: undelivered TRANSACTION_ERROR: 29201 [ 487.067466] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9641 comm=syz-executor4 [ 487.144081] binder: 9643:9646 unknown command 25349 [ 487.146664] IPv6: ADDRCONF(NETDEV_UP): bond_slave_0: link is not ready [ 487.147383] IPv6: ADDRCONF(NETDEV_UP): bond_slave_1: link is not ready [ 487.147683] IPv6: ADDRCONF(NETDEV_UP): vlan0: link is not ready [ 487.148047] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 487.148218] IPv6: ADDRCONF(NETDEV_UP): veth2: link is not ready [ 487.148386] IPv6: ADDRCONF(NETDEV_UP): veth3: link is not ready 03:33:20 executing program 7: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 487.148556] IPv6: ADDRCONF(NETDEV_UP): veth4: link is not ready [ 487.148746] IPv6: ADDRCONF(NETDEV_UP): veth5: link is not ready [ 487.148873] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_0: link becomes ready [ 487.149134] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 487.149321] IPv6: ADDRCONF(NETDEV_CHANGE): bond_slave_1: link becomes ready [ 487.149528] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 487.149755] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 487.149977] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 487.150181] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 487.150509] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 487.150732] IPv6: ADDRCONF(NETDEV_CHANGE): veth3: link becomes ready [ 487.150951] IPv6: ADDRCONF(NETDEV_CHANGE): veth2: link becomes ready [ 487.151159] IPv6: ADDRCONF(NETDEV_CHANGE): veth5: link becomes ready [ 487.151380] IPv6: ADDRCONF(NETDEV_CHANGE): veth4: link becomes ready 03:33:20 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 487.234621] binder: 9643:9649 got transaction to context manager from process owning it [ 487.234634] binder: 9643:9649 transaction failed 29201/-22, size 0-0 line 3004 [ 487.310180] binder: 9643:9646 ioctl c0306201 20007000 returned -22 [ 487.321652] binder: undelivered TRANSACTION_ERROR: 29201 03:33:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:20 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 487.375789] binder: 9655:9660 unknown command 287493 [ 487.384752] binder: 9655:9660 ioctl c0306201 20007000 returned -22 [ 487.392782] binder: 9655:9660 got transaction to context manager from process owning it [ 487.401075] binder: 9655:9660 transaction failed 29201/-22, size 0-0 line 3004 [ 487.410027] binder: undelivered TRANSACTION_ERROR: 29201 03:33:20 executing program 6: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:20 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 487.521976] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9664 comm=syz-executor4 03:33:20 executing program 7: sched_setaffinity(0x0, 0x8, &(0x7f0000000140)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000280)=0x400000000949, 0x2) r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xda10, 0xfffffffffffffffc}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f00000001c0)="d7dc59a26c925bee7f043a45858b6cce5b0883b0f328f3d0a5fdf3e728e7ab29e46104ad0cd3165aca156b7c7c0655b0c687c7bb5161369d35bc229673fb40d918adaef28d506ee996bca7e6eab4cb8c017114859bd347a371de2210349bac7d82527702bc95443594eda26ad223230000101ec5d6eb33be05b103675888a96b01c8f2d375ee1551b28a28f5bf77aba9257a6f8115d15fffc005b8bd91b2000000000000000000") connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendmsg(r0, &(0x7f0000000840)={&(0x7f0000000300)=@vsock={0x28, 0x0, 0xffffffff, @host}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000380)}, {&(0x7f00000003c0)="fa2c3636831d4b833ac76b468fddaf009274d2a5c9ba7d38b022d1df3613028fc418b28040680bdae490f5eda7d613d1af28aac3356e0d2370493e54be1fb4b92d3afa4a5d1e99814981da6bdbb7063c79a1676bd6a95be5b09ca249abe11a8bb147a53b9dbb3772812f3132918de0c5254f0e32fb791d42cbc9d2d5ad691db1", 0x80}, {&(0x7f0000000440)="1d47a1d435563663d69b5299027f3f167f018ea5d47cace1836e3c1dc93ba30065079b10aa0e0957710cc9643dc2dbeba2bcb4edafb8a49b1b5a1246152a5894c4711da943f35db2fa489731cc870e0142114c7bfbf20583248099d7a3370bb566a40d820af81c37537a16268891698677abc18d495493b98fb8f1c06487", 0x7e}, {&(0x7f00000004c0)="af7a6570d19ab54c4a123ac7f8856e", 0xf}], 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="d000000000000000ff010000ffffff7f92d046fd2c37b01d291990fc8cda3a6ebe050d0481ddda49f44f177ea42b6e67d1a7cac774309f235fab401eba97278b9577fe95bba4fe3ee2593760b738ec507e8bfb804d0adfeb8edc3875b6bc765b59be3586e23ca1163c4ec15a12c9a1f8db2f6bbcae71e889498d7356fb918aa324acc4f3db4d922fe6f295fa4cced779969742a797987f3acdfe5e3ef36c4b09b285f4b0065c1ac51bff2ee1834bcf9cedd84d4b0cab77ad2be5172d1a6a2274d3d96f6d9eb4e5598b0000000000000010010000000000002d0100000700000045884c24a7a0ea3cf28f64696038e8302fd80033772bda12db6ba66d8a964d3c6ff9ce9cffe25722ecc350d40616e6a34ead31f8812422f17ee505bef3c353d8c5b8023dbb7ce588fece8e4fdd289f084d809858401e8e1345090c40a761851f7207454d3f4a0455af631f6acb1caf38daed060e27525d562f9c511822b8cbad82b3072739054e9fc73d67387ec45131c53bca42900d5fbb6e88b94c3a730b3f75efed1785a6323b6931259b502186f3a02abb9558d288e23276af4bb7de1ff6211175cfdcb0c15e71b2530a511afe021850f27e30d77048091f0df7fc5157c0916b3dce9cf54d31bf6f641175ebfc0a48c42aed4377fdbac597381bcb000000000801000000000000050100008100000060a2f8038f52f7a11905f8052b0f2659bbcb076ac53f8441dae70a8be937a477182d82582c5302291eb172371b3c6a6802eea969cb88034c92a18eaa7b6db9234b6d13bf36d49f53c0aa07c1e0fd7e5fa10599048e4316cf8b9174777108296c919da92dd830e0ff519ae0f9d9bc476fc8a679dbcc299e4abfa1c3749d6f90f695d68605e80e86071815bc9f3c1614799221cb4e0b4e5dfcece76baa9e5b4848c3270a3f800fc053ca360bd5beb1df949f8d6cf7ec4e67d1cadff40412a79cc99d3be02fdcb4b2c610b3b136e82115aa9ea389dd167f4f222fde0c0c10e5ffc6956850bb86dea2cd0d540beab6a84489105deda4000000d48a76c183d83827b832eb2c6ecdd7cbdbdc387c6528321928a0e452a8ab1cef0ec40b66d2edbf73efd0be09a05284e49513fe28407a159fdaceed9ac250fba90bc09cad90c16f784b7bb722e8968fee76fc53ca4958c0d43e0a56d13885c415e207e2496a5758cff6542d06fabde46454896a888f5ff31706a00981102b6e14feff6baa1b30c63b6ee0f232525b4243ede2c0f4acdd5e68b9ee49b9ffd5af5e7de31c67db0edbba1965c0eb6bc85cfafcce90e492fb3d2620d96a24607e7398f7e3744f0585c0b31cca66a2d9b95f6fd9f672"], 0x2e8, 0x1}, 0x800) r2 = creat(&(0x7f00000008c0)='./file0\x00', 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000540)={'eql\x00', 0x6}) ioctl$BLKROSET(r2, 0x125d, &(0x7f0000000900)=0x8000000080000) sendmmsg(r0, &(0x7f00000002c0), 0x400000000000174, 0x0) rt_sigpending(&(0x7f00000000c0), 0x8) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000380)='/dev/hwrng\x00', 0x103000, 0x0) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r3, 0x10e, 0x2, &(0x7f0000000880)=0xb, 0x4) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f00000002c0)={'ip6_vti0\x00', {0x2, 0x4e22, @local}}) 03:33:21 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0xd, 0x4000000000000002, 0xc) write(r0, &(0x7f0000594000)="1f0000000104ff00fd4354c007110000f305010008000100010423dcffdf00", 0x1f) write(r0, &(0x7f00000000c0)="1f0000000104fffffd3b54c007110000f30501000b0003001f0000b1aedfb5", 0x1f) [ 487.634750] binder: 9667:9673 unknown command 25349 [ 487.639951] binder: 9667:9673 ioctl c0306201 20007000 returned -22 [ 487.650148] binder: 9667:9673 got transaction to context manager from process owning it [ 487.659002] binder: 9667:9673 transaction failed 29201/-22, size 0-0 line 3004 [ 487.667980] binder: undelivered TRANSACTION_ERROR: 29201 [ 487.676226] binder: 9669:9675 unknown command 287493 03:33:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) dup2(r1, r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 487.682789] binder: 9669:9675 ioctl c0306201 20007000 returned -22 [ 487.691400] binder: 9669:9675 got transaction to context manager from process owning it [ 487.699934] binder: 9669:9675 transaction failed 29201/-22, size 0-0 line 3004 [ 487.709094] binder: undelivered TRANSACTION_ERROR: 29201 03:33:21 executing program 6: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0xffffffffffffffff, 0x0) recvfrom$inet(r0, &(0x7f0000000700)=""/249, 0xf9, 0x40012041, &(0x7f0000000340)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000240)={0x8, 0x5, 0xffffffffffffffff, 'queue0\x00', 0x6}) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = socket$inet6(0xa, 0x0, 0x7fffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff) r4 = gettid() ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f0000000480)=r4) write$FUSE_LSEEK(r3, &(0x7f00000001c0)={0x18, 0xe6daf2a0141644b0, 0x7, {0x5}}, 0x18) rt_sigqueueinfo(0x0, 0x1a, &(0x7f00000000c0)={0x34, 0x80, 0x3, 0xcb}) pwritev(r2, &(0x7f0000000680)=[{&(0x7f0000000500)="03dd406bb71a76c48eeeea75c8d818f44ab8162bb7a45cb2e6b0d6743fcad46753234497430f00df70755bd2a07eadb1b3d74dde892fed8f7560fee3e2946cb8125dc60519939bdf3aff28be8583556e2c346301186422d99ed759cc63cab37d14785f57f17a6a7efc4276e600271ad8b5eb6fd24e446c435efb4ac3000000000000050000000000000000", 0x8b}], 0x1, 0x20) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001840)={{{@in=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000440)=0xe8) getgroups(0x7, &(0x7f00000003c0)=[0xee01, 0xffffffffffffffff, 0x0, 0xee00, 0xee00, 0x0, 0xffffffffffffffff]) lchown(&(0x7f0000000180)='./bus\x00', r5, r7) fallocate(r3, 0x1, 0x0, 0x10000101) fchmod(r2, 0x31) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000300)=0x7, 0x4) ioctl(r1, 0x8912, &(0x7f0000000040)="295ed277a4200100360070") openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x600, 0x0) r8 = syz_open_dev$usbmon(&(0x7f0000000800)='/dev/usbmon#\x00', 0x2000000000000000, 0x181000) lchown(&(0x7f0000000380)='./bus\x00', r5, r6) r9 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r8, 0x7001, &(0x7f0000000400)) fstatfs(r9, &(0x7f0000000840)=""/4096) 03:33:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 487.832200] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9683 comm=syz-executor4 03:33:21 executing program 1: seccomp(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0xfffffffffffffffe}]}) r0 = socket(0x14, 0x802, 0x9) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x4e22, @loopback}, 0x10) r1 = gettid() perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, r1, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r2, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) eventfd(0x0) write$binfmt_elf64(r2, &(0x7f0000001480)=ANY=[@ANYBLOB="7f454c4600000000000000000000000000000000000000000000071ef4b8000040000000000000000000000000000000000000000000380000000000000000000000000000000000000000000000000000a51aaa9dee848e6d000000000000000000000000000000a6060000000000000300000000000000d0170000000000000000000000000000000000000000000000000000000000000000000000000000c67e9b790000000000000000000000000000000200000000000000000000ffffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000fcff00000000001f0372ab000000000000000000000000000000001f201f00000000000000000000000000000000e94c82c48db881c78fd03a86b5bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000019af1f423a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c97970c7fb4c8007991ffbe3c0fe143f06f46233138bf9e40ddb70b731701ea01222649c8261"], 0x2f5) recvmsg(r2, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/20, 0x14}, 0x100) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000003c0)=""/190, &(0x7f0000000180)=0xbe) sendto$inet(0xffffffffffffffff, &(0x7f0000000180), 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10) ptrace$setsig(0x4203, r1, 0x0, &(0x7f0000000300)={0xb, 0x401, 0x867e}) write$binfmt_elf64(r2, &(0x7f00000006c0)=ANY=[@ANYBLOB="7f454c4600250000050000000000000003003e00060000002c010000000000004000000000000000e1000000000000000500000087003800020002000700ea000200007001000000ea0a000000000000f7ffffffffffffff00000000ffffffff00000000000000000100000001000000010000000000000001000070040000000500000000000000000000000000000005000000000000000100000001000000ff0f00000000000000fcfffffffffffff423273d395b5dfe49a633eb0eb0263328129db30c89d614ca312379424593d1149401363a977a2b10bc8394762bab422771360aa38dc889b26829f721e3098b0f80c2f4ee55bcf0df04911af0a6a16e0ab5b5bb1e2227df0cb7b403be567ea3b9adef738dd4b7efbd9e56dfc0dc488a064d4ad246d477bc8fedb6c1fbcdb1469e544a6ac9afa9987b94c8d1209a41a79416931a8f43bd761418a2c47221a2a4d6bee2592cd6eab8fa3ac582965b48d68fb1dde708c9901874b0f1628c0adb0dc15872d102a327e9f073a52942892de4cc87c25e76cde841dd1e09db3f59955450018b682981af9bf3133a11fbf7915b41105bd663e6f7116777b3cb43f260d25a06d22119ca7674f7d9eeb496cccae5ea73758600072b6f0c2a040000002001cb9377fbc132be60c8b0bf6ac0a892b355685d62cb7077a1e889c359d7bfc544111c6ca232e6c6593a0b8f085567b065536d649fea6d4e202254fc1a0dedba780af208b0457ed33958cfd97c0155f59b06d997423bb3b6f3d5e01c8b74030434cacb0e50dcc661aff03a72021b6011f6ff05f6070f0bcb7d75cbf1668562cd6599dcf1eac792c47370ac83b2730215d9955f6fa81f59d3209fbaf52f41f8c413432d976fe6eb3ae98661de6250e09bcf7b82d0492b349ca022abade27ee2d41aa83ba7d2ed5193dda7e9c78769b1430e5a171e12e0fa1d057e1aef4b856ab0f2dabc8b207f09d78e1f83461ccac0b2558732ea70d369973971d2c6d94081f33308b1e4b27a2ce6f45838809407045aa63b6219d82564c7323f73bfc2260fd95e5e8eeca550b29adcca477de69469764858d7aa3ab8afd99e883c43dacae12ac88e7fea5a99df90755e5caf59185794ed6419a22fe36d9070ed6558b090cb871914491e2a135047b729107896b784bf87c941f7b993033898b993c83b8bcec93aed20e900921e8c8e716321ad5664665e7f89839258d1477a2e8fceaa9280b9c9dc53b5ed4bd907c3942d8fac1eff961bf3040ae0faed3985bccc355506dfcd52907750828fc988e60aec5b577af9769cebc8d6e87a826826f8362c84fe7ec9e6d3cc39c1b6b6b9005eaaf0d9037fa576757018d3f60fbab576284cd7343e70a4b8143dc67e94c1090b7376eec330f5995c4b3a119646b4a953cf0669d6e52264827bbbae2c7565529a68f46f5e1a23137059867d0192caf6b22e2d74f8fbe12a139bc90a0d12b6acc0a106ba4fc2baf87c254bb540835206fc5f63dbc82581cec68813c331af00086cae971610587c4683d5f1b0dd68b8a419f581f0387cc9d1a435e329a0595d73a4489b1ea23c331ca752bfd46de13faee26e7e2e9b11dd7151883ac8112c0ba049070bcf00881cc0a37395f1a102cddda4b0b903b0233461e70254e6a75b9c29c02fce51b630d5cd58867e5f8e5b47fdb2fb53e0b9485f1079ddb39d7b3ef5d8d37be9a08714575e454274581a8ad758ba53da32d2c893e8a40de0febf31f84016558a9db7c53dec27895d69fa1a34e4b5b856f4d0974a9dd4031e28632a245b921a576f1a19f47d7ba08e9ca94a7ae46c89b379d90e0dfdcffb790586d920ea79f94af735aa51695dfe0c9c73a44b277e877b473b43f5c3a960d7c5e22678ab3f7cf46bdf23cbbd31df613827f8e23f7b2c71be25eab7dbd56f7b426b784583ec97db1659afc521a84e709cd879f8e5afe72366ffcd05c29b92ad591e35a19df805a2b89b9b87a13109c19ea941e9b9f6ee1c47708870abfda2debce7eae0f356bc896a5a207f6bc3ed4186117e1ae9b861d3a9a94520a6df99fd700c6fc3b82467a1257c2040dd34b2fb30c032224e6b864900f93168e387edaeeedaebf8b7b40d4caaa97c85229e63770ced3382013fd11010d0ee46333666aaec98aacc511c92be9e55eee400c74ab4614552624ad88f5d63b6f87e85826ee7cf6f15418f9712c6d07f36a54f097d9bc48b3035ae569af4753e7831dc520fe4726d0c96d0cb7b45e5ca5002884d38ed8e8ead8d4a7da76f9bcfd848fd27345bec7dd4356ef7b11a0cd3113bd9d9bd72597daf8e25b987b6a17329b9c581e7e647eddd060553fd6e9194bc07ffc5ca9eb6e9ce36aa545ac0f6e242e381282522481668f05909a69db9c8f417ce2406fb727c11fa8ed3ec6f097fed51414f3286075c414753979f58a70d97539c1215ad15f4f2bdc9cb27e00245bb2291f767d4c581387a63022c727026043c0180a848edd1c3fffff21c3fe0b11c65caca8941959536882277e3dc9e61da52527a24e2d79a497a80b33b24f1ca184d56ad13194867d7a0a424977b5f256a4643460a03007ccf2abb042c6a8f357e8c67298f4ee68fa10d82aeec9c63884f43927692db04bfa6651a630ff1e945d5c2ceb1552d0cd69830f257e5d2b500e4447f03edc78938d82871b7075be875dee546cd23ae617356f51fe8f1fb11417e63a436d7ca0ecd22fab3719ab5b4a4fa0ac2b6a44002fdddb61f7d6fe2beac291455b144cff1da4cb487c430a42cd6dee2b0752536175bdeb3abf2a393823dddf4567d7a6ac785662eb272ea9ea223e0d63a2d027fc3bfa6da9c1537a5c207c9f2495bd45ee28be938ad3dbdadee778875ba641ceb20f3fb23d57269a4e40e0baea56d0b4247f12ebb7cf6ee0e64b0d521c8636ca845287f752adfde004e37bee0451540bcabf455b43233e287e4ce36ebbf2cf0c18325b72b90c40cc5bdf77f66b07bf5423a80409e1e95424e2d63c09e621354d87d29d28758c290f29746e00e72e1f6ee9fc93841a7a4ec7420c1d78c09f9355b41c5b6a2e94d84218428a4e4e40bcab84f0cdc9a230101146a11e1f36367b4b5f21e76b5e58c31aec27a47e7ce6c22d29c553f03d0515199b541750e92718c53542cb8c0e4202c89b5bc2a4e3cd4fd1e33ba846b2d2d1c94d2e73327b1d327fe80ff1113634e2e94769b97a1088c2f00001fd26ffbf3b4b82036e960a01efd1eecb0e4cff79c5943cb7f3390757f2ebaa20ac131cddf19065dad03237cca7406b5c30228494fe25d9d26631795f3b0a16ac6c8c27e37a75bce127c582beed29fe6137efe5ac28a2a89597db794c570055e318e92f17f36e3fcbc68c8233d2f0c433f9e11b2819ade8026682c9c966d13605ba9cfa66d91f8203260ed06d8c53912b2c25be01165ebda24e3b70c4fa4a99c56470ee400000092272d6ba4a0906d5b8df7039b82bf83378b78ce124aca8b7944fffdd65bfca51e33614282fb1738dd43c6b95f2bc5e9b24605ff3fb5a06ece40c2c4a86b93acdde534777d47c5196e7ef7d65ff45606324b402aa6b81afa463f63f96bc442cd25a033b7b6feed08de0f00bccb16c439813c6c4b1d1733bb55a6245a9180ec71a7f31631613c60af161f5ef64493b859a6c4baa9e3811250984db538169178a4f4cb4141f74e366a28b4fdeef59bb22f6f525c493912a044bd99a3b4b86b2834a4f837d58d4292a22a730b6a2e5ec7bf358c2016326fff4889d5d5e1beec898a3a88d0f4a450d86548a1a9b1cc1bee45e6a4e2c4e09cd69a51d46190755bd42c1e53d4a1f80010da651d6c500a066afa9c98755acf643ff381af66742c6e091746c77e0f14f2583d6d70339ed50e9da34a0aa8820359872132179f087f16cdaf3636688927e39a857a99f911d08406b6addefa9f895f3b29812234eaf4d5a93b9363fa02a4ee9fe8676811004fabc8121f7639e9f92c0d7f796a6355e984d7a85aadc6220847666f8f52c4571516eb1a9fc487e918956411823e1edef555a61ba7d45931457b221bdcc8aaad58e8007497a8846278e0aed68926d3ea9fd96a89ccc89627c86da315c3eb5445bf799df613befe958390660f6c9f7ac02e3187100f18ea3bfacf9662601fc9868329b3524cb8c07850726355bd748f7c51b32e6c4341676cef6af55351e599d196d38d63bf0cd20b85f4bc79a2895b9c5c4d46090b4e1a10394f8ba7201d45d3878dc9b3e7ec3510073424b92a7448f9d8d9c15fff2a1c0e6dde7e6ad83f6243b21c6c14bd1b36e834b9cdc2b09022c0ddad8b5cdedb4a9e401acd96b77825cf6cb459e0c70b310c4d6f7a192c6766e75b4b50e64680b8bbe41065eac33f24c280ae6d89ef5fad05d8a9b635b052176cc3a9c2c9ffd43c0530deafd29079147dd34b5cd866e7feffe95f76695a40c216729ab52614000000000000000000d15fb7a1e1e415271a355e2920683606f9fc1e55e2bf1b5047b16c3c90280c51294756e33654a32aef0ba77bda88c545e20a6145a68d7dbf3e4ba0010fa7eeea87afa4d77297876614aebdc199a9da4b420083d16c28264dd3de22cd5add535914d9150c0efbeac1e113bd094222e55924f5e11ae2e4e3a99418fde8fb355438090f2b37d240238fe5a8f84e5456607e96a94254e12177ddc4399ec8dc6d26ec72e06f76c2b87ad2c42af894f689156c413e5b45015c"], 0xd0b) ioctl(0xffffffffffffffff, 0x2000000000, &(0x7f0000000280)="025cc882") sysfs$2(0x2, 0x1ff, &(0x7f0000000480)=""/140) 03:33:21 executing program 7: personality(0x1bb2baf3005ac137) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(&(0x7f0000018000)='./file0\x00', &(0x7f000002c000)='./file0\x00', &(0x7f00001d0ffa)='ramfs\x00', 0x1000818, &(0x7f000000a000)) creat(&(0x7f0000f66ff4)='./file0/bus\x00', 0x0) r0 = open$dir(&(0x7f0000eb6000)='./file0/bus\x00', 0x0, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x40000, 0x0) pkey_mprotect(&(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x1, 0xffffffffffffffff) [ 487.916399] binder: 9686:9694 unknown command 25349 [ 487.923347] binder: 9686:9694 ioctl c0306201 20007000 returned -22 [ 487.933074] binder: 9686:9694 got transaction to context manager from process owning it [ 487.941309] binder: 9686:9694 transaction failed 29201/-22, size 0-0 line 3004 [ 487.952261] binder: 9688:9698 unknown command 287493 [ 487.953434] binder: undelivered TRANSACTION_ERROR: 29201 03:33:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(0xffffffffffffffff, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 487.963022] binder: 9688:9698 ioctl c0306201 20007000 returned -22 [ 487.974553] binder: 9688:9698 got transaction to context manager from process owning it [ 487.982910] binder: 9688:9698 transaction failed 29201/-22, size 0-0 line 3004 [ 487.991962] binder: undelivered TRANSACTION_ERROR: 29201 03:33:21 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:21 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 488.182513] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9707 comm=syz-executor4 03:33:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, &(0x7f00000006c0)}) 03:33:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, 0xffffffffffffffff) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 488.300735] binder: 9714:9718 unknown command 287493 [ 488.306045] binder: 9714:9718 ioctl c0306201 20007000 returned -22 [ 488.306080] binder: BINDER_SET_CONTEXT_MGR already set [ 488.306088] binder: 9713:9719 ioctl 40046207 0 returned -16 [ 488.334441] binder: 9714:9718 got transaction to context manager from process owning it [ 488.343266] binder: 9714:9718 transaction failed 29201/-22, size 0-0 line 3004 03:33:21 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:21 executing program 7: r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)={0x7c, r1, 0x108, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9bca}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xe1da}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xff}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x14, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7ff}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0xc010) r2 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r3, 0x8200) r4 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x14, r2, 0x0) symlinkat(&(0x7f0000008ff8)='./file1\x00', 0xffffffffffffffff, &(0x7f0000012ff8)='./file0\x00') pipe2$9p(&(0x7f0000000000), 0x4000) fallocate(r4, 0x10, 0x0, 0xe439) 03:33:21 executing program 6: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000200)='/dev/full\x00', 0xffffffffffffffff, 0x0) recvfrom$inet(r0, &(0x7f0000000700)=""/249, 0xf9, 0x40012041, &(0x7f0000000340)={0x2, 0x4e23, @broadcast}, 0x10) ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000240)={0x8, 0x5, 0xffffffffffffffff, 'queue0\x00', 0x6}) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = socket$inet6(0xa, 0x0, 0x7fffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff) r4 = gettid() ioctl$TIOCSPGRP(r3, 0x5410, &(0x7f0000000480)=r4) write$FUSE_LSEEK(r3, &(0x7f00000001c0)={0x18, 0xe6daf2a0141644b0, 0x7, {0x5}}, 0x18) rt_sigqueueinfo(0x0, 0x1a, &(0x7f00000000c0)={0x34, 0x80, 0x3, 0xcb}) pwritev(r2, &(0x7f0000000680)=[{&(0x7f0000000500)="03dd406bb71a76c48eeeea75c8d818f44ab8162bb7a45cb2e6b0d6743fcad46753234497430f00df70755bd2a07eadb1b3d74dde892fed8f7560fee3e2946cb8125dc60519939bdf3aff28be8583556e2c346301186422d99ed759cc63cab37d14785f57f17a6a7efc4276e600271ad8b5eb6fd24e446c435efb4ac3000000000000050000000000000000", 0x8b}], 0x1, 0x20) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000001840)={{{@in=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@loopback}}, &(0x7f0000000440)=0xe8) getgroups(0x7, &(0x7f00000003c0)=[0xee01, 0xffffffffffffffff, 0x0, 0xee00, 0xee00, 0x0, 0xffffffffffffffff]) lchown(&(0x7f0000000180)='./bus\x00', r5, r7) fallocate(r3, 0x1, 0x0, 0x10000101) fchmod(r2, 0x31) setsockopt$inet_udp_encap(r3, 0x11, 0x64, &(0x7f0000000300)=0x7, 0x4) ioctl(r1, 0x8912, &(0x7f0000000040)="295ed277a4200100360070") openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x600, 0x0) r8 = syz_open_dev$usbmon(&(0x7f0000000800)='/dev/usbmon#\x00', 0x2000000000000000, 0x181000) lchown(&(0x7f0000000380)='./bus\x00', r5, r6) r9 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r8, 0x7001, &(0x7f0000000400)) fstatfs(r9, &(0x7f0000000840)=""/4096) [ 488.360221] binder: undelivered TRANSACTION_ERROR: 29201 03:33:21 executing program 5: socketpair$unix(0x1, 0x400000001, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000280)="6465762020257d5d3178e27a4092d5bd36324ade77d0e966dbf8e152663dd1129db02483f3d766c5033321dcde49f3678b2f05000000000000e21c6c94ade0169e36c3e7533b1ce773", 0x3) ftruncate(r1, 0x40001) write$binfmt_elf64(r0, &(0x7f0000000140)=ANY=[@ANYRES32], 0xfffffdf5) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r1, 0x111, 0x3, 0x1, 0x4) recvmmsg(r0, &(0x7f0000000800)=[{{&(0x7f00000000c0)=@nfc, 0x0, &(0x7f0000000940)=[{&(0x7f0000000880)=""/123}], 0x0, &(0x7f0000000680)=""/108}}, {{0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000700)=""/164}], 0x3c3}, 0x3}], 0x1b1, 0x0, 0x0) sendfile(r0, r1, &(0x7f00000001c0), 0x2652665a) pread64(r1, &(0x7f0000000200)=""/73, 0x49, 0x34) ioctl$TCSETSW(r1, 0x5403, &(0x7f0000000040)={0x9, 0xff, 0x7c2, 0x1, 0x3, 0xc60, 0x11, 0x3, 0x3d, 0x2, 0x0, 0x1}) 03:33:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, &(0x7f00000006c0)}) 03:33:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 488.591272] binder: BINDER_SET_CONTEXT_MGR already set [ 488.597168] binder: 9728:9732 ioctl 40046207 0 returned -16 [ 488.615287] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9731 comm=syz-executor4 [ 488.665544] binder: 9734:9736 unknown command 287493 [ 488.670782] binder: 9734:9736 ioctl c0306201 20007000 returned -22 [ 488.679597] binder: 9734:9736 got transaction to context manager from process owning it [ 488.688953] binder: 9734:9736 transaction failed 29201/-22, size 0-0 line 3004 [ 488.703786] binder: undelivered TRANSACTION_ERROR: 29201 03:33:22 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000002780), 0x8000fffffffe) r2 = getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000180)=r2) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) setpriority(0x0, 0x0, 0xffe) unshare(0x8000000) r4 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x5}) mq_timedreceive(r4, &(0x7f0000000000)=""/24, 0x18, 0x0, 0x0) mq_timedreceive(r4, &(0x7f0000000040)=""/50, 0x32, 0x0, &(0x7f00000000c0)={0x77359400}) mq_timedsend(r4, &(0x7f0000000100), 0x0, 0x0, 0x0) getsockname(0xffffffffffffffff, &(0x7f0000000600)=@nfc, &(0x7f0000000680)=0x80) write$binfmt_elf64(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7f45664600000000000000000000000000000000000000000000071ef4b8000040000000000000000000000000000000000000000000380000000000000000000000000000000000000000000000000000a51aaa9dee848e6d000000000000000000000000000000b6060000000000000300000000000000d0170000000000000000000000040000000000000000000000000000000000000000000000000000c67e9b79000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000fcff0000000000000000000000000000000000000000000000000000000000000000000000000000000000e94c82c48db881c78fd03a86b5bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x2b3) setsockopt$inet_int(r1, 0x0, 0xb, &(0x7f0000000200)=0x3, 0x4) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/20, 0x14}, 0x100) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000780)=""/228, &(0x7f0000000880)=0xe4) write$binfmt_elf64(r0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="7f454c460006610401000000000000000200030002000000120200000000000040000000000000000c02000000000000a6d10000030038000200ffffffff468051e57464030000000300000000000000bc08000000000000f9ffffffffffffffff7f0000000000000600000000000000000800000000000005000000020000006f000000000000000000000000000000ea2b000000000000080000000000000003000000000000000800000000000000f8d1cf6bc8252c025b5f92a84bb4d5efd7201c0b3858f135eeae2dc7f0e87b4cb7c2ebe8e1bf26d90204e8796ae2234ab4507f89e0a927c56e06ac8486242f23306477b3ced713d9ccd7a0f1572c2cfeceaf21bfb67974157e7a4e10510b1d74ca0f796a92f62c8102c33ef139e0cf2ccd4388e8404194afc7dcb3c0580904a76736e493f5c3e2f26e041f6b30857e8c9b55fe64259328116a71513c065b05319d42f98f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x57f) write$binfmt_elf64(r0, &(0x7f00000017c0)=ANY=[@ANYBLOB="7f454c4600250000050000000000000003003e00060000002c010000000000004000000000000000e1000000000000000500000087003800020002000700ea000200007001000000ea0a000000000000f7ffffffffffffff00000000ffffffff00000000000000000100000001000000010000000000000001000070040000000500000000000000000000000000000005000000000000000100000001000000ff0f00000000000000fcfffffffffffff423273d395b5dfe49a633eb0eb0263328129db30c89d614ca312379424593d1149401363a977a2b10bc8394762bab422771360aa38dc889b26829f721e3098b0f80c2f4ee55bcf0df04911af0a6a16e0ab5b5bb1e2227df0cb7b403be567ea3b9adef738dd4b7efbd9e56dfc0dc488a064d4ad246d477bc8fedb6c1fbcdb1469e544a6ac9afa9987b94c8d1209a41a79416931a8f43bd761418a2c47221a2a4d6bee2592cd6eab8fa3ac582965b48d68fb1dde708c9901874b0f1628c0adf0dc15872d102a327e9f073a52942892de4cc87c25e76cde841dd1e09db3f59955450018b682981af9bf3133a11fbf7915b41105bd663e6f7116777b3cb43f260d25a06d22119ca7674f7d9eeb496cccae5ea73758600072b6f0c2a040000002001cb9377fbc132be60c8b0bf6ac0a892b355685d62cb7077a1e889c359d7bfc544111c6ca232e6c6593a0b8f085567b065536d649fea6d4e202254fc1a0dedba780af208b0457ed33958cfd97c0155f59b06d997423bb3b6f3d5e01c8b74030434cacb0e50dcc661aff03a72021b6011f6ff05f6070f0bcb7d75cbf1668562cd6599dcf1eac792c47370ac83b2730215d9955f6fa81f59d3209fbaf52f41f8c413432d976fe6eb3ae98661de6250e09bcf7b82d0492b349ca022abade27ee2d41aa83ba7d2ed5193dda7e9c78769b1430e5a171e12e0fa1d057e1aef4b856ab0f2dabc8b207f09d78e1f83461ccac0b2558732ea70d369973971d2c6d94081f33308b1e4b27a2ce6f45838809407045aa63b6219d82564c7323f73bfc2260fd95e5e8eeca550b29adcca477de69469764858d7aa3ab8afd99e883c43dacae12ac88e7fea5a99df90755e5caf59185794ed6419a22fe36d9070ed6558b090cb871914491e2a135047b729107896b784bf87c941f7b993033898b993c83b8bcec93aed20e900921e8c8e716321ad5664665e7f89839258d1477a2e8fceaa9280b9c9dc53b5ed4bd907c3942d8fac1eff961bf3040ae0faed3985bccc355506dfcd52907750828fc988e60aec5b577af9769cebc8d6e87a826826f8362c84fe7ec9e6d3cc39c1b6b6b9005eaaf0d9037fa576757018d3f60fbab576284cd7343e70a4b8143dc67e94c1090b7376eec330f5995c4b3a119646b4a953cf0669d6e52264827bbbae2c7565529a68f46f5e1a23137059867d0192caf6b22e2d74f8fbe12a139bc90a0d12b6acc0a106ba4fc2baf87c254bb540835206fc5f63dbc82581cec68813c331af00086cae971610587c4683d5f1b0dd68b8a419f581f0387cc9d1a435e329a0595d73a4489b1ea23c331ca752bfd46de13faee26e7e2e9b11dd7151883ac8112c0ba049070bcf00881cc0a37395f1a102cddda4b0b903b0233461e70254e6a75b9c29c02fce51b630d5cd58867e5f8e5b47fdb2fb53e0b9485f1079ddb39d7b3ef5d8d37be9a08714575e454274581a8ad758ba53da32d2c893e8a40de0febf31f84016558a9db7c53dec27895d69fa1a34e4b5b856f4d0974a9dd4031e28632a245b921a576f1a19f47d7ba08e9ca94a7ae46c89b379d90e0dfdcffb790586d920ea79f94af735aa51695dfe0c9c73a44b277e877b473b43f5c3a960d7c5e22678ab3f7cf46bdf23cbbd31df613827f8e23f7b2c71be25eab7dbd56f7b426b784583ec97db1659afc521a84e709cd879f8e5afe72366ffcd05c29b92ad591e35a19df805a2b89b9b87a13109c19ea941e9b9f6ee1c47708870abfda2debce7eae0f356bc896a5a207f6bc3ed4186117e1ae9b861d3a9a94520a6df99fd700c6fc3b82467a1257c2040dd34b2fb30c032224e6b864900f93168e387edaeeedaebf8b7b40d4caaa97c85229e63770ced3382013fd11010d0ee46333666aaec98aacc511c92be9e55eee400c74ab4614552624ad88f5d63b6f87e85826ee7cf6f15418f9712c6d07f36a54f097d9bc48b3035ae569af4753e7831dc520fe4726d0c96d0cb7b45e5ca5002884d38ed8e8ead8d4a7da76f9bcfd848fd27345bec7dd4356ef7b11a0cd3113bd9d9bd72597daf8e25b987b6a17329b9c581e7e647eddd060553fd6e9194bc07ffc5ca9eb6e9ce36aa545ac0f6e242e381282522481668f05909a69db9c8f417ce2406fb727c11fa8ed3ec6f097fed51414f3286075c414753979f58a70d97539c1215ad15f4f2bdc9cb27e00245bb2291f767d4c581387a63022c727026043c0180a848edd1c3fffff21c3fe0b11c65caca8941959536882277e3dc9e61da52527a24e2d79a497a80b33b24f1ca184d56ad13194867d7a0a424977b5f256a4643460a03007ccf2abb042c6a8f357e8c67298f4ee68fa10d82aeec9c63884f43927692db04bfa6651a630ff1e945d5c2ceb1552d0cd69830f257e5d2b500e4447f03edc78938d82871b7075be875dee546cd23ae617356f51fe8f1fb11417e63a436d7ca0ecd22fab3719ab5b4a4fa0ac2b6a44002fdddb61f7d6fe2beac291455b144cff1da4cb487c430a42cd6dee2b0752536175bdeb3abf2a393823dddf4567d7a6ac785662eb272ea9ea223e0d63a2d027fc3bfa6da9c1537a5c207c9f2495bd45ee28be938ad3dbdadee778875ba641ceb20f3fb23d57269a4e40e0baea56d0b4247f12ebb7cf6ee0e64b0d521c8636ca845287f752adfde004e37bee0451540bcabf455b43233e287e4ce36ebbf2cf0aa8325b72b90c40cc5bdf77f66b07bf5423a80409e1e95424e2d63c09e621354d87d29d28758c290f29746e00e72e1f6ee9fc93841a7a4ec7420c1d78c09f9355b41c5b6a2e94d84218428a4e4e40bcab84f0cdc9a230101146a11e1f36367b4b5f21e76b5e58c31aec27a47e7ce6c22d29c553f03d0515199b541750e92718c53542cb8c0e4202c89b5bc2a4e3cd4fd1e33ba846b2d2d1c94d2e73327b1d327fe80ff1113634e2e94769b97a1088c2f00001fd26ffbf3b4b82036e960a01efd1eecb0e4cff79c5943cb7f3390757f2ebaa20ac131cddf19065dad03237cca7406b5c30228494fe25d9d26631795f3b0a16ac6c8c27e37a75bce127c582beed29fe6137efe5ac28a2a89597db794c570055e318e92f17f36e3fcbc68c8233d2f0c433f9e11b2819ade8026682c9c966d13605ba9cfa66d91f8203260ed06d8c53912b2c25be01165ebda24e3b70c4fa4a99c56470ee400000092272d6ba4a0906d5b8df7039b82bf83378b78ce124aca8b7944fffdd65bfca51e33614282fb1738dd43c6b95f2bc5e9b24605ff3fb5a06ece40c2c4a86b93acdde534777d47c5196e7ef7d65ff45606324b402aa6b81afa463f63f96bc442cd25a033b7b6feed08de0f00bccb16c439813c6c4b1d1733bb55a6245a9180ec71a7f31631613c60af161f5ef64493b859a6c4baa9e3811250984db538169178a4f4cb4141f74e366a28b4fdeef59bb22f6f525c493912a044bd99a3b4b86b2834a4f837d58d4292a22a730b6a2e5ec7bf358c2016326fff4889d5d5e1beec898a3a88d0f4a450d86548a1a9b1cc1bee45e6a4e2c4e09cd69a51d46190755bd42c1e53d4a1f80010da651d6c500a066afa9c98755acf643ff381af66742c6e091746c77e0f14f2583d6d70339ed50e9da34a0aa8820359872132179f087f16cdaf3636688927e39a857a99f911d08406b6addefa9f895f3b29812234eaf4d5a93b9363fa02a4ee9fe8676811004fabc8121f7639e9f92c0d7f796a6355e984d7a85aadc6220847666f8f52c4571516eb1a9fc487e918956411823e1edef555a61ba7d45931457b221bdcc8aaad58e8007497a8846278e0aed68926d3ea9fd96a89ccc89627c86da315c3eb5445bf799df613befe958390660f6c9f7ac02e3187100f18ea3bfacf9662601fc9868329b3524cb8c07850726355bd748f7c51b32e6c4341676cef6af55351e599d196d38d63bf0cd20b85f4bc79a2895b9c5c4d46090b4e1a10394f8ba7201d45d3878dc9b3e7ec3510073424b92a7448f9d8d9c15fff2a1c0e6dde7e6ad83f6243b21c6c14bd1b36e834b9cdc2b09022c0ddad8b5cdedb4a9e401acd96b77825cf6cb459e0c70b310c4d6f7a192c6766e75b4b50e64680b8bbe41065eac33f24c280ae6d89ef5fad05d8a9b635b052176cc3a9c2c9ffd43c0530deafd29079147dd34b5cd866e7feffe95f76695a40c216729ab52614000000000000000000d15fb7a1e1e415271a355e2920683606f9fc1e55e2bf1b5047b16c3c90280c51294756e33654a32aef0ba77bda88c545e20a6145a68d7dbf3e4ba0010fa7eeea87afa4d77297876614aebdc199a9da4b420083d16c28264dd3de22cd5add535914d9150c0efbeac1e113bd094222e55924f5e11ae2e4e3a99418fde8fb355438090f2b37d240238fe5a8f84e5456607e96a94254e12177ddc4399ec8dc6d26ec72e06f76c2b87ad2c42af894f689156c413e5b45015cd97cc02cf974f468"], 0xd13) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r1) 03:33:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x3, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056304"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, &(0x7f00000006c0)}) 03:33:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:22 executing program 6: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) syz_mount_image$vfat(&(0x7f00000000c0)='vfat\x00', &(0x7f0000000140)='./file0\x00', 0xffffffff, 0x2, &(0x7f0000000240)=[{&(0x7f0000000180)="df4ffd7922c7f7b4f1f5bcf0bedf9815efca97f03116b54868ac794fb44c6908ba6c7d285c961d9758525b81554d5291b1e1891da55020f3708759b4db27b159f036ca3ee69afc12c548f654398851c1", 0x50, 0x30f2}, {&(0x7f0000000200)="12c59e46fb", 0x5, 0x10000}], 0x1080000, &(0x7f0000000280)={[{@nonumtail='nnonumtail=1'}, {@fat=@flush='flush'}, {@iocharset={'iocharset', 0x3d, 'macroman'}}, {@iocharset={'iocharset', 0x3d, 'cp855'}}, {@numtail='nonumtail=0'}, {@utf8no='utf8=0'}, {@utf8='utf8=1'}]}) syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x200, 0x200000) perf_event_open(&(0x7f0000000040)={0x5, 0x70, 0x200, 0x100, 0x6, 0x400, 0x0, 0x5, 0x802, 0x8, 0x40, 0x3, 0x5, 0xb2, 0x1, 0x64ab, 0x1, 0xfffffffffffffffa, 0x39, 0x101, 0x6, 0x1, 0x9, 0x6, 0x7, 0xffffffff, 0x8, 0x2, 0xfffffffffffffff9, 0x7fff, 0xffffffffffff7fff, 0x5, 0x401, 0x8000, 0x7c, 0x1, 0x6, 0x100000000, 0x0, 0x9, 0x0, @perf_config_ext={0x5, 0x5}, 0x8002, 0x0, 0x81, 0x5, 0x9, 0x7fff, 0xffffffffffffff01}, 0xffffffffffffffff, 0x2, 0xffffffffffffff9c, 0x8) r0 = socket$inet(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000880)="24000000580007031dfffd946fa2830020200a0009000304341d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 488.851420] binder: 9742:9750 transaction failed 29189/-22, size 0-0 line 3013 [ 488.860253] binder: undelivered TRANSACTION_ERROR: 29189 03:33:22 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 488.910490] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9753 comm=syz-executor4 [ 488.934533] binder: 9751:9756 unknown command 287493 [ 488.940024] binder: 9751:9756 ioctl c0306201 20007000 returned -22 [ 488.948011] binder: 9751:9756 got transaction to context manager from process owning it 03:33:22 executing program 7: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r0, &(0x7f0000000340)=ANY=[@ANYBLOB="2321202e2f66696c65300affc9f5287343843410f94690c502ad6a8102acc773dc356602a05a4e489cee579cc7be8502ca3693c0932071a7ddf666d528aef2fc20fb7b9596379de6923728553e810030753ff542e154dc106803ebfd0913e44db3e719f8ccbed993ff2ba433f28b935a3f8e84083da724af2adaef694c6952f633ab"], 0x82) close(r0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000400)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r0, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x14, r1, 0x4, 0x70bd25, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0x8000}, 0x4000080) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000001c0)={'bcsh0\x00', {0x2, 0x4e24, @loopback}}) execve(&(0x7f0000000100)='./file0\x00', &(0x7f0000000240)=[&(0x7f0000000140)='{#,@^\x00', &(0x7f0000000200)='!ppp1\x00'], &(0x7f0000000300)=[&(0x7f0000000280)='\x00']) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f00000000c0)={'yam0\x00'}) execve(&(0x7f0000000180)='./file0\x00', &(0x7f0000000400), &(0x7f0000000400)) write$FUSE_NOTIFY_DELETE(r0, &(0x7f0000000500)={0x4a, 0x6, 0x0, {0x2, 0x3, 0x21, 0x0, 'eth1eth1ppp1em1,cgroupeth0.vmnet1'}}, 0x4a) bind$inet(r0, &(0x7f0000000580)={0x2, 0x4e20, @loopback}, 0x10) socket(0xb, 0x0, 0x9) ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0) 03:33:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(0xffffffffffffffff, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 488.956374] binder: 9751:9756 transaction failed 29201/-22, size 0-0 line 3004 [ 488.965403] binder: undelivered TRANSACTION_ERROR: 29201 03:33:22 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="056304401ad2"], 0x0, 0x0, &(0x7f0000002000)}) r1 = dup2(0xffffffffffffffff, r0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000040)) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="046304408200000065cc5d4ee68402569e0ce8ffdec600d0aca22267b1703a3113c16e1e9d8ee9f67cf6f40826a77999c499530167ca644478a8fa7b6e396c6988057ae237b31319f1ca247f692b303ff0195207cf167fb7c8d5856fccf9ef486cf600596d6b1ea4cdd645050cda155a54f49cdd819400dc97a4d112d83068443556ff388369040e3197aadc6d38bff0b5c17af983d510d79a9849cdb89dc5d923f7fb90a8e9cc7f56b37bfa90eca537378894de4eec8c0d6eb1979cc55d45542d618779488a5156d21b8990199943fcdafe759bd87b8da5423d9b6f1306c51b08ab11deb2bf4a7803e39c"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 489.089522] binder: 9762:9765 transaction failed 29189/-22, size 0-0 line 3013 [ 489.097656] binder: undelivered TRANSACTION_ERROR: 29189 03:33:22 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) pwritev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000280)}], 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000200)={0x0, &(0x7f00000001c0)}, 0xfffffffffffffe89) openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x8000, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={@empty, @multicast2, @multicast1}, &(0x7f0000000380)=0xc) pread64(r2, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010005fba000000000000030000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) dup2(r1, r2) [ 489.140746] netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. [ 489.159101] netlink: 8 bytes leftover after parsing attributes in process `syz-executor6'. 03:33:22 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(0xffffffffffffffff, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 489.188053] binder: BINDER_SET_CONTEXT_MGR already set [ 489.193557] binder: 9770:9775 ioctl 40046207 0 returned -16 [ 489.228864] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9774 comm=syz-executor4 [ 489.303619] binder: BINDER_SET_CONTEXT_MGR already set [ 489.309056] binder: 9777:9780 ioctl 40046207 0 returned -16 [ 489.326611] binder: 9779:9782 transaction failed 29189/-22, size 0-0 line 3013 [ 489.341762] binder: undelivered TRANSACTION_ERROR: 29189 [ 489.508684] binder: BINDER_SET_CONTEXT_MGR already set [ 489.514230] binder: 9790:9796 ioctl 40046207 0 returned -16 03:33:23 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r1) sendmsg$netlink(r2, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)=[{&(0x7f00000001c0)=ANY=[@ANYRES64], 0x1}], 0x1, &(0x7f0000000040)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0) recvmmsg(r0, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0x0, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x4000000000002ce, 0x62, 0x0) ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x3) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000000140)={0x0, 0x0, {0x0, 0x0, 0x9a, 0x1, 0x9}}) open(&(0x7f0000000080)='./file0/file0\x00', 0x0, 0x0) 03:33:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="97b10e025efeeab19ce6fcc3501e6820c176b8624a0289"], 0x0, 0x0, &(0x7f0000002000)}) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x0, 0x0) openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pktcdvd/control\x00', 0x8000, 0x0) r3 = pkey_alloc(0x0, 0x3) pkey_mprotect(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x4, r3) ioctl$EVIOCGMTSLOTS(r2, 0x8040450a, &(0x7f0000000080)) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(0xffffffffffffffff, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:23 executing program 7: r0 = syz_open_dev$rtc(&(0x7f0000000140)='/dev/rtc#\x00', 0x0, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000180)) r1 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @multicast1}, &(0x7f0000000040)=0x10, 0x800) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000080)={0x0, @multicast1, 0x4e23, 0x1, 'ovf\x00', 0xc, 0x7, 0x4b}, 0x2c) 03:33:23 executing program 6: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) pwritev(0xffffffffffffffff, &(0x7f0000000300)=[{&(0x7f0000000280)}], 0x1, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout_data(0xffffffffffffffff, 0x107, 0x16, &(0x7f0000000200)={0x0, &(0x7f00000001c0)}, 0xfffffffffffffe89) openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x8000, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000000)={"766574000000000000000000bd6800", 0x43732e5398416f1a}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000002c0)={@empty, @multicast2, @multicast1}, &(0x7f0000000380)=0xc) pread64(r2, &(0x7f0000000340)=""/39, 0x27, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="2800000010005fba000000000000030000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) dup2(r1, r2) 03:33:23 executing program 1: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000002780), 0x8000fffffffe) r2 = getpgrp(0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000180)=r2) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) setpriority(0x0, 0x0, 0xffe) unshare(0x8000000) r4 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x5}) mq_timedreceive(r4, &(0x7f0000000000)=""/24, 0x18, 0x0, 0x0) mq_timedreceive(r4, &(0x7f0000000040)=""/50, 0x32, 0x0, &(0x7f00000000c0)={0x77359400}) mq_timedsend(r4, &(0x7f0000000100), 0x0, 0x0, 0x0) getsockname(0xffffffffffffffff, &(0x7f0000000600)=@nfc, &(0x7f0000000680)=0x80) write$binfmt_elf64(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7f45664600000000000000000000000000000000000000000000071ef4b8000040000000000000000000000000000000000000000000380000000000000000000000000000000000000000000000000000a51aaa9dee848e6d000000000000000000000000000000b6060000000000000300000000000000d0170000000000000000000000040000000000000000000000000000000000000000000000000000c67e9b79000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000fcff0000000000000000000000000000000000000000000000000000000000000000000000000000000000e94c82c48db881c78fd03a86b5bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x2b3) setsockopt$inet_int(r1, 0x0, 0xb, &(0x7f0000000200)=0x3, 0x4) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/20, 0x14}, 0x100) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, &(0x7f0000000780)=""/228, &(0x7f0000000880)=0xe4) write$binfmt_elf64(r0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="7f454c460006610401000000000000000200030002000000120200000000000040000000000000000c02000000000000a6d10000030038000200ffffffff468051e57464030000000300000000000000bc08000000000000f9ffffffffffffffff7f0000000000000600000000000000000800000000000005000000020000006f000000000000000000000000000000ea2b000000000000080000000000000003000000000000000800000000000000f8d1cf6bc8252c025b5f92a84bb4d5efd7201c0b3858f135eeae2dc7f0e87b4cb7c2ebe8e1bf26d90204e8796ae2234ab4507f89e0a927c56e06ac8486242f23306477b3ced713d9ccd7a0f1572c2cfeceaf21bfb67974157e7a4e10510b1d74ca0f796a92f62c8102c33ef139e0cf2ccd4388e8404194afc7dcb3c0580904a76736e493f5c3e2f26e041f6b30857e8c9b55fe64259328116a71513c065b05319d42f98f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000db00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x57f) write$binfmt_elf64(r0, &(0x7f00000017c0)=ANY=[@ANYBLOB="7f454c4600250000050000000000000003003e00060000002c010000000000004000000000000000e1000000000000000500000087003800020002000700ea000200007001000000ea0a000000000000f7ffffffffffffff00000000ffffffff00000000000000000100000001000000010000000000000001000070040000000500000000000000000000000000000005000000000000000100000001000000ff0f00000000000000fcfffffffffffff423273d395b5dfe49a633eb0eb0263328129db30c89d614ca312379424593d1149401363a977a2b10bc8394762bab422771360aa38dc889b26829f721e3098b0f80c2f4ee55bcf0df04911af0a6a16e0ab5b5bb1e2227df0cb7b403be567ea3b9adef738dd4b7efbd9e56dfc0dc488a064d4ad246d477bc8fedb6c1fbcdb1469e544a6ac9afa9987b94c8d1209a41a79416931a8f43bd761418a2c47221a2a4d6bee2592cd6eab8fa3ac582965b48d68fb1dde708c9901874b0f1628c0adf0dc15872d102a327e9f073a52942892de4cc87c25e76cde841dd1e09db3f59955450018b682981af9bf3133a11fbf7915b41105bd663e6f7116777b3cb43f260d25a06d22119ca7674f7d9eeb496cccae5ea73758600072b6f0c2a040000002001cb9377fbc132be60c8b0bf6ac0a892b355685d62cb7077a1e889c359d7bfc544111c6ca232e6c6593a0b8f085567b065536d649fea6d4e202254fc1a0dedba780af208b0457ed33958cfd97c0155f59b06d997423bb3b6f3d5e01c8b74030434cacb0e50dcc661aff03a72021b6011f6ff05f6070f0bcb7d75cbf1668562cd6599dcf1eac792c47370ac83b2730215d9955f6fa81f59d3209fbaf52f41f8c413432d976fe6eb3ae98661de6250e09bcf7b82d0492b349ca022abade27ee2d41aa83ba7d2ed5193dda7e9c78769b1430e5a171e12e0fa1d057e1aef4b856ab0f2dabc8b207f09d78e1f83461ccac0b2558732ea70d369973971d2c6d94081f33308b1e4b27a2ce6f45838809407045aa63b6219d82564c7323f73bfc2260fd95e5e8eeca550b29adcca477de69469764858d7aa3ab8afd99e883c43dacae12ac88e7fea5a99df90755e5caf59185794ed6419a22fe36d9070ed6558b090cb871914491e2a135047b729107896b784bf87c941f7b993033898b993c83b8bcec93aed20e900921e8c8e716321ad5664665e7f89839258d1477a2e8fceaa9280b9c9dc53b5ed4bd907c3942d8fac1eff961bf3040ae0faed3985bccc355506dfcd52907750828fc988e60aec5b577af9769cebc8d6e87a826826f8362c84fe7ec9e6d3cc39c1b6b6b9005eaaf0d9037fa576757018d3f60fbab576284cd7343e70a4b8143dc67e94c1090b7376eec330f5995c4b3a119646b4a953cf0669d6e52264827bbbae2c7565529a68f46f5e1a23137059867d0192caf6b22e2d74f8fbe12a139bc90a0d12b6acc0a106ba4fc2baf87c254bb540835206fc5f63dbc82581cec68813c331af00086cae971610587c4683d5f1b0dd68b8a419f581f0387cc9d1a435e329a0595d73a4489b1ea23c331ca752bfd46de13faee26e7e2e9b11dd7151883ac8112c0ba049070bcf00881cc0a37395f1a102cddda4b0b903b0233461e70254e6a75b9c29c02fce51b630d5cd58867e5f8e5b47fdb2fb53e0b9485f1079ddb39d7b3ef5d8d37be9a08714575e454274581a8ad758ba53da32d2c893e8a40de0febf31f84016558a9db7c53dec27895d69fa1a34e4b5b856f4d0974a9dd4031e28632a245b921a576f1a19f47d7ba08e9ca94a7ae46c89b379d90e0dfdcffb790586d920ea79f94af735aa51695dfe0c9c73a44b277e877b473b43f5c3a960d7c5e22678ab3f7cf46bdf23cbbd31df613827f8e23f7b2c71be25eab7dbd56f7b426b784583ec97db1659afc521a84e709cd879f8e5afe72366ffcd05c29b92ad591e35a19df805a2b89b9b87a13109c19ea941e9b9f6ee1c47708870abfda2debce7eae0f356bc896a5a207f6bc3ed4186117e1ae9b861d3a9a94520a6df99fd700c6fc3b82467a1257c2040dd34b2fb30c032224e6b864900f93168e387edaeeedaebf8b7b40d4caaa97c85229e63770ced3382013fd11010d0ee46333666aaec98aacc511c92be9e55eee400c74ab4614552624ad88f5d63b6f87e85826ee7cf6f15418f9712c6d07f36a54f097d9bc48b3035ae569af4753e7831dc520fe4726d0c96d0cb7b45e5ca5002884d38ed8e8ead8d4a7da76f9bcfd848fd27345bec7dd4356ef7b11a0cd3113bd9d9bd72597daf8e25b987b6a17329b9c581e7e647eddd060553fd6e9194bc07ffc5ca9eb6e9ce36aa545ac0f6e242e381282522481668f05909a69db9c8f417ce2406fb727c11fa8ed3ec6f097fed51414f3286075c414753979f58a70d97539c1215ad15f4f2bdc9cb27e00245bb2291f767d4c581387a63022c727026043c0180a848edd1c3fffff21c3fe0b11c65caca8941959536882277e3dc9e61da52527a24e2d79a497a80b33b24f1ca184d56ad13194867d7a0a424977b5f256a4643460a03007ccf2abb042c6a8f357e8c67298f4ee68fa10d82aeec9c63884f43927692db04bfa6651a630ff1e945d5c2ceb1552d0cd69830f257e5d2b500e4447f03edc78938d82871b7075be875dee546cd23ae617356f51fe8f1fb11417e63a436d7ca0ecd22fab3719ab5b4a4fa0ac2b6a44002fdddb61f7d6fe2beac291455b144cff1da4cb487c430a42cd6dee2b0752536175bdeb3abf2a393823dddf4567d7a6ac785662eb272ea9ea223e0d63a2d027fc3bfa6da9c1537a5c207c9f2495bd45ee28be938ad3dbdadee778875ba641ceb20f3fb23d57269a4e40e0baea56d0b4247f12ebb7cf6ee0e64b0d521c8636ca845287f752adfde004e37bee0451540bcabf455b43233e287e4ce36ebbf2cf0aa8325b72b90c40cc5bdf77f66b07bf5423a80409e1e95424e2d63c09e621354d87d29d28758c290f29746e00e72e1f6ee9fc93841a7a4ec7420c1d78c09f9355b41c5b6a2e94d84218428a4e4e40bcab84f0cdc9a230101146a11e1f36367b4b5f21e76b5e58c31aec27a47e7ce6c22d29c553f03d0515199b541750e92718c53542cb8c0e4202c89b5bc2a4e3cd4fd1e33ba846b2d2d1c94d2e73327b1d327fe80ff1113634e2e94769b97a1088c2f00001fd26ffbf3b4b82036e960a01efd1eecb0e4cff79c5943cb7f3390757f2ebaa20ac131cddf19065dad03237cca7406b5c30228494fe25d9d26631795f3b0a16ac6c8c27e37a75bce127c582beed29fe6137efe5ac28a2a89597db794c570055e318e92f17f36e3fcbc68c8233d2f0c433f9e11b2819ade8026682c9c966d13605ba9cfa66d91f8203260ed06d8c53912b2c25be01165ebda24e3b70c4fa4a99c56470ee400000092272d6ba4a0906d5b8df7039b82bf83378b78ce124aca8b7944fffdd65bfca51e33614282fb1738dd43c6b95f2bc5e9b24605ff3fb5a06ece40c2c4a86b93acdde534777d47c5196e7ef7d65ff45606324b402aa6b81afa463f63f96bc442cd25a033b7b6feed08de0f00bccb16c439813c6c4b1d1733bb55a6245a9180ec71a7f31631613c60af161f5ef64493b859a6c4baa9e3811250984db538169178a4f4cb4141f74e366a28b4fdeef59bb22f6f525c493912a044bd99a3b4b86b2834a4f837d58d4292a22a730b6a2e5ec7bf358c2016326fff4889d5d5e1beec898a3a88d0f4a450d86548a1a9b1cc1bee45e6a4e2c4e09cd69a51d46190755bd42c1e53d4a1f80010da651d6c500a066afa9c98755acf643ff381af66742c6e091746c77e0f14f2583d6d70339ed50e9da34a0aa8820359872132179f087f16cdaf3636688927e39a857a99f911d08406b6addefa9f895f3b29812234eaf4d5a93b9363fa02a4ee9fe8676811004fabc8121f7639e9f92c0d7f796a6355e984d7a85aadc6220847666f8f52c4571516eb1a9fc487e918956411823e1edef555a61ba7d45931457b221bdcc8aaad58e8007497a8846278e0aed68926d3ea9fd96a89ccc89627c86da315c3eb5445bf799df613befe958390660f6c9f7ac02e3187100f18ea3bfacf9662601fc9868329b3524cb8c07850726355bd748f7c51b32e6c4341676cef6af55351e599d196d38d63bf0cd20b85f4bc79a2895b9c5c4d46090b4e1a10394f8ba7201d45d3878dc9b3e7ec3510073424b92a7448f9d8d9c15fff2a1c0e6dde7e6ad83f6243b21c6c14bd1b36e834b9cdc2b09022c0ddad8b5cdedb4a9e401acd96b77825cf6cb459e0c70b310c4d6f7a192c6766e75b4b50e64680b8bbe41065eac33f24c280ae6d89ef5fad05d8a9b635b052176cc3a9c2c9ffd43c0530deafd29079147dd34b5cd866e7feffe95f76695a40c216729ab52614000000000000000000d15fb7a1e1e415271a355e2920683606f9fc1e55e2bf1b5047b16c3c90280c51294756e33654a32aef0ba77bda88c545e20a6145a68d7dbf3e4ba0010fa7eeea87afa4d77297876614aebdc199a9da4b420083d16c28264dd3de22cd5add535914d9150c0efbeac1e113bd094222e55924f5e11ae2e4e3a99418fde8fb355438090f2b37d240238fe5a8f84e5456607e96a94254e12177ddc4399ec8dc6d26ec72e06f76c2b87ad2c42af894f689156c413e5b45015cd97cc02cf974f468"], 0xd13) ioctl$LOOP_CHANGE_FD(r3, 0x4c06, r1) 03:33:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:23 executing program 7: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0xf0, 0x10, 0x300, 0x70bd28, 0x25dfdbfb, {0x11}, [@generic="8c97bcf6280dadcefec6f13c2e99a1c4ecff50c54addfd5420f76024e988817acae349dc5a3205d60a9d9a14b402cc2f234f2849614eeaf79d840f7ecb3caf8018fa7663944f4bcca0b7aada1829e263df7dce531d583f21b7c6da5ea433de378cb555c0f8a7b1681b73b144f4ea5ac32375c7185dbe54aa4717804c5c6c66623f334e3a215dcc04ba1448d65921863bf6460d4ce827779ab5e662a3c84ea28b7ef3a09e94e7ddf48d8c06dcbb8282e5ec70e81652f5884dd64e950315443c2cfdab50d69cfe0fc352acdfa0717a786074bff2d2a80d8e4a6026f3"]}, 0xf0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4) clock_settime(0x7, &(0x7f0000000140)) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x8) listen(r1, 0x0) connect(r0, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/fib_trie\x00') sendfile(r0, r2, &(0x7f0000000000), 0x800000bf) 03:33:23 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) r2 = dup2(r0, r1) r3 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r4 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000240)={0x54, ""/84}) fadvise64(r3, 0x0, 0x7, 0x1) r5 = dup2(r4, r3) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="046304400000000057ca5405f1d0b7199f64d50f44895f1a2efcc66a0483ed4a29849401000100dc2396cbd8b5225dcd80ef4951c4e277391fd2aa84d1c06e21c9d3"], 0x0, 0x0, &(0x7f00000006c0)}) open(&(0x7f0000000100)='./file0\x00', 0x100, 0x8) fcntl$getownex(r1, 0x10, &(0x7f0000000140)={0x0, 0x0}) fcntl$lock(r3, 0x7, &(0x7f0000000180)={0x2, 0x1, 0x2, 0xfff, r6}) ioctl$SG_GET_TIMEOUT(r5, 0x2202, 0x0) write$P9_RVERSION(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="13e90630000000000000000000000000000000"], 0x13) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f00000001c0)={0x0, 0x3e0}, 0x8) [ 489.738295] binder: 9803:9807 unknown command 34517399 [ 489.744901] binder: 9803:9807 ioctl c0306201 20007000 returned -22 [ 489.762808] binder: 9803:9807 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 489.773426] binder: 9803:9807 unknown command 34517399 [ 489.779096] binder: 9803:9807 ioctl c0306201 20007000 returned -22 03:33:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:23 executing program 6: socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x1, 0x0) ppoll(&(0x7f0000000140), 0x0, &(0x7f0000000180)={0x77359400}, &(0x7f00000001c0)={0x9}, 0x8) ioctl$TIOCLINUX7(0xffffffffffffffff, 0x541c, &(0x7f0000000040)={0x7, 0x2}) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)) close(0xffffffffffffffff) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ptmx\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x5) socket$inet_udp(0x2, 0x2, 0x0) r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000240)='/dev/null\x00', 0x2200, 0x0) munlockall() write$FUSE_DIRENT(r0, &(0x7f0000000280)={0x108, 0x0, 0x2, [{0x1, 0x2, 0xa, 0x42c, '/dev/null\x00'}, {0x5, 0x29, 0x0, 0x8}, {0x1, 0x7, 0x0, 0x3}, {0x5, 0x0, 0xa, 0x7, '/dev/ptmx\x00'}, {0x1, 0x393f80, 0x11, 0x1ff, '/selinux/enforce\x00'}, {0x6, 0x1, 0xa, 0x4, '/dev/ptmx\x00'}, {0x1, 0x800, 0x3, 0x6e0134de, '*[*'}]}, 0x108) ppoll(&(0x7f0000000080), 0x0, &(0x7f00000000c0)={0x0, 0x1c9c380}, &(0x7f0000000100), 0x8) socket$key(0xf, 0x3, 0x2) [ 489.817699] binder: BINDER_SET_CONTEXT_MGR already set [ 489.823246] binder: 9806:9816 ioctl 40046207 0 returned -16 03:33:23 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = dup2(r1, r1) sendmsg$netlink(r2, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)=[{&(0x7f00000001c0)=ANY=[@ANYRES64], 0x1}], 0x1, &(0x7f0000000040)=[@rights={0x18, 0x1, 0x1, [r0]}], 0x18}, 0x0) recvmmsg(r0, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0x0, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x4000000000002ce, 0x62, 0x0) ioctl$UI_SET_SNDBIT(r2, 0x4004556a, 0x3) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000000140)={0x0, 0x0, {0x0, 0x0, 0x9a, 0x1, 0x9}}) open(&(0x7f0000000080)='./file0/file0\x00', 0x0, 0x0) 03:33:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, &(0x7f00000006c0)}) 03:33:23 executing program 7: r0 = open(&(0x7f0000000040)='./bus\x00', 0x141042, 0x0) truncate(&(0x7f0000000000)='./bus\x00', 0x800) fallocate(r0, 0x20, 0x0, 0xfffffeff000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0x8401}], 0x1, &(0x7f0000000100)={0x0, 0x989680}, &(0x7f0000000140)={0x4}, 0x8) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) getsockopt$ARPT_SO_GET_ENTRIES(r0, 0x0, 0x61, &(0x7f0000000240)={'filter\x00', 0x76, "7e9e79530a07e5bc1a8cb2328cfc5eb062352d8eb21e9c8fa270d6a0e36fbb2bcc30d3e819c3cbf9632cd408cb276e2c65519c68ac6f5083c1f0a2480093270304b4e4a1ab8831fd6ea9a0869665daab3cc828952fe5f57cdb8e50e0e0bd4e330052c926b209e771fbe677a68726ba97f746ef553658"}, &(0x7f0000000300)=0x9a) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000200)={0xaa, 0x9}) fallocate(r1, 0x0, 0x0, 0x10000101) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000180)=""/99) [ 490.006232] binder: 9822:9829 tried to acquire reference to desc 0, got 1 instead 03:33:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000080)={0x8, &(0x7f0000000040)=[{0x8, 0x7fff, 0x20, 0x80}, {0x6176, 0x6, 0x855b, 0xab61}, {0x3, 0x7, 0x5, 0x200}, {0x9, 0x2, 0x1, 0xfffffffffffffff9}, {0x3, 0x81, 0x1, 0x2}, {0x7f, 0x1ed4, 0x3, 0x9}, {0x634b, 0x5, 0xffffffff, 0x6}, {0x8, 0x2, 0x8000, 0x1}]}, 0x10) [ 490.075174] binder: 9826:9835 ioctl 2202 0 returned -22 [ 490.085365] binder: 9826:9837 tried to acquire reference to desc 0, got 1 instead [ 490.096031] binder: 9826:9837 tried to acquire reference to desc 0, got 1 instead [ 490.104309] binder: 9826:9837 ioctl 2202 0 returned -22 [ 490.110926] binder: BINDER_SET_CONTEXT_MGR already set [ 490.116411] binder: 9831:9838 ioctl 40046207 0 returned -16 03:33:23 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, &(0x7f00000006c0)}) 03:33:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f00000002c0)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0xc2, 0x0, &(0x7f00000001c0)="4eba00fb16fac9f6cb0ddd19c50d31e97b9513b649d59c02b22fde82cc35f482ffb5f0377a50888eb26cf71e613323e7a094e7609bf07e428cf6e2961cba7f9670b51f1b2048ee52f6baeb0114bd4aefa23155b53d45b45fc9a39311cc4451b780cc3116e4dee14a6389f5d21b3adf79de9ae428198ca1acc21c858c0fdb6bcbed5acef20100d78de9ae42bf176c4eeab92983b20e4d0000362bd5155f40371f5fb45cf665ef5b4d7bdf825ed6857a148cce79eaf3b3027c1e29d957377c4dbd18ea"}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000040)={{{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in=@remote}}, &(0x7f0000000140)=0xe8) fdatasync(r1) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000180)={@mcast2, 0x13, r3}) 03:33:23 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 490.343645] binder: BINDER_SET_CONTEXT_MGR already set [ 490.370759] binder: 9852:9855 ioctl 40046207 0 returned -16 [ 490.618445] binder: 9863:9869 ioctl 8916 20000180 returned -22 03:33:24 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x10000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r2, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x20}, 0xc) dup2(r0, r2) 03:33:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000900), 0x0, 0x0, &(0x7f00000006c0)}) 03:33:24 executing program 7: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000040)={0x11, &(0x7f0000000000)=[{0x8, 0x0, 0xc5, 0x8}, {0x20000000000009, 0x3fa, 0x0, 0x4}]}, 0x10) sendmmsg(r1, &(0x7f0000003040), 0x304, 0x0) 03:33:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq'}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:24 executing program 5: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$binfmt_aout(r0, &(0x7f0000000280)=ANY=[@ANYBLOB="0801200303010000b3020000f20e0000030100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x4ba) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)) unlink(&(0x7f0000000080)='./file1\x00') pread64(r0, &(0x7f0000000800)=""/77, 0x4d, 0x0) write$binfmt_elf64(r0, &(0x7f0000000080)=ANY=[], 0x1da) fallocate(r0, 0x0, 0x0, 0x4003ff) write$cgroup_type(r0, &(0x7f0000000240)='threaded\x00', 0xf96d) fallocate(r0, 0x3, 0x7fff, 0x8001) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) fallocate(r0, 0x3, 0x5e89, 0xfff9) execve(&(0x7f0000000000)='./file1\x00', &(0x7f0000000740)=[&(0x7f0000000140)='[,-\x00', &(0x7f0000000180)='^vboxnet1\x00', &(0x7f00000001c0)='\x00', &(0x7f0000000200)='threaded\x00'], &(0x7f00000007c0)=[&(0x7f0000000780)='threaded\x00']) [ 490.787707] binder: BINDER_SET_CONTEXT_MGR already set [ 490.793693] binder: 9871:9878 ioctl 40046207 0 returned -16 03:33:24 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$packet(0x11, 0x2, 0x300) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) ioctl$TIOCMBIC(r2, 0x5417, &(0x7f00000000c0)=0xd142) sendto$inet6(r1, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4, 0x4, @dev}, 0x1c) 03:33:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$EVIOCGABS3F(r2, 0x8018457f, &(0x7f0000000380)=""/154) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000080)={{{@in6=@ipv4={[], [], @multicast1}, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000180)=0xe8) getresuid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)=0x0) sendmsg$nl_route(r2, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)=@ipv6_delrule={0x70, 0x21, 0x429, 0x70bd26, 0x25dfdbfc, {0xa, 0xa0, 0x0, 0x3, 0x800, 0x0, 0x0, 0x3}, [@FRA_SRC={0x14, 0x2, @dev={0xfe, 0x80, [], 0x1a}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1c}}, @FIB_RULE_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e22, 0x4e22}}, @FIB_RULE_POLICY=@FRA_UID_RANGE={0xc, 0x14, {r3, r4}}, @FRA_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x1c}}]}, 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:24 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f00000000c0)) r2 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f00000001c0)={{0xa, 0x4e20, 0x0, @ipv4={[], [], @multicast2}}, {0xa, 0x4e20, 0x1000, @local, 0xffffffffffffffff}, 0x5, [0x1ff, 0xfff, 0x73, 0x6, 0x1, 0x4, 0x6, 0x1]}, 0x5c) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='oom_score_adj\x00') sendfile(r0, r3, &(0x7f0000000140), 0x88003) 03:33:24 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x20000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f0000000180)) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000780)={{{@in6=@mcast1, @in6=@local}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000400)=""/150) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000001c0)=0x6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f0000000340)) ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, &(0x7f0000000240)={0x81, 0x10000, 0x0, 0x7bab, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000a80)) pwrite64(0xffffffffffffffff, &(0x7f0000000940)="241a5025560b85500773ad77782a1043ac371db9b19259473a21613d4eb718c2cacb2c6c3eb8cd3a3f00a6aa3e6713dc9cc35ec8ef0002f74a4eb6043cddcc3ff06b798b59f45bef15e2f0c3d06d1daec8caa6f84c14f3fa943cb5e13259b67d5413641338851f7f271cb50a47e5bfaa7b3684be3ae883f7fcc193075f8f00280a72e755152fc5c5c0a44c9f0596b2bd78501fecd8e7fb1a4fcbdc296f282f017ac2c41cefd605f1f69090e2d26013f00e7609bb6d7a290879e0a80fcc1aadf31310b61e7232ec12be56e60ddb49110ca0cff5038c70ad8fb8e68c1bc7e7b9b9141b408ad90a724e4fbc5874163a0aad51f538a909a8700f17c13516c315e98460c0ac01d70ba0e00005a6057ea0a09c55983b8f8ae12753f7bc606db28cec1c1558470b47ef1b0bf1e213afa5803ea9ceca1f17", 0x134, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000540)={{{@in6=@ipv4={[], [], @local}, @in=@broadcast}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f0000000640)=0xe8) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000200)={0x9, 0x1, 0xb5, 0x0, 0x800}) sendmsg$nl_route(r1, &(0x7f0000000740)={&(0x7f0000000380), 0xc, &(0x7f0000000700)={&(0x7f00000003c0)=ANY=[@ANYPTR], 0x1}}, 0x880) sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYRES32=0x0], 0x1}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40040000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0xe0, 0x0, 0x0, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x421a}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bridge\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1f}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, [], 0xa}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x100000001}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_ADDR={0x14}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9ae2}]}, 0xe0}, 0x1, 0x0, 0x0, 0x40010}, 0x8084) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000002740)={{{@in=@local, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in6}}, &(0x7f0000002840)=0xe8) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$fiemap(r2, 0x40086602, &(0x7f0000000040)=ANY=[]) creat(&(0x7f0000000000)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x0) fcntl$setstatus(r4, 0x4, 0x4000) write$selinux_create(r3, &(0x7f0000000080)=ANY=[@ANYBLOB='s'], 0x1) write$selinux_access(r4, &(0x7f0000000000)={'system_u:object_r:etc_t:s0', 0x20, '/usr/sbin/ntpd'}, 0xfffffeff) write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x0, 0x7530}}, {{0x0, 0x7530}}, {{0x77359400}, 0x0, 0x8}], 0x48) 03:33:24 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$SG_SET_TIMEOUT(r2, 0x2201, &(0x7f00000001c0)=0x5) fadvise64(r2, 0x0, 0xf3b4, 0x3) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f000099e000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r3, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10) epoll_ctl$EPOLL_CTL_MOD(r0, 0x3, r3, &(0x7f0000000140)={0x10000004}) ioctl$int_in(r3, 0x5456, &(0x7f0000000000)=0x100) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x200, 0x0) ioctl$TIOCGWINSZ(r4, 0x5413, &(0x7f0000000100)) ppoll(&(0x7f0000000240)=[{r3}], 0x1, &(0x7f0000000080)={0x0, 0x1c9c380}, &(0x7f00000000c0), 0x8) [ 491.203099] binder: 9890:9896 ioctl 8018457f 20000380 returned -22 [ 491.218115] binder: 9893:9900 tried to acquire reference to desc 0, got 1 instead [ 491.226504] binder: 9890:9896 tried to acquire reference to desc 0, got 1 instead [ 491.226875] binder: BINDER_SET_CONTEXT_MGR already set [ 491.226884] binder: 9890:9896 ioctl 40046207 0 returned -16 03:33:24 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 491.235788] binder: 9890:9896 ioctl 8018457f 20000380 returned -22 [ 491.241684] binder: BINDER_SET_CONTEXT_MGR already set [ 491.241692] binder: 9890:9902 ioctl 40046207 0 returned -16 [ 491.249214] selinux_nlmsg_perm: 5 callbacks suppressed [ 491.249222] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9897 comm=syz-executor4 [ 491.296973] binder: 9893:9900 got transaction to context manager from process owning it [ 491.305457] binder: 9893:9900 transaction failed 29201/-22, size 0-0 line 3004 [ 491.315585] IPVS: Creating netns size=2536 id=76 [ 491.315618] binder: undelivered TRANSACTION_ERROR: 29201 03:33:24 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f00000001c0)=0xc) fstat(0xffffffffffffff9c, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='fuse\x00', 0x110020, &(0x7f0000000280)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0xa000}, 0x2c, {'user_id', 0x3d, r1}, 0x2c, {'group_id', 0x3d, r2}, 0x2c, {[{@allow_other='allow_other'}]}}) r3 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r6 = dup2(r5, r3) accept$packet(r4, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000380)=0x14) ioctl$sock_inet6_SIOCADDRT(r6, 0x890b, &(0x7f00000003c0)={@empty, @remote, @dev={0xfe, 0x80, [], 0x20}, 0x2, 0xe22b, 0x7969, 0x0, 0x1ff, 0x800000, r7}) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="05630440339a51013e39749ce8b9694a47ffc5fb8a9455c891580214640d9a09f28b9dfc145b555a9f326142be888517efde1d9d1b841a0c555db64be6d6098aaf0002a355cb84fe3be172f8ec22ec05cdf28ca52e00685f234b3af705c25fd3573762489b03475c5edd586e5eecb27f5ff6b387bbcf993bc7bc060daee61fa8cb176bc84a449ee60000000000000000000000000000"], 0x0, 0x0, &(0x7f0000002000)}) syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x400) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000080)={@local}, &(0x7f00000000c0)=0x14) r3 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$FICLONE(r3, 0x40049409, r3) 03:33:24 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 491.362301] binder: 9863:9907 ioctl 8916 20000180 returned -22 03:33:24 executing program 6: socketpair(0x1f, 0x0, 0x6, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000200)=""/113, &(0x7f0000000140)=0x71) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[]}}, 0x0) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0)={0x3}, 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010000000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b1d632b010020000000000000"], 0x80}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f0000000280)=""/171) sendmmsg(r2, &(0x7f0000000180), 0x400000000000117, 0x0) 03:33:25 executing program 7: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000280)='-posix_acl_accessnodev\x00', 0x3) ftruncate(0xffffffffffffffff, 0x8200) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x1, 0x31, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) write$FUSE_POLL(r0, &(0x7f00000000c0)={0x18, 0x0, 0x4, {0x7fff}}, 0x18) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x3}, 0x1c) [ 491.593436] binder: 9913:9921 Acquire 1 refcount change on invalid ref 22125107 ret -22 [ 491.605628] binder: BINDER_SET_CONTEXT_MGR already set [ 491.610035] binder: 9913:9924 Acquire 1 refcount change on invalid ref 22125107 ret -22 [ 491.640142] binder: BINDER_SET_CONTEXT_MGR already set [ 491.646215] binder: 9913:9925 ioctl 40046207 0 returned -16 [ 491.646626] binder: 9917:9927 tried to acquire reference to desc 0, got 1 instead [ 491.646636] binder: 9917:9927 got transaction to context manager from process owning it [ 491.646648] binder: 9917:9927 transaction failed 29201/-22, size 0-0 line 3004 [ 491.646938] binder: undelivered TRANSACTION_ERROR: 29201 [ 491.652438] binder: 9913:9921 ioctl 40046207 0 returned -16 03:33:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) socket$unix(0x1, 0x5, 0x0) get_robust_list(0x0, &(0x7f0000000780)=&(0x7f0000000740)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x0, &(0x7f0000000700)={&(0x7f0000000280)}}, &(0x7f00000007c0)=0x18) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x80000000009) creat(&(0x7f0000000700)='./bus\x00', 0x0) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x0, 0x8014, r2, 0xffffffffffffffff) ioctl$KDSIGACCEPT(r2, 0x4b4e, 0x1000000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, &(0x7f0000000000)={0x0, 0x6, 0x4}) mq_unlink(&(0x7f00000000c0)='bdev\x00') r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x8000, 0x0) ioctl$SG_GET_REQUEST_TABLE(r4, 0x2286, &(0x7f0000000380)) getpeername$unix(r4, &(0x7f00000004c0), &(0x7f0000000200)=0x6e) mq_timedsend(r3, &(0x7f00000e6000), 0x0, 0x3, &(0x7f0000000540)) r5 = getpid() mq_notify(r3, &(0x7f0000000040)={0x0, 0x1b, 0x0, @tid=r5}) syncfs(r4) getsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r6 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x543000, 0x0) ioctl$SG_GET_REQUEST_TABLE(r6, 0x2286, &(0x7f0000000240)) getegid() ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40082404, &(0x7f00000005c0)=0x4) mq_timedsend(r3, &(0x7f0000000040), 0x0, 0x0, &(0x7f0000fbc000)) close(r4) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') preadv(r7, &(0x7f0000000700)=[{&(0x7f0000000600)=""/246, 0xf6}], 0x1, 0x80000000) [ 491.660301] binder: 9913:9921 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 491.698467] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9926 comm=syz-executor4 03:33:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) vmsplice(r0, &(0x7f0000000440)=[{&(0x7f0000000080)="628a06954e42d5a6aa80a50004ac2df3991185bacb7f5bb9ad3d6b2b2c8c7b9b8d2f2f6c9259db8967e746da2e570e43afb1370394d5560ef5a14951cd792057a25e00fff29b1afdc9b909cb99c0c33c7fc3f30c5a7552dfb78afde6dd6d5da9fdda969b33afa6a938a384e7855596130627f92b43fa0c19160f9ff0c48852d98a9e70cf83e561e411f773010ad7db447c847b198aad3f761cc4b89dd8357727c116ab9200467074ccb4e972b8004bae8e024361105377e32d8cf397c41dce5acbd4b00c3a", 0xc5}, {&(0x7f0000000180)="6bc0cc", 0x3}, {&(0x7f00000001c0)="84c0e04085f9627ee6231d3c933970659d9dd78cd047c581c0c781f6ea856e8f1c8c25bec8c509da0616c26dee936c294387f1c6d9c96633a2e44ddab38d9de80cf007ef990df8d2b23dbbc04aebb7d1d51a0c6d2ab9703917c2e54a14fab9", 0x5f}, {&(0x7f0000000240)="8b630115a2bbfee57d4c0900e40570b3858e8b916dc921426e57654dec04c763859a410808f36e893adb0a7c84794e21112a303b668d680227d94ed791d3afa76ad2ca5ea4c6975d5dc5009dd12187f9ac6e7d6a0bcca389fb0a841eeffbbd37e1a4706501ccd72e99ca708b71466c357c91908ac53930d23fa89b2497880c6512b98db9c05fa9c6b64ead954ebddec192a5abb30bd85de4d2c680079a8ccbaa72f69b045b30aaa4be3439526b", 0xad}, {&(0x7f0000000300)="75bb0b7b40096f597387a3df420133220f8f6a6b38ad58d477e40ba62df045507a97f7406296eefbb6f9c60dd49074f3dbe3d32f0730e31216c6b6c763", 0x3d}, {&(0x7f0000000340)="5cb58f2b11afe69e66b3a81c96670cf643dc1e999cb1de4821d62fcb1f561b2172543274af2c56", 0x27}, {&(0x7f0000000380)="a7c6cb323a98a201529ef48c046941bb6e1c4957189bbea073e54bfccc1b9d5636432fe55bb07c89257b14ab3bb5f5320cc3bcd517b902be602a43f801facb371f72e6c4ad47780079963d5b1fb46ea0a1fa98f0abce6fbc74dd8e83027064f467f12c63847a560b063072fb55839720af83b2f732990a74cc0770b3294430826d846acb48309b912ef4f7d8ee7a333995117446ba44aff9c2a5458fc8edafda80ba0821fb87b6031451", 0xaa}, {&(0x7f0000000940)="ffbb23f907b3fec0a3fb9f0b5887b72c82e440591ae759d75b1762fe51c6468643a6f7fe4f2dddf49ac7273811a93e9e04b73d1eda19317793e2b8ab1c96cfb10a12648589d1e5afcfd77194e1b4aa69e4765f09e95726b5a4c5ab3dff79f13d753631cbc16a33bac5a7c2e5884365cd556a9de4a0bbf6fde5b584ca907ad5e40ac5ee4f94f2037ad1128152a331e83f64acef0cf4f10ed1cfd004b049c42c589abdf8b0b56c0272a9b2b82c860821cec9e9d6b00ef95fe6dcb096d3420e1fa38b0b64d37da2cd37df09f3a42d185aa236bb11ff23d75c01cfc36cba1c37d93a12ce0ac7dfca4a6b681a52238bda627543f946d7c3911bf965aa3f6c30a34ab5f5caba86091a8579ac6cce233990e38f13c5f553cb475b99e43b5a49d10ed664c1d0a21e1aac8c048b67f0c0e2238cc68e3941fb597fd881b2ce017aa316d2bb7e5b529542ea1d462c8c1f2e6627110fbb7a6cd80d2db027b102f981244c20e3173c4ad6eef5fe54a5ea1626d4f6ba53d36332e8c48777074a399a9dc85c736cfe387db3aa56825a560c123a5abc8c84cba82ca1f8b0886a87c7565e703ccd9a1daccec53cbf1165ecf04358e3be7358af5f67a076809e3d0b4bb30aca7a9425380ba544cd575178819b5009b98e0becbf28619a17ad8728e85c93191f41c396582ced1ec3dfac73bad281cde45f2fdb35dd052a3ac68ff7b3e01acbb9c8368229b199e8d15c81c7c7d566b349bf264d2559be2278357d09f40378d453ab8c3813aae6a4d67e3e8d32efb0275042c2ffa8f2520fa28578d53527f91eb4d9fc7a40c273d70dcec693c661c8c320e9a69ba82e36d3504a0c18cde390347f66b011cbde73738b0bed5422500e5209db78a2c8589565be47cd5a6b08e867ec1b7cfefacb628115a27b11ce7272ac4707fa77233b5658cddccd163c0eb82ed0296d96962f2eb672dd605841f95c38121ba6b1107db6b81c6275b52a982d42d2d4fce88fe02a280aa93b64e4ce303c4e3048e990d5ef45ffc355362e0666e1848e7215b1ad78f68c1b27583a6aae364a088027424738e10fd1b07b44bf82cb9111b8c9982d8ebb963d3939aa6b0ca0d3db97ff6c0062a7e231425e775ea8a9c26963b258892d3cc4456c5c13e8a7a5ecae4dc3f325a9097c337f0d519fa9cd5e2a7dd5cdb3ba32daedf0e0ef874a84f8164e40748799376829c72b3d05cdf9676a9e9b6562b53fedd5c4b9859b06c9c463f5c3d7c1323fbae7a5d2907d9adf61df403a736a76b0124a4c59c15cc8ca8b79e10b383bc7bc01ee232de0d0ed16c319c279d376d19943ea22f9a35c3c1f56e239291002083be42305115a3b7a808432febeee5b54a4ad1bb61ba041bf02398d28d04cc1c8efaf82b1859e7f6bf998c19c46210e899a9b821dab434040c09d10123ebede4f70a61586af2091c81e7318a29ed4110d75a120379d6c8718668a056a6829ffce053c347a44845e75d71b6700d00a11442fff33a9c4fac8676237ce5523dab92444e94c6d55b8a601c7e7af44a6efe1436ce928a73adfd36d8e2d8d05b2b2d3ddf5f969e4a4c10953044d2e9978f20e706b93eaf18f00a4b817b88db7c4f523842d746adfb8bcfe705a74519b096dbd6609bdf975d8c141a4ea2223dee92cc67919358a1f8180ba7a7ca488f422cdab13d48ac782e98fa8940dff69b46ba8094a21e44f03f0dd3390bc8506f4050784769446d2782862688e835cfdd5c61784c112eb7b75222488a9ab1db58b229baf42de912a937ff7102bb2009339c0827866577769995abafc6e11ea0ba6a96ded94c24d076dc8a87dc9db3a1acab31c8ac92ad717d6613699c9ea3a87eef9485427d8af77995f13b59bc307635091a6fa5644f3556ad7ca60a9ebf0aae407d052b0b15f11a4a8bf67dd4ccf68d787ee28c3523e9aa3ebf9629fff9fe6579ddf418e733332a28f0fceaa26dfe42e057854b5529cd64969eda94e7b811c3f104e235f4973e1c7f3a064a35d08c2148f2e17c7e23c3d07c7786b0f02159ff8ac9ce7f95407266b0f09cb3f7393f3c868aa66e37cfe52f2bfef5da1fb789e051ace5d4837f7a809888ce3fc551f7bc9cbc739c3317beba409a5fc48ef639c3849318e34d45d37d4367eec533424ffc0c35e626c43cdb5587450e426eeccc30d0c365411aa419a633cb7f61cc4f32434b7ac752878e65318c80422fd4e0e38d9b80f702f77458e3377a2f59c027763583bba1143d75a60fc38de7eaf3485a4aa729f2f95f2c71100ae170b2147fb03e8a2e520c357c6e6c0c539888650647207ac98fb9d65737538107312c82a04094e809dad47caa8ae7727ed84a6c58edfb43917bd84b585459a4331550b8549d63f1aca72674995e1378099a12b8b0d4c6804707184b00ae477e69ae5f93c8f1a51ab7f7adcf2bdebca2c185ccf8ca22d6cba761ad17666efe2f364a8755a882f62fb3d538bbda2d660c587fc3e71a6bb8536882d42812af1c3664a49e76a134285640faba76a5e7db955f1f969f8bc19228e6f7137f70a4f9fe81ce4f22658812eb6158176f6fa458a407047b3a1cae72a3b3c22096f4a5e7b7b3092a65a4be3fff03cd0831af2bab157004ba1bab80385f3ebfcf0d502eee0f4480931b0c7be642deb06860c5b606cbbaa861c0b52a2ad568f7ae2115e34ae68430363c06b2e2523366125757c4ad76ea93dfc03b1f30297d5c486f641420d8add8848ad28df715a336e01780af01c65a3db40fc302ddd106d7a24c75a3a8af6e777edfbf3e4d4562d34c4c24aaecf71493ae59922e7b831ed0dee1024607bdafbc283ae70d033e40f2c6c6d4caf58d09db223f677c83fb11e9c9cfe9f69c900292a5a4633bb4ab34d4f107fbf32b83bd1594bfc0a0cee224c08ffae90ca8cc320306cfdec8582ccf452ed3549fd0e8e45bedf6ac45e9bfc135eb86d9e03ce16246c9dd21d94b3f1750054855bef67207879820af6832c307e71a5e152c6f130435380c6b979c6e356573fbd8b5a6230d96ff8fe73d5ca9b81fdb0c8a6bf9d23b1c64a102f865a59ccb8f3c96476fcb28b415171f944e7349465d96a04afc17a6346407466092ebca8189ce1573e7aeb088cbdcd52d252118ac960c88a0b9e3470c4223c0018d0c33130d1eaad1a00c37e6dc7526dfb906c52cb99383882bf42841164eaa3706755df34d797be9b87695fa188128e25094aa193e2f2b3e7f28a25a9386cccb7e3092386e631dfd6ea63a255b667939cc0bb25d2001b6337195321cb96db175bb76d9c29fabc9a5bf7a51fefbc0e2a583ff8e7c6c954242cf17336ba18689a265ad9509f1b5a43fec9551362dd438ea3ca3b1eb7817f761e55b2695fe4954c7ce83cdc26db045e0c1be229ac4c3ddfdc0736558e4e4a0c2a427f15cb955180a28be01cf7f3ab0d31ff0d6b646815f859c2967cd5273d27dff22d45329b9c55f83423051880cb25b506c1c60500f977ebfd1ab998ee9ed03732c3f43a3d858bb6ff3e1711d5bc29f6c648ba8dd074dfae6e603d14412f1e5c8343c7e12e3380921ec7ce7741158210f16880801516dda6083c1a652b19d9cb2565f2a74fb0f1ff803db9a30cece2d04c966566a6689aaac75184484e406b69ccd1da9050aa4b67f2edefea944aca33a9628d0664b8c2cf8ca57b8b391f1d1635f268a39e2ddf5d3d4e25543416037dfc8e255ab18f31d9d77876ec9dbac40dfff3806da811ffd957188b2f3741b12f5a270cb55ceea13a9e3545dbd56bceebcf3c1296aa38c261a9fc8942c397471bb9883df43659af1b9f9f3ed56591aedb472379083786a9ab4b3796d05b822d8fff6aa6c73c91208229b394aaf9d39216e54a1546cbba723ecf5471f95579f932680c32ed38b05a5652813bc8da7c7bc61a780f059e00fa39083a1830dda6a61b0e0e841853277768c7b22da7e245c5448a55afc0f57b200c63b055b647825754b62ef1af75a18344100b06196c96f88004bd5b87a2a7806a6ef9825532fb5b6c2d4b3fa2e2bda5dcd444b98922cdcd89752d74f2f008292a246cd95322f7baa47f9493f0b52c53e9a8dfe20746e7fdf60721385dc77e4714e3fbff5c1e7d91ae71a14836d53cadbf947cea8b4a9a78ca827cf2a290734a59a83b5e409870c7c591ef2ccfa5d491025a90c35396e8c4398eef43555cd0800af5ef3e5930a99077315b86574cc52974e76aef1850d2a1824269c98b5c880e09bf05d970ae58dfaef80ff76284aa967a7524e2bf4362a43bb17ed8c83eb953e6366e792e73e7ad7bd385dd781b965abcd08410406e0585984853411fb5a920ac8bcccbae7307fbcb05505aafb96c671e261c49445417ba8a17ab692f3400588382281cdcd6968dbfc9bf4a2bfb8155efcbac0dc4845158deaff52d6dd56350c3a3a3bcfa9ea4ddbef1f6ad8909ceae31673ed2056cfbc2e00a713ce2a1a72cd3266183eef428b84a8d6c87dec561290e6667434d9c8ae75d804b3299e020a49fad84667fd614cd212c1082575b5342d7fe23c6975fb586fdb7f992cafc8432cf5080e4f8699a65c0c8b349f4e58eaa58836bdbdc14f4b68f6bb1c92f684b9f808d729926590101fcaa4e1f257afdc2ac3e04e1aedb7c44afea0ba5a19a460b3f77fe67a6578b7d5dc4ef720e22eed4f2867443dec022c3f59e4d8d15fec442a5f466556cc39b948503ef1b7db1d62b495f2077c481051de1161b9725692cab367297159fbd4d4a23964999a2df8f57aa04bef1f658515ca737d8c5e82bf6bb5d2ae3ddea6a2a6c66ed330d80944ccb1776d14b9e3f64e96813a0b6a30429da11e2bdf41987c34f790ffc20b18424eb3dde2d7bef84eca9bd07e8f42a8546cc9708e8bd7649f7f615a8bfed145786fd79e4670e894da39d434ea002735f847d6643d876e88f1a5a06924be947f7506edbae33872be067916de1001010722ca28e5382c7f959a5a32731b3e79e6b150b34fd78fde3c1d1cb83789cf0b098c5566ae79d44791fa342d59e16db4b752c4966d03b51fd8e1bc40b4c0745cfdea2f8cae2c4ce7387519af45125a4d9db2739290fe37fa53e641ed6efcc7a7705bfdfeb4f3990251d61b316f00d7d1ccf00a7205a555758016189fca16e12d75b33758d197dec65de05cc302d1551e07f85b38be23b244befefc3b5ba2e53c22ab5f957e4427fbea53b30eeb96e50700f6b48012d2b014931424d6725782b55b2dca76e66fb0a528512ab727c5214f0acdb35974315ac41c8a1d6a50ad52dc377a74aa11ca161ac2d2b628f39fc2a0c410eb6e4a515dde2e452fb6477cf2e8aef2323953d31217c5498b11fd969dfd6729b3b09f697cf648341032373634dc8bf10b5b9b863f7d4f78ef3f793faf44b03db9c558dad35a42ea5a1face31e1d8cfa8fb9ae6b533bb98f4db8dbe96fb2a5d88fa7b35bda1e2683de105a51a540d257aa7c69ca809d9a73f60c8240ef2f575c86c1eef30e76ca261109d2196ae1863db401f1fc2fbafe47ebe4deb147c34c63025fc025c5cad87a2fb6b7ebb2a4fa5c12aa7f238a7e7e78475c6a4d5ab049856ff58775b0600c4c31c460a5193b99cbba1ba9943cabf977b65e4b1be1b0ae40986ac2c57f162a3e2b9e34b423b3fe66739607b2000176c3508c4d91756c11042bfc072683fa11117937630f09f2e351c1f98a1992f64a634cc0b609880b2afda6102c2b821a669fd55b907ce93651c3e3343f1b30e185b7a56ace36178a44ebc899a20c7ec457795d24198966e54d08142e02d0496c4bf88ab3345b879d8283d83aacd6e", 0x1000}], 0x8, 0x8) ioctl$PPPIOCGFLAGS(r2, 0x8004745a, &(0x7f00000004c0)) [ 491.740089] binder: 9922:9930 ioctl 890b 200003c0 returned -22 [ 491.748033] binder: 9922:9932 ioctl 890b 200003c0 returned -22 [ 491.765457] IPVS: Creating netns size=2536 id=77 03:33:25 executing program 6: socketpair(0x1f, 0x0, 0x6, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_opts(r1, 0x29, 0x36, &(0x7f0000000200)=""/113, &(0x7f0000000140)=0x71) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[]}}, 0x0) setsockopt$inet_icmp_ICMP_FILTER(0xffffffffffffffff, 0x1, 0x1, &(0x7f00000000c0)={0x3}, 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000184000)=ANY=[@ANYBLOB="020100021000000000000600000000000800120000ffff00000000000000000006000000000000000000800000000000e00000010000000000000000000035000000000000000000000000ff00000000030006000000000002000004000000bb000000000000000003000500000000000200423b1d632b010020000000000000"], 0x80}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f0000000280)=""/171) sendmmsg(r2, &(0x7f0000000180), 0x400000000000117, 0x0) 03:33:25 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}, 0x0, 0x20000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x0) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f0000000180)) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000780)={{{@in6=@mcast1, @in6=@local}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) ioctl$RTC_PIE_OFF(0xffffffffffffffff, 0x7006) ioctl$EVIOCGUNIQ(0xffffffffffffffff, 0x80404508, &(0x7f0000000400)=""/150) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f00000001c0)=0x6) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) ioctl$PPPIOCGMRU(0xffffffffffffffff, 0x80047453, &(0x7f0000000340)) ioctl$VT_SETMODE(0xffffffffffffffff, 0x5602, &(0x7f0000000240)={0x81, 0x10000, 0x0, 0x7bab, 0x6}) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(0xffffffffffffffff, 0xc0a85322, &(0x7f0000000a80)) pwrite64(0xffffffffffffffff, &(0x7f0000000940)="241a5025560b85500773ad77782a1043ac371db9b19259473a21613d4eb718c2cacb2c6c3eb8cd3a3f00a6aa3e6713dc9cc35ec8ef0002f74a4eb6043cddcc3ff06b798b59f45bef15e2f0c3d06d1daec8caa6f84c14f3fa943cb5e13259b67d5413641338851f7f271cb50a47e5bfaa7b3684be3ae883f7fcc193075f8f00280a72e755152fc5c5c0a44c9f0596b2bd78501fecd8e7fb1a4fcbdc296f282f017ac2c41cefd605f1f69090e2d26013f00e7609bb6d7a290879e0a80fcc1aadf31310b61e7232ec12be56e60ddb49110ca0cff5038c70ad8fb8e68c1bc7e7b9b9141b408ad90a724e4fbc5874163a0aad51f538a909a8700f17c13516c315e98460c0ac01d70ba0e00005a6057ea0a09c55983b8f8ae12753f7bc606db28cec1c1558470b47ef1b0bf1e213afa5803ea9ceca1f17", 0x134, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000540)={{{@in6=@ipv4={[], [], @local}, @in=@broadcast}}, {{@in6}, 0x0, @in=@broadcast}}, &(0x7f0000000640)=0xe8) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f0000000200)={0x9, 0x1, 0xb5, 0x0, 0x800}) sendmsg$nl_route(r1, &(0x7f0000000740)={&(0x7f0000000380), 0xc, &(0x7f0000000700)={&(0x7f00000003c0)=ANY=[@ANYPTR], 0x1}}, 0x880) sendmsg$IPVS_CMD_SET_SERVICE(r1, &(0x7f00000002c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYRES32=0x0], 0x1}, 0x1, 0x0, 0x0, 0x20000000}, 0x80) sendmsg$IPVS_CMD_ZERO(0xffffffffffffffff, &(0x7f00000004c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x40040000}, 0xc, &(0x7f0000000480)={&(0x7f0000000380)={0xe0, 0x0, 0x0, 0x70bd2c, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x421a}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80000000}, @IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_bridge\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x5}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1f}, @IPVS_CMD_ATTR_DEST={0x64, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, [], 0xa}}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x2}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x100000001}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x81}, @IPVS_DEST_ATTR_ADDR={0x14}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9ae2}]}, 0xe0}, 0x1, 0x0, 0x0, 0x40010}, 0x8084) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000002740)={{{@in=@local, @in=@multicast1}}, {{@in=@multicast1}, 0x0, @in6}}, &(0x7f0000002840)=0xe8) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000001380)='./file0\x00', 0x0) ioctl$fiemap(r2, 0x40086602, &(0x7f0000000040)=ANY=[]) creat(&(0x7f0000000000)='./file0\x00', 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r4 = creat(&(0x7f0000000040)='./file0\x00', 0x0) fcntl$setstatus(r4, 0x4, 0x4000) write$selinux_create(r3, &(0x7f0000000080)=ANY=[@ANYBLOB='s'], 0x1) write$selinux_access(r4, &(0x7f0000000000)={'system_u:object_r:etc_t:s0', 0x20, '/usr/sbin/ntpd'}, 0xfffffeff) write$evdev(0xffffffffffffffff, &(0x7f0000000100)=[{{0x0, 0x7530}}, {{0x0, 0x7530}}, {{0x77359400}, 0x0, 0x8}], 0x48) 03:33:25 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="05630440339a51013e39749ce8b9694a47ffc5fb8a9455c891580214640d9a09f28b9dfc145b555a9f326142be888517efde1d9d1b841a0c555db64be6d6098aaf0002a355cb84fe3be172f8ec22ec05cdf28ca52e00685f234b3af705c25fd3573762489b03475c5edd586e5eecb27f5ff6b387bbcf993bc7bc060daee61fa8cb176bc84a449ee60000000000000000000000000000"], 0x0, 0x0, &(0x7f0000002000)}) syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x400) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000080)={@local}, &(0x7f00000000c0)=0x14) r3 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$FICLONE(r3, 0x40049409, r3) 03:33:25 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 492.146497] binder: 9941:9950 tried to acquire reference to desc 0, got 1 instead [ 492.154845] binder: 9941:9950 got transaction to context manager from process owning it [ 492.163128] binder: 9941:9950 transaction failed 29201/-22, size 0-0 line 3004 [ 492.172860] binder: undelivered TRANSACTION_ERROR: 29201 [ 492.181467] binder: 9943:9951 ioctl 8004745a 200004c0 returned -22 [ 492.189416] binder: 9943:9953 ioctl 8004745a 200004c0 returned -22 [ 492.258113] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9954 comm=syz-executor4 03:33:25 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = pkey_alloc(0x0, 0x2) pkey_mprotect(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x1000002, r1) ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5, 0x200000) ioctl$PIO_FONTRESET(r2, 0x4b6d, 0x0) socket$inet6(0x10, 0x803, 0x0) 03:33:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout'}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 492.305704] binder: BINDER_SET_CONTEXT_MGR already set [ 492.311643] binder: 9942:9952 ioctl 40046207 0 returned -16 03:33:25 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='task\x00') fcntl$notify(r0, 0x402, 0xc) exit(0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ashmem\x00', 0x40, 0x0) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f0000000040)="e67f283330cacd0451d9ec35d7d6f59afe8d5bc878de2231d32f7a35bdaa4915083e11f77a0cb6b25a3e78be27574f5f4dd0c3ca8b7390914cee275a099a780b006fd1eba3a33cdb6721ad63c76e967aefe820e06347184f270b3eac70f1e0526aba9a63598761a3f5f520625935736cd55cd05b32a4abea44a383b2d69227aa93a6ed87918031009105385cdd9a10ce4a97b47993e8464d558647cd88125cf18299480be4fc77a603a4b8a9d876211f9670519a89b174282cff065018957856c1413d2a586c797e1126c8d9e6c36fad45e9adfdd53dda1fa09337f288afad412b34a24dc05ed0361dfb3c057db32c0465cb9232444a8ecf34987324f59a48e8") getdents(r0, &(0x7f0000002b80)=""/202, 0xec) 03:33:25 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="05630440339a51013e39749ce8b9694a47ffc5fb8a9455c891580214640d9a09f28b9dfc145b555a9f326142be888517efde1d9d1b841a0c555db64be6d6098aaf0002a355cb84fe3be172f8ec22ec05cdf28ca52e00685f234b3af705c25fd3573762489b03475c5edd586e5eecb27f5ff6b387bbcf993bc7bc060daee61fa8cb176bc84a449ee60000000000000000000000000000"], 0x0, 0x0, &(0x7f0000002000)}) syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x400) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000080)={@local}, &(0x7f00000000c0)=0x14) r3 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$FICLONE(r3, 0x40049409, r3) 03:33:25 executing program 0: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x63156121ff0c7705, 0x0) vmsplice(r0, &(0x7f00000003c0)=[{&(0x7f0000000080)="0576deeb3a8a71dee54c065b64931f4db1c478414e910881246177d90c53876d63b943dbfc10f09ccb2120770752c396763e59979f2a19bdd0687013e7f89c22bbc599f21c9ba06cf0072feac2f22cda80760999a403f127e5dc41054ce48060af9a7e1d4dc4a3e360a7f39bf1848bed338f5749c7fdcc0ba7b81570d20c1cbe3f4052d676599ef4d6b9321f60811024ef4c985da6", 0x95}, {&(0x7f0000000140)="741a70da250c3dc3a2af628665e7f60ae67a17bbed2302744368fc4bd3c0dbefea34abd4483b266da61a09930a0de5cd603b3c8b2fd876065578d0d8e96708366e83599e6a56d45a60c1675721c101f0d9d8acb1df05e095d4b1cc404628c68d2b587ea63648a2505b41e4d13b2fc562b33921df273c66e530ba7f1ea587e2944a85", 0x82}, {&(0x7f0000000200)}, {&(0x7f0000000240)="728614c2793096307f797524867215fba202a0d03ff962fabe0ba0804ae06d631bcff75ca7635699fc86c6457263dc91a222ecc87cf041e454428754747cf68f989e3173d6756111ff09f2eba8f887109d783afc6a3c38b7908f627adc0cd84caf9f96d13c1603751fef2faf8972f8bc14485ca4a67ab2519759b5600bc1f6f8", 0x80}, {&(0x7f00000002c0)="d234320c59d00e7a238531035055fcddf1d8cc821f0781256f8cafe3c64dbb8327f2435d4e9679fc955332018e5009b9d2c3583cd7fbc0f3e6bcb592371239efaba43559720a2ef57be6192cdf03ed42ae3142a9374fc598b5986158e525be596efcef4fea1396a6a14e82e063c41849beb342fb20392c7d5d3b4586f2e0ca20a553eb2dc3e3226e5ff5f8e78634953111cf8ead84516529808509bd21caf78426e57c810abc6b7e956a29d4ebc294fe2ace1ca16b176acd69c56709b06db5372763a7682acb563327d45bd0e089aee650f5eb17c4f31a81", 0xd8}], 0x5, 0xd) r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="4516d42bd4b62d8edcc498134798b4"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x101000, 0x0) 03:33:25 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 492.491471] binder: 9967:9970 transaction failed 29189/-22, size 0-0 line 3013 [ 492.499757] binder: undelivered TRANSACTION_ERROR: 29189 03:33:26 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout'}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 492.634445] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=9976 comm=syz-executor4 [ 492.686380] IPVS: Creating netns size=2536 id=78 03:33:26 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) perf_event_open(&(0x7f0000000180)={0x40000000, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000384ff7)='/dev/ppp\x00', 0x101002, 0x0) sched_setaffinity(0x0, 0xfffffffffffffcbf, &(0x7f00000000c0)=0x8000009) r2 = syz_open_dev$mice(&(0x7f0000000380)='/dev/input/mice\x00', 0x0, 0x284100) getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f0000000140), &(0x7f00000001c0)=0x40) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) socket$packet(0x11, 0x3, 0x300) syz_genetlink_get_family_id$ipvs(&(0x7f0000000440)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(r2, &(0x7f0000000600)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000780)=ANY=[@ANYBLOB="00002cbd7000ffdbdf250a00000068000100080006006468000008000200ff0000001400030000000006000000000000000000000000080008000800000008000900380000000c0007003a00002e1bb76d000c000700080000001400000008000500010000000800060064680000080008001f00000030000100080001000a000a0000000c5da37ceb599d8d360007000000000008000000080002002b000000080001000a000000080004000500000050000300140002007369743000000000000000000000000008000800010000000800040000000000080003000300000008000800080000000800010002000000080005"], 0x1}, 0x1, 0x0, 0x0, 0x40040}, 0x40) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@dev, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@local}}, &(0x7f0000000300)=0xe8) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, &(0x7f0000000340)={@loopback, @empty, r4}, 0xc) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000b94000)=""/246) readv(0xffffffffffffffff, &(0x7f0000000140), 0x0) pwritev(r1, &(0x7f0000000040), 0x19d, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) mount(&(0x7f0000000500)='./file0\x00', &(0x7f0000000680)='./file0\x00', &(0x7f00000006c0)="72616d667300000029bd446af554e9feae81ec225161106f9a72f9cc5436e545e51e83bf27b1da6ed3d3dac5fcb5dda29de644b392c75113ecd0658abfea5fe4ddb34f172c1a29f4696f124b9361065b648047d9e83f3ab88a52a80d8bf3dc4735790f1949c792117f1458dbb2b400fe031f872807515afd018c09280e08a35007387273d4d3d9de425747312f5325b2d78152309d98761c99a2037061426948f414dd67311faa3707d14806870615e2e9f4cc35d3", 0x400000000000040, &(0x7f0000000540)) mount(&(0x7f0000000380)='./file0\x00', &(0x7f0000000340)='./file0\x00', &(0x7f0000fdb000)='ubifs\x00', 0x80010, 0x0) mount(&(0x7f00002b9ff8)='./file0\x00', &(0x7f0000cbeff8)='./file0\x00', &(0x7f00005f7ffa)='ramfs\x00', 0x80000, &(0x7f000002f000)) pipe(&(0x7f0000000100)) 03:33:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x400080, 0x0) vmsplice(r1, &(0x7f0000000400)=[{&(0x7f0000000100)="48f441cf1e79a2060b8293810b1e672f61582d0bf690853b37fce4c899b17f33b994e870a1c6fc0fa5016b3ffcd8b3e71527356bc3ff3be383ec15dead3a447e08bc576d2731f984701cbd23a9352266f090c5ee13d29d2ec773a2a5dd0fc254857b1e4207437d68b2238769ce090da278592b95cecc157600a3f001945ddece254a112e", 0x84}, {&(0x7f00000001c0)="f20609af6c174414f1bab64a6cdc5bdc21670c2424b65336014751f196ffeecb352e48496acb8ee1e09d8861af3e10633957ecd77c4b16f60b866fc77ca039da3db2495735bdf8af6f6fadf48d54f78bcc4799daf369f585de535331a4f0d3d10e7cea7c5e122aeb5b0b1bab973407a8ab533b3dfb9b4067a501538b1cab44d4feea02684ba1fabac3566d015d8c171e3f9e909f90eabf60e6f988646c9118919978", 0xa2}, {&(0x7f0000000280)="59c4461d3dbe207be6136b", 0xb}, {&(0x7f00000002c0)="990bb95dc09a9b0a142ad4df724c32de59819e70302a0298facaee9361f7d7aee028c6e74221e416954362debedb36bea2fcbaff47d49d782278d1b61548c9a350bfe986d004d250690156b199f3bb7e95caf65677bd64f61996e2501edcc2c19bd1211b356188b258c0a5b83fbb05e4884e9e9931c800acba2aa4d8f29ae59c9abaef9dad488b27cca75a37e37d4ba85f227e502f6c", 0x96}, {&(0x7f0000000940)="d307f00392af83b0fc760fb56ee5af164bb5f5748f721f50278e53b59ac36aa845b6d41162c69333ba6d26fe9bab0232d79a532ec9ef252106051c0dce57d6e62cccee9e20fb38050f8592592c3ea1f6d6de5915b934b579283e4c2cc726db938eb6e3c761b61604fbbf1b6df9b1903a3fa27fe721c0d527be81176f9e3958d63e89679652ac3001ac52215bf17ee487e0ee0cbeb2db99ddb962bb48f360891477ed706dd54e6071f59fe18299f853d031b6614158dc44d848512a2983a8b7b9669136c175992f9f0282dfd503b201e3ffd5ed4f784fd64732b78f44c46a84efa2e88694cc115933acfcf04377408b54313648e7df36174d4ebe41586bb6552d9f25d3ef06b093c1a8021280e48c4adc271d191edf34a28abaace326fa82d76acc9622d2cf6c93865c4cb20909d0c5b1f9364dd4ff2efbc17c03d8f28c7d8b9fba384a923f2c287c0dde816723c4625d55f3498fd8fa39ea4e66bb4f52dcae10a3ca6cad0c4500fd120332b6224d042ee7c05bd49a33c492ee771d2d97e40c9b55eb39b3eec96b2963fb7cb2b006de5929caa513db27aa1a03149ec355ab423af4e24c99d5d01a386e58f3a6075447829ddc5a028566e7d93801f8a5c9b63512f1ac9d74adfb72dde302afebc41fb3cce43b70a90da8788820a1f20f00064afcaeee694e464ffeb66ff99fd165a980193304c7447002d0fc2f66fb381714b8adcc03ec5d2fa8d9670d3845125d3d07be2ff6d76de3c12e288b9f598a3d498364720a6e37fba1f63d5cdbc7188883342f2b724f618dd4501cd5fae5e3d2097d80dc9d0e3f6fe4cb967c6ba0853a17a45747156f2d0f8ad5879e8c2eb0d432c6366446f7db3e5cab35615e1c293501f2f9c6993efb1f2b95288b65b8cc7a8cf549e5bcd1bd9b2d677e001576b9d89a16e335a91a03a313ea722e80094b0a86ec0a261868c50f142cb99f956eca01f7a118194df706cd8b494377ba85bbcce2e7d53981a3bcb89b6be398546ef15759f175b47094bf348223315ffb714d251cf5f1554cd2c2553ea924db41fce38ee48e2bebbaac1b29e02db7192b419331efbdf807a4719d93d074c69b10e995316be5ea642d454439738122b93762c8bb15f76e4f66b74d07136131ab6b745d3c3f2d8239605ae687d1e828f5eb208c820c72d718b1061b73e708fd18c53e5d245e5daeb72485ee7686321a54bec40c3c9045447d1b0576dea24c7d8ab10d133d1e0eee537d65d610e0e665e1448416ab0c6cbf90e96b0e68b3b2f2743e6fc19d3f3eee803290d1ec96efe382d9070236643ad11c7f3b5930cb90f850b0e82c0f6ce342fe6fa740c048fe7b205ae5c0a7af0845e285fb044bcd895b46a971a708d011ce9594553eef7d2e5a5bb68106d663f54760ee248288a0ac862cdbae225303761fbbfb5faeea0058ac397905528fd01f830d385381eb44189b100dd148e779715ad561a6f7037ba9adc793b6b24b677ed79702a1f240ac516524682326e76ee1dcaabf0fc5f57f9b81d39d7b7563873cdb70a2afa0368588582295bc86350226a6dbdff5761e43e3376314fe5672dd0b2ab2a482b49750ee3f5299d0214a434e753a5488e8370dcbd81de33b4b5cc08281f8c1b56077071e4241a95d0d99e03b9731df4bf9e2b9d087ed5a2141cb1ac01b8c8f72ffb6b72d6b4f235e421adbbb81e78cad4ae405532f857e61bc5ed6a24888f64be69d6b7d60d93c841ac299a9cfde21811b30e1f614c1ff76eb34fd1af68a6752f16b56fb2f6fd16f5aa0ed472af07bf1c7967312da073526b8a9400e9c3824c06ec216baf842a844064930e938d1053e200d35878f5696c99e2bce4eabdb781e5f936e5e420136850d0b3cdd32482bc1d67563ddb06196b64843dc5f37287c8265039ea476c3d0810959f1b228951dbed981633da2836328ee75f3fa2d4a4d7c8947930a7e484da930c258c77057f7e9bb281872a877b4628b3641b29edbf2a18ffb993e76439241788a8a43bce252a83d326030132d6135df1a0cb7534838fabee0eab6e94d2cb746a028c9773f117de986e8d1822a132f9bd25f1f389cec028bed3083dde093919edb6dc4f6c6eecd5bc783d15fa55e5330262e5839b84a2fe9cfe2d46a5330c1132b73ec9a291b383e885b3a7d0876d4a6bedabf64aa2bd42293266c638aef6236258d820d0cdf6481b6c192da532869ebb65276ccbdcc098aee9690ce39c83ed16f3c9ce43f31b60dddc1c9b9f8833c5b7100843e206cae4a7621ea0a8c0fb8094cb9fc1b32882a6c665c4bdef0c82210da7975c060e99fa91d9aff4eaf55ac0f67e74ecf8ff1448004f140d212fffff597412f5e73f9e929687a7e97119adb49f9171e5c5eebb7970e971a1214be07a5ffc765b35f91f3dec3bab852a8eae76ae240b293333eaf1802c4221afd4b832a23ab537b1bc1c614397527241cfa3479df21d55a8d25d43a98b909a0c11cdeee5f5defbdb87c4f4463e5c51208026bec1062c58a18034312a29f6ac1c475728c2eec8e79299b1beef6b5c689a167b8ee817a5ca6f05876b827e655f1e2ecacc10dc8d50b0457c601ed34216c17d7422b845f2155ed3ee83a6ce4ab52ceafb373cf8933274c92222264d9f1388b68dddc49b92b74b9123444be89fbf140b3c8624a5b56343ff3f6ed8320548e8634cf6c41c4b146c59e0aacdea52956e479f4d7ddb6922a48ad51d7ef62344108970d0b327473778a34d05e8c452adf2ec7e21e25594e46d9e150bb35b30edee296c86097b1effbd01d6a7442015c3cb5d0d85c5ddc6efde1b0c7f7ab0c436b67a77b4682ea1caa72047dee2cac1d9ed97e866bbb91bfb04c2fb4d0d3d7304d3203946978a21ad10f60b981a593f8f3733de186f9c8b60ec212c224fd5888b7ee7cbb12b5f763ce8ba685a1d7c837f19cd0028b4ea1b3f992f2e464e9abc43684748a872ed2bf9cfad1b38d85be93c7cb6b08695add98da9f1c28b71d404ffe8290c2dfe6bc245c4384d0aa7d9e56f9af5f0e9cb7081dd6a08e34c76a2aed86e1a2eaeeefcc696214a474adae16fba8b6ef1f85beb8906f12cf29f8426f73631e234a63147a9bd25bffbb2e99b81c2cc444f37e0cb6b294e3387f467f764fb7eee6d12fd7217481ce044db7188192fea704a7a3d90c724fe56fc7870e424f0c9162df4043abacfdee2531cbe8ecde556a679c1387b1498fa45c2de568aa442e39b4c78082d9ee1e9b04c6c367eee9440c39a89330de567a62033f7d3b5de5a0dd5aa8c3c6ab5cea4c712bc4e91f72860371a6debe08737f8f51bbbe17feec53ecd14ae1ac23fb401f672c7d1ef24b86526362e9e51d8f7718491616734bd19cc9375718cb1f67b0dde32eca5687021473f51df1cb75354ef85e73c7604427f760684d901714ae0d2f17465cadc01ccf738d63f8b7c5d86dbadaa662e2d083137ff91ba4e4e00d7daefa0995ddeec14112d2961aed47a2e7647e211f078af1a895a2213c37382a6ca7177c3dd07b678f6bb7481b8a2e56b474c5f1d1d76d0f19327671e9678b5237eeef1ca62c389834858539bcf6d6d5f5ab40fd202e1d2de6ed7772ce87fa28d4c474bbba2a938a72f61cd2eddad120c7ffecbffc7775ccccdbd49a3f451fd92697cd78827e989a9a71b6b705a034a83d9b1468d7d12c8bda2e7fb728c9dab3e6840d3fe76b349dc5d1723c05726cd3476fd338ff544e3f7d89e6ccdb8c00ee9fd8d2cabba96b3e44daabbd51e1822e2ac3a0082b23df3ff0902f08d2e92f43c0f57d004a8f9735c4c863f39c32ca0e4100137c300771f6a043fd1492ca7661d23e6d682b2076974e7e876275827dbaac9ad6b227d52cec44d1d5b17dd611a4e56c34299fbd5e84a007a33ed945550fcbfadcdfe767be02483255a538e8f3916a58e8729fe8d315c60952fc30a1f7fa650618e85f15a09bb657d0e94e3791a831f5666e97d94b4af22be1f67f853a8f0c0c43bb3b31794b7859c84baa0f4e52eecb4da3d87d097474d08278744bb76fbf965e5487c4cda52cfd50f6fab14d329763ccdf51c3b082f541cb933eda136a5842b2f2a892b063d67998f3bfdf608a6f4b36979fed3e934bb7317afcbae27a51a2174f06198e0c1c9f826f83fc3e6c7a9cef64f14b96664361370ec6db5cafd311b03c17497beb21951244a0bf2d0a2da92c909a2353f74903a6e7faaf59ed7a1c5483db76f1126085d6a02e95e92d9890c8a009afd840603aeec67df20b609c43e0fb8ae3e556e508553455edf3623ee241398ca8838d75d6954d5cfdc1604b44fe4a546f6be794c024f7e010ae75a86010adc54dd7e2ae88edead696d9790cb017857622caf3df944c1e2eb7afa6362489808bb69909b62fa2e4d6d86503c6b4bc1f7b458d22a6eb426bdfff9eef5eaeb30481bf5d012bb2370dedd08743ded760ed0e6ff197706db49a1b3902e72eccfd6c1d3b1c225af34b86cd91ff288a5b0b320e15ba0a6e205171c01c9409111e1a9ace9eb3297ed2568710b8a57b078e05c6361dd77094c31960d7a18f4333e05198a74ce741bd94d118b70c93757a00e12ce5e863d08130d08274fa9ef8c64ce6102d47b536ec0c422782b1c314f13898f4c4e8efc8d18f42c1afad36cc551a432b8b2219a91f48fcf26620fb3562515e7140fe9f24d173eb2818d25e949fb8ac2a6bcb06b9651c239a795ecb5a0f7f123783f23a1cb4833a6ac0e83abee640dab643d5a66afb83d3256383c77ba0120371e84ab9e13b0cd4daccca69cf5baf275b074f5a542bf9e7720cd7fa03f57696121a225b1458fb9b85457f79b8384446f7c659b9e3c25164331f55c80ef47287389d9786957b223ef5951ce3eef3d8fee3b017892fdbf198c5bd788c53a07073a15f9b44df26cec951395deb3ddfd46e578ae6a0ccb16056583aeb0ce786e5d3f92a58b0beba568791f8179702c0b198811a247baf88b2abcd3d5674ef9bdd9cec29bc53d1d56e7bc624c11d3eb0e09d89405a4e322a089d099d0c5c09dd05565b74060d3a3f318c9cb1942b29de8fe2f99494f6e828785be5d871c0d8b0f33c88a15ddd673f3cbd522f638b63ead81f1be75b329b56a249b85ccc48d702c63c649a282c8b7350b7291357e6055de14b8f196cd72fb8d15a31d78e2ab5145afa7ccb7236ef144ff0c883ba4ca36306245c5ff204099d46e5721b1ef885694fcabd19914d98770f7092ebcffcff337df213ef36a03dc51e0615cefa1faaa3b0f77a293e3a301a1e5c78c55b67ea015375f561bc9d6f915ddcb622c0a1c9153fc17dc67c7d103a66fa71913cd23ab48351f035477a0ab106dc5522f740225dcce3a697d52feacfd9246bead160860eb6786a8bdde5d2a42cf68b7fca3d25cdb5a7d4a717cae3f6446975aa2d4f8fea2f9dfea75b47cbcf104a43a94509a52ac0bcc7e1f8657718f8fbcfdf766a862596036acf5694ca7381634003f3777d9c83cce403d624042a9964f96693989ef245f1c786b3d24bd470421e490f8c4856bc538c8eb890a9a2a3f972033622ca6ec0846647d22c9b0c37ea69264e155b22753ea74e9a0eb88dd7b0a65b56dddfc643050d92c0fc481b4a35d316b24a9d1236efdb5da918db499af8d3df38c97b5aca0bfec9839265290191694fc05e5d6198658f17bdd0f56a2de321359b79d90e5b3788d67f5f3f619e9919c75a4bc6ac3cbcef87bcddf62df0fc717106e633fa5cb094be20040bdb689fe1e3762400f68157d706cfbd0ca06d7e2fe96b071cfa3b0d32ba47e47c434c9ca360b615d574", 0x1000}, {&(0x7f0000000380)="c856571a022157a2425b4147ca57c242d7ec5da7ed2ac3c6382554660564c2832d2623286938ef4888", 0x29}, {&(0x7f00000003c0)="31285e390c0d3e52094e0cc8a20206c29c76a448a166ce94ee117d600df4b274", 0x20}], 0x7, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0900ab48250440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) ioctl$GIO_UNISCRNMAP(r3, 0x4b69, &(0x7f0000000040)=""/92) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) dup2(r2, r3) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="8404004000736247"], 0x0, 0x0, &(0x7f00000006c0)}) [ 492.773198] binder: 9978:9985 tried to acquire reference to desc 0, got 1 instead [ 492.781908] binder: BINDER_SET_CONTEXT_MGR already set [ 492.787355] binder: 9978:9985 ioctl 40046207 0 returned -16 [ 492.796748] binder: BINDER_SET_CONTEXT_MGR already set [ 492.804943] binder: 9978:9985 ioctl 40046207 0 returned -16 03:33:26 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="05630440339a51013e39749ce8b9694a47ffc5fb8a9455c891580214640d9a09f28b9dfc145b555a9f326142be888517efde1d9d1b841a0c555db64be6d6098aaf0002a355cb84fe3be172f8ec22ec05cdf28ca52e00685f234b3af705c25fd3573762489b03475c5edd586e5eecb27f5ff6b387bbcf993bc7bc060daee61fa8cb176bc84a449ee60000000000000000000000000000"], 0x0, 0x0, &(0x7f0000002000)}) syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x400) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000080)={@local}, &(0x7f00000000c0)=0x14) r3 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$FICLONE(r3, 0x40049409, r3) [ 492.948382] binder: 9989:9995 unknown command 735319621 [ 492.953908] binder: 9989:9995 ioctl c0306201 20007000 returned -22 [ 492.961467] binder: 9989:9995 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 492.971372] binder: 9989:9995 unknown command 735319621 [ 492.971702] binder: 9989:9996 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 492.984749] binder: 9989:9995 ioctl c0306201 20007000 returned -22 03:33:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x20000, 0x0) ioctl$ASHMEM_SET_SIZE(r1, 0x40087703, 0xff) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 492.995311] binder: 9991:9998 transaction failed 29189/-22, size 0-0 line 3013 [ 493.019468] binder: undelivered TRANSACTION_ERROR: 29189 03:33:26 executing program 5: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000180)="26000000130047f10701c1b00effffffff0000000001000000000000005939d09b058bd24c00", 0x10000038b) openat$full(0xffffffffffffff9c, &(0x7f0000000280)='/dev/full\x00', 0x6000, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x80, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000240)={0x7b, @rand_addr=0x9, 0x4e20, 0x2, 'sh\x00', 0x6, 0x4ad, 0x67}, 0x2c) write$FUSE_NOTIFY_POLL(r1, &(0x7f0000000040)={0x18, 0x1, 0x0, {0x4}}, 0x18) ioctl$sock_ifreq(r1, 0x89b5, &(0x7f0000000100)={'bridge_slave_0\x00', @ifru_mtu=0x8000}) mmap(&(0x7f0000f96000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x4, 0x4) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f00000001c0), &(0x7f0000000140)=0x68) recvmsg(r0, &(0x7f0000f95fd7)={&(0x7f0000000080)=@ax25, 0x80, &(0x7f0000000040), 0x0, &(0x7f0000000140), 0xfffffffffffffe73}, 0x0) 03:33:26 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:26 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout'}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 493.305017] binder: 10002:10006 unknown command 1219166217 [ 493.311717] binder: 10002:10006 ioctl c0306201 20007000 returned -22 [ 493.320022] binder: 10002:10006 ioctl 4b69 20000040 returned -22 [ 493.320319] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10004 comm=syz-executor4 [ 493.340200] binder: 10002:10006 unknown command 1073742980 [ 493.345902] binder: 10002:10006 ioctl c0306201 20000680 returned -22 03:33:26 executing program 7: r0 = syz_open_dev$sg(&(0x7f00000004c0)='/dev/sg#\x00', 0x0, 0x0) ioctl$SG_GET_VERSION_NUM(r0, 0x2282, &(0x7f0000000200)) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x80, 0x0) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000040)) [ 493.353382] device lo entered promiscuous mode [ 493.359205] device lo left promiscuous mode [ 493.381541] binder: BINDER_SET_CONTEXT_MGR already set [ 493.387396] binder: 10002:10006 ioctl 40046207 0 returned -16 [ 493.387581] binder: 10002:10010 unknown command 1219166217 03:33:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r2, 0x408c5333, &(0x7f0000000040)={0x8000000000, 0x1f, 0x800, 'queue0\x00', 0x100000000000}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 493.387590] binder: 10002:10010 ioctl c0306201 20007000 returned -22 [ 493.400001] binder: 10002:10010 ioctl 4b69 20000040 returned -22 [ 493.400039] binder: BINDER_SET_CONTEXT_MGR already set [ 493.400048] binder: 10002:10011 ioctl 40046207 0 returned -16 [ 493.400812] binder: 10002:10011 unknown command 1073742980 [ 493.400826] binder: 10002:10011 ioctl c0306201 20000680 returned -22 03:33:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1463c940"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) ioctl$BLKTRACESTOP(r2, 0x1275, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$EVIOCGABS20(r2, 0x80184560, &(0x7f0000000040)=""/13) [ 493.425801] binder: 10007:10014 ioctl 40045564 0 returned -22 [ 493.438238] binder: 10007:10014 ioctl 40045564 0 returned -22 [ 493.593321] binder: 10013:10020 transaction failed 29189/-22, size 0-0 line 3013 03:33:27 executing program 6: creat(&(0x7f0000000700)='./bus\x00', 0x0) socket(0xa, 0x80000, 0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r0, 0x10e, 0x5, &(0x7f00000000c0)=0x100000000, 0x4) r1 = dup(r0) r2 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) read(r1, &(0x7f0000000900)=""/4096, 0x1000) ftruncate(r2, 0x80080) sendfile(r1, r2, &(0x7f0000d83ff8), 0x2008000fffffffe) 03:33:27 executing program 7: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000100)='./file0\x00', 0x0, 0x1, &(0x7f0000000200)=[{&(0x7f0000010400)="1020f5f20100070009000000030000000c0000000900000001000000020000000000000000300000000000000e00000016000000020000000200000002000000020000000e000000000400000004000000080000000c00000010000000140000030000000100000002", 0x69, 0x1400}], 0x0, &(0x7f0000000040)) symlink(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='./file0\x00') 03:33:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/sockstat\x00') setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f00000000c0)={0x889e, {{0xa, 0x4e24, 0x1}}, {{0xa, 0x4e22, 0x3, @empty, 0x1048000000}}}, 0x108) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) ioctl$TUNSETLINK(r3, 0x400454cd, 0x13) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000040)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 493.734852] binder: 10026:10032 ioctl 408c5333 20000040 returned -22 [ 493.745168] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10029 comm=syz-executor4 [ 493.761993] binder: 10027:10033 unknown command 1086939924 [ 493.768741] binder: 10026:10034 ioctl 408c5333 20000040 returned -22 [ 493.775837] binder: 10026:10032 Acquire 1 refcount change on invalid ref 0 ret -22 03:33:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x0, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 493.775992] binder: 10026:10035 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 493.799622] binder: 10027:10033 ioctl c0306201 20007000 returned -22 [ 493.809297] binder: 10027:10033 ioctl 1275 0 returned -22 [ 493.816594] binder: 10027:10033 ioctl 80184560 20000040 returned -22 [ 493.824097] binder: BINDER_SET_CONTEXT_MGR already set 03:33:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 493.830265] binder: undelivered TRANSACTION_ERROR: 29189 [ 493.846453] binder: 10027:10037 unknown command 1086939924 [ 493.846468] binder: 10027:10037 ioctl c0306201 20007000 returned -22 [ 493.868417] binder: 10027:10038 ioctl 1275 0 returned -22 [ 493.874266] binder: BINDER_SET_CONTEXT_MGR already set [ 493.880959] binder: 10027:10037 ioctl 40046207 0 returned -16 [ 493.887717] binder: 10027:10033 ioctl 40046207 0 returned -16 03:33:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 493.895621] device lo entered promiscuous mode [ 493.909260] device lo left promiscuous mode 03:33:27 executing program 1: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000280)) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x0, 0xd43f58e118afee75}, 0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket(0x18, 0x0, 0x1) ioctl$EVIOCSCLOCKID(0xffffffffffffffff, 0x400445a0, &(0x7f0000000180)=0xa93) connect(r1, &(0x7f0000dcd000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @rand_addr}, 0x2}}, 0x2e) sendmmsg(r1, &(0x7f00000002c0), 0x4000000000000f4, 0x0) mlockall(0x2) time(&(0x7f0000000100)) ftruncate(0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x0, 0x12, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f00000000c0)=0x200, 0x4) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f00000001c0)=@req={0x6b32, 0x0, 0x9, 0x7}, 0x10) 03:33:27 executing program 7: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000415fc8)={&(0x7f0000000000), 0xc, &(0x7f00000daff0)={&(0x7f0000000040)=ANY=[@ANYBLOB="c40000001900050b00000000000000d4ffffffff00000000000000007ef303deeb49e8e400000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0010000200000000000000"], 0xc4}}, 0x0) 03:33:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="04630440a443671a"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:27 executing program 6: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)={0x2000}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r1, 0x80003) sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe) [ 494.085308] binder: 10046:10056 ioctl 400454cd 13 returned -22 [ 494.095555] binder: 10046:10056 ioctl 400454cd 13 returned -22 [ 494.113730] binder: 10052:10062 tried to acquire reference to desc 0, got 1 instead [ 494.121956] binder: 10052:10062 got transaction to context manager from process owning it [ 494.131183] binder: 10052:10062 transaction failed 29201/-22, size 0-0 line 3004 [ 494.141029] binder: undelivered TRANSACTION_ERROR: 29201 [ 494.176009] binder: 10063:10065 tried to acquire reference to desc 0, got 1 instead [ 494.185177] binder: BINDER_SET_CONTEXT_MGR already set [ 494.191076] binder: 10063:10065 ioctl 40046207 0 returned -16 [ 494.290025] binder: 10070:10072 IncRefs 0 refcount change on invalid ref 442975140 ret -22 [ 494.300562] binder: 10070:10072 IncRefs 0 refcount change on invalid ref 442975140 ret -22 03:33:27 executing program 5: getpgid(0x0) openat$cgroup(0xffffffffffffffff, &(0x7f0000000000)='syz0\x00', 0x200002, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_user\x00', 0x0, 0x0) syz_open_dev$sndseq(&(0x7f0000042ff3)='/dev/snd/seq\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write(r1, &(0x7f00000003c0)="e1616c50e2b5b875c38cace6000ea9b58fc8e54ba1e25aa2952a077e11d0284b8335098768aadb5e2f7cb9e82daa83b10b5603338f32d426d88599b9cf16e9bfd38908c4fa32f0f762540489e0870000", 0x50) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000002c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000540)={0x0, &(0x7f0000000480)}, 0x1a5) ioctl$TIOCSCTTY(r0, 0x540e, 0x3) clone(0xbd319029ddd0a11b, &(0x7f00000006c0), &(0x7f0000000200), &(0x7f0000000040), &(0x7f0000000480)="e45a8b03e55043b8c239482987c9e1d553bb8928a70719b56666092c97570f63a45147abc98ee9af56727ccf9637c9f6a6b74a3d0ede72695f5bf1f4d0b5e9f36ca65857847fab40f94a10caddb16cf1dc4a93b5b46ea7f0c6c17a6e76128ae235e23cb723c7eb074ff7cdeada3f0c24c661613ab00337d9c47b71f707ccf493cff36bc9") pselect6(0x40, &(0x7f0000f33fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, &(0x7f0000768000), &(0x7f0000086000), &(0x7f0000349000), &(0x7f0000f14000)={&(0x7f00000000c0), 0x8}) add_key(&(0x7f0000000140)='id_resolver\x00', &(0x7f0000000180), &(0x7f00000002c0), 0x0, 0xffffffffffffffff) keyctl$read(0xb, 0x0, &(0x7f0000000300)=""/72, 0x48) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000380)={0x9, &(0x7f0000000280)=[{0x3, 0x8}, {0x1ff, 0x850}, {0xfff, 0xdc6}, {0x7414, 0x4}, {0x6, 0x4}, {0x10001, 0x2}, {0x0, 0x5}, {0x9, 0x9}, {0x8001, 0x5}]}) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000100), 0xc, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="f1b1e1dce91e07c49be684208e0164e2050ce7e386695ddf23be091ab875bd2db512749f380ed1ed691b3ef9d055172b607c95ac6683d10ba70409e298463806544835ad2f8ca3f954601c85b3a5a6c6cced9e0ff68d70d087abbe834ad6b897b869bce103166a09c8b07523a956a17fd8c4f6fef8e432ebf0a0d8efc0c6bd4c61135d5371874c46bcb67bc1be5b9c9bd16f2cc6d033bffc14c717c7f30854e294f48c8e"], 0x1}}, 0x4000000) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@ipv4={[], [], @rand_addr}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@broadcast}}, &(0x7f0000000680)=0xe8) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f00000006c0)={@multicast2, @remote, r3}, 0xc) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000700)={0xa8f, {{0x2, 0x4e22, @local}}}, 0x88) write$UHID_DESTROY(0xffffffffffffffff, &(0x7f00000007c0), 0x4) socket$inet6(0xa, 0x8000f, 0x6) 03:33:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0463d7d9d2f8044900001a50"], 0x0, 0x0, &(0x7f00000006c0)}) dup2(r1, r0) 03:33:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$unix(0x1, 0x1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:27 executing program 7: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket(0xa, 0x2, 0x8) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x7) setsockopt$inet6_int(r0, 0x29, 0x11, &(0x7f0000000100)=0x7, 0x4) 03:33:27 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 494.424063] binder: 10082:10085 unknown command -640195836 [ 494.432278] binder: 10080:10089 tried to acquire reference to desc 0, got 1 instead [ 494.432289] binder: 10080:10089 got transaction to context manager from process owning it 03:33:27 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) socket(0x10, 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(0xffffffffffffffff, r0, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x410000, 0x0) ioctl$SG_GET_REQUEST_TABLE(r1, 0x2286, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0xfffffffffffffd8f, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f0000000200)={{0xffffffffffffffff, 0x3, 0x9, 0x3, 0x2}}) [ 494.432300] binder: 10080:10089 transaction failed 29201/-22, size 0-0 line 3004 [ 494.432583] binder: undelivered TRANSACTION_ERROR: 29201 [ 494.501880] binder: 10088:10097 tried to acquire reference to desc 0, got 1 instead 03:33:27 executing program 7: mkdir(&(0x7f0000000380)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f0000000380)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a000000290100000000000000000000b5e6bdbed0770cf084fe1f5bc52cac82a1a3ca3a0c23c6af4b43"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWALK(r1, &(0x7f0000000080)={0x9, 0x6f, 0x1, {0x13b13b13b13b1433}}, 0x4) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@access_uid={'access'}}]}}) open$dir(&(0x7f00000013c0)='./file0\x00', 0x0, 0x0) 03:33:27 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000000480)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x114, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78) ioctl$SG_IO(0xffffffffffffffff, 0x2285, &(0x7f0000000300)={0x53, 0xffffffffffffffff, 0x6, 0x0, @buffer={0x0, 0x1b, &(0x7f0000000200)=""/27}, &(0x7f0000000440)='\x00\x00\x00\x00\x00\x00', &(0x7f0000000080)=""/126, 0x0, 0x0, 0x0, &(0x7f00000002c0)}) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000000)={0xb7c5, 0x7, 0x9, 0x0, 0x6}) write$binfmt_elf64(r0, &(0x7f0000000300)=ANY=[], 0xf6) read(r0, &(0x7f0000000380)=""/42, 0xf0) [ 494.502055] binder: 10088:10097 tried to acquire reference to desc 0, got 1 instead [ 494.554655] binder: 10082:10085 ioctl c0306201 20000680 returned -22 [ 494.588740] binder: BINDER_SET_CONTEXT_MGR already set [ 494.594390] binder: 10082:10106 unknown command -640195836 [ 494.594400] binder: 10082:10106 ioctl c0306201 20000680 returned -22 [ 494.622762] binder: BINDER_SET_CONTEXT_MGR already set [ 494.632896] binder: 10082:10091 ioctl 40046207 0 returned -16 03:33:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f00000005c0)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/am_droprate\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f00000000c0)='team\x00') accept$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000180)={{{@in=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000280)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000002c0)={{{@in6=@mcast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@ipv4={[], [], @rand_addr}}}, &(0x7f00000003c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000400)={{{@in6=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000500)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000006c0)={{{@in=@dev, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000000600)=0xe8) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000640)={0x0, @empty, @rand_addr}, &(0x7f00000007c0)=0xc) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x15, &(0x7f0000000800)={@empty, 0x0}, &(0x7f0000000840)=0x14) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000880)={0x0, @empty, @local}, &(0x7f00000008c0)=0xc) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000a00)={0x0, @multicast1, @dev}, &(0x7f0000000a40)=0xc) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000a80)={{{@in6=@ipv4={[], [], @dev}, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast2}}, 0x0, @in=@multicast1}}, &(0x7f0000000b80)=0xe8) getpeername$packet(0xffffffffffffffff, &(0x7f0000000bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000c00)=0x14) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000001240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4004040}, 0xc, &(0x7f0000001200)={&(0x7f0000000c40)={0x590, r3, 0xc08, 0x70bd2c, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x13c, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x47}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x8001, 0x8000, 0x2, 0xada}]}}}]}}, {{0x8, 0x1, r6}, {0xbc, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7ff}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}]}}, {{0x8, 0x1, r9}, {0xf0, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x101}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0xc, 0x4, [{0x48b8, 0x101, 0x3, 0x5}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}]}}, {{0x8, 0x1, r10}, {0xfc, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r11}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}]}}, {{0x8, 0x1, r12}, {0x170, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x86}}, {0x8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r13}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r14}}}]}}]}, 0x590}, 0x1, 0x0, 0x0, 0x40801}, 0x20000000) r15 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r15, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 494.639651] binder: 10082:10085 ioctl 40046207 0 returned -16 [ 494.700607] binder: 10107:10108 tried to acquire reference to desc 0, got 1 instead [ 494.717240] binder: 10107:10108 got transaction to context manager from process owning it [ 494.727478] binder: 10107:10108 transaction failed 29201/-22, size 0-0 line 3004 [ 494.740474] binder: undelivered TRANSACTION_ERROR: 29201 [ 494.775506] binder: 10110:10115 ioctl 40345410 20000200 returned -22 [ 494.825706] binder: 10110:10120 ioctl 40345410 20000200 returned -22 [ 494.876513] binder: 10118:10124 tried to acquire reference to desc 0, got 1 instead [ 494.893165] binder: BINDER_SET_CONTEXT_MGR already set [ 494.898472] binder: 10118:10124 ioctl 40046207 0 returned -16 [ 494.916624] binder: BINDER_SET_CONTEXT_MGR already set [ 494.916633] binder: 10118:10127 ioctl 40046207 0 returned -16 03:33:28 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x6, 0x9000}, 0x4) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = socket(0x200000000000011, 0x4000000000080003, 0x80) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/224, 0x32) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000001c0)={0x6}) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f00000004c0)="b4d43b234c6ea2448ec204bb5ed08ed7d01212d1f4389be983306c055560f03eeae050962c44a9a0812ba587535b36e17a4cda4e250d6fc7c6880e4b8ef3676b4a9d34eef77def941def9218cd3c54f751cddd140b63822ec09b979b5c6f93625992b25651891674bbcfdf49a57ba32c3eb370898fb8ac60bd1a2bb54dbdaf4ab29a6ccc372e6cbe74e2bb2ca86bcc3503cd5d1b7f8d90164b72b4b1b4e5e2d16f259a0c061d29cd41f9ab876da12619d52478cdd4b6550f4aa6d6f63d88b2aaf7367994ec3a5115744c775dbcc33e206218aca3bdf39d507c9a1ebacfd31b27c4536f527b54b74a8561c666f0d2183cc2b77db6e8be9737246ba1be546e1dcb") ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) bind$packet(r1, &(0x7f0000000200)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f2f6e657400000000000000072f6578706972655f6e6f646573b14a8874745f63", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="080425bd7000fbdbdf250f0000001c0001000800090017000000080006006c630000080008003f0000002000030008000800010000001400060000000000000000000000ffffac1414aa08000400af0000001c0002000800030003000000080007000900000008000500ff0f000008000500c40000001c0001000800080000080000080004004e20000008000b00736970004800020014000100fe800000000000000000000000000018080002004e2300000800030000000000080005000700000008000b000a000000080004003f0000000800050092000000"], 0x1}, 0x1, 0x0, 0x0, 0x4000}, 0x4000811) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000140), &(0x7f0000000180)=0x8) 03:33:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:28 executing program 7: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000380)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x62000010}, 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r2, @ANYBLOB="02002cbd7000fcdbdf250d00000008000600ff03000028000100080001000a000000080009006900000008000600666f00000c000700080000000400000048000100080005000300000008000100f5a400000c000700060000001c000000080004004e230000080001000a00000008000500040000000800001400020008000b0002000000080002004e2000bdcdb05e5be36aa100080005000900000000000000000000000000000000"], 0xb0}, 0x1, 0x0, 0x0, 0x10}, 0x40) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2b, &(0x7f0000000140)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) dup3(r3, r0, 0x0) 03:33:28 executing program 5: socket$l2tp(0x18, 0x1, 0x1) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/validatetrans\x00', 0x1, 0x0) ppoll(&(0x7f0000000380)=[{}, {}], 0x2, &(0x7f00000003c0)={0x0, 0x989680}, &(0x7f0000000400), 0x8) socket$inet_tcp(0x2, 0x1, 0x0) perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x3090c0, 0x0) ioctl$RTC_PIE_OFF(r0, 0x7006) socket(0x10, 0x0, 0xc) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000080)={'HL\x00'}, &(0x7f0000000180)=0x1e) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='trens=fd,rfdno=', @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB=',\x00']) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno'}}) 03:33:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) chdir(&(0x7f0000000040)='./file0\x00') r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000500)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000540)=[@acquire_done={0x40106309, r3, 0x2}], 0xffffffffffffffa5, 0x0, &(0x7f00000004c0)}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f00000000c0)={0x0}) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000400)={'broute\x00'}, &(0x7f0000000480)=0x78) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f00000001c0)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0xa8, 0x0, &(0x7f00000002c0)=[@enter_looper, @clear_death={0x400c630f, 0x1, 0x2}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x8, &(0x7f0000000100)=[@ptr={0x70742a85, 0x1, &(0x7f0000000080), 0x1, 0x3, 0x3c}, @flat={0x776a2a85, 0x1, r4, 0x4}], &(0x7f0000000140)=[0x454ad1b2f5b09126]}, 0x5}}, @transaction={0x40406300, {0x4, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x58, 0x30, &(0x7f0000000200)=[@ptr={0x70742a85, 0x0, &(0x7f0000000180), 0x1, 0x2, 0x7}, @fd={0x66642a85, 0x0, r1, 0x0, 0x1}, @flat={0x776a2a85, 0x0, r5, 0x4}], &(0x7f0000000280)=[0x20, 0x0, 0x20, 0x38, 0x60, 0x78]}}, @register_looper], 0xf, 0x0, &(0x7f0000000380)="c0af24ff3c4f26a50a5f4bf34fb248"}) 03:33:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="07349bcede28f004"], 0x0, 0x0, &(0x7f00000006c0)}) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x80080, 0x0) ioctl$EVIOCRMFF(r2, 0x40044581, &(0x7f0000000040)=0xfffffffeffffffff) ioctl$sock_inet_SIOCSIFDSTADDR(r3, 0x8918, &(0x7f00000000c0)={'veth1_to_team\x00', {0x2, 0x4e21, @rand_addr=0x1ff}}) 03:33:28 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, 0xffffffffffffffff, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:28 executing program 6: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000140)={0x2000}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r1, 0x80003) sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe) 03:33:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 495.118080] binder: 10137:10146 BC_ACQUIRE_DONE u0000000000000000 node 628 cookie mismatch 0000000000000002 != 0000000000000000 [ 495.118266] binder: 10138:10145 tried to acquire reference to desc 0, got 1 instead [ 495.118277] binder: 10138:10145 got transaction to context manager from process owning it [ 495.118288] binder: 10138:10145 transaction failed 29201/-22, size 0-0 line 3004 [ 495.118743] binder: undelivered TRANSACTION_ERROR: 29201 [ 495.120728] binder: 10139:10147 unknown command -828689401 03:33:28 executing program 7: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000380)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x62000010}, 0xc, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b0000000", @ANYRES16=r2, @ANYBLOB="02002cbd7000fcdbdf250d00000008000600ff03000028000100080001000a000000080009006900000008000600666f00000c000700080000000400000048000100080005000300000008000100f5a400000c000700060000001c000000080004004e230000080001000a00000008000500040000000800001400020008000b0002000000080002004e2000bdcdb05e5be36aa100080005000900000000000000000000000000000000"], 0xb0}, 0x1, 0x0, 0x0, 0x10}, 0x40) r3 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet_group_source_req(r0, 0x0, 0x2b, &(0x7f0000000140)={0x2, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @multicast2}}}, 0x108) dup3(r3, r0, 0x0) [ 495.120737] binder: 10139:10147 ioctl c0306201 20000680 returned -22 [ 495.123584] binder: 10139:10147 ioctl 40044581 20000040 returned -22 [ 495.126242] binder: 10139:10147 unknown command -828689401 [ 495.126250] binder: 10139:10147 ioctl c0306201 20000680 returned -22 [ 495.126381] binder: 10139:10147 ioctl 40044581 20000040 returned -22 [ 495.175636] binder: 10137:10151 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 495.175647] binder: 10137:10151 got transaction to invalid handle 03:33:28 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 495.175657] binder: 10137:10151 transaction failed 29201/-22, size 64-8 line 3013 [ 495.220981] 9pnet_virtio: no channels available for device (null) [ 495.234283] binder: 10137:10146 unknown command 0 [ 495.239646] binder: 10137:10146 ioctl c0306201 20000680 returned -22 [ 495.246975] 9pnet: Insufficient options for proto=fd [ 495.268291] binder: BINDER_SET_CONTEXT_MGR already set [ 495.273845] binder: 10137:10146 ioctl 40046207 0 returned -16 [ 495.279876] binder: BINDER_SET_CONTEXT_MGR already set [ 495.285305] binder: 10137:10155 ioctl 40046207 0 returned -16 [ 495.291384] binder: 10137:10151 BC_ACQUIRE_DONE u0000000000000000 no match [ 495.314170] binder: 10137:10151 unknown command 0 03:33:28 executing program 5: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, 0xffffffffffffffff, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 495.328598] 9pnet_virtio: no channels available for device (null) [ 495.338161] binder: 10137:10151 ioctl c0306201 20000680 returned -22 [ 495.352172] binder: 10137:10154 BC_CLEAR_DEATH_NOTIFICATION invalid ref 1 [ 495.352182] binder: 10137:10154 got transaction to invalid handle [ 495.352192] binder: 10137:10154 transaction failed 29201/-22, size 64-8 line 3013 [ 495.352603] binder: undelivered TRANSACTION_ERROR: 29201 03:33:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 495.353697] 9pnet: Insufficient options for proto=fd [ 495.387788] binder: undelivered TRANSACTION_ERROR: 29201 [ 495.439862] binder: 10158:10163 tried to acquire reference to desc 0, got 1 instead [ 495.448000] binder: 10158:10163 got transaction to context manager from process owning it [ 495.464699] binder: 10158:10163 transaction failed 29201/-22, size 0-0 line 3004 03:33:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="19630500d7b06bc0f405c8975888c298d40d4db11b25440482bb051e0e815ccec92448c8faee4a6f2bff88995891c4cecf9ddfc2c195760ce673d1a2830ac091fdaed6594d11986e1037f8"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) r3 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1000000, 0x40010, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {{0x3, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x50, 0x10, &(0x7f0000000180)=[@fda={0x66646185, 0x7, 0x0, 0x24}, @fd={0x66642a85, 0x0, r1, 0x0, 0x2}, @flat={0x776a2a85, 0x10b, r3, 0x4}], &(0x7f0000000200)=[0x0, 0x0]}, 0xf1}}], 0x0, 0x0, &(0x7f0000000140)}) 03:33:28 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 495.474252] binder: 10161:10167 tried to acquire reference to desc 0, got 1 instead [ 495.502498] binder: undelivered TRANSACTION_ERROR: 29201 03:33:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:29 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025c3f0a00145f8f764070") pipe(&(0x7f0000000040)={0xffffffffffffffff}) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0x8323, @remote, 0x8c}, 0x1c) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f00000002c0)=ANY=[@ANYBLOB="eb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008b211773f74740cbcb04419db5f9f94384a45afd3832fdac72ceabb0db02b408b349b190e40e0f79ebccd24b1ca9912275a8f8871af864d6"]) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x11}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$intptr(0x1a, 0x1) 03:33:29 executing program 2: syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x7fff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:29 executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x6, 0x9000}, 0x4) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = socket(0x200000000000011, 0x4000000000080003, 0x80) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/224, 0x32) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000001c0)={0x6}) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f00000004c0)="b4d43b234c6ea2448ec204bb5ed08ed7d01212d1f4389be983306c055560f03eeae050962c44a9a0812ba587535b36e17a4cda4e250d6fc7c6880e4b8ef3676b4a9d34eef77def941def9218cd3c54f751cddd140b63822ec09b979b5c6f93625992b25651891674bbcfdf49a57ba32c3eb370898fb8ac60bd1a2bb54dbdaf4ab29a6ccc372e6cbe74e2bb2ca86bcc3503cd5d1b7f8d90164b72b4b1b4e5e2d16f259a0c061d29cd41f9ab876da12619d52478cdd4b6550f4aa6d6f63d88b2aaf7367994ec3a5115744c775dbcc33e206218aca3bdf39d507c9a1ebacfd31b27c4536f527b54b74a8561c666f0d2183cc2b77db6e8be9737246ba1be546e1dcb") ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) bind$packet(r1, &(0x7f0000000200)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f2f6e657400000000000000072f6578706972655f6e6f646573b14a8874745f63", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="080425bd7000fbdbdf250f0000001c0001000800090017000000080006006c630000080008003f0000002000030008000800010000001400060000000000000000000000ffffac1414aa08000400af0000001c0002000800030003000000080007000900000008000500ff0f000008000500c40000001c0001000800080000080000080004004e20000008000b00736970004800020014000100fe800000000000000000000000000018080002004e2300000800030000000000080005000700000008000b000a000000080004003f0000000800050092000000"], 0x1}, 0x1, 0x0, 0x0, 0x4000}, 0x4000811) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000140), &(0x7f0000000180)=0x8) 03:33:29 executing program 5: openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x912, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x0, 0x0) r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0x2000) ioctl$RTC_PIE_OFF(r1, 0x7006) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000380)=ANY=[@ANYBLOB="7261770000000000000000000000000000000000000000000000000000000000e7000000dd6e2a2c40d214d32071445961b79db45e584fdd56e8e264a7621d0508cd0cb92c5b7251e110ef8514ba31157401433ab42998c13e156900da6d2545de27a78ed53d70637874b1c41a0bf09c7618ada977c24e169aead58f7a6c08f110f199c1b685ad86cc56daac0ba1c595f5c9e0cda71a117e1ac8fb05f18cf892a413c6af98fc56913c336b2e4e71e69a22e8aecd8529c2fb7e2bd6e0c4235edccaf83b9874b97a07904341adb2b96b630a8d2351ae09cb74f0b14a436f9f13289464c5d2beb1cf09d5ff8ddd7c604436fc5a2a335d24b3b495d9f828f3fa55d8580dd4eb021b0441427609e754f64e2c0368589594a768580b8a63de41eb1d6c"], &(0x7f00000001c0)=0x10b) close(r0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400202) syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') [ 495.583988] binder: 10175:10177 tried to acquire reference to desc 0, got 1 instead [ 495.593174] binder: BINDER_SET_CONTEXT_MGR already set [ 495.598962] binder: 10175:10177 ioctl 40046207 0 returned -16 [ 495.604749] binder: BINDER_SET_CONTEXT_MGR already set [ 495.604758] binder: 10175:10179 ioctl 40046207 0 returned -16 03:33:29 executing program 6: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000100)={0x0, 0x6, 0x9000}, 0x4) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = socket(0x200000000000011, 0x4000000000080003, 0x80) flistxattr(0xffffffffffffffff, &(0x7f0000000340)=""/224, 0x32) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$IOC_PR_CLEAR(0xffffffffffffffff, 0x401070cd, &(0x7f00000001c0)={0x6}) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f00000004c0)="b4d43b234c6ea2448ec204bb5ed08ed7d01212d1f4389be983306c055560f03eeae050962c44a9a0812ba587535b36e17a4cda4e250d6fc7c6880e4b8ef3676b4a9d34eef77def941def9218cd3c54f751cddd140b63822ec09b979b5c6f93625992b25651891674bbcfdf49a57ba32c3eb370898fb8ac60bd1a2bb54dbdaf4ab29a6ccc372e6cbe74e2bb2ca86bcc3503cd5d1b7f8d90164b72b4b1b4e5e2d16f259a0c061d29cd41f9ab876da12619d52478cdd4b6550f4aa6d6f63d88b2aaf7367994ec3a5115744c775dbcc33e206218aca3bdf39d507c9a1ebacfd31b27c4536f527b54b74a8561c666f0d2183cc2b77db6e8be9737246ba1be546e1dcb") ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'sit0\x00', 0x0}) bind$packet(r1, &(0x7f0000000200)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)="2f70726f632f2f6e657400000000000000072f6578706972655f6e6f646573b14a8874745f63", 0x2, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x4) sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000440)={&(0x7f0000000700)=ANY=[@ANYBLOB="080425bd7000fbdbdf250f0000001c0001000800090017000000080006006c630000080008003f0000002000030008000800010000001400060000000000000000000000ffffac1414aa08000400af0000001c0002000800030003000000080007000900000008000500ff0f000008000500c40000001c0001000800080000080000080004004e20000008000b00736970004800020014000100fe800000000000000000000000000018080002004e2300000800030000000000080005000700000008000b000a000000080004003f0000000800050092000000"], 0x1}, 0x1, 0x0, 0x0, 0x4000}, 0x4000811) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000140), &(0x7f0000000180)=0x8) [ 495.692603] binder: 10182:10186 unknown command 353049 [ 495.698314] binder: 10182:10186 ioctl c0306201 20007000 returned -22 [ 495.706253] binder: 10182:10186 got transaction to invalid handle [ 495.712668] binder: 10182:10186 transaction failed 29201/-22, size 80-16 line 3013 [ 495.722753] binder: 10182:10186 unknown command 353049 [ 495.727840] binder: 10182:10188 got transaction to invalid handle [ 495.727852] binder: 10182:10188 transaction failed 29201/-22, size 80-16 line 3013 03:33:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) write$FUSE_NOTIFY_RETRIEVE(r2, &(0x7f0000000080)={0x30, 0x5, 0x0, {0x0, 0x0, 0x7fffffff, 0x101}}, 0x30) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) unlink(&(0x7f0000000040)='./file0\x00') [ 495.728046] binder: undelivered TRANSACTION_ERROR: 29201 [ 495.747824] binder: 10182:10186 ioctl c0306201 20007000 returned -22 [ 495.754987] binder: undelivered TRANSACTION_ERROR: 29201 [ 495.778529] binder: 10185:10190 tried to acquire reference to desc 0, got 1 instead 03:33:29 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000200)="0a5cc80700315f85715070") r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x9}, 0x1c) fcntl$addseals(r1, 0x409, 0x4) setsockopt$sock_void(r1, 0x29, 0x1, 0x0, 0x300) 03:33:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 495.787233] binder: 10185:10190 got transaction to context manager from process owning it [ 495.795990] binder: 10185:10190 transaction failed 29201/-22, size 0-0 line 3004 [ 495.805406] binder: undelivered TRANSACTION_ERROR: 29201 03:33:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:29 executing program 2: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x200000, 0x0) ioctl$EVIOCGREP(r0, 0x80084503, &(0x7f00000000c0)=""/99) r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$RNDZAPENTCNT(r0, 0x5204, &(0x7f0000000140)=0x7) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630462"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0474ab4e60e9cba67d077ec6f00bfff3f108074bfa44ab6fc792d1b2baf1b852aaef4a408411f5780ce6e51190e625cd94"], 0x0, 0x0, &(0x7f00000006c0)}) [ 495.877029] binder: 10195:10198 tried to acquire reference to desc 0, got 1 instead [ 495.885861] binder: BINDER_SET_CONTEXT_MGR already set [ 495.891217] binder: 10195:10199 ioctl 40046207 0 returned -16 [ 495.897467] binder: 10195:10199 tried to acquire reference to desc 0, got 1 instead [ 495.906038] binder: BINDER_SET_CONTEXT_MGR already set [ 495.911430] binder: 10195:10199 ioctl 40046207 0 returned -16 03:33:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) ptrace(0x421f, r2) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$UI_SET_PROPBIT(r3, 0x4004556e, 0x1) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0xffffffffffffffdc, 0x0, &(0x7f00000006c0)}) 03:33:29 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/checkreqprot\x00', 0x18001, 0x0) ioctl$KDENABIO(r1, 0x4b36) r2 = dup(r1) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) signalfd4(r2, &(0x7f0000000300)={0xffffffffffffff96}, 0x8, 0x80000) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f0000000300), &(0x7f0000000340)) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x0, 0x0) ioctl$KDSKBLED(r4, 0x4b65, 0x3b4) accept4(r4, 0x0, &(0x7f0000000180), 0x80800) kexec_load(0xffffffffffffffff, 0x1, &(0x7f0000000500)=[{&(0x7f0000000040), 0x18c, 0x46, 0x1000000}], 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000440)='/dev/full\x00', 0x0, 0x0) getpeername$inet(0xffffffffffffffff, &(0x7f0000000480), &(0x7f00000004c0)=0x10) set_robust_list(&(0x7f0000000400)={0x0, 0x81, &(0x7f00000003c0)={&(0x7f0000000380)}}, 0x18) getpeername(r3, &(0x7f0000000240)=@in6={0xa, 0x0, 0x0, @local}, &(0x7f00000002c0)=0x80) fremovexattr(0xffffffffffffffff, &(0x7f0000000140)=@known='com.apple.FinderInfo\x00') bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000100)='/dev/pktcdvd/control\x00', 0x0, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x3, 0x3ff) socketpair$inet6_tcp(0xa, 0x1, 0x0, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) rt_sigtimedwait(&(0x7f00000001c0)={0x4}, &(0x7f00000002c0), &(0x7f0000000300)={0x0, 0x1c9c380}, 0x8) mincore(&(0x7f0000ffb000/0x4000)=nil, 0x4000, &(0x7f0000000240)=""/111) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) 03:33:29 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x4a6f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000040000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$P9_RLINK(0xffffffffffffffff, &(0x7f0000000300)={0x7}, 0x7) sysinfo(&(0x7f0000000180)=""/9) pipe2$9p(&(0x7f0000000040), 0x4000) 03:33:29 executing program 5: r0 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0xfffffffffffffffa, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x101240, 0x0) write$P9_RVERSION(r1, &(0x7f00000000c0)={0x15, 0x65, 0xffff, 0x7, 0x8, '9P2000.L'}, 0x15) fadvise64(r0, 0x0, 0x440, 0x1) ioctl$SG_SET_TIMEOUT(r0, 0x2201, &(0x7f0000000080)) 03:33:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:29 executing program 6: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) prctl$getreaper(0x28, &(0x7f0000000340)) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fstat(0xffffffffffffffff, &(0x7f0000001fc0)) perf_event_open(&(0x7f0000000040)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x0, &(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100), &(0x7f0000000140)) socket$unix(0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x40040, 0x0) ioctl$SCSI_IOCTL_GET_BUS_NUMBER(r1, 0x5386, &(0x7f0000000300)) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) write$binfmt_elf64(r0, &(0x7f0000001540)=ANY=[@ANYBLOB="7f454c4600000000000000000000000000000000000000000000071ef4b8000040000000000000000000000000000000000000000000380000000000000000000000000000000000000000000000000000a51aaa9dee848e6d000000000000000000000000000000b6060000000000000300000000000000d0170000000000000000000000040000000000000000000000000000000000000000000000000000c67e9b790000def616ea000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000fcff0000000000000000000000000000000000000000000000000000000000000000000000000000000000e94c82c48db881c78fd03a86b5bb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000e9ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000004a00000000000000000000000000000000000000000000000000000000003b9e04000000000000000000000000c1602ab10ea26736c47fc1ca258fb16460cf335ab338d1e15e0edf42a1cc766f7dfc81048dbeedf778f343d0b4c899f099172f569e31e6742a5171687bd92f849ba6dcbc496f4a819064f5c625f2ce8c07153961525af9c9d03f580d757249f2e53f17b2e50c919515710da2b5878281e8d88cc0f6c58eb91f500bd040d627b439e4ba29d82e91cd0000000000000002fc63f23af0cde7dafa63a1d1e16d38f56d5e31d89bc7e062b10ddf451311c414b5080f1f2e2bebe5dbc349a056b6dab760af6034d6695563f2e997e23b7ff47f6683cdcfbfc72f67213a381bd05269da6ce5b22d5b9b8bb5b9704e385a4123204fc470f1475ed79db3173a54caee0958e09fceb07c33e186a223fdabe75883c6"], 0x3cc) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/20, 0x14}, 0x100) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = dup2(r3, r3) sendmsg$netlink(r4, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)=[{&(0x7f00000001c0)=ANY=[@ANYRES64], 0x1}], 0x1, &(0x7f0000000040)=[@rights={0x18, 0x1, 0x1, [r2]}], 0x18}, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f0000000100)) recvmmsg(r2, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0x0, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x4000000000002ce, 0x62, 0x0) sendto$inet(r0, &(0x7f0000000180)="cc649bcf1524328e07f973a7f3f1244b780f48386978c155e78d31e6ccde14a3", 0x20, 0x0, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10) write$binfmt_elf64(r0, &(0x7f0000002500)=ANY=[@ANYBLOB="7f454c4600250000050000000000000003003e00060000002c010000000000004000000000000000e1000000000000000500000087003800020002000700ea000200007001000000ea0a000000000000f7ffffffffffffff00000000ffffffff0000000000000000010000000100000001000000000000000100007004000000050000000000000000000000000000e8a88ae457d0e7d1003bbc8f840005000000000000000100000001000000ff0f00000000000000fcfffffffffffff423273d395b5dfe49a633eb0eb0263328129db30c89d614ca312379424593d1149401363a977a2b10bc8394762bab422771360aa38dc889b26829f721e3098b0f80c2f4ee55bcf0df04911af0a6a16e0ab5b5bb1e2227df0cb7b403be567ea3b9adef738dd4b7efbd9e56dfc0dc488a064d4ad246d477bc8fedb6c1fbcdb1469e544a6ac9afa9987b94c8d1209a41a79416931a8f43bd761418a2c47221a2a4d6bee2592cd6eab8fa3ac582965b48d68fb1dde708c9901874b0f1628c0adb0dc15872d102a327e9f073a52942892de4cc87c25e76cde841dd1e09db3f59955450018b682981af9bf3133a11fbf7915b41105bd663e6f7116777b3cb43f260d25a06d22119ca7674f7d9eeb496cccae5ea73758600072b6f0c2a040000002001cb9377fbc132be60c8b0bf6ac0a892b355685d62cb7077a1e889c359d7bfc544111c6ca232e6c6593a0b8f085567b065536d649fea6d4e202254fc1a0dedba780af208b0457ed33958cfd97c0155f59b06d997423bb3b6f3d5e01c8b74030434cacb0e50dcc661aff03a72021b6011f6ff05f6070f0bcb7d75cbf1668562cd6599dcf1eac792c47370ac83b2730215d9955f6fa81f59d3209fbaf52f41f8c413432d976fe6eb3ae98661de6250e09bcf7b82d0492b349ca022abade27ee2d41aa83ba7d2ed5193dda7e9c78769b1430e5a171e12e0fa1d057e1aef4b856ab0f2dabc8b207f09d78e1f83461ccac0b2558732ea70d369973971d2c6d94081f33308b1e4b27a2ce6f45838809407045aa63b6219d82564c7323f73bfc2260fd95e5e8eeca550b29adcca477de69469764858d7aa3ab8afd99e883c43dacae12ac88e7fea5a99df90755e5caf59185794ed6419a22fe36d9070ed6558b090cb871914491e2a135047b729107896b784bf87c941f7b993033898b993c83b8bcec93aed20e900921e8c8e716321ad5664665e7f89839258d1477a2e8fceaa9280b9c9dc53b5ed4bd907c3942d8fac1eff961bf3040ae0faed3985bccc355506dfcd52907750828fc988e60aec5b577af9769cebc8d6e87a826826f8362c84fe7ec9e6d3cc39c1b6b6b9005eaaf0d9037fa576757018d3f60fbab576284cd7343e70a4b8143dc67e94c1090b7376eec330f5995c4b3a119646b4a953cf0669d6e52264827bbbae2c7565529a68f46f5e1a23137059867d0192caf6b22e2d74f8fbe12a139bc90a0d12b6acc0a106ba4fc2baf87c254bb540835206fc5f63dbc82581cec68813c331af00086cae971610587c4683d5f1b0dd68b8a419f581f0387cc9d1a435e329a0595d73a4489b1ea23c331ca752bfd46de13faee26e7e2e9b11dd7151883ac8112c0ba049070bcf00881cc0a37395f1a102cddda4b0b903b0233461e70254e6a75b9c29c02fce51b630d5cd58867e5f8e5b47fdb2fb53e0b9485f1079ddb39d7b3ef5d8d37be9a08714575e454274581a8ad758ba5bda32d2c893e8a40de0febf31f84016558a9db7c53dec27895d69fa1a34e4b5b856f4d0974a9dd4031e28632a245b921a576f1a19f47d7ba08e9ca94a7ae46c89b379d90e0dfdcffb790586d920ea79f94af735aa51695dfe0c9c73a44b277e877b473b43f5c3a960d7c5e22678ab3f7cf46bdf23cbbd31df613827f8e23f7b2c71be25eab7dbd56f7b426b784583ec97db1659afc521a84e709cd879f8e5afe72366ffcd05c29b92ad591e35a19df805a2b89b9b87a13109c19ea941e9b9f6ee1c47708870abfda2debce7eae0f356bc896a5a207f6bc3ed4186117e1ae9b861d3a9a94520a6df99fd700c6fc3b82467a1257c2040dd34b2fb30c032224e6b864900f93168e387edaeeedaebf8b7b40d4caaa97c85229e63770ced3382013fd11010d0ee46333666aaec98aacc511c92be9e55eee400c74ab4614552624ad88f5d63b6f87e85826ee7cf6f15418f9712c6d07f36a54f097d9bc48b3035ae569af4753e7831dc520fe4726d0c96d0cb7b45e5ca5002884d38ed8e8ead8d4a7da76f9bcfd848fd27345bec7dd4356ef7b11a0cd3113bd9d9bd72597daf8e25b987b6a17329b9c581e7e647eddd060553fd6e9194bc07ffc5ca9eb6e9ce36aa545ac0f6e242e381282522481668f05909a69db9c8f417ce2406fb727c11fa8ed3ec6f097fed51414f3286075c414753979f58a70d97539c1215ad15f4f2bdc9cb27e00245bb2291f767d4c581387a63022c727026043c0180a848edd1c3fffff21c3fe0b11c65caca8941959536882277e3dc9e61da52527a24e2d79a497a80b33b24f1ca184d56ad13194867d7a0a424977b5f256a4643460a03007ccf2abb042c6a8f357e8c67298f4ee68fa10d82aeec9c63884f43927692db04bfa6651a630ff1e945d5c2ceb1552d0cd69830f257e5d2b500e4447f03edc78938d82871b7075be875dee546cd23ae617356f51fe8f1fb11417e63a436d7ca0ecd22fab3719ab5b4a4fa0ac2b6a44002fdddb61f7d6fe2beac291455b144cff1da4cb487c430a42cd6dee2b0752536175bdeb3abf2a393823dddf4567d7a6ac785662eb272ea9ea223e0d63a2d027fc3bfa6da9c1537a5c207c9f2495bd45ee28be938ad3dbdadee778875ba641ceb20f3fb23d57269a4e40e0baea56d0b4247f12ebb7cf6ee0e64b0d521c8636ca845287f752adfde004e37bee0451540bcabf455b43233e287e4ce36ebbf2cf0aa8325b72b90c40cc5bdf77f66b07bf5423a80409e1e95424e2d63c09e621354d87d29d28758c290f29746e00e72e1f6ee9fc93841a7a4ec7420c1d78c09f9355b41c5b6a2e94d84218428a4e4e40bcab84f0cdc9a230101146a11e1f36367b4b5f21e76b5e58c31aec27a47e7ce6c22d29c553f03d0515199b541750e92718c53542cb8c0e4202c89b5bc2a4e3cd4fd1e33ba846b2d2d1c94d2e73327b1d327fe80ff1113634e2e94769b97a1088c2f00001fd26ffbf3b4b82036e960a01efd1eecb0e4cff79c5943cb7f3390757f2ebaa20ac131cddf19065dad03237cca7406b5c30228494fe25d9d26631795f3b0a16ac6c8c27e37a75bce127c582beed29fe6137efe5ac28a2a89597db794c570055e318e92f17f36e3fcbc68c8233d2f0c433f9e11b2819ade8026682c9c966d13605ba9cfa66d91f8203260ed06d8c53912b2c25be01165ebda24e3b70c4fa4a99c56470ee400000092272d6ba4a0906d5b8df7039b82bf83378b78ce124aca8b7944fffdd65bfca51e33614282fb1738dd43c6b95f2bc5e9b24605ff3fb5a06ece40c2c4a86b93acdde534777d47c5196e7ef7d65ff45606324b402aa6b81afa463f63f96bc442cd25a033b7b6feed08de0f00bccb16c439813c6c4b1d1733bb55a6245a9180ec71a7f31631613c60af161f5ef64493b859a6c4baa9e3811250984db538169178a4f4cb4141f74e366a28b4fdeef59bb22f6f525c493912a044bd99a3b4b86b2834a4f837d58d4292a22a730b6a2e5ec7bf358c2016326fff4889d5d5e1beec898a3a88d0f4a450d86548a1a9b1cc1bee45e6a4e2c4e09cd69a51d46190755bd42c1e53d4a1f80010da651d6c500a066afa9c98755acf643ff381af66742c6e091746c77e0f14f2583d6d70339ed50e9da34a0aa8820359872132179f087f16cdaf3636688927e39a857a99f911d08406b6addefa9f895f3b29812234eaf4d5a93b9363fa0272ee9fe8676811004fabc8121f7639e9f92c0d7f796a6355e984d7a85aadc6220847666f8f52c4571516eb1a9fc487e918956411823e1edef555a61ba7d45931457b221bdcc8aaad58e8007497a8846278e0aed68926d3ea9fd96a89ccc89627c86da315c3eb5445bf799df613befe958390660f6c9f7ac02e3187100f18ea3bfacf9662601fc9868329b3524cb8c07850726355bd748f7c51b32e6c4341676cef6af55351e599d196d38d63bf0cd20b85f4bc79a2895b9c5c4d46090b4e1a10394f8ba7201d45d3878dc9b3e7ec3510073424b92a7448f9d8d9c15fff2a1c0e6dde7e6ad83f6243b21c6c14bd1b36e834b9cdc2b09022c0ddad8b5cdedb4a9e401acd96b77825cf6cb459e0c70b310c4d6f7a192c6766e75b4b50e64680b8bbe41065eac33f24c280ae6d89ef5fad05d8a9b635b052176cc3a9c2c9ffd43c0530deafd29079147dd34b5cd866e7feffe95f76695a40c216729ab52614000000000000000000d15fb7a1e1e415271a355e2920683606f9fc1e55e2bf1b5047b16c3c90280c51294756e33654a32aef0ba77bda88c545e20a6145a68d7dbf3e4ba0010fa7eeea87afa4d77297876614aebdc199a9da4b420083d16c28264dd3de22cd5add535914d9150c0efbeac1e113bd094222e55924f5e11ae2e4e3a99418fde8fb355438090f2b37d240238fe5a8f84e5456607e96a94254e12177ddc4399ec8dc6d26ec72e06f76c2b87ad2c42af894f689156c413e5b45015cd97cc02cf974f4688bbf"], 0xd22) ptrace$peek(0xffffffffffffffff, 0x0, &(0x7f0000000140)) [ 496.107360] binder: 10218:10222 unknown command 1644454661 [ 496.113544] binder: 10218:10222 ioctl c0306201 20007000 returned -22 [ 496.121261] binder: 10218:10222 unknown command 1319859204 [ 496.126963] binder: 10218:10222 ioctl c0306201 20000680 returned -22 [ 496.135173] binder: BINDER_SET_CONTEXT_MGR already set [ 496.140718] binder: 10218:10222 ioctl 40046207 0 returned -16 [ 496.146555] binder: 10218:10224 unknown command 1644454661 03:33:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl(r0, 0x0, &(0x7f0000000940)="9cc7a5140159269d8ce5bc18be1e35a82205ff9abd723a236e9c8c43ae44573ba199c9302e745ea4060061ec4f3a5544c8cede1e95b4d385d8f5c70fea484dc26340fd0154b19b83b6aba5455b6dc1ab602dc32382cff56bfb45565399bb9bdc560bae96546d687f4a3cf1da5d76a6bf7403afbfedbc5bb428fb4a2d42891ea956fa25a49c18017928508c18dcaf7ce9462b153cd6c73495c1249ee89969a5194c13925bdbdcc6c17b661494c914b6a5837d44c1ae1f92434d04dfc580309f387cdb4098d5e652dbc8d00cd26c5f20885c99125625f4c98fd00f1e0c02841dd48d9981bfa06c141fd8e1daa785f1852df8d8e4d90e22046b99e85b316cf3b45f94655c515a961bdae847df5ffd224ebeb345e824d58a9ec2fab30269a506373fe6213f7647e6d1b3bc91ac1867aa3e9f6b14f120492c8ba898444bf582956cc463ccd8e78684a701909d1cf0c0fa08fde6637d4d28fabcfbcfa9fb588d0e0854827c71e16ae88f3d494706aa6f99b7727ee9035ee94a34fd52aefb1dcabb3afe0b6af7a0bbb957d095ce1f95e140ab441fd661069cef3e890126903fceadac17acf0b06d38aeac22590dd6da04c2dba6549bff4673b710c7868bfbc30ac3f4c424169407b3c4c390da91779ac6be2813581be28bc90b20c78716317f8c72773becb367fc22ccc5da4b580dc04e7b012453538a8dbe935d1d2624f66fe08036319dbf6bb68cc813bdbe43d7a672f005a9d7a14b4263ea7d41a77d5d7ba3266b57f546a90d12b4de032eb5dc65e55a48016f4900e01d08365eb326aad056be85000032c25ed6c65efd4dcdbd80c2e1d6a9b8fb1c11098d77df5a62a711230faba5c48c777fa64e9748e18cc2ba76c3b72a5982162f53a40cfdd9d68ab4eec7d4580b481a31d248ee3bfeb39b4b57200002cdea888d558f3f30c65ddd0add2f030f841dd8b6b83873f435a76cecad90580c447013333c2d1aa867af616f95a09f31b1033253b3dc365a0478665939b08268c7d4d681c30e79eb8b24beba24e4687f0e7dc07fa4ca844918132f0e2e085bbe6701f03ec4576287feea40a72af3954e38e5af65698454d8833ab8bf839626b9aee2811ad61e0b60c29d0957d61128818517392028b6c54512b350cadac3afc7f1089dcf01dc44ae124cc2dee9022fd69af008a04c31270f408ecd30c2dcec7dd9e50bd080db31f7e5a9ff297376406a0e154d76a8256760273ac2a43472cd5eeaacb04c09441192fbe3f568c0ae039d4b98f85e152458c98f86eef15e2d67406cfd69635e5ef0877f49a91ee0c4e463cea5d10e11fc90d0cde24d9d04e62cea73026a00b07434429e31fffafbb5e4db89b6517d1bcc6a63ef6d5ad0094c121d1bb4621b9ee8d988080096311573ae8ed3bf75913b1adf0fbaabb99ffad02888556f845c6ee3548670a953febbdb2008ae186e28ed7079bb95d4c4456a069aeae9372b221c794cdb647ffdc282775a4ad042e934df99aee6f23a38d016fe25819c67a3022b497e4c5c4433dc3c52fe9b7b5904bf9bc7b68f06200d105aeb27822a257dc634a94e4d3336fdadb1f80d893d459c98989399ef3bbc4f711a7820180c5957b16125660edd84b665ca9fcac2a594bac301e8473f47d749dac209af72e64b7915664b830cef3a5645b0e42d67722e5b3f2abc5b3d543cc96bffb76e9d5eeab6da9b89dbeb3374f471adaf8cf077ea81114f48bc15ce60eb76beb2df3d5d9fe6a42228ca443a79224897dea51e6635e535638d24d73ca44bee5215767b785b4cca217b4ba56d97b597cffedfada52e263c95e1d7892ddc95008e14e86478c14bab560718e16af64459e509384bed1b8bdfff52d35054cbd9377305e0221ea6c4ac4359853a0ab0f45cb57f7e33fe5de748cdb09296608c5261e59810669c6b98c816fd4fb47a47c73704ef396067d98ae74a8982d288ecf58144d7b1bb6bbe6072b6a4f45b8d4414268343faa530457a8067276a79c22d4e91287a67bbca4263bc9f45975a8c0ab632ddf2df4a63efecc5478d5bc39bbc6a19219c61074d7effdc1b5bb341e654663de240227cb2ac605f0002e90225f51828e37a0e779d27378b5661dab8f8c4c8ac24c1502bd656fefbc97af159ca286b8175fe1f121bcf9943935414a321e5c22cb237784421496a5ec6b24b1888ba35ba7efbe953b00f2ed6b1c92476bb2dd690b573ef711bc93f6777c16b074fc4c74da6f82753ff50372ac8d9dbdc50eafceeab2293b3e1943800c723693fe6c450ef2cde07d3a383ba552b2137023fb38a0d3c05a0bf7e0b94853990b9e4883e8c313e9eda229893fba7609665e75286af78f89f2282fe54f33f0b658ae796c5152b25a9c4970dd448a6c9e573c7bdf50a8be32716e215cf02ff8356d59d7a991b101e0574096fe1b5206f96db8ef998691c112e269f4de917986fb44beffd36c681b603582ed6095dc1846611c787dc5be3c7ad3db30b58eb39739ea0228f419e8bb5d33337764f6c64474c87e094216d1c65a3669241760fc300ef9269e0ea51c2e421d4d72fd82405e8a29d7f8d7c2ce2690aec603d31217d1e6edef3d6a6a3954395b04d11016e61904205a581710d5e2c4c168d89e5859bb7ecb017809cd84e04219d0b0f2e5e597b12c8d6d79b5b1fed0c8bac01c9c04f3703ab64ded4b41921246a1880cab6eb8c527223dbcd98723a76eac83e2372fbfa33e7b9b22cbe227ed9c14128c300379990a095978a22caaaa3dcc3f4f41c15565b7bd4530f56ef23f48db24ead9819fdd20a4fe542d11f005765dce2f9c8ffaaf169647aef19adf4c3ea915dad5bcd3d6410d934125c49c4b0a98874508ac4e8efe0d4f5d66d835e2f6908f66e148b7e0af82d2c46747c7d951d97266215b3f1a20f229cfe3a8fb8c7abb31140532b1fb43179bd46283402069d878390372408d1a5c374a6a50f5d78828a8875bc77def926d7b79f52c75693c087a30ffd38db819ccfceedf3835d4b5e315d232919f0cb8fd2fd43c98b857c66bf55798d250bc62b51910c55da1bd75f3bbc30a071185b796691b5656a8c119685e2c0312eacf85ac1e8a21b3f6a62c9e918764e3ad4d50f37a4ae1b6944118ca3d561c3c85a02d08659e8794fa8b1778047ae4a48378e5dbb88de1d93f5c3b30cbee232d2aab6b7938e72730fbeda7afd70dea1289610d9bbea2a67124c1645e9e551ec6733c84ba69e493d81f28948b65dbdf753aa5cb79dc9ff6150ab74117fd8f96e97e154a873c647579281f29e8c78db83844acd3109ba061b4bbedf66f89d28d8c3df6ba32eaf83c7de375b357490e152bc8b1a982c9fd08a6dbd9b2c8de273ae30157f1bb618562a089a8aca37d710734485626230f03c095827c4de9fa86de6290882356fbc4e05adac595495977a7f75c7a946b8cdbdefbfe407379d6dddaebfe0f74e500d344ba8ff3d5fa7875121c170b19edc33f501478b80f053cf9d11052785ed90d47cfd1f8ae21d9bd134ba3eda22d8a721b507675c345e784907fe824be2f23c8f3cf73fb85fdc34d774cebf241cd9926126e4ae85a8a2b921e2da9b5c7dc98be7a94ce6eb0e586eace68886f7d35de331c114e724cf4d3cab79d34eae26310aac20ef844438275f2c70126b6aeca48db5976757eae6cf818641db2e75b331acf8d4b40f0ea870c4a5f8f61527f044d7410ccd8c8ee0e4a9c51ba63bac6bee8d020d54e89c27a323fcf6fe2c3b0ead48fc8dd2a89db721f09aecc365e79584ff2f2acbc220d278efe0fb9806dd3afcf2b6e48208b44ae1d725cf9f87466c6cba5f73cd4d386791c0122a558db807ce06ef60fba13bc0c503b78489fd430c816cc926785e93eab24d76f8b601d1b757ebd39e08829cf0a172155e59c60506746ab3778f233fbc701ba9ea7916dec54984f2f5a684504ee5bef408a27ab87fddc1347c664f104f92bb2f6f1dae716cb56e3a021291f778b12dcf6faee288c859b7cbab10bc999b4f94ebf5c20adc0ce1b9e9c9b4e447f845e5425f42bc21218032ff28a7253264e33f602769723e4e6e1cd660e7012654915615925f29dd7396e2217e8ec016d6974166bc6e50986309b88d635dff5cada67b1c6a8ddf81e381738f5320539a3c449acc1e700e32189e3f064a768aa186ca1517b8be77718168ab767ec3ba64e9be72b9778b2ba2df990c8be9e08be864f47333c05a6b0dd4bde75c1a68962c06f79c132ac90e60a53d72a9d27f9f23718a5aba5d22bf8406261439d94cb4dcf08639ed94d3206f4bbe4227a337742a7759ddf857a9590e2c1656b93d9ea6c2b0f66c0f15ca122c565b11b735c4f2cf00a36158407545335efc8aea37219d73141482628aae8905616f7b6cd3136df1f714999ce9780eedcf4871f6e1086c43232c1c59101f67d9fbb3e159e4d72dced51d05223ac2c6f008da56c52346d30f7ec33e3c9d1857fc3b56c8a43566b390631342bb3a0a1c76c96eb5d97ce8a238830dd2ec2fd5f8cc2571360bf7ab0a396abecadba74ce6c163c49614ba5a8533114b700d0dcee668b558aab8440a519a4993838d5fb23896916d9b19dfd17db28c87f06932ed9579ba1cba752ec2064d4ef69289d78fb0a3e5a56c9d75949f729b616a565263fff980f9ddf9bce200febdc7ab088c1c1a8ddc061eb5f5f06fdbbc376c084ee46160dd3305b6b5dfda6687b3adf199130e1faec224372f9457dc824e195a0e4246fc8a49d029f3babd8e158729e1bb50b48f79cb23f3fcf652296112be83160056d336533b669d6559bb28e22025fc8bd7e6b6bce85dbf33e87d60904c753fe83332a5761458d7b43e4bc0ac93adeb7fa01f56f22273b4f2004fdff8ff387d44e6295883577f8d602f9b7e6950322fecf7194c58715fb31cde6e1da91ff145198a35307f9bf7fbbb80d9c56760026d36ac59fe987a2846042128318afa3ffbb04b9b9f49faff77df2e2a5808a45bf7126e79fb2dac0e95825d4392e8c2b0fae5c2c94125abb713ff35263cb0782314cad480622c705bbc7747eabd2f812394b7bef926e992079680d8d4d0306b2d62b9f1361ec48f201f4b0be05e24c6d7baa873b35c206cf6b7cfb7c967dc08767ccdc64d239e83aa75a797ad144e74bdb5dcc0004ebbf3c62b7021ca833f0b152d700e83ea8c0d780543270ab195f236f00fb82d41c7731d21b203e820c1e98dea841c922f30604b7a75285360430e1d5c7584028fd15ff58621e3f8647995e8b08b31b571c9793888faa453c79ac2605196c5f2cd2db15537e0eab48c23cb5ab30c09930f8644be3ecfcbff9d03a4fd1ac533e7b0c73caf8ff995853c7446344a18271409552277e81a17b2382bf4d331f0de94ea3239a3b99fbcc7025cc46afce0a6258ed839651198324671acbd86f1fb328ad90ce4b4660d11907d40bce0d6cc4e4f67c20371d91332655cc09a9d1af833ab52d83abee2269959d7f0ae9e676b4b5959c9bde18b5741522ad1335bda7cc747470097408c76a65575c05701d9cf699c066c71e9b79b4cde01ef475afa8fd1ebb6ef43c258dfaaafbd5f868b49fe2e66f066ffa3b2798f8537391cf7d03181a7dbff59540638033eda8a25c96e1005fecdb2c55becd94b440a22fdabe8065f6809ad30179ee2b5cd36e7c0beec287c7cafb58a71891f5d4b44d9980b43e73eaf0924df1c737c1a8cab30b1907dbbe589dad33af1a18f48757d3badc37930417f9861d5b0d718b5951b885d23c028092aec5b92ecc0980eda71214d0a838716d6a529d035219272f7aed2af") r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0xfffffffffffffffe) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 496.146564] binder: 10218:10224 ioctl c0306201 20007000 returned -22 [ 496.149944] binder: BINDER_SET_CONTEXT_MGR already set [ 496.149953] binder: 10218:10225 ioctl 40046207 0 returned -16 03:33:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:29 executing program 5: setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000040)={{0x5e, @loopback, 0x4e22, 0x2, 'ovf\x00', 0x20, 0x7, 0x73}, {@local, 0x4e23, 0x2003, 0x632d, 0x4}}, 0x44) lsetxattr(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=@known='com.apple.system.Security\x00', &(0x7f00000001c0)='posix_acl_accessvmnet1keyringsystemcpuset+trustedGPL\x00', 0x35, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) read(r0, &(0x7f0000000200)=""/101, 0x65) creat(&(0x7f0000000000)='./file0/file0\x00', 0x1) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000100)="390000001100090469001b00810800000700fd3f03000000450001070000001419001a000400230007000033007c000200000809c99183a8a5", 0x39}], 0x1) [ 496.245673] binder: 10227:10229 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 496.255019] binder: 10227:10234 IncRefs 0 refcount change on invalid ref 0 ret -22 03:33:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) rt_sigreturn() r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 496.389961] binder: 10242:10246 ioctl 0 20000940 returned -22 [ 496.403073] binder: BINDER_SET_CONTEXT_MGR already set [ 496.406103] binder: 10242:10249 ioctl 0 20000940 returned -22 [ 496.425013] binder: 10242:10246 ioctl 40046207 0 returned -16 03:33:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x20201) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r1, 0xc0305302, &(0x7f0000000100)={0x0, 0x800, 0x897c, 0x87, 0xac, 0x1000}) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="000000000000799bfe2c04adbd16e619500cc3d5a06a0000"], 0x0, 0x0, &(0x7f00000006c0)}) write$P9_RSETATTR(r3, &(0x7f00000000c0)={0x7, 0x1b, 0x2}, 0x7) 03:33:29 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 496.441824] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10252 comm=syz-executor4 03:33:29 executing program 1: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000600)='/dev/rfkill\x00', 0x10000000010004, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x9) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f00000006c0)={{0x5, 0x40}, 0x0, 0x1, 0x6, {0x7ff, 0x88}, 0xd3}) renameat2(r2, &(0x7f0000000400)='./file0\x00', r2, &(0x7f0000000440)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000280)={0x0, 0x3, 0x7f, 0xc8}, 0x14) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000580)='/dev/sequencer2\x00', 0x1, 0x0) mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000640), 0x0, 0x0, &(0x7f0000000680)={0xa, 0x0, 0x0, @dev}, 0x1c) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$VT_RESIZE(0xffffffffffffffff, 0x5609, &(0x7f0000000240)={0x401, 0x7, 0x3}) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x12, 0x8, "2bfad2f687cba212f07ba6d0668ff0998c00cb1e50bafb115ef6f1e24a13df4c4a621f1e56012b04a1e912d55f778185a8e05845c8d56bb12bddf287eb406cfb", "d1ba49a35ad9f307a796f71399320208c2a03fce31fb438918eb36aab0272f36", [0x6, 0x8]}) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') ioctl$KDSIGACCEPT(0xffffffffffffffff, 0x4b4e, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f00000004c0)=""/170, &(0x7f0000000180)=0xaa) r3 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x1, 0x0) r4 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$IP_VS_SO_SET_ADD(r3, 0x0, 0x482, &(0x7f0000000040)={0x0, @rand_addr=0x81, 0x4e23, 0x2, 'ovf\x00', 0x0, 0x0, 0x6b}, 0x2c) dup2(r4, r3) 03:33:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:29 executing program 7: r0 = socket$inet6(0xa, 0x80803, 0x2) setsockopt$sock_int(r0, 0x1, 0x1d, &(0x7f0000000000), 0x4) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000040)) 03:33:29 executing program 5: openat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x200000, 0x108) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140)='/dev/hwrng\x00', 0x80000, 0x0) setsockopt$IP_VS_SO_SET_EDIT(r0, 0x0, 0x483, &(0x7f0000000100)={0x3f, @dev={0xac, 0x14, 0x14, 0x19}, 0x4e22, 0x0, 'none\x00', 0x4026, 0x1f}, 0x2c) r1 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(0xffffffffffffffff, 0x0, 0x63, &(0x7f0000000180)={'HL\x00'}, &(0x7f00000001c0)=0x1e) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x3, 0x401f, r1, 0x1) r2 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) write$cgroup_type(r2, &(0x7f00000009c0)='threaded\x00', 0xfffffc47) ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f0000000240)={{0x2, 0x4e21, @remote}, {0x1, @broadcast}, 0x20, {0x2, 0x4e23}, 'erspan0\x00'}) 03:33:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x80, 0x0) getsockopt$packet_int(r2, 0x107, 0xe, &(0x7f00000001c0), &(0x7f0000000240)=0x196) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="046304400000000092afc9712ed9fee7cf40406a2b429aa0a8832a358d7e0480d0e0c07e7e02acf5472593fc2973b75c54b7d4616384"], 0x0, 0x0, &(0x7f00000006c0)}) [ 496.591611] binder: 10265:10268 unknown command 0 [ 496.596953] binder: 10265:10268 ioctl c0306201 20000680 returned -22 [ 496.606731] binder: 10265:10268 unknown command 0 [ 496.611975] binder: 10265:10268 ioctl c0306201 20000680 returned -22 03:33:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 496.680688] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10276 comm=syz-executor4 [ 496.702049] binder: 10275:10281 tried to acquire reference to desc 0, got 1 instead 03:33:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:30 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:30 executing program 6: syz_mount_image$vfat(&(0x7f0000000140)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e000, 0x1, &(0x7f0000000040)=[{&(0x7f0000010000)="eb64c86d6b66732e66617400020441000500077008f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) r0 = open(&(0x7f0000000180)='./file0/file0\x00', 0x3fffa, 0x0) fstatfs(r0, &(0x7f00000005c0)=""/4096) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") r2 = socket$netlink(0x10, 0x3, 0x16) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000040)={"6c6f3a2c000081800000faffdff700", &(0x7f0000000080)=ANY=[@ANYBLOB="3b0000000200000000000000000000400000000000000000"]}) utime(&(0x7f0000001880)='./file0\x00', &(0x7f0000000440)={0xffffffff, 0x91c2}) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) setsockopt$packet_buf(r3, 0x107, 0x7, &(0x7f0000000400)="db1050c922", 0x5) r4 = socket(0x10, 0x2, 0x0) mount(&(0x7f0000001700)='./file0/file0\x00', &(0x7f00000001c0)='./file0\x00', &(0x7f0000000580)='ubifs\x00', 0x1003, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000187ff8)='.', &(0x7f0000000480)='rootfs\x00', 0x5010, &(0x7f00000e7000)) r5 = fcntl$getown(r0, 0x9) perf_event_open(&(0x7f0000000380)={0x3, 0x70, 0xffffffff, 0x2, 0x1, 0x9501, 0x0, 0xffffffffffff4aa9, 0x20, 0x1, 0x100000000, 0x100000000, 0xfffffffffffff5ad, 0x8000, 0x8, 0x20, 0x7, 0x80000001, 0x13d, 0x8003, 0x0, 0x7f, 0x3, 0x6, 0x6, 0x5, 0x6, 0x200, 0xb9a4, 0x0, 0x8000, 0x7fff, 0x40, 0x6188, 0x100000000, 0x2, 0x3, 0x6ec, 0x0, 0x4, 0x4, @perf_bp={&(0x7f0000000340), 0x2}, 0x240, 0x1, 0xfffffffffffffff8, 0x7, 0xea7, 0xffff, 0x7}, r5, 0x9, r0, 0x1) mount(&(0x7f0000001900)='.', &(0x7f0000187ff8)='.', &(0x7f0000753000)='bfs\x00', 0x5010, &(0x7f0000000500)="8f2ef1dafa31894a239d26783696ef83b3393c672534b55914241ec4029c61cccabda854d9194aabc7b022ff0b7d2cbc2c7ffc0a2b9b21f89564ab98733952cbef47be3b59ff722795") r6 = syz_open_procfs(r5, &(0x7f00000019c0)='net/snmp\x00') sendfile(r4, r6, &(0x7f0000000000), 0x80000002) r7 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) r8 = getegid() fchown(r7, 0x0, r8) ioctl$TIOCMGET(r3, 0x5415, &(0x7f00000016c0)) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f00000015c0)={@in6={{0xa, 0x4e22, 0x2, @remote, 0x4}}, 0x6, 0x9, 0xfd, "96c1ba742ddc1c664a1929edecdd05b31b3dfd4e1b7074d8f7d08a56656d21866825899e97d0ce22528bc8df547ebfe78b59265ce2a784bc0be6bd632bed5d075297feee3f57dd9b846335e1838e558a"}, 0xd8) pivot_root(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='./file0\x00') pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f0000000000)='./file0\x00') 03:33:30 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:30 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 496.925565] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10298 comm=syz-executor4 03:33:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0xfffffffffffffffd) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004300)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000240)=""/160, 0xa0}, {&(0x7f0000000300)=""/252, 0xfc}], 0x2, &(0x7f0000000440)=""/136, 0x88, 0x7ff}, 0xcb39}, {{&(0x7f0000000500)=@can={0x1d, 0x0}, 0x80, &(0x7f0000000880)=[{&(0x7f0000000580)=""/230, 0xe6}, {&(0x7f0000000680)=""/88, 0x58}, {&(0x7f0000000700)=""/214, 0xd6}, {&(0x7f0000000800)=""/88, 0x58}], 0x4, &(0x7f00000008c0)=""/4096, 0x1000, 0x5}, 0xf3}, {{&(0x7f00000018c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast}, 0x80, &(0x7f0000001b00)=[{&(0x7f0000001940)=""/156, 0x9c}, {&(0x7f0000001a00)=""/204, 0xcc}], 0x2, 0x0, 0x0, 0xff}, 0x100000000}, {{0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000001b40)=""/249, 0xf9}, {&(0x7f0000001c40)=""/34, 0x22}, {&(0x7f0000001c80)=""/173, 0xad}, {&(0x7f0000001d40)=""/22, 0x16}, {&(0x7f0000001d80)=""/84, 0x54}, {&(0x7f0000001e00)=""/61, 0x3d}, {&(0x7f0000001e40)=""/4096, 0x1000}, {&(0x7f0000002e40)=""/188, 0xbc}, {&(0x7f0000002f00)=""/199, 0xc7}], 0x9, &(0x7f00000030c0)=""/138, 0x8a, 0x2}, 0x8}, {{0x0, 0x0, &(0x7f00000042c0)=[{&(0x7f0000003180)=""/4096, 0x1000}, {&(0x7f0000004180)=""/228, 0xe4}, {&(0x7f0000004280)=""/34, 0x22}], 0x3, 0x0, 0x0, 0x7}, 0xa20}], 0x5, 0x40, &(0x7f0000004440)={0x0, 0x989680}) sendto$packet(r1, &(0x7f00000001c0)="796de06a705a919ccf7bcfba4d0d0502bd745b39c8c1138587adee12245e4faae6b34812995eaa7c6b7c30dee9aeb9851ad7589eb1c9cdab4c9afd3d7b01168d1b255deae80e04ed9110fa53cfcaf0f08605f85f03c4254e0c73b861accad0", 0x5f, 0x20008010, &(0x7f0000004480)={0x11, 0x0, r2, 0x1, 0x7}, 0x14) mknod$loop(&(0x7f0000000040)='./file0\x00', 0xc000, 0x1) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) write$P9_RCLUNK(r1, &(0x7f0000000080)={0x7, 0x79, 0x1}, 0x7) r4 = dup2(r3, r0) ioctl$SNDRV_TIMER_IOCTL_INFO(r4, 0x80e85411, &(0x7f00000044c0)=""/194) r5 = geteuid() r6 = getgid() getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000045c0)={{{@in6=@dev, @in6}}, {{@in=@local}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8) lchown(&(0x7f0000000100)='./file0\x00', r5, r6) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x20e, 0x0, &(0x7f0000000080), 0x1ee, 0x0, &(0x7f00000006c0)}) 03:33:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x6f, &(0x7f0000000080)=0x200, 0xfd3e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:30 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x10000, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14) mkdir(&(0x7f0000000180)='./file1\x00', 0x0) fchmodat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) pwrite64(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) mprotect(&(0x7f00000c5000/0x3000)=nil, 0x3000, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x3, @dev, 0x2000000000003f}, 0x12) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x8000fffffffe) [ 496.979405] binder: 10296:10300 Acquire 1 refcount change on invalid ref 0 ret -22 [ 496.988147] binder: 10290:10297 Acquire 1 refcount change on invalid ref 0 ret -22 [ 496.989474] binder: 10284:10288 Acquire 1 refcount change on invalid ref 0 ret -22 [ 496.989551] binder: 10284:10292 IncRefs 0 refcount change on invalid ref 0 ret -22 03:33:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:30 executing program 6: r0 = syz_open_dev$sg(&(0x7f0000000200)='/dev/sg#\x00', 0x0, 0x163882) syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x0) timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000080)) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f0000000000)) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x12000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000100)={0x1000, 0x4, 0x400, 0x4, 0xffff}, 0x14) tkill(0x0, 0x0) 03:33:30 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:30 executing program 0: r0 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) fremovexattr(r0, &(0x7f00000000c0)=@known='trusted.syz\x00') r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001b40)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$VT_WAITACTIVE(r2, 0x5607) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x20000, 0x0) write$UHID_INPUT(r3, &(0x7f00000002c0)={0x8, "02075e093c01cb5c7bb4d10868f349053d6a3ab1e6274f6db8fb2178c2390653248b6fed5160a212fb3c0da32c13ff360a924b9fe45ad758c4437e3932cfdb19cdfd438366b8dc464dcc51ddcce2a4e8c4878d75b74edd81c7d193342f4009a25491f307e4a5fdfaa877a825434720ad472995017321af361a7e5f196e525c322ced20062e2d4423978ddafe91c6ebbf181eb9d296a5d2bb8a78db5e9d1b357f6212754234d6dbdeb5b288aec7ab65c240e2f655e90b377e0c37eae9cfd92dc1c88cc2f492e336b4c2ba6a6169444d554da5af45d617413759a7159959b018a028ed7ca956c1a7ea56ccba3aca3b12fade92640643a64ed6dcd4f41335e97878bd5417af1b6680912cab6d3d3fd81348900f9094e07ac7bb9e0597ea266f317ff3dceff66926a62278ed2863676061776a689e5c319e1b37b4816729c3ee21b7820c5cb5729e381ffb6a05ce73aa5c0a75085a65e2a23de476e201b45ed19639d8a670ab1d1def03fe4a564f4156d35a9f4d5fe5437af1cd4ad07b86ed4a6c71cac0bdf5c365e8d64d578577e5e233b0e16a2687de1d318d5977e9003f1fb10dbbe598468224f0b7cfb259d2a41106713765e47638df9af57195693d9d54a44dc29ab708fdefd35a007f46cf4127d38747de9bddaf6bda384633b36c6eb541defbaff474c305bd97c5d48ca109fbf01121f8db034bc50ee15002ea27c5f3085d90adc230077d580fc7269bb665352a306416c6afda7641445c4f12205ec145a07c76472e3b18a769237a4762e9768b5b26fcc90be70c0a6757796570ed20a8cc357e71e9de52ca113a8a7ea875b8c225f878cf3da20915e08c803abbf7f5cf5e12d4119667adffb99947ea6aa8a7d6d4a3125757d36d8aa8ff20c3198848aaf8e50f3bb046e68dec0a5774a899ec8076041560a24f9abdad19cb91b746c0fc01ad24ee8c3fbb647e59aa54b5e2e3077694495b50955fa5b78863e68912adb45a022a6dc91b35da436d19bbac85be02ec76579c2b29ad25eed95f99b4229d59ff7468e5c90bf48f72c62031453359755afcb4818b1a95c1470fa13329bc3f7b5224973a10da26a4c394d8b0b1d22ab549408603ab3b3ffb6547b20f6b8f92f6f3bc270a5893112a03ffc7b07b64ab1693462bbb1d457d5000113913a1120116b448a2a520cc8ff7603312b42facff1b875f9985b58f2d28a6e52f9db491ed30807a0f27eba3239a418bf9be7a930a3e5f6ea369f2112e689dbe313211d9d927c9b09309c07e798f029627842a79e9bf1461846b6d4f621d426d72803797bba4038361cbd34087b9b8171f9a0462a2cb7109088ad02f7da0da615b5fb386791de01c05f5796d8563a402dfb228dfe60754a86210b1440d032413e89fa8f7f130ccad344c5f90118373465ed67e97554d3a6a9aefc4e73c81e8eaaf207064e566313f95fb03af0a4d91f96873d73bc3b0b2b8080d72f0751b1659fd164e06777878e3f88f009b0e9afbe48d815093621a3ed25804bac36e4a7036b2331f31a68a12423ba07f23021415d59dda1d9c021338ac24a6f1e6da7147621d397922b45dab3521ca8d32e73df0cc80e503eabc1e959640bf0261e467f7919d1a1d3bd8aabbd6b6d1a40bb8988c1706931b8865354dc67a9ef0cd89e0e67cfb98714a22b6f493d36d4abf1a7357ccec1af5f05ae19c7c529e6edc5667453952da91fa3101dd461b9ff17d2e3639224cc6075a5c4dc0f2745dc8e6f82e62c4c6f93a7089dfed63e4135797d1fa0d7b87913995786834e20dd69bfa4ebf9c3ed7151d3f9357fb5f58272f7f4bbbdb933f6403546c5bfb7a9ae5906355c2d6f4dff28684ef1db3dd25d229a7cab8892f14aa9b0c0963efd08024b8aec1fd735b7e42a3edec628fa6b7210fae52e1109168f76779a70086c6c4c6ba15e44923b708c7965c175537d0e73481178b9e052013cf0ba4d8fd9e3238cd05cc2e4d84a2dbec7496e1afdbbca09953138ce867be41197fc8526cf0e692d417215bb9a9c52ba7a51d9f197ef06c9a6b80c4ea14f9312b447165a9158e1888fd78e8c058866aa1ace321da5baba33e42917797f33ff7cc6d9b38917081af0db020e6ccf56a555da0e18126fe54fb35db4275fac48949f07223309e4071cf5162b9b5136880fcbf28f4397ceb95ade01723b406d7bbd9db78c00b056003e92956ad1f261c36f2f2eb7c714c770070135315c6f9c4b6a607d16d8c43c615edd71637abeecb71cfbda18d3cd610231ddfb4ca313443d132fcd9f93b27cc2a957b084c2f3bcbbfb2d95c4cdfd83f1cc2c876c56375438c2ae003590dc90d40de5a24f633a1f8023661d5821c51e196c139681366293212242c7fd6b01f8133c15b5cc15dfd1f1af2614a255264af2b8711f71936718f47a04843a831d7c6a2975d8046f10b4c3232aa4ef8ce10de3658a5bae5b5d88dd96b6d8b6902b6709c6aa59f27f86e28915a14084646f3672752531969b873e3fbfd71e50516cfec78f2ec0265235c77c021ba3a94da253113df1a107c2c0ce0549bf2af82d5d5f83e341bbd6d8bf94029966ad6aac2e94b7ca3dba685e3584968fcfa4d48ca323fec5d38f94b4328be8bafe0785b4c79a7aa28456ee731b96a5302085219f571b81efab9da0389ce731be74f3c6c5036872551c5fa54070bce0b24b52dc8a7db53d902522bcc873a69237eb065f277c0a633120702efafbcd10dadd26ddee60b2161bb79e72911d985b054c8196c383fc53954d109afa36d8e871159daf125d92b73f24127db635928970f36a55afe68a8add719740be4f62b60023e4e27f66c4317035d72e9323a7b69c5e0036c18dd721135bdb92c0f602d6aaadadd5ab237daf9fb6a75742262390fa3a38e841f95c058135e6cc64f3755a8eb662ca03eefb34a9cdc93f93d84934af647d6d05c31819b7c76ad34057e3937f603060e3c336afa8a53fb8d51d8c39ec69ddbcf6fc8863a21397a6f4608b2087b2204a9f98deb77fc8bfe24fb993967132bfd8c96e00766ff11dc8e0960894cf75f104772b13a704ea8721a7a2441c1fd0f329e141fdbc3ed5568f2c64cf0102b501ef1363ed5940a283faddd7b2ea0ca4e5faab4f72f3e417043185d54aab7ad2ec1559405695bb45d1d39eb6f2d40606ea5baca65f5ed3c69068a51a7e653781290b2240ba98607fc10a7acddf962c1d7c16a78d70304506c71d813644c9f9545b7b38c9a10336c927f16292e7a20ccf5ff30bf6262610bf284abe6b1a9d957e74bc05ce53757b593a45ed29c6a88533a5efbb11c250cf057c149d1cb5dffb782b1d887cdcdeb411c9ea6a32e0f944cfe494c02a35abd4da3bdb30035d4c00faba2f29f5b407927239f9ecbbdc8d4c3b6b6dece2ba1ca920d082b30dceed459c3add2618e1e3b82bc7f678849891fb7cd0ad330bd2edd4bf52d5673c48d3ebc4b58fcd1530b39fce6a0ac1a85d79ff0a3ac6b6adde9fed97910706648ce30a91d68541b6d1629f71b73cde7d0709107e99b128b1b2bbb20afb12544b97a51f68e364d951d3ef73f67358ec4bbca6504dd040873ca3fbb8e09ebbf637deaa6342fb6a7769a39bf7d389682b29815a167afb2f0f351d4650476412284b7b68c79a6e62509ead655a333cee7050e49b810fd414a2904930f712a9f8954fdfc6cc7a2615568f43429696240f4834c3523dfbaefc9b6f9de02a9fa48ad06d099ba6e2a59fc84dd9d5527c218df153a4478639e30c1875fb453d794eaeed62166b43aef56f5cd81763da7250646afc426e41c30940a04e22a9ab22ff185e5c1818023bddc46069ab7b83147837f2f366253db981ac7c4578e2c737756e6b5cd8d52c1f44da6f85554e589d89d0c0a9fafe25ca6a9fe3423d3153bd4a97c2d711d67f118310dc4c68c796393ca2c49867b7861282d4a6c71e02c4da859fbdab5cbf5b622ce3a46485f49e4cdb6c93a911eb5f493d96b9fa5d87a2fc151f3d75d4fc2cf290446f55dac88c321af2c91b2f817fa1f61b08affd712beaabe1f8feb62c2caa0af6555d28a9a0b81d14c664d60be44880dd92d6bf88596db3b5358d0ecca69976e7b64c72c4b94291171dc80f065af6d5a195ee73ea948ab6dfe91bf139c5faf5f8ca7bfb76ae77cf2bc8a40aab9ee99ea0711f38e6694696ed7110dc4de67cd081bd7d1ce6bb750d594b4f556ce7f6d0adfea6157055beefa84b503f772fe7e8ab92205d1b650121522a47ea2500978d31bd19920e7f29103cee8f87408a509790b8d535f55d1bb3b31c6b791d434fbeb61caf2a4d86f91e93df0d7c437c3b924fe9e78abdc13ed557481b155bc99628d3818304738c3f53d1d1109c2c8d25de8f5d9b5ced095a28e38c448ef57ac6a3c90622018cd387447f4e60c03eea5306cf6cec9f7177af43883db5951669fcfa92230948e18a4f64035ca51f494edfb308373662a76bd2c5eedeb6e71547a1b8762cc382d31c1d64b9629920c6a0c95936403343ce2dd1693720ddb772399a0fa88913ace2894870547ba87ad715c50ee52fc461df8c9d45ef2244631a4995697bf14b5d37766fffedb654dafc4f9d86a8ebc87b77ec874ce10befa7c5b112e3f1219d759a84a3a01eb430b33dc3f5f6da09d48d7c80cf8d7b2930fdd903839137dedb7ee1185c34021f34737b4921042f2fc81aad61ff2101873532aa0cfde80e8562ca51e5469d40a420e0416b1e608868e6d15d010610248bdc0eb1e6e7c5c1d18acca0aa43f1ebca9e1afe16fde770057ee9a7c6103a0917a62846516d27bd967aff544c0d4ef1338a64f07886d0af06b90de73e65bbf7bc6e806e928c767cf284ce159380e20364b3b30417d7f627cbf79c1f0527103dd4822aa078a6d461d64db47fb8d9b36225e6f9d42c449064f5b1cd4daaa65d36c951a45f1f969291cbef4cbb3d30427b6c211119a3b07d1fb86410168a07770da5c56b35e3254f1c875fb31ff29367260cfd196db0b70bbe7d2d14141253df68b2ceec522762a677f942baf6b327bd0e9c057ed455d4154eb4fbc22a5625a58f4164916b6219cef2c54548706c41a77c51c6ac5291e5a98a3ee27e3f531698b7989e45e0d8f8401da20af540762132fea4131c89128e887e97078029cc5e070e4733ab6e3dc5b3f42f2fbc70a0d4b4091683f9a471e3bd01a51138b0832154970c58d63e86a16a62220b2c9a1682478d08589b0d94611bd4085f71d77fcc747e47e3a93ddacb90fc49dd847fa649a65eaea4c104f37f66414e65bf3c1efc51f117bb0d53c116d6c37e4e93579d1eb9a9ebd89af32ed2aec9d82e96b89e032f2132534658cb6c26a9e34b372c23fec0d9a6d69c1c0f4c5b8f5fdb2dd0e16bda8803b47f5307c05f94c21a1f9d5c82a84b013d95f2172657c64c5b2237840906df530f1fb869bf50169a1233388a46136be42c60d0f8f8c2bacb30bd34f7a932a35bf98c6d7575e6db17a47d02d303254cf84bcc19e6dfc259f22f77760003ac6c3fa1fc201ca3c6674a05e8a88600501642cabef48f41e4e3cc49cd1e6fd1d64b4e492e06a269f242646f731e07207208b7fc9a414cf729c358f3583d9026b6c359171a81f55a22ed6ed5001c1b61a83f0c62d1b03bb24b966b33854a9fd052be04d6eb12722b3d0ccc3dca0b395ded957b8cbb75eaa1b5ed7c8c35c1bd491666187c472d7fa54f915ea6443a39700683d4f5676e20b183f2918f6a3c53343ca56bc17704b2e3be21dd144ad6aaa4cdf07efd989b97983545469f67ba43a9c9619cb58cb598a9c813a589165", 0x1000}, 0x1006) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = dup2(0xffffffffffffffff, r1) syz_mount_image$f2fs(&(0x7f0000000100)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x7f, 0x9, &(0x7f0000001880)=[{&(0x7f0000001300)="f4fa075674d14813454082bc88f56b26be80bd49de37c8d57cbacad163a9dbd124871ae76420431f27b631c204ece2b8fa17ad436210e5e34aa2904ba3960074e3811faabbfec5be43124e2aec6349fd80a970ddd73399d14dbce4e43de5ed3255ad675902d008dc8b9e4eefecc6a127fff72b7d11f85efb66ac627a4361f43e96931fe7b6cf62f2cd22df4fe5d2c9de4f9ee51bb32274513e7e8a9165c53f4d62eceb389db8e8b7947f0d07db3f6adfe5e778e233229c1adddd015ff0085f992db4a2cc67a8429250c979c4069c30c95e5bb7c5169b27e6ba393e9e6f4d8fd53a54a37a8bb88376390423c31a", 0xed, 0x9}, {&(0x7f0000001400)="6bcd42f9f80b253b1d65cbc10eafa9fdd6b619051c76525485f321ba2e6d3042fc87f0d6416067e17c91501fefd7d1591c6b509c4439426cee4aa33a49c65478166dff154488c8d9644ba84e19763cdebb52f19d118ffead639a1d2a2ba9a31ae581135d", 0x64, 0x5d1}, {&(0x7f0000001480)="cc0565317c4530be7070b45b453e20b4f54fcc2a5bcc0c6f512bfdd8774ccca28b2ca21ac60517ac382a483461407e58f27a250051dc6f86191419112f57d9ea6ace688a3082951186ceb40d6b6830ac83f35d9357f35b168e81cf0ec8915aedcfac1494e5ef46568191155509ee0d8a797a2353f4895c135f14a619789b7b0a2116266f23c1b785bd83fc9ab944def537c1191552860c7d8c23686667", 0x9d, 0x7}, {&(0x7f0000001540)="da4ed95b3821231bdfe2980e8c646cc16d21e455e739489701f09e6e99365d09cbb601732b96c95d5d20ccecb609a22a2575f5ec1e7f92d3d2e5c70c8179cc95044dfb6c06cc336a65394bbe89ad8b3203fab573f1b237e4b861200b1e26b1f98eb6ca26a373f27ae213c343541e894f4369441bac793b421705210f443b1037314a9fec342582ee01c55a05c6ba386f042babe9624ec875ecca61b562d91124e1fe169ab298673e057479545a93daac40bdc953e2cd6ab2f2f3599a8659ea4d5f63", 0xc2, 0x4}, {&(0x7f0000001640)="bcd56ab859e4fa29268c44ebac02e40c59b7fd2ca31e9962d923567c29353f638bec417acba80632da929712f50448146260f99140e122f9b7ce3b3da1fc992b43a6d1912b7926adf6fdeaf4391523830ce742323c40063928166477a5b1b30c9d9e2067ccf5ee222067dee72e64d467cd", 0x71, 0x1}, {&(0x7f00000016c0)="1db5ddf86c2622a356ed180f3688eddd38634746f3782c0750cf30fb596d33aa61e81cffd2ea4406bcd8da1b4f784e68ae807e8c0b870a546f0b3333b21b2578a6ba94068955eee5298cbb3f6ad698b426a43160e375fcfee73aa913747b0298f3c2f6c8bd7961fc2c100af58d5f05f3f6a6f45c490a70f28696220a16215ff90c2886ee88c45281c6f730130d90d62614a82c70d02013b2b4e908a10d44868715ef2ba4f023d74b186d9a36", 0xac, 0x1}, {&(0x7f0000001780)="b693dd963d4e5093e3c62be49a1191635d27a899c3b8557fca90a514333fb551aa2a52cb23cba8f4d400bf61d78eba92e5444175ca2b798dfaf4ccacb7645a2db27277d7b957cc8439192b88e31b5d45e11e63a5b1616e211189a5d8e824c26f3bea75f84a8a0abda05ea1e453b0b8863ca27f159c48e633683e87bdd9f41883cd71e70c32db08ac7648b485d658346482f2b7a25067b28fd820eabcbe4f9d1baf802408e7c2b70f53c7c1e3a32eb9739f9d66af", 0xb4, 0xfff}, {&(0x7f0000000180)="06359bee786aba70b045b58d311513b310ff81ad701bffbcfdead59959655f35ab", 0x21, 0xfffffffffffffffd}, {&(0x7f0000001840)="ff", 0x1, 0x4}], 0x180009, &(0x7f0000001980)={[{@data_flush='data_flush'}, {@noinline_xattr='noinline_xattr'}, {@noinline_xattr='noinline_xattr'}, {@fsync_mode_strict='fsync_mode=strict'}]}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f00000019c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000001a40)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000001b80)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001c80)={0x70, 0x0, &(0x7f0000001bc0)=[@free_buffer={0x40086303, r5}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x68, 0x0, &(0x7f0000001ac0)=[@ptr={0x70742a85, 0x0, &(0x7f0000001a00), 0x1, 0x1, 0xc}, @flat={0x0, 0x1, r6, 0x4}, @ptr={0x70742a85, 0x1, &(0x7f0000001a80), 0x1, 0x4, 0x1e}], &(0x7f0000001b40)}, 0x3}}, @exit_looper, @increfs_done={0x40106308, r7, 0x4}], 0x2e, 0x0, &(0x7f0000001c40)="e8451799bf3e79a6cddd15a973f8789b4369211c76b8355d3f7947f569db057b141ca746ab3eafcf1e8a4fafc1db"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000200)=[@increfs], 0x65, 0x0, &(0x7f0000000240)="c31a92e0b7b4ef8df9e8005ad411a706c82381730ee55757fa5986150e0bbad9f6029170f8010d4c0391a5614fc57e2fa5558d7be58b70a13ff981cfee87a16e4c3965ac1d6c8a29cd4b95cf2fcb013aa62f0249c7c151ff41b7eb5871982b5adac4cb2367"}) [ 497.209809] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10320 comm=syz-executor4 [ 497.249746] binder: 10323:10327 tried to acquire reference to desc 0, got 1 instead [ 497.424721] binder: 10333:10336 BC_FREE_BUFFER u0000000000000000 no match [ 497.435453] binder: 10333:10336 got transaction to invalid handle [ 497.448865] binder: 10333:10336 transaction failed 29201/-22, size 104-0 line 3013 [ 497.465418] binder: BINDER_SET_CONTEXT_MGR already set [ 497.473090] binder: 10333:10336 ioctl 40046207 0 returned -16 [ 497.495616] binder: 10333:10342 BC_FREE_BUFFER u0000000000000000 no match [ 497.503677] binder: 10333:10342 got transaction to invalid handle [ 497.510696] binder: 10333:10342 transaction failed 29201/-22, size 104-0 line 3013 [ 497.520532] binder: undelivered TRANSACTION_ERROR: 29201 [ 497.528736] binder: undelivered TRANSACTION_ERROR: 29201 03:33:31 executing program 5: r0 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) fremovexattr(r0, &(0x7f00000000c0)=@known='trusted.syz\x00') r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001b40)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$VT_WAITACTIVE(r2, 0x5607) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x20000, 0x0) write$UHID_INPUT(r3, &(0x7f00000002c0)={0x8, "02075e093c01cb5c7bb4d10868f349053d6a3ab1e6274f6db8fb2178c2390653248b6fed5160a212fb3c0da32c13ff360a924b9fe45ad758c4437e3932cfdb19cdfd438366b8dc464dcc51ddcce2a4e8c4878d75b74edd81c7d193342f4009a25491f307e4a5fdfaa877a825434720ad472995017321af361a7e5f196e525c322ced20062e2d4423978ddafe91c6ebbf181eb9d296a5d2bb8a78db5e9d1b357f6212754234d6dbdeb5b288aec7ab65c240e2f655e90b377e0c37eae9cfd92dc1c88cc2f492e336b4c2ba6a6169444d554da5af45d617413759a7159959b018a028ed7ca956c1a7ea56ccba3aca3b12fade92640643a64ed6dcd4f41335e97878bd5417af1b6680912cab6d3d3fd81348900f9094e07ac7bb9e0597ea266f317ff3dceff66926a62278ed2863676061776a689e5c319e1b37b4816729c3ee21b7820c5cb5729e381ffb6a05ce73aa5c0a75085a65e2a23de476e201b45ed19639d8a670ab1d1def03fe4a564f4156d35a9f4d5fe5437af1cd4ad07b86ed4a6c71cac0bdf5c365e8d64d578577e5e233b0e16a2687de1d318d5977e9003f1fb10dbbe598468224f0b7cfb259d2a41106713765e47638df9af57195693d9d54a44dc29ab708fdefd35a007f46cf4127d38747de9bddaf6bda384633b36c6eb541defbaff474c305bd97c5d48ca109fbf01121f8db034bc50ee15002ea27c5f3085d90adc230077d580fc7269bb665352a306416c6afda7641445c4f12205ec145a07c76472e3b18a769237a4762e9768b5b26fcc90be70c0a6757796570ed20a8cc357e71e9de52ca113a8a7ea875b8c225f878cf3da20915e08c803abbf7f5cf5e12d4119667adffb99947ea6aa8a7d6d4a3125757d36d8aa8ff20c3198848aaf8e50f3bb046e68dec0a5774a899ec8076041560a24f9abdad19cb91b746c0fc01ad24ee8c3fbb647e59aa54b5e2e3077694495b50955fa5b78863e68912adb45a022a6dc91b35da436d19bbac85be02ec76579c2b29ad25eed95f99b4229d59ff7468e5c90bf48f72c62031453359755afcb4818b1a95c1470fa13329bc3f7b5224973a10da26a4c394d8b0b1d22ab549408603ab3b3ffb6547b20f6b8f92f6f3bc270a5893112a03ffc7b07b64ab1693462bbb1d457d5000113913a1120116b448a2a520cc8ff7603312b42facff1b875f9985b58f2d28a6e52f9db491ed30807a0f27eba3239a418bf9be7a930a3e5f6ea369f2112e689dbe313211d9d927c9b09309c07e798f029627842a79e9bf1461846b6d4f621d426d72803797bba4038361cbd34087b9b8171f9a0462a2cb7109088ad02f7da0da615b5fb386791de01c05f5796d8563a402dfb228dfe60754a86210b1440d032413e89fa8f7f130ccad344c5f90118373465ed67e97554d3a6a9aefc4e73c81e8eaaf207064e566313f95fb03af0a4d91f96873d73bc3b0b2b8080d72f0751b1659fd164e06777878e3f88f009b0e9afbe48d815093621a3ed25804bac36e4a7036b2331f31a68a12423ba07f23021415d59dda1d9c021338ac24a6f1e6da7147621d397922b45dab3521ca8d32e73df0cc80e503eabc1e959640bf0261e467f7919d1a1d3bd8aabbd6b6d1a40bb8988c1706931b8865354dc67a9ef0cd89e0e67cfb98714a22b6f493d36d4abf1a7357ccec1af5f05ae19c7c529e6edc5667453952da91fa3101dd461b9ff17d2e3639224cc6075a5c4dc0f2745dc8e6f82e62c4c6f93a7089dfed63e4135797d1fa0d7b87913995786834e20dd69bfa4ebf9c3ed7151d3f9357fb5f58272f7f4bbbdb933f6403546c5bfb7a9ae5906355c2d6f4dff28684ef1db3dd25d229a7cab8892f14aa9b0c0963efd08024b8aec1fd735b7e42a3edec628fa6b7210fae52e1109168f76779a70086c6c4c6ba15e44923b708c7965c175537d0e73481178b9e052013cf0ba4d8fd9e3238cd05cc2e4d84a2dbec7496e1afdbbca09953138ce867be41197fc8526cf0e692d417215bb9a9c52ba7a51d9f197ef06c9a6b80c4ea14f9312b447165a9158e1888fd78e8c058866aa1ace321da5baba33e42917797f33ff7cc6d9b38917081af0db020e6ccf56a555da0e18126fe54fb35db4275fac48949f07223309e4071cf5162b9b5136880fcbf28f4397ceb95ade01723b406d7bbd9db78c00b056003e92956ad1f261c36f2f2eb7c714c770070135315c6f9c4b6a607d16d8c43c615edd71637abeecb71cfbda18d3cd610231ddfb4ca313443d132fcd9f93b27cc2a957b084c2f3bcbbfb2d95c4cdfd83f1cc2c876c56375438c2ae003590dc90d40de5a24f633a1f8023661d5821c51e196c139681366293212242c7fd6b01f8133c15b5cc15dfd1f1af2614a255264af2b8711f71936718f47a04843a831d7c6a2975d8046f10b4c3232aa4ef8ce10de3658a5bae5b5d88dd96b6d8b6902b6709c6aa59f27f86e28915a14084646f3672752531969b873e3fbfd71e50516cfec78f2ec0265235c77c021ba3a94da253113df1a107c2c0ce0549bf2af82d5d5f83e341bbd6d8bf94029966ad6aac2e94b7ca3dba685e3584968fcfa4d48ca323fec5d38f94b4328be8bafe0785b4c79a7aa28456ee731b96a5302085219f571b81efab9da0389ce731be74f3c6c5036872551c5fa54070bce0b24b52dc8a7db53d902522bcc873a69237eb065f277c0a633120702efafbcd10dadd26ddee60b2161bb79e72911d985b054c8196c383fc53954d109afa36d8e871159daf125d92b73f24127db635928970f36a55afe68a8add719740be4f62b60023e4e27f66c4317035d72e9323a7b69c5e0036c18dd721135bdb92c0f602d6aaadadd5ab237daf9fb6a75742262390fa3a38e841f95c058135e6cc64f3755a8eb662ca03eefb34a9cdc93f93d84934af647d6d05c31819b7c76ad34057e3937f603060e3c336afa8a53fb8d51d8c39ec69ddbcf6fc8863a21397a6f4608b2087b2204a9f98deb77fc8bfe24fb993967132bfd8c96e00766ff11dc8e0960894cf75f104772b13a704ea8721a7a2441c1fd0f329e141fdbc3ed5568f2c64cf0102b501ef1363ed5940a283faddd7b2ea0ca4e5faab4f72f3e417043185d54aab7ad2ec1559405695bb45d1d39eb6f2d40606ea5baca65f5ed3c69068a51a7e653781290b2240ba98607fc10a7acddf962c1d7c16a78d70304506c71d813644c9f9545b7b38c9a10336c927f16292e7a20ccf5ff30bf6262610bf284abe6b1a9d957e74bc05ce53757b593a45ed29c6a88533a5efbb11c250cf057c149d1cb5dffb782b1d887cdcdeb411c9ea6a32e0f944cfe494c02a35abd4da3bdb30035d4c00faba2f29f5b407927239f9ecbbdc8d4c3b6b6dece2ba1ca920d082b30dceed459c3add2618e1e3b82bc7f678849891fb7cd0ad330bd2edd4bf52d5673c48d3ebc4b58fcd1530b39fce6a0ac1a85d79ff0a3ac6b6adde9fed97910706648ce30a91d68541b6d1629f71b73cde7d0709107e99b128b1b2bbb20afb12544b97a51f68e364d951d3ef73f67358ec4bbca6504dd040873ca3fbb8e09ebbf637deaa6342fb6a7769a39bf7d389682b29815a167afb2f0f351d4650476412284b7b68c79a6e62509ead655a333cee7050e49b810fd414a2904930f712a9f8954fdfc6cc7a2615568f43429696240f4834c3523dfbaefc9b6f9de02a9fa48ad06d099ba6e2a59fc84dd9d5527c218df153a4478639e30c1875fb453d794eaeed62166b43aef56f5cd81763da7250646afc426e41c30940a04e22a9ab22ff185e5c1818023bddc46069ab7b83147837f2f366253db981ac7c4578e2c737756e6b5cd8d52c1f44da6f85554e589d89d0c0a9fafe25ca6a9fe3423d3153bd4a97c2d711d67f118310dc4c68c796393ca2c49867b7861282d4a6c71e02c4da859fbdab5cbf5b622ce3a46485f49e4cdb6c93a911eb5f493d96b9fa5d87a2fc151f3d75d4fc2cf290446f55dac88c321af2c91b2f817fa1f61b08affd712beaabe1f8feb62c2caa0af6555d28a9a0b81d14c664d60be44880dd92d6bf88596db3b5358d0ecca69976e7b64c72c4b94291171dc80f065af6d5a195ee73ea948ab6dfe91bf139c5faf5f8ca7bfb76ae77cf2bc8a40aab9ee99ea0711f38e6694696ed7110dc4de67cd081bd7d1ce6bb750d594b4f556ce7f6d0adfea6157055beefa84b503f772fe7e8ab92205d1b650121522a47ea2500978d31bd19920e7f29103cee8f87408a509790b8d535f55d1bb3b31c6b791d434fbeb61caf2a4d86f91e93df0d7c437c3b924fe9e78abdc13ed557481b155bc99628d3818304738c3f53d1d1109c2c8d25de8f5d9b5ced095a28e38c448ef57ac6a3c90622018cd387447f4e60c03eea5306cf6cec9f7177af43883db5951669fcfa92230948e18a4f64035ca51f494edfb308373662a76bd2c5eedeb6e71547a1b8762cc382d31c1d64b9629920c6a0c95936403343ce2dd1693720ddb772399a0fa88913ace2894870547ba87ad715c50ee52fc461df8c9d45ef2244631a4995697bf14b5d37766fffedb654dafc4f9d86a8ebc87b77ec874ce10befa7c5b112e3f1219d759a84a3a01eb430b33dc3f5f6da09d48d7c80cf8d7b2930fdd903839137dedb7ee1185c34021f34737b4921042f2fc81aad61ff2101873532aa0cfde80e8562ca51e5469d40a420e0416b1e608868e6d15d010610248bdc0eb1e6e7c5c1d18acca0aa43f1ebca9e1afe16fde770057ee9a7c6103a0917a62846516d27bd967aff544c0d4ef1338a64f07886d0af06b90de73e65bbf7bc6e806e928c767cf284ce159380e20364b3b30417d7f627cbf79c1f0527103dd4822aa078a6d461d64db47fb8d9b36225e6f9d42c449064f5b1cd4daaa65d36c951a45f1f969291cbef4cbb3d30427b6c211119a3b07d1fb86410168a07770da5c56b35e3254f1c875fb31ff29367260cfd196db0b70bbe7d2d14141253df68b2ceec522762a677f942baf6b327bd0e9c057ed455d4154eb4fbc22a5625a58f4164916b6219cef2c54548706c41a77c51c6ac5291e5a98a3ee27e3f531698b7989e45e0d8f8401da20af540762132fea4131c89128e887e97078029cc5e070e4733ab6e3dc5b3f42f2fbc70a0d4b4091683f9a471e3bd01a51138b0832154970c58d63e86a16a62220b2c9a1682478d08589b0d94611bd4085f71d77fcc747e47e3a93ddacb90fc49dd847fa649a65eaea4c104f37f66414e65bf3c1efc51f117bb0d53c116d6c37e4e93579d1eb9a9ebd89af32ed2aec9d82e96b89e032f2132534658cb6c26a9e34b372c23fec0d9a6d69c1c0f4c5b8f5fdb2dd0e16bda8803b47f5307c05f94c21a1f9d5c82a84b013d95f2172657c64c5b2237840906df530f1fb869bf50169a1233388a46136be42c60d0f8f8c2bacb30bd34f7a932a35bf98c6d7575e6db17a47d02d303254cf84bcc19e6dfc259f22f77760003ac6c3fa1fc201ca3c6674a05e8a88600501642cabef48f41e4e3cc49cd1e6fd1d64b4e492e06a269f242646f731e07207208b7fc9a414cf729c358f3583d9026b6c359171a81f55a22ed6ed5001c1b61a83f0c62d1b03bb24b966b33854a9fd052be04d6eb12722b3d0ccc3dca0b395ded957b8cbb75eaa1b5ed7c8c35c1bd491666187c472d7fa54f915ea6443a39700683d4f5676e20b183f2918f6a3c53343ca56bc17704b2e3be21dd144ad6aaa4cdf07efd989b97983545469f67ba43a9c9619cb58cb598a9c813a589165", 0x1000}, 0x1006) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = dup2(0xffffffffffffffff, r1) syz_mount_image$f2fs(&(0x7f0000000100)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x7f, 0x9, &(0x7f0000001880)=[{&(0x7f0000001300)="f4fa075674d14813454082bc88f56b26be80bd49de37c8d57cbacad163a9dbd124871ae76420431f27b631c204ece2b8fa17ad436210e5e34aa2904ba3960074e3811faabbfec5be43124e2aec6349fd80a970ddd73399d14dbce4e43de5ed3255ad675902d008dc8b9e4eefecc6a127fff72b7d11f85efb66ac627a4361f43e96931fe7b6cf62f2cd22df4fe5d2c9de4f9ee51bb32274513e7e8a9165c53f4d62eceb389db8e8b7947f0d07db3f6adfe5e778e233229c1adddd015ff0085f992db4a2cc67a8429250c979c4069c30c95e5bb7c5169b27e6ba393e9e6f4d8fd53a54a37a8bb88376390423c31a", 0xed, 0x9}, {&(0x7f0000001400)="6bcd42f9f80b253b1d65cbc10eafa9fdd6b619051c76525485f321ba2e6d3042fc87f0d6416067e17c91501fefd7d1591c6b509c4439426cee4aa33a49c65478166dff154488c8d9644ba84e19763cdebb52f19d118ffead639a1d2a2ba9a31ae581135d", 0x64, 0x5d1}, {&(0x7f0000001480)="cc0565317c4530be7070b45b453e20b4f54fcc2a5bcc0c6f512bfdd8774ccca28b2ca21ac60517ac382a483461407e58f27a250051dc6f86191419112f57d9ea6ace688a3082951186ceb40d6b6830ac83f35d9357f35b168e81cf0ec8915aedcfac1494e5ef46568191155509ee0d8a797a2353f4895c135f14a619789b7b0a2116266f23c1b785bd83fc9ab944def537c1191552860c7d8c23686667", 0x9d, 0x7}, {&(0x7f0000001540)="da4ed95b3821231bdfe2980e8c646cc16d21e455e739489701f09e6e99365d09cbb601732b96c95d5d20ccecb609a22a2575f5ec1e7f92d3d2e5c70c8179cc95044dfb6c06cc336a65394bbe89ad8b3203fab573f1b237e4b861200b1e26b1f98eb6ca26a373f27ae213c343541e894f4369441bac793b421705210f443b1037314a9fec342582ee01c55a05c6ba386f042babe9624ec875ecca61b562d91124e1fe169ab298673e057479545a93daac40bdc953e2cd6ab2f2f3599a8659ea4d5f63", 0xc2, 0x4}, {&(0x7f0000001640)="bcd56ab859e4fa29268c44ebac02e40c59b7fd2ca31e9962d923567c29353f638bec417acba80632da929712f50448146260f99140e122f9b7ce3b3da1fc992b43a6d1912b7926adf6fdeaf4391523830ce742323c40063928166477a5b1b30c9d9e2067ccf5ee222067dee72e64d467cd", 0x71, 0x1}, {&(0x7f00000016c0)="1db5ddf86c2622a356ed180f3688eddd38634746f3782c0750cf30fb596d33aa61e81cffd2ea4406bcd8da1b4f784e68ae807e8c0b870a546f0b3333b21b2578a6ba94068955eee5298cbb3f6ad698b426a43160e375fcfee73aa913747b0298f3c2f6c8bd7961fc2c100af58d5f05f3f6a6f45c490a70f28696220a16215ff90c2886ee88c45281c6f730130d90d62614a82c70d02013b2b4e908a10d44868715ef2ba4f023d74b186d9a36", 0xac, 0x1}, {&(0x7f0000001780)="b693dd963d4e5093e3c62be49a1191635d27a899c3b8557fca90a514333fb551aa2a52cb23cba8f4d400bf61d78eba92e5444175ca2b798dfaf4ccacb7645a2db27277d7b957cc8439192b88e31b5d45e11e63a5b1616e211189a5d8e824c26f3bea75f84a8a0abda05ea1e453b0b8863ca27f159c48e633683e87bdd9f41883cd71e70c32db08ac7648b485d658346482f2b7a25067b28fd820eabcbe4f9d1baf802408e7c2b70f53c7c1e3a32eb9739f9d66af", 0xb4, 0xfff}, {&(0x7f0000000180)="06359bee786aba70b045b58d311513b310ff81ad701bffbcfdead59959655f35ab", 0x21, 0xfffffffffffffffd}, {&(0x7f0000001840)="ff", 0x1, 0x4}], 0x180009, &(0x7f0000001980)={[{@data_flush='data_flush'}, {@noinline_xattr='noinline_xattr'}, {@noinline_xattr='noinline_xattr'}, {@fsync_mode_strict='fsync_mode=strict'}]}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f00000019c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000001a40)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000001b80)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001c80)={0x70, 0x0, &(0x7f0000001bc0)=[@free_buffer={0x40086303, r5}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x68, 0x0, &(0x7f0000001ac0)=[@ptr={0x70742a85, 0x0, &(0x7f0000001a00), 0x1, 0x1, 0xc}, @flat={0x0, 0x1, r6, 0x4}, @ptr={0x70742a85, 0x1, &(0x7f0000001a80), 0x1, 0x4, 0x1e}], &(0x7f0000001b40)}, 0x3}}, @exit_looper, @increfs_done={0x40106308, r7, 0x4}], 0x2e, 0x0, &(0x7f0000001c40)="e8451799bf3e79a6cddd15a973f8789b4369211c76b8355d3f7947f569db057b141ca746ab3eafcf1e8a4fafc1db"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000200)=[@increfs], 0x65, 0x0, &(0x7f0000000240)="c31a92e0b7b4ef8df9e8005ad411a706c82381730ee55757fa5986150e0bbad9f6029170f8010d4c0391a5614fc57e2fa5558d7be58b70a13ff981cfee87a16e4c3965ac1d6c8a29cd4b95cf2fcb013aa62f0249c7c151ff41b7eb5871982b5adac4cb2367"}) 03:33:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) signalfd4(r0, &(0x7f00000000c0)={0x400}, 0x8, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) write$P9_RWSTAT(r2, &(0x7f0000000040)={0x7, 0x7f, 0x2}, 0x7) 03:33:31 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="020a000007000000000000000000000005001a00ff010000000027a3b538072e410d080001e0000002000000000000000000000000000002"], 0x38}}, 0x0) sync_file_range(r0, 0x10001, 0x40, 0x4) 03:33:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000900)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:31 executing program 1: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x10000, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14) mkdir(&(0x7f0000000180)='./file1\x00', 0x0) fchmodat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) pwrite64(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) mprotect(&(0x7f00000c5000/0x3000)=nil, 0x3000, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x3, @dev, 0x2000000000003f}, 0x12) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x8000fffffffe) 03:33:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000000, 0x10, r0, 0x1d) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="147404400400ecff8308588d673c185d41d85caf9e2327e919f4145bb668841277d0235980b8cb6fd73d"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 497.657326] binder: 10351:10356 tried to acquire reference to desc 0, got 1 instead [ 497.666452] binder: BINDER_SET_CONTEXT_MGR already set [ 497.672025] binder: 10351:10356 ioctl 40046207 0 returned -16 [ 497.688014] binder: 10353:10361 unknown command 1074033684 [ 497.694029] binder: 10353:10361 ioctl c0306201 20000680 returned -22 03:33:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000002e40)='/dev/snapshot\x00', 0x10000, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x43, &(0x7f0000002e80)={'HL\x00'}, &(0x7f0000002ec0)=0x1e) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000002f80)=ANY=[@ANYBLOB="d1e02c71f1e0ebc7f4c89072441f66f746b62fe0cdf41161c4d9fc67b0c67ff2997fe520795217868dd72043458d60bfb7fec6b03386bbfd45af3d3a69a2b04f9262aac5938cfab3a6a5c0775b2db2ad4fc34248326c1f40d0a05f1dd0f18cc39cc0f866f9c5d13d59baa70ed27de5d946e7e5522f1a2c4b41658a14f2d1b5fc502ec06fa35f7a62cfa23aa8b2db9e2da0d3a39dafc5e4eceb2ad65686da7f1893d85d06f60fbbc11a4dcd0ffb9841b4f3e9b16c4e11f6bdf6bbf1fca7679e668b81b8dc7aa40630d3007ecfe1d3306ca23b4e6b62c2e313d431413215c55426e671ee07795c32ec676b140d95aba6223c4870ad321adac68134f9e7ab1cfb6e56ff6b7c2894b2b7f5e53db9923040edc7a19bfca7f93900000000000000c9814e0fe54f2d7e1da50ed7d7fde1c59746ea785eb4075598c6bed36f619d9d11e6a30a31a72d5dad07329d70d06dc863cb657a28f095bf8e3bb9e4835944f873092e701d9d329ee46e6eaca10d3f4668"], 0x0, 0x0, &(0x7f0000002000)}) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x4e2800, 0x0) recvmmsg(r3, &(0x7f0000002d40)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000180)=""/237, 0xed}, {&(0x7f0000000280)=""/200, 0xc8}, {&(0x7f0000000380)=""/172, 0xac}, {&(0x7f0000000440)=""/166, 0xa6}, {&(0x7f0000000040)=""/87, 0x57}, {&(0x7f0000000500)=""/16, 0x10}, {&(0x7f0000000540)=""/157, 0x9d}, {&(0x7f00000006c0)=""/212, 0xd4}], 0x8, &(0x7f00000007c0)=""/244, 0xf4, 0x7e52}, 0x1000}, {{&(0x7f0000000940)=@l2, 0x80, &(0x7f0000000b80)=[{&(0x7f00000009c0)=""/240, 0xf0}, {&(0x7f0000000ac0)=""/150, 0x96}, {&(0x7f00000008c0)=""/27, 0x1b}], 0x3, &(0x7f0000000bc0)=""/149, 0x95, 0x2}, 0x8}, {{&(0x7f0000000c80)=@nl=@proc, 0x80, &(0x7f0000001d00)=[{&(0x7f0000000d00)=""/4096, 0x1000}], 0x1, &(0x7f0000001d40)=""/4096, 0x1000, 0x10001}}], 0x3, 0x10000, &(0x7f0000002e00)) poll(&(0x7f00000000c0)=[{r1, 0x10}, {r1, 0x20}], 0x2, 0x8) ioctl$PIO_UNIMAPCLR(r3, 0x4b68, &(0x7f0000002f40)={0x0, 0x10000, 0x3}) r4 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="0463e68100000000"], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$RTC_RD_TIME(r2, 0x80247009, &(0x7f0000002f00)) 03:33:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x20000, 0x0) ioctl$SG_GET_COMMAND_Q(r0, 0x2270, &(0x7f0000000180)) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x1, 0x12, 0x1f, 0x1, "04aaef3b4c781328c2902cad092d559f18f10b349f2caef97015a0a35342456cde34985bb35b0737d22f655c7c22eeff9b75885da0ad0d91a18ba404132b8258", "34ad92042696f1e1fc261e265a873bf6d7953691fa118596afd431aa715caa9f", [0x5, 0x4]}) socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x1, 'ifb0\x00', 0x1}, 0x18) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000001c0)) 03:33:31 executing program 7: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x10000, 0x0) getsockname$packet(r0, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14) mkdir(&(0x7f0000000180)='./file1\x00', 0x0) fchmodat(0xffffffffffffffff, &(0x7f0000000040)='./file1\x00', 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) pwrite64(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fallocate(r1, 0x0, 0x0, 0x1000f4) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) mprotect(&(0x7f00000c5000/0x3000)=nil, 0x3000, 0x0) r2 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r2, 0x8200) r3 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x3, @dev, 0x2000000000003f}, 0x12) sendmmsg(r4, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000d83ff8), 0x8000fffffffe) [ 497.703001] binder: 10354:10362 got transaction to context manager from process owning it [ 497.711520] binder: 10354:10362 transaction failed 29201/-22, size 0-0 line 3004 [ 497.711940] binder: 10353:10366 unknown command 1074033684 [ 497.711948] binder: 10353:10366 ioctl c0306201 20000680 returned -22 [ 497.723222] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10363 comm=syz-executor4 [ 497.725239] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10363 comm=syz-executor4 03:33:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000900)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 497.764688] binder: undelivered TRANSACTION_ERROR: 29201 03:33:31 executing program 1: ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000040)) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setparam(0x0, &(0x7f0000000480)) write$P9_ROPEN(0xffffffffffffffff, &(0x7f0000000180)={0x18, 0x71, 0x1, {{0x0, 0x4}, 0x180}}, 0x18) socket$inet6(0xa, 0x0, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, &(0x7f00000001c0)="e6276cf85668dcd2be2768471dcd2af6f368d73bc89b0625cd73a532ed6515af76e7c6bb3feec3f75d16edce1345276cca6902ba89528a4647f49af6508e5e57da827a3cfa0b142ef223c3e7bfa3121e16ae4955a3e40440ed320f9c80b97fb85d6c345b44f04b55") write$binfmt_aout(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f00003b9fdc)={0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77d2}) ioctl$TCSETSW(0xffffffffffffffff, 0x5403, &(0x7f0000000140)={0x0, 0x0, 0x0, 0xaf2}) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x181a81, 0x0) [ 497.950092] binder: 10369:10374 tried to acquire reference to desc 0, got 1 instead [ 497.959199] binder: BINDER_SET_CONTEXT_MGR already set [ 497.964724] binder: 10369:10374 ioctl 40046207 0 returned -16 [ 497.964981] binder: BINDER_SET_CONTEXT_MGR already set [ 497.964991] binder: 10369:10376 ioctl 40046207 0 returned -16 [ 497.982711] binder: 10370:10378 unknown command 1898766545 [ 497.982720] binder: 10370:10378 ioctl c0306201 20007000 returned -22 [ 497.995223] binder: 10370:10378 unknown command -2115607804 [ 497.995232] binder: 10370:10378 ioctl c0306201 20000680 returned -22 [ 497.995948] binder: 10370:10378 unknown command 1898766545 [ 497.995956] binder: 10370:10378 ioctl c0306201 20007000 returned -22 [ 498.004590] binder: 10370:10378 unknown command -2115607804 [ 498.004600] binder: 10370:10378 ioctl c0306201 20000680 returned -22 03:33:31 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x6) ioctl(r0, 0x100008912, &(0x7f0000000100)="025cc80700145f8f764070") perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0x11}, 0x0, 0x0, 0xffffffffffffffff, 0x0) capset(&(0x7f0000000180)={0x19980330}, &(0x7f00009b3000)) fanotify_init(0x0, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x88000, 0x0) ioctl$VT_WAITACTIVE(r1, 0x5607) 03:33:31 executing program 5: r0 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) fremovexattr(r0, &(0x7f00000000c0)=@known='trusted.syz\x00') r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001b40)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$VT_WAITACTIVE(r2, 0x5607) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x20000, 0x0) write$UHID_INPUT(r3, &(0x7f00000002c0)={0x8, "02075e093c01cb5c7bb4d10868f349053d6a3ab1e6274f6db8fb2178c2390653248b6fed5160a212fb3c0da32c13ff360a924b9fe45ad758c4437e3932cfdb19cdfd438366b8dc464dcc51ddcce2a4e8c4878d75b74edd81c7d193342f4009a25491f307e4a5fdfaa877a825434720ad472995017321af361a7e5f196e525c322ced20062e2d4423978ddafe91c6ebbf181eb9d296a5d2bb8a78db5e9d1b357f6212754234d6dbdeb5b288aec7ab65c240e2f655e90b377e0c37eae9cfd92dc1c88cc2f492e336b4c2ba6a6169444d554da5af45d617413759a7159959b018a028ed7ca956c1a7ea56ccba3aca3b12fade92640643a64ed6dcd4f41335e97878bd5417af1b6680912cab6d3d3fd81348900f9094e07ac7bb9e0597ea266f317ff3dceff66926a62278ed2863676061776a689e5c319e1b37b4816729c3ee21b7820c5cb5729e381ffb6a05ce73aa5c0a75085a65e2a23de476e201b45ed19639d8a670ab1d1def03fe4a564f4156d35a9f4d5fe5437af1cd4ad07b86ed4a6c71cac0bdf5c365e8d64d578577e5e233b0e16a2687de1d318d5977e9003f1fb10dbbe598468224f0b7cfb259d2a41106713765e47638df9af57195693d9d54a44dc29ab708fdefd35a007f46cf4127d38747de9bddaf6bda384633b36c6eb541defbaff474c305bd97c5d48ca109fbf01121f8db034bc50ee15002ea27c5f3085d90adc230077d580fc7269bb665352a306416c6afda7641445c4f12205ec145a07c76472e3b18a769237a4762e9768b5b26fcc90be70c0a6757796570ed20a8cc357e71e9de52ca113a8a7ea875b8c225f878cf3da20915e08c803abbf7f5cf5e12d4119667adffb99947ea6aa8a7d6d4a3125757d36d8aa8ff20c3198848aaf8e50f3bb046e68dec0a5774a899ec8076041560a24f9abdad19cb91b746c0fc01ad24ee8c3fbb647e59aa54b5e2e3077694495b50955fa5b78863e68912adb45a022a6dc91b35da436d19bbac85be02ec76579c2b29ad25eed95f99b4229d59ff7468e5c90bf48f72c62031453359755afcb4818b1a95c1470fa13329bc3f7b5224973a10da26a4c394d8b0b1d22ab549408603ab3b3ffb6547b20f6b8f92f6f3bc270a5893112a03ffc7b07b64ab1693462bbb1d457d5000113913a1120116b448a2a520cc8ff7603312b42facff1b875f9985b58f2d28a6e52f9db491ed30807a0f27eba3239a418bf9be7a930a3e5f6ea369f2112e689dbe313211d9d927c9b09309c07e798f029627842a79e9bf1461846b6d4f621d426d72803797bba4038361cbd34087b9b8171f9a0462a2cb7109088ad02f7da0da615b5fb386791de01c05f5796d8563a402dfb228dfe60754a86210b1440d032413e89fa8f7f130ccad344c5f90118373465ed67e97554d3a6a9aefc4e73c81e8eaaf207064e566313f95fb03af0a4d91f96873d73bc3b0b2b8080d72f0751b1659fd164e06777878e3f88f009b0e9afbe48d815093621a3ed25804bac36e4a7036b2331f31a68a12423ba07f23021415d59dda1d9c021338ac24a6f1e6da7147621d397922b45dab3521ca8d32e73df0cc80e503eabc1e959640bf0261e467f7919d1a1d3bd8aabbd6b6d1a40bb8988c1706931b8865354dc67a9ef0cd89e0e67cfb98714a22b6f493d36d4abf1a7357ccec1af5f05ae19c7c529e6edc5667453952da91fa3101dd461b9ff17d2e3639224cc6075a5c4dc0f2745dc8e6f82e62c4c6f93a7089dfed63e4135797d1fa0d7b87913995786834e20dd69bfa4ebf9c3ed7151d3f9357fb5f58272f7f4bbbdb933f6403546c5bfb7a9ae5906355c2d6f4dff28684ef1db3dd25d229a7cab8892f14aa9b0c0963efd08024b8aec1fd735b7e42a3edec628fa6b7210fae52e1109168f76779a70086c6c4c6ba15e44923b708c7965c175537d0e73481178b9e052013cf0ba4d8fd9e3238cd05cc2e4d84a2dbec7496e1afdbbca09953138ce867be41197fc8526cf0e692d417215bb9a9c52ba7a51d9f197ef06c9a6b80c4ea14f9312b447165a9158e1888fd78e8c058866aa1ace321da5baba33e42917797f33ff7cc6d9b38917081af0db020e6ccf56a555da0e18126fe54fb35db4275fac48949f07223309e4071cf5162b9b5136880fcbf28f4397ceb95ade01723b406d7bbd9db78c00b056003e92956ad1f261c36f2f2eb7c714c770070135315c6f9c4b6a607d16d8c43c615edd71637abeecb71cfbda18d3cd610231ddfb4ca313443d132fcd9f93b27cc2a957b084c2f3bcbbfb2d95c4cdfd83f1cc2c876c56375438c2ae003590dc90d40de5a24f633a1f8023661d5821c51e196c139681366293212242c7fd6b01f8133c15b5cc15dfd1f1af2614a255264af2b8711f71936718f47a04843a831d7c6a2975d8046f10b4c3232aa4ef8ce10de3658a5bae5b5d88dd96b6d8b6902b6709c6aa59f27f86e28915a14084646f3672752531969b873e3fbfd71e50516cfec78f2ec0265235c77c021ba3a94da253113df1a107c2c0ce0549bf2af82d5d5f83e341bbd6d8bf94029966ad6aac2e94b7ca3dba685e3584968fcfa4d48ca323fec5d38f94b4328be8bafe0785b4c79a7aa28456ee731b96a5302085219f571b81efab9da0389ce731be74f3c6c5036872551c5fa54070bce0b24b52dc8a7db53d902522bcc873a69237eb065f277c0a633120702efafbcd10dadd26ddee60b2161bb79e72911d985b054c8196c383fc53954d109afa36d8e871159daf125d92b73f24127db635928970f36a55afe68a8add719740be4f62b60023e4e27f66c4317035d72e9323a7b69c5e0036c18dd721135bdb92c0f602d6aaadadd5ab237daf9fb6a75742262390fa3a38e841f95c058135e6cc64f3755a8eb662ca03eefb34a9cdc93f93d84934af647d6d05c31819b7c76ad34057e3937f603060e3c336afa8a53fb8d51d8c39ec69ddbcf6fc8863a21397a6f4608b2087b2204a9f98deb77fc8bfe24fb993967132bfd8c96e00766ff11dc8e0960894cf75f104772b13a704ea8721a7a2441c1fd0f329e141fdbc3ed5568f2c64cf0102b501ef1363ed5940a283faddd7b2ea0ca4e5faab4f72f3e417043185d54aab7ad2ec1559405695bb45d1d39eb6f2d40606ea5baca65f5ed3c69068a51a7e653781290b2240ba98607fc10a7acddf962c1d7c16a78d70304506c71d813644c9f9545b7b38c9a10336c927f16292e7a20ccf5ff30bf6262610bf284abe6b1a9d957e74bc05ce53757b593a45ed29c6a88533a5efbb11c250cf057c149d1cb5dffb782b1d887cdcdeb411c9ea6a32e0f944cfe494c02a35abd4da3bdb30035d4c00faba2f29f5b407927239f9ecbbdc8d4c3b6b6dece2ba1ca920d082b30dceed459c3add2618e1e3b82bc7f678849891fb7cd0ad330bd2edd4bf52d5673c48d3ebc4b58fcd1530b39fce6a0ac1a85d79ff0a3ac6b6adde9fed97910706648ce30a91d68541b6d1629f71b73cde7d0709107e99b128b1b2bbb20afb12544b97a51f68e364d951d3ef73f67358ec4bbca6504dd040873ca3fbb8e09ebbf637deaa6342fb6a7769a39bf7d389682b29815a167afb2f0f351d4650476412284b7b68c79a6e62509ead655a333cee7050e49b810fd414a2904930f712a9f8954fdfc6cc7a2615568f43429696240f4834c3523dfbaefc9b6f9de02a9fa48ad06d099ba6e2a59fc84dd9d5527c218df153a4478639e30c1875fb453d794eaeed62166b43aef56f5cd81763da7250646afc426e41c30940a04e22a9ab22ff185e5c1818023bddc46069ab7b83147837f2f366253db981ac7c4578e2c737756e6b5cd8d52c1f44da6f85554e589d89d0c0a9fafe25ca6a9fe3423d3153bd4a97c2d711d67f118310dc4c68c796393ca2c49867b7861282d4a6c71e02c4da859fbdab5cbf5b622ce3a46485f49e4cdb6c93a911eb5f493d96b9fa5d87a2fc151f3d75d4fc2cf290446f55dac88c321af2c91b2f817fa1f61b08affd712beaabe1f8feb62c2caa0af6555d28a9a0b81d14c664d60be44880dd92d6bf88596db3b5358d0ecca69976e7b64c72c4b94291171dc80f065af6d5a195ee73ea948ab6dfe91bf139c5faf5f8ca7bfb76ae77cf2bc8a40aab9ee99ea0711f38e6694696ed7110dc4de67cd081bd7d1ce6bb750d594b4f556ce7f6d0adfea6157055beefa84b503f772fe7e8ab92205d1b650121522a47ea2500978d31bd19920e7f29103cee8f87408a509790b8d535f55d1bb3b31c6b791d434fbeb61caf2a4d86f91e93df0d7c437c3b924fe9e78abdc13ed557481b155bc99628d3818304738c3f53d1d1109c2c8d25de8f5d9b5ced095a28e38c448ef57ac6a3c90622018cd387447f4e60c03eea5306cf6cec9f7177af43883db5951669fcfa92230948e18a4f64035ca51f494edfb308373662a76bd2c5eedeb6e71547a1b8762cc382d31c1d64b9629920c6a0c95936403343ce2dd1693720ddb772399a0fa88913ace2894870547ba87ad715c50ee52fc461df8c9d45ef2244631a4995697bf14b5d37766fffedb654dafc4f9d86a8ebc87b77ec874ce10befa7c5b112e3f1219d759a84a3a01eb430b33dc3f5f6da09d48d7c80cf8d7b2930fdd903839137dedb7ee1185c34021f34737b4921042f2fc81aad61ff2101873532aa0cfde80e8562ca51e5469d40a420e0416b1e608868e6d15d010610248bdc0eb1e6e7c5c1d18acca0aa43f1ebca9e1afe16fde770057ee9a7c6103a0917a62846516d27bd967aff544c0d4ef1338a64f07886d0af06b90de73e65bbf7bc6e806e928c767cf284ce159380e20364b3b30417d7f627cbf79c1f0527103dd4822aa078a6d461d64db47fb8d9b36225e6f9d42c449064f5b1cd4daaa65d36c951a45f1f969291cbef4cbb3d30427b6c211119a3b07d1fb86410168a07770da5c56b35e3254f1c875fb31ff29367260cfd196db0b70bbe7d2d14141253df68b2ceec522762a677f942baf6b327bd0e9c057ed455d4154eb4fbc22a5625a58f4164916b6219cef2c54548706c41a77c51c6ac5291e5a98a3ee27e3f531698b7989e45e0d8f8401da20af540762132fea4131c89128e887e97078029cc5e070e4733ab6e3dc5b3f42f2fbc70a0d4b4091683f9a471e3bd01a51138b0832154970c58d63e86a16a62220b2c9a1682478d08589b0d94611bd4085f71d77fcc747e47e3a93ddacb90fc49dd847fa649a65eaea4c104f37f66414e65bf3c1efc51f117bb0d53c116d6c37e4e93579d1eb9a9ebd89af32ed2aec9d82e96b89e032f2132534658cb6c26a9e34b372c23fec0d9a6d69c1c0f4c5b8f5fdb2dd0e16bda8803b47f5307c05f94c21a1f9d5c82a84b013d95f2172657c64c5b2237840906df530f1fb869bf50169a1233388a46136be42c60d0f8f8c2bacb30bd34f7a932a35bf98c6d7575e6db17a47d02d303254cf84bcc19e6dfc259f22f77760003ac6c3fa1fc201ca3c6674a05e8a88600501642cabef48f41e4e3cc49cd1e6fd1d64b4e492e06a269f242646f731e07207208b7fc9a414cf729c358f3583d9026b6c359171a81f55a22ed6ed5001c1b61a83f0c62d1b03bb24b966b33854a9fd052be04d6eb12722b3d0ccc3dca0b395ded957b8cbb75eaa1b5ed7c8c35c1bd491666187c472d7fa54f915ea6443a39700683d4f5676e20b183f2918f6a3c53343ca56bc17704b2e3be21dd144ad6aaa4cdf07efd989b97983545469f67ba43a9c9619cb58cb598a9c813a589165", 0x1000}, 0x1006) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = dup2(0xffffffffffffffff, r1) syz_mount_image$f2fs(&(0x7f0000000100)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x7f, 0x9, &(0x7f0000001880)=[{&(0x7f0000001300)="f4fa075674d14813454082bc88f56b26be80bd49de37c8d57cbacad163a9dbd124871ae76420431f27b631c204ece2b8fa17ad436210e5e34aa2904ba3960074e3811faabbfec5be43124e2aec6349fd80a970ddd73399d14dbce4e43de5ed3255ad675902d008dc8b9e4eefecc6a127fff72b7d11f85efb66ac627a4361f43e96931fe7b6cf62f2cd22df4fe5d2c9de4f9ee51bb32274513e7e8a9165c53f4d62eceb389db8e8b7947f0d07db3f6adfe5e778e233229c1adddd015ff0085f992db4a2cc67a8429250c979c4069c30c95e5bb7c5169b27e6ba393e9e6f4d8fd53a54a37a8bb88376390423c31a", 0xed, 0x9}, {&(0x7f0000001400)="6bcd42f9f80b253b1d65cbc10eafa9fdd6b619051c76525485f321ba2e6d3042fc87f0d6416067e17c91501fefd7d1591c6b509c4439426cee4aa33a49c65478166dff154488c8d9644ba84e19763cdebb52f19d118ffead639a1d2a2ba9a31ae581135d", 0x64, 0x5d1}, {&(0x7f0000001480)="cc0565317c4530be7070b45b453e20b4f54fcc2a5bcc0c6f512bfdd8774ccca28b2ca21ac60517ac382a483461407e58f27a250051dc6f86191419112f57d9ea6ace688a3082951186ceb40d6b6830ac83f35d9357f35b168e81cf0ec8915aedcfac1494e5ef46568191155509ee0d8a797a2353f4895c135f14a619789b7b0a2116266f23c1b785bd83fc9ab944def537c1191552860c7d8c23686667", 0x9d, 0x7}, {&(0x7f0000001540)="da4ed95b3821231bdfe2980e8c646cc16d21e455e739489701f09e6e99365d09cbb601732b96c95d5d20ccecb609a22a2575f5ec1e7f92d3d2e5c70c8179cc95044dfb6c06cc336a65394bbe89ad8b3203fab573f1b237e4b861200b1e26b1f98eb6ca26a373f27ae213c343541e894f4369441bac793b421705210f443b1037314a9fec342582ee01c55a05c6ba386f042babe9624ec875ecca61b562d91124e1fe169ab298673e057479545a93daac40bdc953e2cd6ab2f2f3599a8659ea4d5f63", 0xc2, 0x4}, {&(0x7f0000001640)="bcd56ab859e4fa29268c44ebac02e40c59b7fd2ca31e9962d923567c29353f638bec417acba80632da929712f50448146260f99140e122f9b7ce3b3da1fc992b43a6d1912b7926adf6fdeaf4391523830ce742323c40063928166477a5b1b30c9d9e2067ccf5ee222067dee72e64d467cd", 0x71, 0x1}, {&(0x7f00000016c0)="1db5ddf86c2622a356ed180f3688eddd38634746f3782c0750cf30fb596d33aa61e81cffd2ea4406bcd8da1b4f784e68ae807e8c0b870a546f0b3333b21b2578a6ba94068955eee5298cbb3f6ad698b426a43160e375fcfee73aa913747b0298f3c2f6c8bd7961fc2c100af58d5f05f3f6a6f45c490a70f28696220a16215ff90c2886ee88c45281c6f730130d90d62614a82c70d02013b2b4e908a10d44868715ef2ba4f023d74b186d9a36", 0xac, 0x1}, {&(0x7f0000001780)="b693dd963d4e5093e3c62be49a1191635d27a899c3b8557fca90a514333fb551aa2a52cb23cba8f4d400bf61d78eba92e5444175ca2b798dfaf4ccacb7645a2db27277d7b957cc8439192b88e31b5d45e11e63a5b1616e211189a5d8e824c26f3bea75f84a8a0abda05ea1e453b0b8863ca27f159c48e633683e87bdd9f41883cd71e70c32db08ac7648b485d658346482f2b7a25067b28fd820eabcbe4f9d1baf802408e7c2b70f53c7c1e3a32eb9739f9d66af", 0xb4, 0xfff}, {&(0x7f0000000180)="06359bee786aba70b045b58d311513b310ff81ad701bffbcfdead59959655f35ab", 0x21, 0xfffffffffffffffd}, {&(0x7f0000001840)="ff", 0x1, 0x4}], 0x180009, &(0x7f0000001980)={[{@data_flush='data_flush'}, {@noinline_xattr='noinline_xattr'}, {@noinline_xattr='noinline_xattr'}, {@fsync_mode_strict='fsync_mode=strict'}]}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f00000019c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000001a40)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000001b80)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001c80)={0x70, 0x0, &(0x7f0000001bc0)=[@free_buffer={0x40086303, r5}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x68, 0x0, &(0x7f0000001ac0)=[@ptr={0x70742a85, 0x0, &(0x7f0000001a00), 0x1, 0x1, 0xc}, @flat={0x0, 0x1, r6, 0x4}, @ptr={0x70742a85, 0x1, &(0x7f0000001a80), 0x1, 0x4, 0x1e}], &(0x7f0000001b40)}, 0x3}}, @exit_looper, @increfs_done={0x40106308, r7, 0x4}], 0x2e, 0x0, &(0x7f0000001c40)="e8451799bf3e79a6cddd15a973f8789b4369211c76b8355d3f7947f569db057b141ca746ab3eafcf1e8a4fafc1db"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000200)=[@increfs], 0x65, 0x0, &(0x7f0000000240)="c31a92e0b7b4ef8df9e8005ad411a706c82381730ee55757fa5986150e0bbad9f6029170f8010d4c0391a5614fc57e2fa5558d7be58b70a13ff981cfee87a16e4c3965ac1d6c8a29cd4b95cf2fcb013aa62f0249c7c151ff41b7eb5871982b5adac4cb2367"}) 03:33:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0xffffffffffffff20, 0x0, &(0x7f0000000040)="f400a03ae1d14116db141b863f38922a86a724909380802fe58380988103b3b4344e1160a18907e6ded7e8cd4b9a8ca60e79e78b7a84ed09219ba0c85e661b2c0c49ebb861184b9c176e3f00000000000000f095315de1c06b3e4ac18be5a8df24d1c89bbfc35d5aac164a097da21f9800f6ca6fa6c2656fa3419d8952c2b0185ed34ead3cd585017070ebc6e498ff2e5979a7d9c67325909055b98f921fbe297cadc106369f02611b81a500000000000000000000000000"}) r2 = dup2(r1, r0) mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x4, 0x50, r1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="056304523213c1fb34fb11db74851e7edb9485499ce7e2d50d4a2efd2be824608892a381fa3aef68a9740068c2ebce33b64cb41609ba1379ac67f94dcf2ae92f5eba4ca11160c33f2d4da90716d805eef8080686ae83fe2dc7accb82a16b7a2ef546ec608f33c7f1a903beda18d91e62c21d8eb99698f8599b49f88eb9e94f434ad599a1f5642adb1bb29cd3c374d0e2c580e06d77162d2e0000b4e7c23f1b906311a969bbcd0d8417d4b609d7291640c55edfd645f279b6ec050992a3dcd70b9d82bb2d30a973570cc5e103efca201391393b6bbd99c311cedec5a246bd48e06fd684b85029413a605b083737b4d018a7734c7a667e31af7c5d7f3ba3201972e8ecaa"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) openat$cgroup_ro(r2, &(0x7f0000000080)='io.stat\x00', 0x0, 0x0) 03:33:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x4c, 0x0, &(0x7f0000000900)=[@transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 498.058000] binder: BINDER_SET_CONTEXT_MGR already set [ 498.063606] binder: 10379:10386 ioctl 40046207 0 returned -16 [ 498.073133] binder_alloc: 10379: binder_alloc_buf, no vma [ 498.078767] binder: 10379:10386 transaction failed 29189/-3, size 0-0 line 3136 [ 498.102367] binder: undelivered TRANSACTION_ERROR: 29189 03:33:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sysfs$2(0x2, 0x8, &(0x7f0000000940)=""/4096) sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f00000005c0)) 03:33:31 executing program 7: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_read_part_table(0xfffffffffffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="000000000000000000000000000000000000000000000000e0e51532000000000200880126000100000064000000000127008e030c00650000006400000000030d00f0043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) request_key(&(0x7f00000002c0)='dns_resolver\x00', &(0x7f0000000300), &(0x7f00000000c0)='\\%^self\x00', 0xffffffffffffffff) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000001680)) mq_notify(r1, &(0x7f0000000640)={0x0, 0x38}) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80), 0x0, 0x0, 0x0) r2 = socket(0x19, 0x6, 0x800) gettid() syslog(0x3, &(0x7f0000000380)=""/201, 0xffffffffffffffd5) r3 = socket$packet(0x11, 0x10000002, 0x300) r4 = dup2(r3, r2) getsockopt$inet6_buf(r2, 0x29, 0xff, &(0x7f0000000540)=""/25, &(0x7f0000000200)=0x19) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000280)) mq_notify(r4, &(0x7f0000000180)={0x0, 0x4000034, 0x0, @thr={&(0x7f0000000680)="875121050911e8d9cb7386b20180b0436510747edc7dccd4f25bc0bed203a15d759cca1a63e4fed8f5e87207bb8ef908b465fcaddbc95bff9f737a64bf81be4ec5f2f88ef220b525c09e774fc09e351e71052a7ab248e229572ac5e2658552185c9df4579b097b1f4611384a61325e85baccbe035d9b53e3d91b66af0ac32caf4b2af52a78d9aa130c1ce5611ef22f501998ee82a54a3b30ab30d000db11b2012accdc9a7e4da187a47d5db2e2199a555d446c5ff1905dd2efe1edcadbda279775cd7591a431e2af452985df6946a4b388316e764152f69871fb89aae794fdba5f9f3eae38e8514c4d1675568ab35b77677fb6929a34deb2cb3c321dd16fc9bd67b4d4cd0180a9bd3927de8765f35b87a961a482ce39c0b9e7c966d590b320de3bc550b88de79aad6deabacd753b4675323134e903ad22f8948a9083a4a87f94a65da92fa33a48bf4a2e2f9b7301c6c2c5654d9e4a6ee3bd5d253b3f8c6fbe75a639a92dc041a2cdb643994342d50209a37eb4684fe34947ea4b53d5ff5a2ca20a5f27bb3b90990056a7c6178a0c78356294dc850e86e824ffd8ee317ec88351c5c191769c9eaf110a971cd583e5b02e9dfe331baaed50c65d7c39ed4462ce86693376f0c37d277fba51e45a9e3a12cd8c6e56dc516ee201ea6e0da11711e8180309a11fd4fc3e0e6bbaf56a0eb13c00bf961dd9adaba4b4636e0e0009d0f053020f6de0cbf36c5cb8591eb04ab1b5356268744b0c522a3d07c1a6d0eccb4ce66a74f2f1d28f493908b50d0c663c2130d821e2172a43b53b6b083a9d044d2282fdeeec1f0042e36b7017e305d9ec1d5017c44c7ad12c62f260d8fa8a65e6b54e14e66a57b03347af31e4d83cbf3cb223851ab885ab8d16952877016b46e33378a66e98184c4ebb3f305d520f64f963e007060c028597903973d00b8698485b3d275b23cea6c3aca8c27628aecfb4e7f456ef3b44bf7ec7063cd079825ad6fe0dcb9256ce25260d96d895c79b1fa3e789522837d48b1760009b2001ef1ecae95df88198cfb5fc82ee1dd0d02c93466101b1f18b476a102dea3e3bbad17cc1b267cd9b319b264e334831c121f11aa4254e986e6f5e7029c65c3da524fa8b71492a02d7fa187dee026f668da11017917fd518d8ea3343c927bb359160f4a063f780cf16cf1bff7b900352e05ec45160c58902b3818653def4afa7a234b475a2aa8504eb924efb7aea9c1a3e60607dc06d5eafb969399070ec2f7897b968f0e01aeee9d6d3466d453a847fe34477a78d5965aadb589cc56e474fcac0e1f6b8e38e0a3eb136b03dcd57db67a36c7f885e0b20a375fa6d3c89810acefeb5b41e8e298d2e001dfc85614c7e49d513bb585de0a18b7ffaa5b16f6df7e12c6bc6f64b45f2e979e373642517b7a762378bfb96004cf1d407a7569d2181c70c014ff5179826c2426727e5192237815b113eb62cef506600b7dc89761590c56bae6653e82a8f810f5e33db97a880ad2200c2349d3ed59959b44c875ff0ecde742eb921ffa982deb9f7bf3081d793752afc6fa6dd63b617edef7cc6a430f37161e0689441b3c7996f934d7abf3bac09c6537e662ad70ced79379ea025b8f25dc10f4d2bcaa7d7d2a1aa3bc8d9aaf4e585a31fa51111f30fcbedfd8a2281a58cb98149c5c910565496fa58dea9dab766aec6bae3d633a5cf8a2b08dda0c0b8b3622ed2653dac20070ecdaaa08439b2eea73b75f0d1b2afa8e786c88a9cf675f54b415a9f8bd58710249746f36caf9d55343cd0c0592c4cf9f57b690bf45e8b87b3e8cfd456d428a715a2ad6a0245e3f8efbbd103dc0bef16fe8627a6ac205e07fbdd6b15b539bae2bccedc02960cee268c06cd093b727cb7b9e3ea4a3b9743a0ae111e8d1efa3757322969490a4e0ebcafa1c20083005b73690062cf5d6b15cf2ffb783059443052488916cafaec62b49352fa0cba8f4b3609cd0476411b79522dc0deefb055dae4e891b48ca2951f80ffd127deaa9fbfb0bdd5ed04f094df86457a44839c92e109dee7ed791a25d486ea7ed2a98a521209d51d4e37d35981599a633b5d8d5b389161d82683c83cdbf614c2ab92d39b5cd970485d1b8cb3b14aa7102b560bbf9b867c2df30dc520765839c3e8e7f8f17f6268c05db53bbc795e362bf5b34e636afd30a6b93762cfc62ff433702ee077789ea182df37eb0c14e2aea4da602c6a3af033fb0c88f22b6a341bb735c8f557c53add61804c6f8eee1a9253fc194f2d5bf69b2c481062f33fa5d73a0db58e6aec0b5fd97f076a8c161bbefe96d999a9c39ddb91e57bf195ed70e06eb2a41fa9ab310a24128cdf8bb1cd63f9a5e3374a115a943ca89c1ec1c99c52f0f57c2e86ee33983419147d8f7393afb8f326882c7e79a87c056fdb830a0982b52021e753a9cef95aae92aa0e9735665213135d52ec819d22980e72806247ad18c966359a49b1c8ff794c3cbb9a9c0661ee763aab6efe83ac1037c6819937eec7b53d67ffce67747ab7168f6bac2fd98388b1f74f45165dc09f078ff2222824f10ecbe7f332f529388359f71a83295dc698addb017f866b4c2364709efbbb1d2495ac12dc122177fc85a97e6720b5767556c19e7c67e9d22355edfb0de32257621356459b27517204373c6fee7bf38ea70f648ab61201ae0d43824d4e8406d6900173e588c0c1240238929b509de84e4b8367deda8c67ffe626a999cdb13dd43002e156b401ca3e7f87e434626278ae717e137665dd205c027d23628b4b233471b87627e3a0e87a0a4c63dbf1523a05fae5796618a5f2570f25a87e0cc32a87615fcea3a988f54ea298d92aecd290088b087abb107e31437c8c1ce15b3b996e2d3f9916fa5b2bd471b100cca507dfb2324b51cf4808ac4e62f3d23c63f197aeac2d120409591b33abf87260114cbd8b5f4f9c26208594ce50bc4c96d21197ec09596c4937daf0cec867b01822e8a3cb487aa16bae628e4f6a094bc9f4c05a785e5d4eb21edfd0aa30d990a9756b1a4e4c1661b9b09957f72b3c9a0c361e6f26fed5f0db0254b3848d442f8f613033aab1f02edd1f79f3bc318a2abd0585b8a0841479bea41569c88033963787e84491d14a510eb2aa9cf7868fead773083ab3bc270c7e63713df9dc0ae7af78a60a22cb4a5120ea817c7960863df8c86232a8b79f05231149af166a9c043330d926242d459618b4041d31f63eb79bf3892480fd073700a94317655c9009ab55efea526154c8c6947403a8dae08d84d6af8994d35432a578160207fcf49de1d49858e9c1c08a65f18bf63dccb96bf2c359f9d655c5843670d24d93489df807306f18f8db809417b8365e9ddfff2d31b15ad66a8085e2a03a15d708078199b6762499dd0110549ef8343c9149376983cb9d8f0c5c18fe55eca6c38f7b8433b4905f7b36bfacb0f15b89bf00a7f2b5cd8a1c4d573f5d030bf040f0ef42da0992debbfb2ef645b3f6268ee78d1e6d2ea31baa40a7a42790ed35031ca12fc3fed8526796e1c220b1c390641f4a3d5f5735347f7d9b243e2fdae0aca57eb1f3218e95b1b07e2c1e7ee0af7849963d1335d2e56dae57260e9b4b197f429cb9da731afd6c3796ff117e9ddecaa01ae380f395f779245b0ad87bab677cee0df43dbb7ed710b484794cba4a4a6a6e122ca472aaa5ff20b949906334ede6d999d6a5e357c4536185decf8195b5a115ca20647e5442cadd453874968e72e40acf4ee0cbd338900c09b6d2542aa8e76439fcd9befca80dd3460a13155ef71368e789bb987acf8928ef5bf93f1eda8075144cc71b06c6284b85902bf5e8cc4b588867570ad7b62de896d2e0c9b16e7e905bf98da4fe5238345a8b45f8d1d5f6381867ae16a30e36f88dbe05e141878dfb48ddc9cf34f7c28d94b7b3fcb31743e8ad8e6deeb86668292e8b531c4f53d468d709dcb027134e513593a5dd22f51941c9c9d44bbdbb29fe7fa2781d4df6b677c82ca3b2e622371ff3bd0c8fe10e1bc47d24cb2f6c3b019befa65cf8662ce3f64e94323584e109b96b237f70cc94f981d8ae31d8a283cb234effe0a818380a18d0d88e40d7e0e9d45f8d15cf2ad9cc07725b2a0fd4432c1c3f9a003b2b02768ce4b0dc64a283c225df5de877cd41abee602d9abb939500f79506957906e9ee5134a1f4ad5cd3c95f7db5e02faff02714bdb144ce4b76de2026052442ae1f2ae837889588bc328c98681bb48003c7458797dd92441a22ec16356ae0e3f1061187824fd032e2409e4255a5bc5bcde74b1d76cd117e609473f84c4068a5573dd744909f433b79d5b3c0688c8f5e0c9044c3abb1136f8fe30e7c487b469b03b0dda76036f8776768fbd0a3a7326653511258a68b2a7c044eb819e2146ecf1f462d6501dc7c0064ebb99cbf2ed537d912d262a841b5c0ca369188e58aa25f1f45dd90bfebe404bd1032234a5c9a2bc2987aa7d2ab4ba83e43187fd3710bb2adf57ae7eaf24ebf074d6788261716aca2a8f18481226b5b3bb237479e2c1833c238b0bd1b05a0446092b6ba412569c966edc38728da854c72af354e3d4c3675e55106f23421309810155324599b9cb2b5922afa37185369c14d3e964e3b70df29ea2b7f84709b8fec28f6332149803fda046ff9103de84a016b698d9e4fe5db354e5c5f693ee8174588dff88878365171a3955face7aa1bf1a7bd4992495541cc8b209fbd385511c1c81768088d731871f9e9f50e0f4d9b869d61898fa88874ede04c5b35705b5f73c6db4cd0951022e6632fdbf36fcb3566cc14e828124a258aad7ba96c84f2ddd31888c61c8a67c4553987a6599337a2bfe70fb2c6c37ae821780f43d3755d32cb76620c3de001edc1c8b9f70cb522bbfa08e8572e83107dd8859e4018b357f03c456ba36b1e9ce4c7bcb9886b4dde43c82cb604b921cd82017106935fb61b5c2d5b8495dc531c614eb258784d5e3104dc3d3193be59d6c8b52b1f0faa137df6ec84721ef337b33e21d4d98cac1e2c2e24ed1f8b39b6c28628c855a49a05eb441ecbcae7427e7f95cc5d621911ad0c338e23a906feacbae4709c8ccce74170664d7e3f266547c959081212b77c507d7034aede4cd3e870641f82816b45de412fdc25e0b72f4b04565b38fdc32847efbcf3e7bf288d393a685fbda7bf7b37aa440a1a8c7d74b87156b5cf71265b7ff381c0e295d04162266b7433e0e7dd510b9e0abbb8b259f829cd3a34d1b6cffef26180838f4420abaf2034ef2ebbd488b686a6b4a5a88504bae98fabe84682ce732227cece512e0d7ebc29a54c797450519b54fa500061544d901a7c18d83eab5f599f45db5806e806ca56c899426b9b1d385143c558abd5057870a7afa031166eb9a824cb114b0b6b7576d192f5924d628cc1dba760b0a3802874ec507d7e1f515ef45319083479f464e6d24f963b41461d49e14702a29b5f70779a96c3e53bab31b48c148e62d627f3443391962818df69982ae1ff9553274b698e7c91a92e29439b46b27e06142739a4b8986701105f3444d3df47a0c48aac0bf41d53a625539bebc8641fc6caf93de1d56f2e5fb091b549d84a9d5db57b97655e28eef62aed923c6c45475be26d17ae878f06262b5e65285bd060da30cd958463ca222a9fbd1d53bb9ccebbcf2945960b5454cb74ab473baf94eadb96d1d3f6b04ba60cabf2118263ac16c3db3d6f082abfec4e9cdd2acf0251183807d5c79210c0a5f78d5618413a9af4dbbb52defe0fe7c8538807abfe14c8362fe8ef3332305afe4370902ab977df61827e25819a7a7f", &(0x7f0000000600)="9a7c7eb978e9f65c50da43163e4a9cf56c45225a7b75065b7863159c96aa41d7623197b526ab08c6151448c81ec03eb554470457"}}) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000016c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}, &(0x7f0000001700)=0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f00000005c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0xc0000031}, 0xc, &(0x7f0000000480)={&(0x7f0000001740)=ANY=[@ANYBLOB="4c00fa00", @ANYRES16=r5, @ANYBLOB="010000000000fcdbdf250400000008000500e2300000080004000000000008000600000000003c400300140006000100e200000000000000130000000108000100000000002c25de140831b0d406d79828f8184afccd3a16060feda977a3dae08feb40fe5dad5f4731c4e7280ab6c1cb942eae14fda68e48d11f3c1cf33e176acce6e21ff896a5e28ae6566996c7ab2e79cd65f643ada519d87ea9ce4e950be504097840b6cf0e40feb253be5b93f31cc395d0efde621a7e860944a64bf4dd6967b640310caf80b63813a5976620d320dc61f1d4bc4c36db57461bdabc8137f613318b8b1a5a14528c17e109defe1866be36804f3d643cb136e7f2679b276e616ff2ea90c5e69d0eeb5b2b8ecf9fef7c7954cb2095df5ba63f408500000000000000846835e18ab4045e46b9f14528b9714cc8ad4a2b252c2f242223c1a5227077ca6cac70cf909cfe00db806a06b38336916065744044746edd8cc99966a42fc58e53e5aa8669128172e87c044dfe33e106ba49a626b97ebf21a2927dad6e81e3f633ebcb67b969b59def22db3ced08f7b42aad41cc5578438f2be6d10015afdc2e40f0e4a41489645ef11aee84b867de0364bdbb745857c21d429a80be609ae5e4b81ac9bd"], 0x4c}, 0x1, 0x0, 0x0, 0x41}, 0x10) 03:33:31 executing program 5: r0 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.procs\x00', 0x2, 0x0) fremovexattr(r0, &(0x7f00000000c0)=@known='trusted.syz\x00') r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001b40)='/dev/ptmx\x00', 0x101000, 0x0) ioctl$VT_WAITACTIVE(r2, 0x5607) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x20000, 0x0) write$UHID_INPUT(r3, &(0x7f00000002c0)={0x8, "02075e093c01cb5c7bb4d10868f349053d6a3ab1e6274f6db8fb2178c2390653248b6fed5160a212fb3c0da32c13ff360a924b9fe45ad758c4437e3932cfdb19cdfd438366b8dc464dcc51ddcce2a4e8c4878d75b74edd81c7d193342f4009a25491f307e4a5fdfaa877a825434720ad472995017321af361a7e5f196e525c322ced20062e2d4423978ddafe91c6ebbf181eb9d296a5d2bb8a78db5e9d1b357f6212754234d6dbdeb5b288aec7ab65c240e2f655e90b377e0c37eae9cfd92dc1c88cc2f492e336b4c2ba6a6169444d554da5af45d617413759a7159959b018a028ed7ca956c1a7ea56ccba3aca3b12fade92640643a64ed6dcd4f41335e97878bd5417af1b6680912cab6d3d3fd81348900f9094e07ac7bb9e0597ea266f317ff3dceff66926a62278ed2863676061776a689e5c319e1b37b4816729c3ee21b7820c5cb5729e381ffb6a05ce73aa5c0a75085a65e2a23de476e201b45ed19639d8a670ab1d1def03fe4a564f4156d35a9f4d5fe5437af1cd4ad07b86ed4a6c71cac0bdf5c365e8d64d578577e5e233b0e16a2687de1d318d5977e9003f1fb10dbbe598468224f0b7cfb259d2a41106713765e47638df9af57195693d9d54a44dc29ab708fdefd35a007f46cf4127d38747de9bddaf6bda384633b36c6eb541defbaff474c305bd97c5d48ca109fbf01121f8db034bc50ee15002ea27c5f3085d90adc230077d580fc7269bb665352a306416c6afda7641445c4f12205ec145a07c76472e3b18a769237a4762e9768b5b26fcc90be70c0a6757796570ed20a8cc357e71e9de52ca113a8a7ea875b8c225f878cf3da20915e08c803abbf7f5cf5e12d4119667adffb99947ea6aa8a7d6d4a3125757d36d8aa8ff20c3198848aaf8e50f3bb046e68dec0a5774a899ec8076041560a24f9abdad19cb91b746c0fc01ad24ee8c3fbb647e59aa54b5e2e3077694495b50955fa5b78863e68912adb45a022a6dc91b35da436d19bbac85be02ec76579c2b29ad25eed95f99b4229d59ff7468e5c90bf48f72c62031453359755afcb4818b1a95c1470fa13329bc3f7b5224973a10da26a4c394d8b0b1d22ab549408603ab3b3ffb6547b20f6b8f92f6f3bc270a5893112a03ffc7b07b64ab1693462bbb1d457d5000113913a1120116b448a2a520cc8ff7603312b42facff1b875f9985b58f2d28a6e52f9db491ed30807a0f27eba3239a418bf9be7a930a3e5f6ea369f2112e689dbe313211d9d927c9b09309c07e798f029627842a79e9bf1461846b6d4f621d426d72803797bba4038361cbd34087b9b8171f9a0462a2cb7109088ad02f7da0da615b5fb386791de01c05f5796d8563a402dfb228dfe60754a86210b1440d032413e89fa8f7f130ccad344c5f90118373465ed67e97554d3a6a9aefc4e73c81e8eaaf207064e566313f95fb03af0a4d91f96873d73bc3b0b2b8080d72f0751b1659fd164e06777878e3f88f009b0e9afbe48d815093621a3ed25804bac36e4a7036b2331f31a68a12423ba07f23021415d59dda1d9c021338ac24a6f1e6da7147621d397922b45dab3521ca8d32e73df0cc80e503eabc1e959640bf0261e467f7919d1a1d3bd8aabbd6b6d1a40bb8988c1706931b8865354dc67a9ef0cd89e0e67cfb98714a22b6f493d36d4abf1a7357ccec1af5f05ae19c7c529e6edc5667453952da91fa3101dd461b9ff17d2e3639224cc6075a5c4dc0f2745dc8e6f82e62c4c6f93a7089dfed63e4135797d1fa0d7b87913995786834e20dd69bfa4ebf9c3ed7151d3f9357fb5f58272f7f4bbbdb933f6403546c5bfb7a9ae5906355c2d6f4dff28684ef1db3dd25d229a7cab8892f14aa9b0c0963efd08024b8aec1fd735b7e42a3edec628fa6b7210fae52e1109168f76779a70086c6c4c6ba15e44923b708c7965c175537d0e73481178b9e052013cf0ba4d8fd9e3238cd05cc2e4d84a2dbec7496e1afdbbca09953138ce867be41197fc8526cf0e692d417215bb9a9c52ba7a51d9f197ef06c9a6b80c4ea14f9312b447165a9158e1888fd78e8c058866aa1ace321da5baba33e42917797f33ff7cc6d9b38917081af0db020e6ccf56a555da0e18126fe54fb35db4275fac48949f07223309e4071cf5162b9b5136880fcbf28f4397ceb95ade01723b406d7bbd9db78c00b056003e92956ad1f261c36f2f2eb7c714c770070135315c6f9c4b6a607d16d8c43c615edd71637abeecb71cfbda18d3cd610231ddfb4ca313443d132fcd9f93b27cc2a957b084c2f3bcbbfb2d95c4cdfd83f1cc2c876c56375438c2ae003590dc90d40de5a24f633a1f8023661d5821c51e196c139681366293212242c7fd6b01f8133c15b5cc15dfd1f1af2614a255264af2b8711f71936718f47a04843a831d7c6a2975d8046f10b4c3232aa4ef8ce10de3658a5bae5b5d88dd96b6d8b6902b6709c6aa59f27f86e28915a14084646f3672752531969b873e3fbfd71e50516cfec78f2ec0265235c77c021ba3a94da253113df1a107c2c0ce0549bf2af82d5d5f83e341bbd6d8bf94029966ad6aac2e94b7ca3dba685e3584968fcfa4d48ca323fec5d38f94b4328be8bafe0785b4c79a7aa28456ee731b96a5302085219f571b81efab9da0389ce731be74f3c6c5036872551c5fa54070bce0b24b52dc8a7db53d902522bcc873a69237eb065f277c0a633120702efafbcd10dadd26ddee60b2161bb79e72911d985b054c8196c383fc53954d109afa36d8e871159daf125d92b73f24127db635928970f36a55afe68a8add719740be4f62b60023e4e27f66c4317035d72e9323a7b69c5e0036c18dd721135bdb92c0f602d6aaadadd5ab237daf9fb6a75742262390fa3a38e841f95c058135e6cc64f3755a8eb662ca03eefb34a9cdc93f93d84934af647d6d05c31819b7c76ad34057e3937f603060e3c336afa8a53fb8d51d8c39ec69ddbcf6fc8863a21397a6f4608b2087b2204a9f98deb77fc8bfe24fb993967132bfd8c96e00766ff11dc8e0960894cf75f104772b13a704ea8721a7a2441c1fd0f329e141fdbc3ed5568f2c64cf0102b501ef1363ed5940a283faddd7b2ea0ca4e5faab4f72f3e417043185d54aab7ad2ec1559405695bb45d1d39eb6f2d40606ea5baca65f5ed3c69068a51a7e653781290b2240ba98607fc10a7acddf962c1d7c16a78d70304506c71d813644c9f9545b7b38c9a10336c927f16292e7a20ccf5ff30bf6262610bf284abe6b1a9d957e74bc05ce53757b593a45ed29c6a88533a5efbb11c250cf057c149d1cb5dffb782b1d887cdcdeb411c9ea6a32e0f944cfe494c02a35abd4da3bdb30035d4c00faba2f29f5b407927239f9ecbbdc8d4c3b6b6dece2ba1ca920d082b30dceed459c3add2618e1e3b82bc7f678849891fb7cd0ad330bd2edd4bf52d5673c48d3ebc4b58fcd1530b39fce6a0ac1a85d79ff0a3ac6b6adde9fed97910706648ce30a91d68541b6d1629f71b73cde7d0709107e99b128b1b2bbb20afb12544b97a51f68e364d951d3ef73f67358ec4bbca6504dd040873ca3fbb8e09ebbf637deaa6342fb6a7769a39bf7d389682b29815a167afb2f0f351d4650476412284b7b68c79a6e62509ead655a333cee7050e49b810fd414a2904930f712a9f8954fdfc6cc7a2615568f43429696240f4834c3523dfbaefc9b6f9de02a9fa48ad06d099ba6e2a59fc84dd9d5527c218df153a4478639e30c1875fb453d794eaeed62166b43aef56f5cd81763da7250646afc426e41c30940a04e22a9ab22ff185e5c1818023bddc46069ab7b83147837f2f366253db981ac7c4578e2c737756e6b5cd8d52c1f44da6f85554e589d89d0c0a9fafe25ca6a9fe3423d3153bd4a97c2d711d67f118310dc4c68c796393ca2c49867b7861282d4a6c71e02c4da859fbdab5cbf5b622ce3a46485f49e4cdb6c93a911eb5f493d96b9fa5d87a2fc151f3d75d4fc2cf290446f55dac88c321af2c91b2f817fa1f61b08affd712beaabe1f8feb62c2caa0af6555d28a9a0b81d14c664d60be44880dd92d6bf88596db3b5358d0ecca69976e7b64c72c4b94291171dc80f065af6d5a195ee73ea948ab6dfe91bf139c5faf5f8ca7bfb76ae77cf2bc8a40aab9ee99ea0711f38e6694696ed7110dc4de67cd081bd7d1ce6bb750d594b4f556ce7f6d0adfea6157055beefa84b503f772fe7e8ab92205d1b650121522a47ea2500978d31bd19920e7f29103cee8f87408a509790b8d535f55d1bb3b31c6b791d434fbeb61caf2a4d86f91e93df0d7c437c3b924fe9e78abdc13ed557481b155bc99628d3818304738c3f53d1d1109c2c8d25de8f5d9b5ced095a28e38c448ef57ac6a3c90622018cd387447f4e60c03eea5306cf6cec9f7177af43883db5951669fcfa92230948e18a4f64035ca51f494edfb308373662a76bd2c5eedeb6e71547a1b8762cc382d31c1d64b9629920c6a0c95936403343ce2dd1693720ddb772399a0fa88913ace2894870547ba87ad715c50ee52fc461df8c9d45ef2244631a4995697bf14b5d37766fffedb654dafc4f9d86a8ebc87b77ec874ce10befa7c5b112e3f1219d759a84a3a01eb430b33dc3f5f6da09d48d7c80cf8d7b2930fdd903839137dedb7ee1185c34021f34737b4921042f2fc81aad61ff2101873532aa0cfde80e8562ca51e5469d40a420e0416b1e608868e6d15d010610248bdc0eb1e6e7c5c1d18acca0aa43f1ebca9e1afe16fde770057ee9a7c6103a0917a62846516d27bd967aff544c0d4ef1338a64f07886d0af06b90de73e65bbf7bc6e806e928c767cf284ce159380e20364b3b30417d7f627cbf79c1f0527103dd4822aa078a6d461d64db47fb8d9b36225e6f9d42c449064f5b1cd4daaa65d36c951a45f1f969291cbef4cbb3d30427b6c211119a3b07d1fb86410168a07770da5c56b35e3254f1c875fb31ff29367260cfd196db0b70bbe7d2d14141253df68b2ceec522762a677f942baf6b327bd0e9c057ed455d4154eb4fbc22a5625a58f4164916b6219cef2c54548706c41a77c51c6ac5291e5a98a3ee27e3f531698b7989e45e0d8f8401da20af540762132fea4131c89128e887e97078029cc5e070e4733ab6e3dc5b3f42f2fbc70a0d4b4091683f9a471e3bd01a51138b0832154970c58d63e86a16a62220b2c9a1682478d08589b0d94611bd4085f71d77fcc747e47e3a93ddacb90fc49dd847fa649a65eaea4c104f37f66414e65bf3c1efc51f117bb0d53c116d6c37e4e93579d1eb9a9ebd89af32ed2aec9d82e96b89e032f2132534658cb6c26a9e34b372c23fec0d9a6d69c1c0f4c5b8f5fdb2dd0e16bda8803b47f5307c05f94c21a1f9d5c82a84b013d95f2172657c64c5b2237840906df530f1fb869bf50169a1233388a46136be42c60d0f8f8c2bacb30bd34f7a932a35bf98c6d7575e6db17a47d02d303254cf84bcc19e6dfc259f22f77760003ac6c3fa1fc201ca3c6674a05e8a88600501642cabef48f41e4e3cc49cd1e6fd1d64b4e492e06a269f242646f731e07207208b7fc9a414cf729c358f3583d9026b6c359171a81f55a22ed6ed5001c1b61a83f0c62d1b03bb24b966b33854a9fd052be04d6eb12722b3d0ccc3dca0b395ded957b8cbb75eaa1b5ed7c8c35c1bd491666187c472d7fa54f915ea6443a39700683d4f5676e20b183f2918f6a3c53343ca56bc17704b2e3be21dd144ad6aaa4cdf07efd989b97983545469f67ba43a9c9619cb58cb598a9c813a589165", 0x1000}, 0x1006) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = dup2(0xffffffffffffffff, r1) syz_mount_image$f2fs(&(0x7f0000000100)='f2fs\x00', &(0x7f0000000140)='./file0\x00', 0x7f, 0x9, &(0x7f0000001880)=[{&(0x7f0000001300)="f4fa075674d14813454082bc88f56b26be80bd49de37c8d57cbacad163a9dbd124871ae76420431f27b631c204ece2b8fa17ad436210e5e34aa2904ba3960074e3811faabbfec5be43124e2aec6349fd80a970ddd73399d14dbce4e43de5ed3255ad675902d008dc8b9e4eefecc6a127fff72b7d11f85efb66ac627a4361f43e96931fe7b6cf62f2cd22df4fe5d2c9de4f9ee51bb32274513e7e8a9165c53f4d62eceb389db8e8b7947f0d07db3f6adfe5e778e233229c1adddd015ff0085f992db4a2cc67a8429250c979c4069c30c95e5bb7c5169b27e6ba393e9e6f4d8fd53a54a37a8bb88376390423c31a", 0xed, 0x9}, {&(0x7f0000001400)="6bcd42f9f80b253b1d65cbc10eafa9fdd6b619051c76525485f321ba2e6d3042fc87f0d6416067e17c91501fefd7d1591c6b509c4439426cee4aa33a49c65478166dff154488c8d9644ba84e19763cdebb52f19d118ffead639a1d2a2ba9a31ae581135d", 0x64, 0x5d1}, {&(0x7f0000001480)="cc0565317c4530be7070b45b453e20b4f54fcc2a5bcc0c6f512bfdd8774ccca28b2ca21ac60517ac382a483461407e58f27a250051dc6f86191419112f57d9ea6ace688a3082951186ceb40d6b6830ac83f35d9357f35b168e81cf0ec8915aedcfac1494e5ef46568191155509ee0d8a797a2353f4895c135f14a619789b7b0a2116266f23c1b785bd83fc9ab944def537c1191552860c7d8c23686667", 0x9d, 0x7}, {&(0x7f0000001540)="da4ed95b3821231bdfe2980e8c646cc16d21e455e739489701f09e6e99365d09cbb601732b96c95d5d20ccecb609a22a2575f5ec1e7f92d3d2e5c70c8179cc95044dfb6c06cc336a65394bbe89ad8b3203fab573f1b237e4b861200b1e26b1f98eb6ca26a373f27ae213c343541e894f4369441bac793b421705210f443b1037314a9fec342582ee01c55a05c6ba386f042babe9624ec875ecca61b562d91124e1fe169ab298673e057479545a93daac40bdc953e2cd6ab2f2f3599a8659ea4d5f63", 0xc2, 0x4}, {&(0x7f0000001640)="bcd56ab859e4fa29268c44ebac02e40c59b7fd2ca31e9962d923567c29353f638bec417acba80632da929712f50448146260f99140e122f9b7ce3b3da1fc992b43a6d1912b7926adf6fdeaf4391523830ce742323c40063928166477a5b1b30c9d9e2067ccf5ee222067dee72e64d467cd", 0x71, 0x1}, {&(0x7f00000016c0)="1db5ddf86c2622a356ed180f3688eddd38634746f3782c0750cf30fb596d33aa61e81cffd2ea4406bcd8da1b4f784e68ae807e8c0b870a546f0b3333b21b2578a6ba94068955eee5298cbb3f6ad698b426a43160e375fcfee73aa913747b0298f3c2f6c8bd7961fc2c100af58d5f05f3f6a6f45c490a70f28696220a16215ff90c2886ee88c45281c6f730130d90d62614a82c70d02013b2b4e908a10d44868715ef2ba4f023d74b186d9a36", 0xac, 0x1}, {&(0x7f0000001780)="b693dd963d4e5093e3c62be49a1191635d27a899c3b8557fca90a514333fb551aa2a52cb23cba8f4d400bf61d78eba92e5444175ca2b798dfaf4ccacb7645a2db27277d7b957cc8439192b88e31b5d45e11e63a5b1616e211189a5d8e824c26f3bea75f84a8a0abda05ea1e453b0b8863ca27f159c48e633683e87bdd9f41883cd71e70c32db08ac7648b485d658346482f2b7a25067b28fd820eabcbe4f9d1baf802408e7c2b70f53c7c1e3a32eb9739f9d66af", 0xb4, 0xfff}, {&(0x7f0000000180)="06359bee786aba70b045b58d311513b310ff81ad701bffbcfdead59959655f35ab", 0x21, 0xfffffffffffffffd}, {&(0x7f0000001840)="ff", 0x1, 0x4}], 0x180009, &(0x7f0000001980)={[{@data_flush='data_flush'}, {@noinline_xattr='noinline_xattr'}, {@noinline_xattr='noinline_xattr'}, {@fsync_mode_strict='fsync_mode=strict'}]}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f00000019c0)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000001a40)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000001b80)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000001c80)={0x70, 0x0, &(0x7f0000001bc0)=[@free_buffer={0x40086303, r5}, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x68, 0x0, &(0x7f0000001ac0)=[@ptr={0x70742a85, 0x0, &(0x7f0000001a00), 0x1, 0x1, 0xc}, @flat={0x0, 0x1, r6, 0x4}, @ptr={0x70742a85, 0x1, &(0x7f0000001a80), 0x1, 0x4, 0x1e}], &(0x7f0000001b40)}, 0x3}}, @exit_looper, @increfs_done={0x40106308, r7, 0x4}], 0x2e, 0x0, &(0x7f0000001c40)="e8451799bf3e79a6cddd15a973f8789b4369211c76b8355d3f7947f569db057b141ca746ab3eafcf1e8a4fafc1db"}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000200)=[@increfs], 0x65, 0x0, &(0x7f0000000240)="c31a92e0b7b4ef8df9e8005ad411a706c82381730ee55757fa5986150e0bbad9f6029170f8010d4c0391a5614fc57e2fa5558d7be58b70a13ff981cfee87a16e4c3965ac1d6c8a29cd4b95cf2fcb013aa62f0249c7c151ff41b7eb5871982b5adac4cb2367"}) 03:33:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000080), 0x4) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r2) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:31 executing program 1: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r2 = syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x200000) mq_timedsend(r2, &(0x7f00000001c0)="5f7a16fdea89", 0x6, 0x3, &(0x7f0000000200)={0x0, 0x989680}) nanosleep(&(0x7f00000000c0)={r0, r1+10000000}, &(0x7f0000000100)) clock_gettime(0x7, &(0x7f0000000080)) r3 = socket$inet6(0xa, 0x1000000000002, 0x0) lseek(r3, 0x0, 0x0) fallocate(r2, 0x62, 0x7, 0x3ff) mmap(&(0x7f0000000000/0xc1f000)=nil, 0xc1f000, 0x2, 0x71, 0xffffffffffffffff, 0x0) keyctl$read(0xb, 0xfffffffffffffffd, &(0x7f0000000000)=""/4, 0x4) [ 498.274232] binder: 10400:10406 unknown command 1376019205 [ 498.280779] binder: 10400:10406 ioctl c0306201 20007000 returned -22 [ 498.289718] binder: BINDER_SET_CONTEXT_MGR already set [ 498.297103] binder: 10400:10410 unknown command 1376019205 [ 498.297112] binder: 10400:10410 ioctl c0306201 20007000 returned -22 [ 498.310053] binder: 10400:10406 ioctl 40046207 0 returned -16 03:33:31 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket(0x18, 0x0, 0x3) pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f0000000040)="6e86f970c8962d174ac3955e21dd4b092e7321d2b76d34fd26c5f21cb1f12a4a03e73e6086d196be47400dc6d3afe08fa8fca9a95a8bd0b3eda70a1b00982a9f20d1fb6f4f5c77296886ca39d5bc6bbed4a7d56739730b76a3471d42509249ad194ee2a8bbe721f353518f5cdf23085f18222ff1badff6ebec72a82116f74e200a851c6fd0a00e809890c893de74658c515bd18315ada804867a08a3d31d88abb454d2e3db17682586ae64eb") socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) keyctl$set_reqkey_keyring(0xe, 0x7) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) dup3(r0, r1, 0x0) 03:33:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="04400000"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 498.310112] binder: BINDER_SET_CONTEXT_MGR already set [ 498.310121] binder: 10400:10410 ioctl 40046207 0 returned -16 [ 498.320144] binder: 10405:10415 got transaction to context manager from process owning it [ 498.320155] binder: 10405:10415 transaction failed 29201/-22, size 0-0 line 3004 [ 498.320426] binder: undelivered TRANSACTION_ERROR: 29201 03:33:31 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303030303030302c75a765725f78643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:31 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f0000c86f88)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) get_robust_list(0x0, &(0x7f0000000780)=&(0x7f0000000740)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x0, &(0x7f0000000700)={&(0x7f0000000280)}}, &(0x7f00000007c0)=0x18) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f00000001c0)=""/9, &(0x7f0000000200)=0x9) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900020000000000000000000000030006000000000002000000e0000054d81458186fe8b90002000100000000000000060200000000030005000000000002000000e00000010000000000000000"], 0x60}}, 0x0) [ 498.416630] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10420 comm=syz-executor4 [ 498.444887] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10421 comm=syz-executor4 03:33:31 executing program 7: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_read_part_table(0xfffffffffffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="000000000000000000000000000000000000000000000000e0e51532000000000200880126000100000064000000000127008e030c00650000006400000000030d00f0043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) request_key(&(0x7f00000002c0)='dns_resolver\x00', &(0x7f0000000300), &(0x7f00000000c0)='\\%^self\x00', 0xffffffffffffffff) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000001680)) mq_notify(r1, &(0x7f0000000640)={0x0, 0x38}) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80), 0x0, 0x0, 0x0) r2 = socket(0x19, 0x6, 0x800) gettid() syslog(0x3, &(0x7f0000000380)=""/201, 0xffffffffffffffd5) r3 = socket$packet(0x11, 0x10000002, 0x300) r4 = dup2(r3, r2) getsockopt$inet6_buf(r2, 0x29, 0xff, &(0x7f0000000540)=""/25, &(0x7f0000000200)=0x19) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000280)) mq_notify(r4, &(0x7f0000000180)={0x0, 0x4000034, 0x0, @thr={&(0x7f0000000680)="875121050911e8d9cb7386b20180b0436510747edc7dccd4f25bc0bed203a15d759cca1a63e4fed8f5e87207bb8ef908b465fcaddbc95bff9f737a64bf81be4ec5f2f88ef220b525c09e774fc09e351e71052a7ab248e229572ac5e2658552185c9df4579b097b1f4611384a61325e85baccbe035d9b53e3d91b66af0ac32caf4b2af52a78d9aa130c1ce5611ef22f501998ee82a54a3b30ab30d000db11b2012accdc9a7e4da187a47d5db2e2199a555d446c5ff1905dd2efe1edcadbda279775cd7591a431e2af452985df6946a4b388316e764152f69871fb89aae794fdba5f9f3eae38e8514c4d1675568ab35b77677fb6929a34deb2cb3c321dd16fc9bd67b4d4cd0180a9bd3927de8765f35b87a961a482ce39c0b9e7c966d590b320de3bc550b88de79aad6deabacd753b4675323134e903ad22f8948a9083a4a87f94a65da92fa33a48bf4a2e2f9b7301c6c2c5654d9e4a6ee3bd5d253b3f8c6fbe75a639a92dc041a2cdb643994342d50209a37eb4684fe34947ea4b53d5ff5a2ca20a5f27bb3b90990056a7c6178a0c78356294dc850e86e824ffd8ee317ec88351c5c191769c9eaf110a971cd583e5b02e9dfe331baaed50c65d7c39ed4462ce86693376f0c37d277fba51e45a9e3a12cd8c6e56dc516ee201ea6e0da11711e8180309a11fd4fc3e0e6bbaf56a0eb13c00bf961dd9adaba4b4636e0e0009d0f053020f6de0cbf36c5cb8591eb04ab1b5356268744b0c522a3d07c1a6d0eccb4ce66a74f2f1d28f493908b50d0c663c2130d821e2172a43b53b6b083a9d044d2282fdeeec1f0042e36b7017e305d9ec1d5017c44c7ad12c62f260d8fa8a65e6b54e14e66a57b03347af31e4d83cbf3cb223851ab885ab8d16952877016b46e33378a66e98184c4ebb3f305d520f64f963e007060c028597903973d00b8698485b3d275b23cea6c3aca8c27628aecfb4e7f456ef3b44bf7ec7063cd079825ad6fe0dcb9256ce25260d96d895c79b1fa3e789522837d48b1760009b2001ef1ecae95df88198cfb5fc82ee1dd0d02c93466101b1f18b476a102dea3e3bbad17cc1b267cd9b319b264e334831c121f11aa4254e986e6f5e7029c65c3da524fa8b71492a02d7fa187dee026f668da11017917fd518d8ea3343c927bb359160f4a063f780cf16cf1bff7b900352e05ec45160c58902b3818653def4afa7a234b475a2aa8504eb924efb7aea9c1a3e60607dc06d5eafb969399070ec2f7897b968f0e01aeee9d6d3466d453a847fe34477a78d5965aadb589cc56e474fcac0e1f6b8e38e0a3eb136b03dcd57db67a36c7f885e0b20a375fa6d3c89810acefeb5b41e8e298d2e001dfc85614c7e49d513bb585de0a18b7ffaa5b16f6df7e12c6bc6f64b45f2e979e373642517b7a762378bfb96004cf1d407a7569d2181c70c014ff5179826c2426727e5192237815b113eb62cef506600b7dc89761590c56bae6653e82a8f810f5e33db97a880ad2200c2349d3ed59959b44c875ff0ecde742eb921ffa982deb9f7bf3081d793752afc6fa6dd63b617edef7cc6a430f37161e0689441b3c7996f934d7abf3bac09c6537e662ad70ced79379ea025b8f25dc10f4d2bcaa7d7d2a1aa3bc8d9aaf4e585a31fa51111f30fcbedfd8a2281a58cb98149c5c910565496fa58dea9dab766aec6bae3d633a5cf8a2b08dda0c0b8b3622ed2653dac20070ecdaaa08439b2eea73b75f0d1b2afa8e786c88a9cf675f54b415a9f8bd58710249746f36caf9d55343cd0c0592c4cf9f57b690bf45e8b87b3e8cfd456d428a715a2ad6a0245e3f8efbbd103dc0bef16fe8627a6ac205e07fbdd6b15b539bae2bccedc02960cee268c06cd093b727cb7b9e3ea4a3b9743a0ae111e8d1efa3757322969490a4e0ebcafa1c20083005b73690062cf5d6b15cf2ffb783059443052488916cafaec62b49352fa0cba8f4b3609cd0476411b79522dc0deefb055dae4e891b48ca2951f80ffd127deaa9fbfb0bdd5ed04f094df86457a44839c92e109dee7ed791a25d486ea7ed2a98a521209d51d4e37d35981599a633b5d8d5b389161d82683c83cdbf614c2ab92d39b5cd970485d1b8cb3b14aa7102b560bbf9b867c2df30dc520765839c3e8e7f8f17f6268c05db53bbc795e362bf5b34e636afd30a6b93762cfc62ff433702ee077789ea182df37eb0c14e2aea4da602c6a3af033fb0c88f22b6a341bb735c8f557c53add61804c6f8eee1a9253fc194f2d5bf69b2c481062f33fa5d73a0db58e6aec0b5fd97f076a8c161bbefe96d999a9c39ddb91e57bf195ed70e06eb2a41fa9ab310a24128cdf8bb1cd63f9a5e3374a115a943ca89c1ec1c99c52f0f57c2e86ee33983419147d8f7393afb8f326882c7e79a87c056fdb830a0982b52021e753a9cef95aae92aa0e9735665213135d52ec819d22980e72806247ad18c966359a49b1c8ff794c3cbb9a9c0661ee763aab6efe83ac1037c6819937eec7b53d67ffce67747ab7168f6bac2fd98388b1f74f45165dc09f078ff2222824f10ecbe7f332f529388359f71a83295dc698addb017f866b4c2364709efbbb1d2495ac12dc122177fc85a97e6720b5767556c19e7c67e9d22355edfb0de32257621356459b27517204373c6fee7bf38ea70f648ab61201ae0d43824d4e8406d6900173e588c0c1240238929b509de84e4b8367deda8c67ffe626a999cdb13dd43002e156b401ca3e7f87e434626278ae717e137665dd205c027d23628b4b233471b87627e3a0e87a0a4c63dbf1523a05fae5796618a5f2570f25a87e0cc32a87615fcea3a988f54ea298d92aecd290088b087abb107e31437c8c1ce15b3b996e2d3f9916fa5b2bd471b100cca507dfb2324b51cf4808ac4e62f3d23c63f197aeac2d120409591b33abf87260114cbd8b5f4f9c26208594ce50bc4c96d21197ec09596c4937daf0cec867b01822e8a3cb487aa16bae628e4f6a094bc9f4c05a785e5d4eb21edfd0aa30d990a9756b1a4e4c1661b9b09957f72b3c9a0c361e6f26fed5f0db0254b3848d442f8f613033aab1f02edd1f79f3bc318a2abd0585b8a0841479bea41569c88033963787e84491d14a510eb2aa9cf7868fead773083ab3bc270c7e63713df9dc0ae7af78a60a22cb4a5120ea817c7960863df8c86232a8b79f05231149af166a9c043330d926242d459618b4041d31f63eb79bf3892480fd073700a94317655c9009ab55efea526154c8c6947403a8dae08d84d6af8994d35432a578160207fcf49de1d49858e9c1c08a65f18bf63dccb96bf2c359f9d655c5843670d24d93489df807306f18f8db809417b8365e9ddfff2d31b15ad66a8085e2a03a15d708078199b6762499dd0110549ef8343c9149376983cb9d8f0c5c18fe55eca6c38f7b8433b4905f7b36bfacb0f15b89bf00a7f2b5cd8a1c4d573f5d030bf040f0ef42da0992debbfb2ef645b3f6268ee78d1e6d2ea31baa40a7a42790ed35031ca12fc3fed8526796e1c220b1c390641f4a3d5f5735347f7d9b243e2fdae0aca57eb1f3218e95b1b07e2c1e7ee0af7849963d1335d2e56dae57260e9b4b197f429cb9da731afd6c3796ff117e9ddecaa01ae380f395f779245b0ad87bab677cee0df43dbb7ed710b484794cba4a4a6a6e122ca472aaa5ff20b949906334ede6d999d6a5e357c4536185decf8195b5a115ca20647e5442cadd453874968e72e40acf4ee0cbd338900c09b6d2542aa8e76439fcd9befca80dd3460a13155ef71368e789bb987acf8928ef5bf93f1eda8075144cc71b06c6284b85902bf5e8cc4b588867570ad7b62de896d2e0c9b16e7e905bf98da4fe5238345a8b45f8d1d5f6381867ae16a30e36f88dbe05e141878dfb48ddc9cf34f7c28d94b7b3fcb31743e8ad8e6deeb86668292e8b531c4f53d468d709dcb027134e513593a5dd22f51941c9c9d44bbdbb29fe7fa2781d4df6b677c82ca3b2e622371ff3bd0c8fe10e1bc47d24cb2f6c3b019befa65cf8662ce3f64e94323584e109b96b237f70cc94f981d8ae31d8a283cb234effe0a818380a18d0d88e40d7e0e9d45f8d15cf2ad9cc07725b2a0fd4432c1c3f9a003b2b02768ce4b0dc64a283c225df5de877cd41abee602d9abb939500f79506957906e9ee5134a1f4ad5cd3c95f7db5e02faff02714bdb144ce4b76de2026052442ae1f2ae837889588bc328c98681bb48003c7458797dd92441a22ec16356ae0e3f1061187824fd032e2409e4255a5bc5bcde74b1d76cd117e609473f84c4068a5573dd744909f433b79d5b3c0688c8f5e0c9044c3abb1136f8fe30e7c487b469b03b0dda76036f8776768fbd0a3a7326653511258a68b2a7c044eb819e2146ecf1f462d6501dc7c0064ebb99cbf2ed537d912d262a841b5c0ca369188e58aa25f1f45dd90bfebe404bd1032234a5c9a2bc2987aa7d2ab4ba83e43187fd3710bb2adf57ae7eaf24ebf074d6788261716aca2a8f18481226b5b3bb237479e2c1833c238b0bd1b05a0446092b6ba412569c966edc38728da854c72af354e3d4c3675e55106f23421309810155324599b9cb2b5922afa37185369c14d3e964e3b70df29ea2b7f84709b8fec28f6332149803fda046ff9103de84a016b698d9e4fe5db354e5c5f693ee8174588dff88878365171a3955face7aa1bf1a7bd4992495541cc8b209fbd385511c1c81768088d731871f9e9f50e0f4d9b869d61898fa88874ede04c5b35705b5f73c6db4cd0951022e6632fdbf36fcb3566cc14e828124a258aad7ba96c84f2ddd31888c61c8a67c4553987a6599337a2bfe70fb2c6c37ae821780f43d3755d32cb76620c3de001edc1c8b9f70cb522bbfa08e8572e83107dd8859e4018b357f03c456ba36b1e9ce4c7bcb9886b4dde43c82cb604b921cd82017106935fb61b5c2d5b8495dc531c614eb258784d5e3104dc3d3193be59d6c8b52b1f0faa137df6ec84721ef337b33e21d4d98cac1e2c2e24ed1f8b39b6c28628c855a49a05eb441ecbcae7427e7f95cc5d621911ad0c338e23a906feacbae4709c8ccce74170664d7e3f266547c959081212b77c507d7034aede4cd3e870641f82816b45de412fdc25e0b72f4b04565b38fdc32847efbcf3e7bf288d393a685fbda7bf7b37aa440a1a8c7d74b87156b5cf71265b7ff381c0e295d04162266b7433e0e7dd510b9e0abbb8b259f829cd3a34d1b6cffef26180838f4420abaf2034ef2ebbd488b686a6b4a5a88504bae98fabe84682ce732227cece512e0d7ebc29a54c797450519b54fa500061544d901a7c18d83eab5f599f45db5806e806ca56c899426b9b1d385143c558abd5057870a7afa031166eb9a824cb114b0b6b7576d192f5924d628cc1dba760b0a3802874ec507d7e1f515ef45319083479f464e6d24f963b41461d49e14702a29b5f70779a96c3e53bab31b48c148e62d627f3443391962818df69982ae1ff9553274b698e7c91a92e29439b46b27e06142739a4b8986701105f3444d3df47a0c48aac0bf41d53a625539bebc8641fc6caf93de1d56f2e5fb091b549d84a9d5db57b97655e28eef62aed923c6c45475be26d17ae878f06262b5e65285bd060da30cd958463ca222a9fbd1d53bb9ccebbcf2945960b5454cb74ab473baf94eadb96d1d3f6b04ba60cabf2118263ac16c3db3d6f082abfec4e9cdd2acf0251183807d5c79210c0a5f78d5618413a9af4dbbb52defe0fe7c8538807abfe14c8362fe8ef3332305afe4370902ab977df61827e25819a7a7f", &(0x7f0000000600)="9a7c7eb978e9f65c50da43163e4a9cf56c45225a7b75065b7863159c96aa41d7623197b526ab08c6151448c81ec03eb554470457"}}) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000016c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}, &(0x7f0000001700)=0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f00000005c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0xc0000031}, 0xc, &(0x7f0000000480)={&(0x7f0000001740)=ANY=[@ANYBLOB="4c00fa00", @ANYRES16=r5, @ANYBLOB="010000000000fcdbdf250400000008000500e2300000080004000000000008000600000000003c400300140006000100e200000000000000130000000108000100000000002c25de140831b0d406d79828f8184afccd3a16060feda977a3dae08feb40fe5dad5f4731c4e7280ab6c1cb942eae14fda68e48d11f3c1cf33e176acce6e21ff896a5e28ae6566996c7ab2e79cd65f643ada519d87ea9ce4e950be504097840b6cf0e40feb253be5b93f31cc395d0efde621a7e860944a64bf4dd6967b640310caf80b63813a5976620d320dc61f1d4bc4c36db57461bdabc8137f613318b8b1a5a14528c17e109defe1866be36804f3d643cb136e7f2679b276e616ff2ea90c5e69d0eeb5b2b8ecf9fef7c7954cb2095df5ba63f408500000000000000846835e18ab4045e46b9f14528b9714cc8ad4a2b252c2f242223c1a5227077ca6cac70cf909cfe00db806a06b38336916065744044746edd8cc99966a42fc58e53e5aa8669128172e87c044dfe33e106ba49a626b97ebf21a2927dad6e81e3f633ebcb67b969b59def22db3ced08f7b42aad41cc5578438f2be6d10015afdc2e40f0e4a41489645ef11aee84b867de0364bdbb745857c21d429a80be609ae5e4b81ac9bd"], 0x4c}, 0x1, 0x0, 0x0, 0x41}, 0x10) 03:33:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 498.522187] binder: BINDER_SET_CONTEXT_MGR already set [ 498.527727] binder: 10423:10435 ioctl 40046207 0 returned -16 03:33:31 executing program 6: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_read_part_table(0xfffffffffffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="000000000000000000000000000000000000000000000000e0e51532000000000200880126000100000064000000000127008e030c00650000006400000000030d00f0043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) request_key(&(0x7f00000002c0)='dns_resolver\x00', &(0x7f0000000300), &(0x7f00000000c0)='\\%^self\x00', 0xffffffffffffffff) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCGIFMTU(r0, 0x8921, &(0x7f0000001680)) mq_notify(r1, &(0x7f0000000640)={0x0, 0x38}) recvmmsg(0xffffffffffffffff, &(0x7f0000000b80), 0x0, 0x0, 0x0) r2 = socket(0x19, 0x6, 0x800) gettid() syslog(0x3, &(0x7f0000000380)=""/201, 0xffffffffffffffd5) r3 = socket$packet(0x11, 0x10000002, 0x300) r4 = dup2(r3, r2) getsockopt$inet6_buf(r2, 0x29, 0xff, &(0x7f0000000540)=""/25, &(0x7f0000000200)=0x19) ioctl$SIOCGIFHWADDR(0xffffffffffffffff, 0x8927, &(0x7f0000000280)) mq_notify(r4, &(0x7f0000000180)={0x0, 0x4000034, 0x0, @thr={&(0x7f0000000680)="875121050911e8d9cb7386b20180b0436510747edc7dccd4f25bc0bed203a15d759cca1a63e4fed8f5e87207bb8ef908b465fcaddbc95bff9f737a64bf81be4ec5f2f88ef220b525c09e774fc09e351e71052a7ab248e229572ac5e2658552185c9df4579b097b1f4611384a61325e85baccbe035d9b53e3d91b66af0ac32caf4b2af52a78d9aa130c1ce5611ef22f501998ee82a54a3b30ab30d000db11b2012accdc9a7e4da187a47d5db2e2199a555d446c5ff1905dd2efe1edcadbda279775cd7591a431e2af452985df6946a4b388316e764152f69871fb89aae794fdba5f9f3eae38e8514c4d1675568ab35b77677fb6929a34deb2cb3c321dd16fc9bd67b4d4cd0180a9bd3927de8765f35b87a961a482ce39c0b9e7c966d590b320de3bc550b88de79aad6deabacd753b4675323134e903ad22f8948a9083a4a87f94a65da92fa33a48bf4a2e2f9b7301c6c2c5654d9e4a6ee3bd5d253b3f8c6fbe75a639a92dc041a2cdb643994342d50209a37eb4684fe34947ea4b53d5ff5a2ca20a5f27bb3b90990056a7c6178a0c78356294dc850e86e824ffd8ee317ec88351c5c191769c9eaf110a971cd583e5b02e9dfe331baaed50c65d7c39ed4462ce86693376f0c37d277fba51e45a9e3a12cd8c6e56dc516ee201ea6e0da11711e8180309a11fd4fc3e0e6bbaf56a0eb13c00bf961dd9adaba4b4636e0e0009d0f053020f6de0cbf36c5cb8591eb04ab1b5356268744b0c522a3d07c1a6d0eccb4ce66a74f2f1d28f493908b50d0c663c2130d821e2172a43b53b6b083a9d044d2282fdeeec1f0042e36b7017e305d9ec1d5017c44c7ad12c62f260d8fa8a65e6b54e14e66a57b03347af31e4d83cbf3cb223851ab885ab8d16952877016b46e33378a66e98184c4ebb3f305d520f64f963e007060c028597903973d00b8698485b3d275b23cea6c3aca8c27628aecfb4e7f456ef3b44bf7ec7063cd079825ad6fe0dcb9256ce25260d96d895c79b1fa3e789522837d48b1760009b2001ef1ecae95df88198cfb5fc82ee1dd0d02c93466101b1f18b476a102dea3e3bbad17cc1b267cd9b319b264e334831c121f11aa4254e986e6f5e7029c65c3da524fa8b71492a02d7fa187dee026f668da11017917fd518d8ea3343c927bb359160f4a063f780cf16cf1bff7b900352e05ec45160c58902b3818653def4afa7a234b475a2aa8504eb924efb7aea9c1a3e60607dc06d5eafb969399070ec2f7897b968f0e01aeee9d6d3466d453a847fe34477a78d5965aadb589cc56e474fcac0e1f6b8e38e0a3eb136b03dcd57db67a36c7f885e0b20a375fa6d3c89810acefeb5b41e8e298d2e001dfc85614c7e49d513bb585de0a18b7ffaa5b16f6df7e12c6bc6f64b45f2e979e373642517b7a762378bfb96004cf1d407a7569d2181c70c014ff5179826c2426727e5192237815b113eb62cef506600b7dc89761590c56bae6653e82a8f810f5e33db97a880ad2200c2349d3ed59959b44c875ff0ecde742eb921ffa982deb9f7bf3081d793752afc6fa6dd63b617edef7cc6a430f37161e0689441b3c7996f934d7abf3bac09c6537e662ad70ced79379ea025b8f25dc10f4d2bcaa7d7d2a1aa3bc8d9aaf4e585a31fa51111f30fcbedfd8a2281a58cb98149c5c910565496fa58dea9dab766aec6bae3d633a5cf8a2b08dda0c0b8b3622ed2653dac20070ecdaaa08439b2eea73b75f0d1b2afa8e786c88a9cf675f54b415a9f8bd58710249746f36caf9d55343cd0c0592c4cf9f57b690bf45e8b87b3e8cfd456d428a715a2ad6a0245e3f8efbbd103dc0bef16fe8627a6ac205e07fbdd6b15b539bae2bccedc02960cee268c06cd093b727cb7b9e3ea4a3b9743a0ae111e8d1efa3757322969490a4e0ebcafa1c20083005b73690062cf5d6b15cf2ffb783059443052488916cafaec62b49352fa0cba8f4b3609cd0476411b79522dc0deefb055dae4e891b48ca2951f80ffd127deaa9fbfb0bdd5ed04f094df86457a44839c92e109dee7ed791a25d486ea7ed2a98a521209d51d4e37d35981599a633b5d8d5b389161d82683c83cdbf614c2ab92d39b5cd970485d1b8cb3b14aa7102b560bbf9b867c2df30dc520765839c3e8e7f8f17f6268c05db53bbc795e362bf5b34e636afd30a6b93762cfc62ff433702ee077789ea182df37eb0c14e2aea4da602c6a3af033fb0c88f22b6a341bb735c8f557c53add61804c6f8eee1a9253fc194f2d5bf69b2c481062f33fa5d73a0db58e6aec0b5fd97f076a8c161bbefe96d999a9c39ddb91e57bf195ed70e06eb2a41fa9ab310a24128cdf8bb1cd63f9a5e3374a115a943ca89c1ec1c99c52f0f57c2e86ee33983419147d8f7393afb8f326882c7e79a87c056fdb830a0982b52021e753a9cef95aae92aa0e9735665213135d52ec819d22980e72806247ad18c966359a49b1c8ff794c3cbb9a9c0661ee763aab6efe83ac1037c6819937eec7b53d67ffce67747ab7168f6bac2fd98388b1f74f45165dc09f078ff2222824f10ecbe7f332f529388359f71a83295dc698addb017f866b4c2364709efbbb1d2495ac12dc122177fc85a97e6720b5767556c19e7c67e9d22355edfb0de32257621356459b27517204373c6fee7bf38ea70f648ab61201ae0d43824d4e8406d6900173e588c0c1240238929b509de84e4b8367deda8c67ffe626a999cdb13dd43002e156b401ca3e7f87e434626278ae717e137665dd205c027d23628b4b233471b87627e3a0e87a0a4c63dbf1523a05fae5796618a5f2570f25a87e0cc32a87615fcea3a988f54ea298d92aecd290088b087abb107e31437c8c1ce15b3b996e2d3f9916fa5b2bd471b100cca507dfb2324b51cf4808ac4e62f3d23c63f197aeac2d120409591b33abf87260114cbd8b5f4f9c26208594ce50bc4c96d21197ec09596c4937daf0cec867b01822e8a3cb487aa16bae628e4f6a094bc9f4c05a785e5d4eb21edfd0aa30d990a9756b1a4e4c1661b9b09957f72b3c9a0c361e6f26fed5f0db0254b3848d442f8f613033aab1f02edd1f79f3bc318a2abd0585b8a0841479bea41569c88033963787e84491d14a510eb2aa9cf7868fead773083ab3bc270c7e63713df9dc0ae7af78a60a22cb4a5120ea817c7960863df8c86232a8b79f05231149af166a9c043330d926242d459618b4041d31f63eb79bf3892480fd073700a94317655c9009ab55efea526154c8c6947403a8dae08d84d6af8994d35432a578160207fcf49de1d49858e9c1c08a65f18bf63dccb96bf2c359f9d655c5843670d24d93489df807306f18f8db809417b8365e9ddfff2d31b15ad66a8085e2a03a15d708078199b6762499dd0110549ef8343c9149376983cb9d8f0c5c18fe55eca6c38f7b8433b4905f7b36bfacb0f15b89bf00a7f2b5cd8a1c4d573f5d030bf040f0ef42da0992debbfb2ef645b3f6268ee78d1e6d2ea31baa40a7a42790ed35031ca12fc3fed8526796e1c220b1c390641f4a3d5f5735347f7d9b243e2fdae0aca57eb1f3218e95b1b07e2c1e7ee0af7849963d1335d2e56dae57260e9b4b197f429cb9da731afd6c3796ff117e9ddecaa01ae380f395f779245b0ad87bab677cee0df43dbb7ed710b484794cba4a4a6a6e122ca472aaa5ff20b949906334ede6d999d6a5e357c4536185decf8195b5a115ca20647e5442cadd453874968e72e40acf4ee0cbd338900c09b6d2542aa8e76439fcd9befca80dd3460a13155ef71368e789bb987acf8928ef5bf93f1eda8075144cc71b06c6284b85902bf5e8cc4b588867570ad7b62de896d2e0c9b16e7e905bf98da4fe5238345a8b45f8d1d5f6381867ae16a30e36f88dbe05e141878dfb48ddc9cf34f7c28d94b7b3fcb31743e8ad8e6deeb86668292e8b531c4f53d468d709dcb027134e513593a5dd22f51941c9c9d44bbdbb29fe7fa2781d4df6b677c82ca3b2e622371ff3bd0c8fe10e1bc47d24cb2f6c3b019befa65cf8662ce3f64e94323584e109b96b237f70cc94f981d8ae31d8a283cb234effe0a818380a18d0d88e40d7e0e9d45f8d15cf2ad9cc07725b2a0fd4432c1c3f9a003b2b02768ce4b0dc64a283c225df5de877cd41abee602d9abb939500f79506957906e9ee5134a1f4ad5cd3c95f7db5e02faff02714bdb144ce4b76de2026052442ae1f2ae837889588bc328c98681bb48003c7458797dd92441a22ec16356ae0e3f1061187824fd032e2409e4255a5bc5bcde74b1d76cd117e609473f84c4068a5573dd744909f433b79d5b3c0688c8f5e0c9044c3abb1136f8fe30e7c487b469b03b0dda76036f8776768fbd0a3a7326653511258a68b2a7c044eb819e2146ecf1f462d6501dc7c0064ebb99cbf2ed537d912d262a841b5c0ca369188e58aa25f1f45dd90bfebe404bd1032234a5c9a2bc2987aa7d2ab4ba83e43187fd3710bb2adf57ae7eaf24ebf074d6788261716aca2a8f18481226b5b3bb237479e2c1833c238b0bd1b05a0446092b6ba412569c966edc38728da854c72af354e3d4c3675e55106f23421309810155324599b9cb2b5922afa37185369c14d3e964e3b70df29ea2b7f84709b8fec28f6332149803fda046ff9103de84a016b698d9e4fe5db354e5c5f693ee8174588dff88878365171a3955face7aa1bf1a7bd4992495541cc8b209fbd385511c1c81768088d731871f9e9f50e0f4d9b869d61898fa88874ede04c5b35705b5f73c6db4cd0951022e6632fdbf36fcb3566cc14e828124a258aad7ba96c84f2ddd31888c61c8a67c4553987a6599337a2bfe70fb2c6c37ae821780f43d3755d32cb76620c3de001edc1c8b9f70cb522bbfa08e8572e83107dd8859e4018b357f03c456ba36b1e9ce4c7bcb9886b4dde43c82cb604b921cd82017106935fb61b5c2d5b8495dc531c614eb258784d5e3104dc3d3193be59d6c8b52b1f0faa137df6ec84721ef337b33e21d4d98cac1e2c2e24ed1f8b39b6c28628c855a49a05eb441ecbcae7427e7f95cc5d621911ad0c338e23a906feacbae4709c8ccce74170664d7e3f266547c959081212b77c507d7034aede4cd3e870641f82816b45de412fdc25e0b72f4b04565b38fdc32847efbcf3e7bf288d393a685fbda7bf7b37aa440a1a8c7d74b87156b5cf71265b7ff381c0e295d04162266b7433e0e7dd510b9e0abbb8b259f829cd3a34d1b6cffef26180838f4420abaf2034ef2ebbd488b686a6b4a5a88504bae98fabe84682ce732227cece512e0d7ebc29a54c797450519b54fa500061544d901a7c18d83eab5f599f45db5806e806ca56c899426b9b1d385143c558abd5057870a7afa031166eb9a824cb114b0b6b7576d192f5924d628cc1dba760b0a3802874ec507d7e1f515ef45319083479f464e6d24f963b41461d49e14702a29b5f70779a96c3e53bab31b48c148e62d627f3443391962818df69982ae1ff9553274b698e7c91a92e29439b46b27e06142739a4b8986701105f3444d3df47a0c48aac0bf41d53a625539bebc8641fc6caf93de1d56f2e5fb091b549d84a9d5db57b97655e28eef62aed923c6c45475be26d17ae878f06262b5e65285bd060da30cd958463ca222a9fbd1d53bb9ccebbcf2945960b5454cb74ab473baf94eadb96d1d3f6b04ba60cabf2118263ac16c3db3d6f082abfec4e9cdd2acf0251183807d5c79210c0a5f78d5618413a9af4dbbb52defe0fe7c8538807abfe14c8362fe8ef3332305afe4370902ab977df61827e25819a7a7f", &(0x7f0000000600)="9a7c7eb978e9f65c50da43163e4a9cf56c45225a7b75065b7863159c96aa41d7623197b526ab08c6151448c81ec03eb554470457"}}) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f00000016c0)={&(0x7f0000ffc000/0x4000)=nil, 0x4000}, &(0x7f0000001700)=0x10) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_GET_SERVICE(r4, &(0x7f00000005c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0xc0000031}, 0xc, &(0x7f0000000480)={&(0x7f0000001740)=ANY=[@ANYBLOB="4c00fa00", @ANYRES16=r5, @ANYBLOB="010000000000fcdbdf250400000008000500e2300000080004000000000008000600000000003c400300140006000100e200000000000000130000000108000100000000002c25de140831b0d406d79828f8184afccd3a16060feda977a3dae08feb40fe5dad5f4731c4e7280ab6c1cb942eae14fda68e48d11f3c1cf33e176acce6e21ff896a5e28ae6566996c7ab2e79cd65f643ada519d87ea9ce4e950be504097840b6cf0e40feb253be5b93f31cc395d0efde621a7e860944a64bf4dd6967b640310caf80b63813a5976620d320dc61f1d4bc4c36db57461bdabc8137f613318b8b1a5a14528c17e109defe1866be36804f3d643cb136e7f2679b276e616ff2ea90c5e69d0eeb5b2b8ecf9fef7c7954cb2095df5ba63f408500000000000000846835e18ab4045e46b9f14528b9714cc8ad4a2b252c2f242223c1a5227077ca6cac70cf909cfe00db806a06b38336916065744044746edd8cc99966a42fc58e53e5aa8669128172e87c044dfe33e106ba49a626b97ebf21a2927dad6e81e3f633ebcb67b969b59def22db3ced08f7b42aad41cc5578438f2be6d10015afdc2e40f0e4a41489645ef11aee84b867de0364bdbb745857c21d429a80be609ae5e4b81ac9bd"], 0x4c}, 0x1, 0x0, 0x0, 0x41}, 0x10) 03:33:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) shutdown(r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 498.608997] binder: 10439:10446 unknown command 16388 [ 498.612331] binder: 10440:10445 tried to acquire reference to desc 0, got 1 instead [ 498.612696] binder: BINDER_SET_CONTEXT_MGR already set [ 498.612704] binder: 10440:10445 ioctl 40046207 0 returned -16 [ 498.622588] binder: BINDER_SET_CONTEXT_MGR already set [ 498.622596] binder: 10440:10445 ioctl 40046207 0 returned -16 [ 498.649352] binder: 10439:10446 ioctl c0306201 20007000 returned -22 [ 498.662952] binder: 10439:10446 got transaction to context manager from process owning it [ 498.671392] binder: 10439:10446 transaction failed 29201/-22, size 0-0 line 3004 03:33:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 498.704283] binder: undelivered TRANSACTION_ERROR: 29201 [ 498.734768] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10465 comm=syz-executor4 03:33:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="7472616e733d72646d612c706f72743d3078303030303030303019a7ef0eda2f1a781fd0b330303030303030302c54e9d1e36a15639283a914cd8174696d656f75743d307830303030303030303030301aa3c704d4b7e17478c4088830303042312c73713d3078666666cc6666666638366162646531642c74696d656f75743d307830303030303030bdfbd065a145acf79a24f3520fd8ce0555eb123bd24903fb74d2a8a2ea34a9950e015c42b064cc10291e5f2952ad92268d25b666962ac0fa9bcb94e04cad8d3b2d217cae558445482df38d1b3abc3a2d72d97e49d9174b185968c0e8bafb8d1ed87a0d933893fa3171c65d0435a0ddcba299678273cc4e81ed09dc131ffa84748af0ebad4790b73ec591954bb014501c8578009ff895b2fcf3e14ee5655c209eb45554a0d9b7cd6f63299b1a26682a7407cb2b0a13a70278527393fcb154255c3fb21ac7fcc9f4e682094de99b4d321b958d18942323c9d25cd39f7f1f8c88469798ca9c56eff413b8ff1cf9de1b4a0ce3a32a8ceb3a98d3936f0aca4e47c48b19b92b57515efb2a6d2b7eddf8bba350ea27264ac69b08e130eb9a64901a2772034725433c0534ce560c31a3016c394a90a4272141cbb76427332308c2cd7852f1231a37f29f76846e85268f5e401cf8ed95c428e3bef06c18c7d7c0a92ac0dbfda788e2233881ce0025ee1cdfb8c03841709b1c73742566730ae83ec4cf671d3950c43fd2747ce5aed4a527b62289d230e28c7b469c67be46877f7875cbbcbdcd5cd267e0ff62906f1b7fb9400efcb5000000000000000000"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:32 executing program 7: ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/enforce\x00', 0x10047f9, 0x0) ioctl$TIOCEXCL(r0, 0x540c) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_read_part_table(0xfffffffffffffffe, 0x1, &(0x7f0000000200)=[{&(0x7f0000010000)="000000000000000000000000000000000000000000000000e0e51532000000000200880126000100000064000000000127008e030c00650000006400000000030d00f0043100c90000006400000000043200052020002d010000d306000055aa", 0x60, 0x1a0}]) ptrace$setregs(0xd, 0x0, 0x80000000, &(0x7f0000000300)="901e0135804e86") openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000480)='./cgroup.cpu/syz0\x00', 0x200002, 0x0) syz_mount_image$vfat(&(0x7f0000000000)='vfat\x00', &(0x7f0000000100)='./file0\x00', 0x100000000000e002, 0x0, &(0x7f0000000040), 0x0, &(0x7f0000000240)=ANY=[]) creat(&(0x7f0000000a00)='./file0/file0\x00', 0x0) seccomp(0x0, 0x0, &(0x7f0000000200)={0x1, &(0x7f00000001c0)=[{0x0, 0x0, 0x1, 0x7}]}) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) 03:33:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040), 0x8b, 0x0, &(0x7f0000000080)="1212cc031fc7b2f04182fe35e7136e8caacef8880db5da741d757fcd2f78d6bb8ee9b2be1b5dd61e09f05357c7a4cd55f3e8b2e2d2ca82d8ff6fc3c69d001d0ed7a00da59fb9da2194e78eefe5a9ce49b48fa63c69098bad0d8b7615c8feade05173b8631944e512467e6ba8aa2b856ced9880799c8ee56c120cd71ab33bc72b8cfcb24c486d396a3ded6c"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) recvfrom$unix(r2, &(0x7f0000000940)=""/4096, 0x1000, 0x2040, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:32 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) perf_event_open(&(0x7f0000c86f88)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) get_robust_list(0x0, &(0x7f0000000780)=&(0x7f0000000740)={&(0x7f0000000180)={&(0x7f0000000140)}, 0x0, &(0x7f0000000700)={&(0x7f0000000280)}}, &(0x7f00000007c0)=0x18) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f00000001c0)=""/9, &(0x7f0000000200)=0x9) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c000000000000000000000002000900020000000000000000000000030006000000000002000000e0000054d81458186fe8b90002000100000000000000060200000000030005000000000002000000e00000010000000000000000"], 0x60}}, 0x0) [ 498.753062] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10465 comm=syz-executor4 03:33:32 executing program 6: r0 = socket$inet(0x2, 0x803, 0xffffffff) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000ff0ffc)=0x8000000000004, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000440)='/dev/pktcdvd/control\x00', 0x241, 0x0) rt_sigaction(0x20, &(0x7f0000000640)={0x0, {0x8}, 0x8000002, 0x20}, &(0x7f0000000680), 0x8, &(0x7f00000006c0)) bind$inet(r2, &(0x7f0000deb000)={0x2, 0x4e23, @remote}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@mcast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000000100)=0xe8) eventfd(0x0) getresuid(&(0x7f0000000400), &(0x7f0000000480), &(0x7f00000004c0)=0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000600)={0x1, 'bridge0\x00'}, 0x18) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000500)={{{@in=@multicast1, @in6=@mcast1, 0x4e22, 0x5, 0x4e21, 0x0, 0xa, 0x0, 0x0, 0x67, r3, r4}, {0x6, 0x80, 0x4, 0x5, 0x7, 0xfffffffffffff000, 0x1, 0x1}, {0x400, 0x1, 0x8000, 0x2}, 0x0, 0x0, 0x2, 0x1, 0x2}, {{@in6=@ipv4={[], [], @rand_addr}, 0x0, 0xff}, 0xa, @in=@local, 0x3507, 0x0, 0x3, 0x0, 0x164, 0x3b2, 0x7}}, 0xe8) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000340)={'ifb0\x00'}) sendto$inet(r0, &(0x7f0000865000), 0x0, 0x0, &(0x7f0000fd9ff0)={0x2, 0x4e21, @rand_addr}, 0x10) [ 498.843673] binder: 10473:10477 tried to acquire reference to desc 0, got 1 instead [ 498.852661] binder: BINDER_SET_CONTEXT_MGR already set [ 498.858373] binder: 10473:10477 ioctl 40046207 0 returned -16 [ 498.918546] binder: 10478:10485 tried to acquire reference to desc 0, got 1 instead [ 498.926617] binder: 10478:10485 got transaction to context manager from process owning it [ 498.935258] binder: 10478:10485 transaction failed 29201/-22, size 0-0 line 3004 [ 498.970620] binder: undelivered TRANSACTION_ERROR: 29201 03:33:32 executing program 1: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x802, 0x0) write$uinput_user_dev(r0, &(0x7f0000000400)={'syz1\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x94], [0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8b46], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000, 0x0, 0xfe]}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, &(0x7f0000000300)={{}, 'syz0\x00'}) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) recvfrom$inet6(r1, &(0x7f0000000880)=""/145, 0x91, 0x1, &(0x7f0000000100)={0xa, 0x4e20, 0xff, @ipv4={[], [], @multicast1}, 0x7db7}, 0x1c) write(r0, &(0x7f0000000180)="969516ef392495dd7ad3624d191b626d25327955abbbfa26c9d562b0cf72cfd7979f0688e66e09d3d80ae569053f123dbc54e96294181a4c1bf005e06a2a7fc03cc81e7a1bb1d9f643415a4356b0bd4010162b92be8538909f31514875b920407e45f9cc92ec590d3a0e275363ec4e12f2b6", 0x72) getsockname$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000200)=0x1c) r2 = syz_open_dev$evdev(&(0x7f0000000140)='/dev/input/event#\x00', 0x3, 0x0) ioctl$EVIOCSABS3F(r2, 0x401845ff, &(0x7f00000000c0)={0x0, 0x10001, 0x0, 0x2, 0x7}) sched_setscheduler(0x0, 0x0, &(0x7f0000000040)) 03:33:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x480400) r1 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000100)={0x2, 0x0, @remote}, &(0x7f0000000140)=0x10, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000180)) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) getsockname$netlink(r2, &(0x7f0000000040), &(0x7f0000000080)=0xc) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = dup2(r3, r0) setsockopt$inet6_icmp_ICMP_FILTER(r4, 0x1, 0x1, &(0x7f00000001c0)={0x3}, 0x4) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="60aa0700ba0ade8045d542ca061be13ab59d7081e663cfec76074a1c9cd1ac"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630477"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0563cc5135a181d10dcdc92b0440ba6db0a8adda0e42d6ce9495d6cf30e996c8d860b1c6a220c7f7f6ae5df0dda808155f90b43337cfc9ab1665b71ea0e23d563ba8d42d5ad897c8eb667c3a23a3de0e16abe5aafd3adbcf8d04013d15ae5ce51d8aa2a838d2e1cce877d4d70b729c3b4e2eb27d22cb2020fbecd584dbc2d1274ad86dcd4a78fcc4baf2adfc8743329275a5ff132e6e43b882534f2cd6c1295848e03d2a7468dd745d2ff92780d88af5f05dc1615bf038cd339c0000"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x4, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x8) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0)='tls\x00', 0x4) 03:33:32 executing program 7: r0 = socket$inet(0x10, 0x3, 0x80) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x0, &(0x7f00000001c0)}, 0x0) sendmsg(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000009ff0)}, 0xfffffffffffffffd) accept$inet(r0, &(0x7f0000000040)={0x2, 0x0, @remote}, &(0x7f0000000080)=0x10) 03:33:32 executing program 5: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) dup(r0) ioctl(r0, 0x8912, &(0x7f0000000180)="0a5cc80700315f85715070") open(&(0x7f0000000000)='./file0\x00', 0x20000, 0x18) r1 = epoll_create1(0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f0000000080)={0x20000003}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r2, &(0x7f00000000c0)) 03:33:32 executing program 6: mkdir(&(0x7f0000000180)='./file1\x00', 0x0) r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/vs/drop_entry\x00', 0x2, 0x0) r1 = memfd_create(&(0x7f00000001c0)='/\x00', 0x0) memfd_create(&(0x7f0000000040)=')*securitylo\x00', 0x2) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) 03:33:32 executing program 7: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x0, 0xfffffffffffffffc}, 0x3) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r2, 0xc02c5341, &(0x7f00000000c0)) sendto$inet6(r1, &(0x7f00000001c0), 0x0, 0x0, &(0x7f0000000080)={0xa, 0x200800800, 0x3, @remote}, 0x1c) 03:33:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="e94f6886741a8ab3e6b5e6d930612de412cceb24b730574c30292cd203a03e7c49d8f44fcf71f72e5691c3f46eea9e5ae12823e3d225f909a5b87677d02c1f52bd9a761d5aeff5b9a3a4f803158b6affc8c07e53650e9ae532cf11f2f32cb1eddf29b2516b76b60cd2841736e1bb2a0629ebdc58e16552a71c7fe4c1e7ccf24a37bc4a02eb27c9841a89a617b3ee311ac05d53d10d95aa3a068b5b3b653e376b2129b8a3ce12572e0d"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_read_part_table(0x8, 0x3, &(0x7f0000000180)=[{&(0x7f0000000080)="19d21e7e46502efeffdf83f44742f37bca3b77fbf6be735ca83d35fb73a705764e8897f528920a33d8ac2f2d129a2890742cfe7816820c46cf0582ab32f38ea16a9475983d83ba4593ed61056e06bdde0e44720e97ca322a2e1314a2891953d5dc912f0e3d4773784bb4ca40ba14c6ce2232452fc3b9db40c3b831aac7f2774f", 0x80, 0x1000}, {&(0x7f0000000940)="e41abbf06255312752b75ef4d9a071ef51e85d2948cc38c4cdc875b5592f0f749455e5360e09f8e9aa216a9908d7e8fc74a4e4f86b12bcc89c436cb2a8e0f4210c487f585ecf9bcc9a59b020b8db4cc6a3426bbf0aff4fe5f05f748d6513d0d19d6579fc3e58f8b35c7342d70b442eab312a702a655832742909e8f6a384357a13663473d98dae3233d8ee7c5564591f5156a628c19d36db2dad0d417dcfbde2206edb3618817ea684f32751cf4926f1c1c891d9fc5c4fb837b1950803c38f97bce5cd80591244025acdadb97e4fca39b03c988d8adbf4565e87e100f304dc3e0148c65069b5a6508829da9d48a88460e41b6cb853017e752a7ab0c7453e1a3a00097b81f8cbd4b802bf1a091b759f50066388513c559c91016020cfad5cf4be90cee1e627651a38d41ddd417c10748e9fd2afdd7bfff152bb9b41c1f84fec24c949c6aa355e995346bd39a03e345787eabae8355607c1f0ed7321cdb2cf1406014897db8e7e0c3f49c483b962a8ded6edffa039ccf3f6683543d612c4814b79c7cefc1cbad4098d5aaba0cf4c599d832e7102789e4ff8701a2a1483ce2d239df176ef85a9a30eaf0318220a93a7cc4ce664b4a81cba10eec9944c7a3ff87c1c7ad9bf5e61a28ed094787ba6200857299cb7e89fa1a1935dd4794cf30aac4dc9183430dfd07d57bf91d582d8be6660857c374439f76e2cf4d81f1e023053dc5d0d14497f537c91f3a129f3c6495185e94083b4ae74866d3e4c7758578dd6bb333e6769f758f933aad6746eb899e08622d2a5706bff7a3bf6ca042c1a89ef89c0426a1269f142cd138501cb057bd490afdcfaf48d9cacad70482af1b758deaf3ca2a5aa4a8b872e13a74c67fa6e23bf66ee5e72e0a8c743da08bf7adce9721c732bd335ae43c4dca18aa0dcdfe9ad7dbf1dacc7672f779da5d0c65e49af407ba9cbaec96148391c92c9ca4acc5e1af4c6df5d36fa84f888ff0e77a5881e637969b15f60f301156d6c610c6c58be6ea3ae46eb0425b69317b8da7d6e1f2a56836b90d12ac12c4fd4c636c2f5a25764cb9f20bf5df17d0659856c9e1700a77c4980f3576e5dbb7515b1e8ff71ee4b57449d269eed45dba235c9a53732f68ad9e841cf0d040dc1b989c70cfa31d6a7570f6c6fd6f4f3d34c4f9232b77561bc761e886b99f6d921a5cac320a4a275c30d506ddbae22656a70b7f88e35c81044950f91b9577bec597065af2f63340d2df82fb5a02bf6e7a028193073c81b155763e25034cf459945c20018f8e501f6ed5e00bc45dab1b1ad3417983ccc61d42ed6d14709e356fcc6c8cae36209669c7d06c86563b4e42068092a0a06eb98fd9b7320f50f7639c5799138d2c392310831fd39666851992de7f87ea3af381e31da09e76b7d4308bef9c02072637a4cba78c8dab2dc934ac91124bfeef04a46c3d07b02bd16104506958bb65c9d8fa9aba774c82fe5a8008a17cc64df453579b0e7c773bf77e5fc4fe86a73c94120dd53ffe10385f9b7aca5af54175d4059ed3c82f52128a1a0b6c4712a0ce168b58f34c81dfb9ac0b0d3ed484d9aa3e33fa6d2c8a06b5d82252e76e1fc64582281fc1262c97e4f146d06f073c6afb12787bbc1e4e82b6d1c09224ee0d3d3efa4e281b5f5dd85b5f5a53a441481b9ca1c24ff8ae6761e42265744a3f37b489c9908d2dca8be85ad41fd71f3a97338130e54c1bf7b2d426b0a0eff6fa8971dd2566de506215bd90e538157e18dbc6b40923e6f1a7b4d70653a9effddf1c49909438c1708de57c9041844ab37359665f038c1c3fbfbf372a560a6f492022eb789b83b16a4ddc441e11b4c0bc9ff1e8ac5d44318c80e20dd798f459b01a08538c5ebb28d381e8b76baab7b0bb3e200224d46af3f07aa824d93572479d8f4831b4d2035fc45a14e9541e8ff9233cacaaf788080b537b0129eeef22e0d8e635dfe82a2542ef1290d3e91fc706b091816c5098f547886ec4a0b4e5c187ac7a9fc8dbcac585d6219f4559a4410fcf59b306605a61a443d2c1465f14eeb7e5beadf44d96ebf9ac39837e4faf149bdae14ab74d6d262181672b74f3f05bdeaca640e2367764262eeb7aae2e29601f59f97c1c7909a72823c6a03ab0ede981a9ca48dd4632593355d787b0ab540eb4fad11095cd6d5a46045deaf9fd2e86e4171ff007ac8fa9f5e4102c358d65945c65c9c2d38bd745138b218feb950585412845b38f04e57064c49c6488746cb287382fa1e28e8fe09e4674206f7f3fdb3390573027286c8926ab7cf84342a26a1ed8bfdb4710b9766f8ccc1a30cab512d0527bf80274d08292b5cab78428397f2b9255ac73d44b81c0515b99ccdb577f9bf54748be006296ca87868efd0040509bd2a1bc05acd169a94e0583a1df63afad56d1fa811ceba364e0d5b27ae25a121d9c6a984822818159262630395661f1fbf9fab78039658ce747ae0f10663ac0bae5d9113c04bef310446d7e217feecb84fd6736ab06c731c27781af0b9a1b319dd2f1d5d57f188251e1cd396be310d848e43295aa5f6dea8810904645ce0d05962eae53813881cbb5fd96e452e63e459b46ef4b9ff8e2b5a58590df10d0dd1af369f41c678838dc720c79736aec1e5cb05654693276b741512c2bf0b0a1038a8ea6f9bd9f3ab488c8e65ab422a95d01a34efb9b53e2a47ae0bd690028427f85df705454945fc9020f23a7d89f2d1c932f459aa938d28f7465424a13057783082ada15496d926b6687452fbb58227287fe2b2ad370e7b0312e0352fee7c05f5cc2e9f38cf20914f706eff1ff916a154afb03d24a807257d4607bb6fa19592d78b29d8b5708193ebd05461c5eb3f637b27d3585a1ed06ca34c941e3b2c7d5b0fe9adeb06d9705787b759538c80e1078c3175c80e6237c6b122e9b654b890b07acb33a2ee9d307858f7bff4c153a3629eba24c6f809a08acb7faa16845128c564d9f84c30bc4a9a00ae97c25db8ffeba5ec4cda2c16299e16c2249943a1eceead3479176ea36afd10d55bf0715fdef37f7919ea7016a1ee4ba7ce9028031884db9677d11df172b37c7f6023d44a52dd7b0be2523d36989d02dc6ab88305d0befa3cb5ee78d37b8b31dbad962a9923542b6a8720a4c71ca2b9202044d630dfa8c9150adf671f42a6e1fbdfa1d93b9ace32fbf3ed205f1c29bb7bcd1a77627dad930dd40a0461edbf42825cc0583c570d8b96df9d649677ab009348bc5096ef456c3951ee19b4ece606382ded585823b756e456cd9318a82a8ed5c4b57b3ba6832966f81f4c918a50db43844cbae91fb0d03a6adf1bf2338846cd729fe5c7b7506e4c18b5dab9548fbccfc681f99c4f147db4af6bb7e029beb62826b1b21659b205831b6a388408b2c435dff83002d3fa733c78a271149949a592de5f55ce3fae4de164fe23849ebea9aa813dd55767fcdd90056b8a1d809d0dd4d96e15e157248db2aa2319b6b9256423a401ef31c7b58900a1fb82a03ef0a0449e6da235a95cfc16da23f99772652e4785cb8601c6afc2fe05c394a54a8954edd270a35d63922b2a013937665bad4aaeb54aa36a3347e088677e9d918ae40596a7fef0afb5878f393734343ebd2d1374e54472d2be18c44eecff262730eff9e66e5cdbd55d198484848e9cb4aaf79bfcd4e4ae92dcfa32d9a31dc754b60797e2fff4ee507cf63bfa13204f9c851f599b2e378b242b337741a572d4aa25f8dc51ed01ae76f75efd2b9fb6452738b075107bb232941ee6e47a4b2acd704ab9d4adeb33b0c1b34dc5a7df663fa28cf24064869fb3f831de6971a75d07c30e6a3d53c1058efd1ccbd6d5dc3528d5b7804ba597372715ccfd10da8cd63a4355d0e889bce8a3db2074ea0218109fed9d4fc5fc350fcc802828d616014a399b85bd0cfdd8aecf9e85a1463acf22b50758c609b511a6baf63bdf9e0d7c3f6fcf045d89b466394f73292e839577df51191cbcc0b32dd1981404e0f21759dbfb50e0764d34b9bc74517b872dcf2e531f68ce11ebd888479875a390157872a4eeb9dd667268164c462c40700706e4a87fb413f98af4a35831455d088c1b9777b6c74786b2a2587fcd7b69976cc930be27c0912c30093e4659d22e4e4354f933cfed52c6863ac5f7eed817484ddd9998bb57c025fd59faa61dd07183882f86fa59732ad3c0b2046c676a499f2b812782165b52ca3a04d5baa1dd119a7f8540931651936ea972574a4e80c8d2802c44c55b42f51905c781edea76d694b162a58924393643e2a35c8ade0c2f750a3a1424ced8592f688d3aad05369a62314ba55a3f35a5669be3242687111bc991483195f628f469812eb6556a1728b22f2591fa7f900abd005e21d007417000f7cc3b53736eb50ebed3ff3fbd3a013d863293c3f86af222ffbd482ca5fb08cfba16b1a90b4966281428b2bab77a7320f86e8582390999198f31f29407e6cded41c44fcbb573f45bfb97e6ca518b932ee558c856e557af8b139f661a1bb7ebb3d3c7e396e879e5edc35b1e7489cad24921f0fa61ec725f5808fc4ee9f699c6ad7d9b4fd697df92836eefea8f90929dc0e0d0f4fb2d3c532e1c28058431993c0fc61f3c86bb4e02097e242589de6c67ac4ccc561135a5fccac7f1fb32ae9ec49b3b90c9e42cb02b77a868430f8310ea98e7b1971ce7dd4397832992c8ab220170370d81ce2ff7b6f10b331a4b3b540f2ca31e1f6bd84bf9dcf23e165a318b8c13b5473531e71de0cfba356eee50306a4616f81774eef92bc20b9681cede42db4878555548ca5130fcd810630322e1dba6dc375521780fa7f0dc7a61022ee0a9f7b6704ed79b56c55accbd038aa90cc6bf049aa04b1c95ea428fb4545a1ccc13c0fd13ace8bfb4699a649be7fe90bf47002b456cd14fc5df5855daa865a1ca3bda5005997a15006bea4cab547f2f53a253c91513059edf654426c76eb80afa290a89108e1cbbbe6884385a6e5e5660e77f63bf530b730d158843441c1361f5b4b58ae5641269f6cbf924c197190220214dcac28b22585683ec29acd4aa7accaf161a0e34ae783aa87d9b59e433a6bcbc81f678a19720c3655f63627d68cc04268f58e8e37aaece65fea4742b01d0071f3d755ad1596a1e60c27316bf4dfb80a574812b1ce54d4829934f4644870579a50c941eaf947e70b8ccdffc37eb143eaa6cef0ecd4b496c79291e93d0cc1a5793d81c486acd68a614c5b8ee8d0bcc190cbe8c3fee13b9d2a4a8168ff412951e0a99f390d6a552b2d66857acc78cfa988e0217ddef781bb5edf48108945fdf14eb3349d687d283af19fb1c3f3f5c66fc40e31719e1c879933a60dc0c92bf439e290f63526774746b4a7b249e758a154113bb4746553b8459fbd9e462b9a6dd343fd6a685475185c94fd3f572aa8db2c9ce9fe81a992201eadaf2db143c653d188c90e60f0a61eacc68c4a5a1dd16cde3cc82a033fe5de622cce48488ec5bd533b1735caff91920aa982cef9fa6d99f95a25bce3f3ffd0a9695082bb726435de5188d26194704c390e0acbde10fefa906eadd1a15ecdf8b3562c3fffa48733f236a4d8a0f79a69742496b6735ed0258a66a491f527951ea4875cefb26dcde3b376023b6a3b4dd0de494b03f975dd255706682ef48d9a1f683aeaf79bbb0ea6dd53f6b3a6dff6788c3a6ca6fe30bc340890ba1a497ae23294909e6b920cae8682cbc457eb764fd5e63d5ca153167af8c575f26230f3a2628dd05ae160b9d054a5d423f01b317a40064b151b38cc75a70180e90dc3fff5c51f1b39b7f4af2d9e1551c97", 0x1000, 0x7}, {&(0x7f0000000100)="2f01b94acc4760662316a1742bc61f5250a11f14ff3376b5632f42f33e726afbab1029a19c4d518ae93b59c1c2630feba4bcee87b8a9f9c1e26d1e596197548e82bfb5ff61a00f0dfc339c5ac7c03e6b0e7c06a115b5ac6688e056bcad0ca3f195c6267c621477", 0x67, 0x400}]) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563f391"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 499.371806] binder: 10512:10517 unknown command 1372349189 [ 499.377643] binder: 10512:10517 ioctl c0306201 20007000 returned -22 [ 499.388319] binder: 10512:10517 got transaction to context manager from process owning it [ 499.398085] binder: 10512:10517 transaction failed 29201/-22, size 0-0 line 3004 [ 499.406600] binder: 10511:10521 unknown command 1996776197 03:33:32 executing program 6: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000240)=0x1, 0x4) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000140)=0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/checkreqprot\x00', 0x4001, 0x0) perf_event_open(&(0x7f00000000c0)={0x4, 0x70, 0x8, 0x62ae, 0x4, 0x8000, 0x0, 0x6, 0x1000, 0x7, 0x7, 0x6, 0x4, 0x6, 0x7, 0x1, 0x6fea, 0x3, 0x0, 0x4, 0x9, 0x6, 0x3f7, 0x2, 0xb4f, 0xfffffffffffffffe, 0x65, 0x235, 0x20, 0x81, 0x6, 0xffffffffffff0001, 0x7d7, 0x8000, 0x400, 0xa3b8, 0x7, 0x7ff, 0x0, 0x7, 0x0, @perf_config_ext={0x1000, 0xd1f}, 0x4, 0x80000001, 0x41b, 0x7, 0x8f, 0x16e0, 0x3}, r2, 0x4, r3, 0x8) bind$unix(r1, &(0x7f0000366000)=@file={0x1, "e91f7189591e9233614b00"}, 0xc) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_unix(&(0x7f0000000000)="e91f7189591e9233614b00", &(0x7f0000000040)="e91f7189591e9233614b00", &(0x7f0000000080)='9p\x00', 0x0, &(0x7f0000000200)={'trans=unix,'}) 03:33:32 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x0, 0x0) setsockopt$packet_buf(r1, 0x107, 0x7, &(0x7f0000000140), 0x0) ioctl$SCSI_IOCTL_DOORUNLOCK(r1, 0x5381) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) fchown(0xffffffffffffffff, 0x0, 0x0) mount(&(0x7f0000000700)='./file0\x00', &(0x7f0000000040)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) ioctl$HDIO_GETGEO(r1, 0x301, &(0x7f0000000180)) setsockopt$inet6_int(r1, 0x29, 0x5b, &(0x7f00000001c0)=0x101, 0x4) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 499.406608] binder: 10511:10521 ioctl c0306201 20007000 returned -22 [ 499.408142] binder: 10510:10518 unknown command 502368 [ 499.408149] binder: 10510:10518 ioctl c0306201 20000680 returned -22 [ 499.408460] binder: BINDER_SET_CONTEXT_MGR already set [ 499.408468] binder: 10511:10521 ioctl 40046207 0 returned -16 03:33:32 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$md(0xffffffffffffff9c, &(0x7f0000000240)='/dev/md0\x00', 0x20000, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) rename(&(0x7f0000000180)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000340)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f2f66696c653000") mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) perf_event_open$cgroup(&(0x7f00000003c0)={0x0, 0x70, 0x2, 0x27b, 0x1, 0x1, 0x0, 0x0, 0x10000, 0x8, 0xfffffffffffffffa, 0x3f, 0x68, 0x8, 0x0, 0x2, 0x3, 0x0, 0xfffffffffffffeff, 0x9, 0x100000001, 0x1, 0xfffffffffffffffa, 0x80000, 0x0, 0x3f, 0x8e7a, 0x3, 0x0, 0x9, 0x0, 0x1, 0x6, 0x3, 0x7f, 0x7, 0x0, 0x1b59, 0x0, 0x7fffffff, 0x4, @perf_config_ext={0x5, 0x9}, 0x10000, 0x200000000000, 0x1, 0x5, 0x2, 0x7, 0x400}, r0, 0xb, 0xffffffffffffff9c, 0x1) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 499.409325] binder: 10510:10527 tried to acquire reference to desc 0, got 1 instead [ 499.415006] binder: 10511:10521 unknown command 1996776197 [ 499.415014] binder: 10511:10521 ioctl c0306201 20007000 returned -22 [ 499.416079] 9pnet: Insufficient options for proto=fd [ 499.417399] binder: BINDER_SET_CONTEXT_MGR already set [ 499.417407] binder: 10511:10521 ioctl 40046207 0 returned -16 [ 499.435903] 9pnet: Insufficient options for proto=fd 03:33:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 499.541515] binder: undelivered TRANSACTION_ERROR: 29201 [ 499.570375] input: syz1 as /devices/virtual/input/input29 [ 499.579143] input: syz1 as /devices/virtual/input/input30 03:33:33 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) getgroups(0x1, &(0x7f0000000080)=[0x0]) r3 = getegid() getresgid(&(0x7f00000000c0)=0x0, &(0x7f0000000100), &(0x7f0000000140)=0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000200)=0xc) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0, 0x0}, &(0x7f0000000280)=0xc) r8 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000340)='/dev/snapshot\x00', 0x2000, 0x0) ioctl$UI_DEV_DESTROY(r8, 0x5502) fchown(r1, r6, r4) getgroups(0x4, &(0x7f0000000300)=[r2, r3, r5, r3, r7]) memfd_create(&(0x7f0000000740)="2f67726f3c23fb57e6c60f1f4b45b74d999a9a8c2c3bcce7be01a332229cd12dcea440d899c22cba00000000000000f3fef6e034d804e5f07302df5b540745df4b1dee483b157624c5bc719a099e6a357cd6abb4398c340800", 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f0000000000)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r9, &(0x7f00000000c0), 0x40002cc, 0x0, 0x0) 03:33:33 executing program 7: r0 = socket$inet6(0xa, 0x2, 0x0) writev(r0, &(0x7f0000000300)=[{&(0x7f0000000040)="47ac57ea54429c890e1f16919a3c92800ee4f6fa76d9b0ca9fcf8b9ac3731682627d83869b6942097b85774bebb4e9988ab4562a397ab9b4cf06f21468b89c85f47313b43a1d1e912303a2c62b8d49c4e13b8941a2c0cc3eb710cf6bffc73c1595b4dc67cdc0203c62fe7cf7e1e140595b33ea3ce6439f44f256bd331bb5737ab0ef745416f3ab253a71cedcf501b738f19f03794aa6874ad2c0", 0x9a}, {&(0x7f0000000140)="1c6a15d25207d3887f4feae28629056dcd2c625204946ff2be466182520f3021bdfea9125cedec5ff66a789f9508", 0x2e}, {&(0x7f0000000240)="20e761601cbde7935c4b38c4361c09a80b8f756cbfd6a7c303ed3ff0b96bb0587bbc0e05c80a4bd2069ae5bc8d41b2edd696cbc8767fd76a3e3a193805ad4d17affb6500f20ac99985d500fc23f303ceac64f9a6f15a975ca7565dce955119c19a91839a15ddaf010ca4aee8547062e1b3a1f40acb93262f28a152f03536bac961eeadbcc4fdbf7652abc47f70354fa1f46eeaf7d3", 0x95}, {&(0x7f0000000180)="c7cafdfe2cd767437c9ce41cce3df0c1760ae6bf2b60e2c99a011ec5b56f3c2c37c7e0c205a983553fee15f5e2301d71a02d7f5d3d1ae718328f426f55ccb84cb3dced330e5fa4e2f082", 0x4a}], 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1, 0x2}, 0x1c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, 0x1c) sendto$inet(r0, &(0x7f0000000140), 0x0, 0x0, &(0x7f0000000200)={0x2, 0x4e20}, 0x10) [ 499.668868] binder: 10538:10545 unknown command -2039984151 [ 499.675392] binder: 10538:10545 ioctl c0306201 20000680 returned -22 [ 499.683611] binder: BINDER_SET_CONTEXT_MGR already set [ 499.689159] binder: 10538:10545 ioctl 40046207 0 returned -16 [ 499.696395] binder: BINDER_SET_CONTEXT_MGR already set [ 499.696404] binder: 10538:10551 ioctl 40046207 0 returned -16 03:33:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r0, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 499.698610] binder: 10538:10552 unknown command -2039984151 [ 499.698620] binder: 10538:10552 ioctl c0306201 20000680 returned -22 [ 499.721156] binder: 10539:10555 unknown command -1846320379 [ 499.721162] binder: 10539:10555 ioctl c0306201 20007000 returned -22 [ 499.722006] binder: 10539:10555 ioctl 2270 20000040 returned -22 [ 499.723089] binder: 10539:10555 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 499.768012] binder: 10539:10555 unknown command -1846320379 [ 499.777184] binder: 10539:10555 ioctl c0306201 20007000 returned -22 [ 499.785793] 9pnet: p9_fd_create_unix (10557): problem connecting socket: éq‰Y’3aK: -91 [ 499.793318] 9pnet: p9_fd_create_unix (10562): problem connecting socket: éq‰Y’3aK: -91 03:33:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x400, 0x111) ioctl$TUNSETQUEUE(r2, 0x400454d9, &(0x7f0000000080)={'veth0_to_team\x00', 0x200}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:33 executing program 6: r0 = getuid() ioprio_set$uid(0x2396b738b5c03d9b, r0, 0x89b) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") setitimer(0x1, &(0x7f0000000000)={{}, {0x77359400}}, 0x0) setitimer(0x1, &(0x7f000000bfe0)={{0x77359400}, {0x0, 0x2710}}, &(0x7f000002c000)) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in=@multicast2, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@broadcast}}, &(0x7f0000000240)=0xe8) setuid(r2) r3 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCGMTSLOTS(r3, 0x8040450a, &(0x7f0000000300)=""/66) [ 499.816015] binder: 10539:10563 ioctl 2270 20000040 returned -22 [ 499.816497] binder: 10539:10546 IncRefs 0 refcount change on invalid ref 0 ret -22 03:33:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000400)='/dev/null\x00', 0x10000, 0x0) mq_getsetattr(r1, &(0x7f0000000100), &(0x7f0000000140)) r2 = socket(0x10, 0x2, 0x0) ioctl$sock_inet_SIOCDELRT(r2, 0x890c, &(0x7f00000006c0)={0x7fffffff, {0x2, 0x4e21, @multicast1}, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e24, @local}, 0x10c, 0x9, 0x3, 0x81, 0xec, &(0x7f00000004c0)='ip6tnl0\x00', 0x81, 0x5, 0x5ee4}) fgetxattr(r0, &(0x7f00000000c0)=@known='security.evm\x00', &(0x7f0000000180)=""/33, 0x21) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r2, r3, &(0x7f0000000000), 0x80000002) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000440)=0x4, 0x4) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000240)='fuse\x00', 0x200000001000, &(0x7f0000000340)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x6ffc}, 0x2c, {'user_id', 0x3d, r4}, 0x2c, {'group_id', 0x3d, r5}, 0x2c, {[{@default_permissions='default_permissions'}]}}) 03:33:33 executing program 5: socketpair$inet(0x2, 0x0, 0x400, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_udp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000340)) ioctl$SIOCGIFMTU(0xffffffffffffffff, 0x8921, &(0x7f0000000140)) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) memfd_create(&(0x7f0000000380)='/dev/loop#\x00', 0x1) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r2 = memfd_create(&(0x7f0000000540)="00eb0c432d0174df5f00000000", 0x3) fcntl$setstatus(r1, 0x4, 0x4000) pwritev(0xffffffffffffffff, &(0x7f0000000340), 0x0, 0x81806) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)={0x2, 0x3, 0x0, 0x9, 0xa, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x2}, @sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}]}, 0x50}}, 0x0) r4 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000012000), 0x4) sendmsg$key(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000600)={0x2, 0xa, 0x0, 0x0, 0x2}, 0x10}}, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x2, 0xa, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r3, &(0x7f000033efc8)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="020900004200000000000000000000003800688f531695e992fa09a5f847497b815544f4fe1477e0b6f77ecb355bac7563fffc62f696785cf902dbee9ad6d7d7d1efb11ccad6a72ea0faa93eed904cbd56da97b288"], 0x55}}, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) sendfile(r1, r1, &(0x7f0000000000), 0x2000005) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f0000002000)={{0xa, 0x0, 0xfffffffffffffffd}, {0xa, 0x0, 0x0, @empty, 0x1}}, 0x5c) [ 499.863745] binder: 10560:10569 tried to acquire reference to desc 0, got 1 instead [ 499.872027] binder: 10560:10569 got transaction to context manager from process owning it [ 499.882290] binder: 10560:10569 transaction failed 29201/-22, size 0-0 line 3004 03:33:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) write$input_event(r2, &(0x7f00000000c0)={{r4, r5/1000+30000}, 0x0, 0x1, 0x200}, 0x18) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 499.919595] binder: undelivered TRANSACTION_ERROR: 29201 03:33:33 executing program 1: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000140)=0x5) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f00000006c0)={0x3, 'ifb0\x00', 0x3}, 0xffffffffffffffb4) ioctl$RTC_IRQP_SET(0xffffffffffffffff, 0x4008700c, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x0, 0x105082) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000600)='/dev/pktcdvd/control\x00', 0x0, 0x0) r3 = pkey_alloc(0x0, 0x0) pkey_mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, r3) fcntl$getown(0xffffffffffffffff, 0x9) r4 = memfd_create(&(0x7f0000000040)="0009e0ffffffffffffff05000000000400000000", 0x0) accept4$inet(r2, &(0x7f0000000280)={0x2, 0x0, @remote}, &(0x7f00000002c0)=0x10, 0x80800) sched_setattr(0x0, &(0x7f0000000300)={0x0, 0x2, 0x0, 0x0, 0x5, 0xed9c, 0x100000001}, 0x0) pwritev(r4, &(0x7f0000f50f90)=[{&(0x7f00000000c0)='S', 0x1}], 0x1, 0x4081003) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r4) fallocate(r1, 0x11, 0x0, 0x100000001) syz_open_dev$ndb(&(0x7f0000000100)='/dev/nbd#\x00', 0x0, 0x10000) 03:33:33 executing program 7: r0 = socket(0x10, 0x2, 0x0) sendmsg$nl_route(r0, &(0x7f00000003c0)={&(0x7f0000000040), 0xc, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="5c0000002100110000000000000000000a20800000000000000000001500010014000100fe8000000000000000000000000000aa1400010000000000000000000000ffffac1414bb1400020000000000000000000000ffff7f000001d2acbd4b118041bcae43c0d907519055f9ee73a82beb1e2f10e1b8bf3649b5ddd7762e9bcaefc4b7b447a67e00195e790c9266954a2b327d4f3fe6847ccd289591d98f43d202ce72b58d6fd5cb3c4d8164cccc8f707cd19e8ffedea0ce2dcbcb29ae8d1a08daf06816599b9c3cce04f8e1201f2c56a116faf480c260bf2dc75f2784ce4dc4"], 0x5c}}, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8020000}, 0xc, &(0x7f0000000200)={&(0x7f00000000c0)={0x13c, r1, 0x400, 0x70bd27, 0x45, {}, [@IPVS_CMD_ATTR_SERVICE={0x78, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@multicast2}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7ff}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@remote}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e20}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_DEST={0x30, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@loopback}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x4}]}, @IPVS_CMD_ATTR_DAEMON={0x64, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'veth0_to_team\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1e}}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7ff}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x2}}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}]}, @IPVS_CMD_ATTR_DEST={0x4}]}, 0x13c}, 0x1, 0x0, 0x0, 0x1}, 0x11) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000340)='/dev/rfkill\x00', 0x84002, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000002c0)={0x0}, &(0x7f0000000300)=0xc) mq_notify(r2, &(0x7f0000000600)={0x0, 0x40, 0x6, @tid=r3}) ioctl$BINDER_THREAD_EXIT(r2, 0x40046208, 0x0) statfs(&(0x7f0000000280)='./file0\x00', &(0x7f0000000400)=""/224) [ 500.031044] binder: 10572:10577 unknown command 0 [ 500.036224] binder: 10572:10577 ioctl c0306201 20007000 returned -22 [ 500.043936] binder: BINDER_SET_CONTEXT_MGR already set [ 500.049257] binder: 10572:10577 ioctl 40046207 0 returned -16 [ 500.056678] binder: BINDER_SET_CONTEXT_MGR already set [ 500.057114] binder: 10572:10578 unknown command 0 [ 500.057122] binder: 10572:10578 ioctl c0306201 20007000 returned -22 [ 500.073810] binder: 10572:10577 ioctl 40046207 0 returned -16 03:33:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="f6627d28411c532aeed805f754170b9498acaaf6c78d9f574fa17db47addc6e79895be068bc2690eb0f018189b84edd51e8f4eafcaefcfe100a1716b47600644a2d93afdee0ea63307530a1c12088e1ad0f10943d79e1830ec6cef2c4217f1b433e6171cecd8aca78da3e53e249baec0bd38c86b6347506a95a207d46682d8e6224170f3c8317d2b29ad3cecbb6bd72e6dfc270518ac70fd6032e87e8fee7bfacea1d8c2d2cabd49adacef9cb4b58a534dad1494908551270d"], 0x0, 0x0, &(0x7f00000006c0)}) [ 500.073995] binder: BINDER_SET_CONTEXT_MGR already set [ 500.074079] binder: 10572:10578 ioctl 40046207 0 returned -16 03:33:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) write$P9_RREADLINK(r0, &(0x7f0000000040)={0xa, 0x17, 0x1, {0x1, '.'}}, 0xa) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:33 executing program 6: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x38000000000003) r2 = dup(r1) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000000)) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2}, 0x1c) dup2(r0, r1) fcntl$getown(0xffffffffffffffff, 0x9) acct(0x0) [ 500.191763] binder: 10583:10590 tried to acquire reference to desc 0, got 1 instead [ 500.199724] binder: 10583:10590 got transaction to context manager from process owning it [ 500.208482] binder: 10583:10590 transaction failed 29201/-22, size 0-0 line 3004 03:33:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$restrict_keyring(0x1d, r1, &(0x7f0000000100)='user\x00', &(0x7f0000000140)='eth1\x00') r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05566b64"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:33 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) lstat(&(0x7f0000000180)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f2f66696c653000", &(0x7f0000000340)) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x80080, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000940)={0xb, 'syz1\x00', 'syz0\x00', 'syz1\x00', 0xcd, 0xfffffffffffffffb, 0x100, 0xc4, 0x434ef5c4, 0x2, "33f8b750062b2525b7d95d11e04def7a3f1dfe85e7faa2fabfae6b189792bb5943da8718d30658b0e95cfaf247ab8b3783764a9b2b8a88e3544e30715b1d2514efa5a22f667afd4d05c73dd83d4e2eeaabebf1556af0a94fea6846d3221c49cf7d0a7e7b0e58a318c3488deaf5375e51db0b00f1249bb5c6a91ede637ba2a2886f2208d317daa6e0cbd39c7f073fef3fe2a4344f6f19dbf39d40fb7f998ee16e0f262e41a0e38623c40ff6f271dd92f408934374c6c5595c2620c55ecf6a4efea4903ba8750b5c1005cc857003"}, 0x1e5) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7472616e733d72646d612c703030303030303030303030302c74696d656f75743d3078303030303030303030303030303030312c73713d3078666666666666666638366162646531642c74696d656f75743d3078300d1a025f3030303030303030303030303030302c00"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f00000003c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f2f66696c653000", &(0x7f00000005c0)) [ 500.244322] binder: undelivered TRANSACTION_ERROR: 29201 03:33:33 executing program 7: r0 = socket$inet6(0xa, 0x800000000001, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = socket$inet(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000011fc8)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000000)="24000000010407031dfffd946fa2830020200a0009000100041d85680c1baba20400ff7e28000000110affffba010000000009b356da5a80d18be34c8546c8243929db2406b20cd37ed01cc0", 0x4c}], 0x1}, 0x0) [ 500.392739] binder: 10596:10607 unknown command 679305974 [ 500.398523] binder: 10596:10607 ioctl c0306201 20000680 returned -22 [ 500.407081] binder: BINDER_SET_CONTEXT_MGR already set [ 500.413240] binder: 10596:10607 ioctl 40046207 0 returned -16 [ 500.421174] binder: BINDER_SET_CONTEXT_MGR already set [ 500.421185] binder: 10596:10608 ioctl 40046207 0 returned -16 [ 500.421217] binder: 10596:10609 unknown command 679305974 03:33:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x40000, 0x0) [ 500.421225] binder: 10596:10609 ioctl c0306201 20000680 returned -22 03:33:33 executing program 5: mkdir(&(0x7f0000000280)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000540)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d303030303030303030303030303030303030343030300500757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) mknod$loop(&(0x7f0000000080)='./file0/file1\x00', 0x0, 0xffffffffffffffff) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000000)={0x50, 0x0, 0x1}, 0x50) read$FUSE(r0, &(0x7f0000001000), 0x1000) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000400)='./file0\x00', 0x80000002) read$FUSE(r0, &(0x7f00000030c0), 0x1000) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) openat(r2, &(0x7f0000000100)='./file0/file1\x00', 0x4000, 0x100) write$FUSE_ENTRY(r0, &(0x7f0000003000)={0x90, 0x0, 0x3}, 0x90) 03:33:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x400400, 0x0) ioctl$BLKSECTGET(r2, 0x1267, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:33 executing program 6: unshare(0x400) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002ff7)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000280)=""/246) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070") socket$packet(0x11, 0x2, 0x300) ioctl$EVIOCGREP(r0, 0x4004743c, &(0x7f0000000180)=""/174) set_thread_area(&(0x7f0000000000)={0x5f2, 0xffffffffffffffff, 0x1000, 0x80000001, 0x5, 0x3ff, 0x9, 0xfce8, 0x4, 0x8}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:33:34 executing program 7: r0 = syz_open_dev$sndseq(&(0x7f00000002c0)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r0, 0x40605346, &(0x7f0000000080)={0x9, 0x2, {0xffffffffffffffff, 0x0, 0x7, 0x3, 0x100000001}}) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r0, 0x80045300, &(0x7f0000000000)) socketpair(0xb, 0x80000, 0x6, &(0x7f0000000040)) [ 500.600857] binder: 10614:10621 unknown command 1684755973 [ 500.621061] netlink: 20 bytes leftover after parsing attributes in process `syz-executor7'. [ 500.638386] binder: 10614:10621 ioctl c0306201 20007000 returned -22 [ 500.650644] binder: 10614:10621 got transaction to context manager from process owning it [ 500.663681] binder: 10614:10621 transaction failed 29201/-22, size 0-0 line 3004 03:33:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000"], 0x0, 0x0, &(0x7f0000002000)}) socketpair$inet_udp(0x2, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$inet_group_source_req(r2, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffe0, {{0x2, 0x4e20, @rand_addr=0x8000}}, {{0x2, 0x4e20, @remote}}}, 0x108) r3 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x1) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:34 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$mice(&(0x7f00000000c0)='/dev/input/mice\x00', 0x0, 0x200) read$FUSE(r0, &(0x7f0000000940), 0x1000) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB='trans=rdma,port=0x00000000=0x0000000000000001,sq=0xffffffff86abde1d,timeout=0x0000000000000000,\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00']) open(&(0x7f0000000180)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x422481, 0x2) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xfffffffffffffffe}, &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="2c008f19e384f65854249099fa205a13c1426652e2a86e8146ddfef0146b0a79b148bd4a4c8181f4a195c78fd938015544c937694c7354f8dcc7b7c4597ad26626678a6faa0ebc155c096c9a32f83ada10446163b75cad54e3ff33bc43045e4da0cbfece95017d508c99"]) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="34a1497c"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 500.706306] binder: undelivered TRANSACTION_ERROR: 29201 [ 500.720901] binder: 10625:10631 tried to acquire reference to desc 0, got 1 instead [ 500.737184] binder: BINDER_SET_CONTEXT_MGR already set [ 500.747815] binder: 10625:10631 ioctl 40046207 0 returned -16 03:33:34 executing program 1: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x0, 0x2080) openat$cgroup_ro(r0, &(0x7f0000000040)='memory.stat\x00', 0x0, 0x0) ioctl$TCSETSF(r0, 0x5404, &(0x7f00000000c0)={0x6, 0x7fffffff, 0x5, 0x3, 0x6, 0x6, 0x4, 0x14, 0xffffffff, 0x3, 0xcc, 0x6}) 03:33:34 executing program 7: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) mprotect(&(0x7f000004a000/0x4000)=nil, 0x4000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f00000001c0)='./file0\x00', 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff5c, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r0, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='veth1_to_bond\x00', 0x10) mlockall(0x3) r1 = socket(0xa, 0x2, 0x0) dup2(r1, r0) 03:33:34 executing program 6: perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000000)='/dev/sg#\x00', 0x0, 0x0) r1 = creat(&(0x7f0000000100)='./file0\x00', 0xc) ioctl$sock_inet_SIOCRTMSG(r1, 0x890d, &(0x7f00000001c0)={0xfffffffffffffffc, {0x2, 0x4e20, @rand_addr=0xe031}, {0x2, 0x4e20, @local}, {0x2, 0x4e24, @remote}, 0x4, 0x3ff, 0x9, 0x4, 0x8b17, &(0x7f0000000140)='veth0_to_bridge\x00', 0x9ee, 0x9, 0x80000000}) truncate(&(0x7f0000000240)='./file0\x00', 0x7d6b) ioctl$SG_IO(r0, 0x2285, &(0x7f00000002c0)={0x53, 0x0, 0x6, 0x0, @buffer={0xd, 0x4, &(0x7f0000000040)=""/4}, &(0x7f0000000180)="3c1a006b527d", &(0x7f00000000c0)=""/41, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 03:33:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair(0x0, 0x80806, 0x6, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r2, 0xc08c5335, &(0x7f0000000080)={0x401, 0x80000000, 0x74da, 'queue1\x00', 0x7}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:34 executing program 5: r0 = socket$inet6(0xa, 0x1003000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000240)=ANY=[]) open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@mcast2, 0x7, 0x3, 0xff, 0x4, 0xa3bf, 0x4, 0xd4f}, &(0x7f0000000140)=0x20) [ 501.026398] binder: 10646:10653 unknown command 1 [ 501.031367] binder: 10646:10653 ioctl c0306201 20007000 returned -22 [ 501.042912] binder: 10646:10653 ioctl 8912 1 returned -22 [ 501.049848] binder: 10646:10653 got transaction to context manager from process owning it [ 501.058375] binder: 10646:10653 transaction failed 29201/-22, size 0-0 line 3004 [ 501.068289] binder: BINDER_SET_CONTEXT_MGR already set 03:33:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x1ba, 0x0, &(0x7f0000000240)="45fd3eb6045587069b8b57279bd1491ccceff9048ddc80f50058cabdc6478ef9fc9cbe94af634a775e87475e88e0e84e73ef13e5a606cab5dd5a322a85f8ce464e2db7b16b1618bdccbb1c980f25be3d86edfb363bd244c60334b8794fc30bd971c840f95baafd2d4d7a680443cc7d3c6d1e336f3d34f1ce1c86d970179fdea0c7d1cc778334c07ed80fee714f0170a79d094d342a492b23495669c0c9c22a0427cbd29fbf3e723574f25db005f94aa0cddc96130beeb748f51cd60baa5a0a499f9006bf405b9cd23fa92a6f0ee721a1c2e3307f2d0a275c68f0c39835ff9a8bf99456fd2750b65445fac0996de472d96d2e1df7b559dbeae50d4d68efcccbbdcab2089466f5c82fe9b0cfb0359399370d241eb727a63b824f8c584718987edaf81622feeade2d40a6e9b0758e7058f869eca5c5c8a0a0a39b8977b8ee46c8071e793eb27528a4e8d282d4994cfbc90b7d9904abd6c3577d85a6c015d7552172e80b59629275ce23875a4f647d28473dfd84382b3c890f384a1f875800000e3b0d562ebbca787479591b6972e51a87cfaba9186cd4efed8e3a9fbfeb32f7b0d841a7ec039bf7f0fc50cae9ebae212f5d34de72f571a5e5890710"}) r2 = dup2(r1, r0) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 501.068648] binder: 10646:10654 unknown command 1 [ 501.068656] binder: 10646:10654 ioctl c0306201 20007000 returned -22 [ 501.085212] binder: 10646:10653 ioctl 40046207 0 returned -16 [ 501.085221] binder: BINDER_SET_CONTEXT_MGR already set [ 501.085229] binder: 10646:10655 ioctl 40046207 0 returned -16 [ 501.092811] binder: 10646:10654 ioctl 8912 1 returned -22 [ 501.092890] binder_alloc: 10646: binder_alloc_buf, no vma [ 501.092907] binder: 10646:10655 transaction failed 29189/-3, size 0-0 line 3136 [ 501.093378] binder: undelivered TRANSACTION_ERROR: 29189 [ 501.093405] binder: undelivered TRANSACTION_ERROR: 29201 [ 501.093535] binder: 10650:10657 unknown command 2085200180 [ 501.093773] binder: 10650:10657 ioctl c0306201 20007000 returned -22 [ 501.094475] binder: BINDER_SET_CONTEXT_MGR already set [ 501.094485] binder: 10650:10657 ioctl 40046207 0 returned -16 [ 501.101203] binder: 10650:10659 unknown command 2085200180 [ 501.101211] binder: 10650:10659 ioctl c0306201 20007000 returned -22 03:33:34 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) r2 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x100000b, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x7c, 0x0, &(0x7f0000000100)=[@increfs_done={0x40106308, r1, 0x3}, @register_looper, @register_looper, @reply_sg={0x40486312, {{0x3, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x0, 0x30, &(0x7f0000000080), &(0x7f00000000c0)=[0x38, 0x0, 0x48, 0x78, 0x28, 0x18]}, 0x6}}, @acquire_done={0x40106309, r2}], 0x87, 0x0, &(0x7f0000000180)="a9d20d29318d866bd554acd3b21fe4eeb779055436a00bfed1bd776ed2fb97d74c9307e435c50572c86936d798108d7f698d74724f88f423e6e89265cd3ef2ae508b1d6d53fa4c4208cb841d807b635f4f603f0d0ae9b22667ce6398a1eb394ad90265b24b83b7dc986c3419e09a909bab1087afbf180bc8056ddd449ac71c57b3f600b9c71664"}) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = dup2(r3, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x40000000000001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 501.102180] binder: BINDER_SET_CONTEXT_MGR already set [ 501.102188] binder: 10650:10659 ioctl 40046207 0 returned -16 03:33:34 executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000080), 0xc) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f000000b000)={&(0x7f0000000100), 0xc, &(0x7f0000beeff0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c010000100013070000000000000000fe80000000000000000000000000000000000000000000000000000000000000000000004bf4e120065817301ddca179eb2a1e29f02881f5ef5f38e96d5a259ea0aaae7516caa2128cdcea01aba87843de0326d355971a0e428c503a6739924761082c525ced5b96efba5066330e9e9ca8286dfadb5140d9fe03fddef5c8852d8a2ac2b82ce1298aca11eb22621959d4b48ff8f3191b3692d9e4cf214c1c761c1e867b7b0aab9adab827273c8774403ddc0be643", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000000003200000000000000000000000000ffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000000000004c001200726663343130362867636d28616573292900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000"], 0x13c}}, 0x0) 03:33:34 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000200)=""/117, &(0x7f0000000280)=0x8) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ppp\x00', 0x404000, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./file0\x00', 0x80, 0x50) r2 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000640)='/dev/pktcdvd/control\x00', 0x12000, 0x0) ioctl$LOOP_SET_BLOCK_SIZE(r2, 0x4c09, 0x12d09556) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f0000000100)=""/189) r3 = accept4(0xffffffffffffffff, &(0x7f0000000300)=@nl=@unspec, &(0x7f0000000480)=0x80, 0x80800) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000580)=ANY=[@ANYBLOB="e0000002ac1414aa0000000001000000ac140008e23a01d5938a1e63d7b96f82377b6fc4cd3057472cb39fd556b2053ae13c78121515458aa411f4a5ece78b57d23c2fde72935f4d2779cec52b1cb48661"], 0x1) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) ioctl(0xffffffffffffffff, 0x4000008912, &(0x7f0000000100)="295ee1311f16f477671070") ioctl$LOOP_CTL_ADD(r4, 0x4c80, 0x0) r5 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$SG_GET_SCSI_ID(r5, 0x2276, &(0x7f0000000380)) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, &(0x7f00000003c0)=0x3) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000880)={&(0x7f0000000900)=ANY=[@ANYBLOB="010125bd7000ffdbdf25080000003400020014000100ffffffff000000000000000000000000080002004e23000014000100ac1414bb000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000000}, 0x4044845) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000001980)={@remote, @local, @loopback, 0x0, 0x0, 0x3, 0x0, 0x0, 0x200}) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f00000007c0), &(0x7f00000001c0)=0x68) sysfs$2(0x2, 0x7, &(0x7f0000000680)=""/233) add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffe) ioctl$INOTIFY_IOC_SETNEXTWD(r1, 0x40044900, 0x7) add_key$user(&(0x7f0000000500)='user\x00', &(0x7f0000000540)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000580), 0x0, 0xffffffffffffffff) 03:33:34 executing program 6: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = open(&(0x7f00009e1000)='./file0\x00', 0x8040, 0x0) fcntl$setlease(r1, 0x400, 0x0) rt_sigprocmask(0x0, &(0x7f0000000040)={0xfffffffffffffffc}, 0x0, 0x8) rt_sigtimedwait(&(0x7f00005a1000)={0xfffff7fffffffffd}, &(0x7f0000d31ff0), &(0x7f00007adff0)={0x77359400}, 0xdc) acct(&(0x7f0000000040)='./file0\x00') fcntl$setlease(r1, 0x400, 0x2) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 501.329087] binder: 10677:10679 ioctl 2287 20000040 returned -22 [ 501.338804] binder: 10677:10679 tried to acquire reference to desc 0, got 1 instead [ 501.348461] binder: BINDER_SET_CONTEXT_MGR already set [ 501.354195] binder: 10677:10679 ioctl 40046207 0 returned -16 [ 501.363352] binder: 10677:10679 ioctl 2287 20000040 returned -22 [ 501.363378] binder: BINDER_SET_CONTEXT_MGR already set 03:33:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x1010, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="046304400000000009ee078c6ef35eb5c25c943536536882a73bc814c660f9076fd418ca776584827ce40dae962192"], 0x0, 0x0, &(0x7f00000006c0)}) [ 501.363388] binder: 10677:10682 ioctl 40046207 0 returned -16 [ 501.407477] binder: 10681:10685 BC_INCREFS_DONE u0000000000000000 no match [ 501.414814] binder: 10681:10685 ERROR: BC_REGISTER_LOOPER called without request [ 501.424163] binder: 10681:10685 ERROR: BC_REGISTER_LOOPER called without request [ 501.432741] binder: 10681:10685 got reply transaction with no transaction stack [ 501.440410] binder: 10681:10685 transaction failed 29201/-71, size 0-48 line 2921 03:33:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0463044000000000116348400000000000004000000000008a588a000000000000000000f6ff0000008000000000000000000000000000000000000000000000080000000000", @ANYPTR=&(0x7f00000002c0)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000006c0)}) [ 501.463121] binder: 10684:10686 ioctl 8912 40000000000001 returned -22 [ 501.471543] binder: 10681:10685 BC_INCREFS_DONE u0000000000000000 no match [ 501.471960] binder: 10684:10686 tried to acquire reference to desc 0, got 1 instead [ 501.471971] binder: 10684:10686 got transaction to context manager from process owning it [ 501.471983] binder: 10684:10686 transaction failed 29201/-22, size 0-0 line 3004 [ 501.479107] binder: BINDER_SET_CONTEXT_MGR already set [ 501.479116] binder: 10684:10686 ioctl 40046207 0 returned -16 [ 501.490058] binder: BINDER_SET_CONTEXT_MGR already set [ 501.490066] binder: 10684:10688 ioctl 40046207 0 returned -16 [ 501.490138] binder: 10684:10686 ioctl 8912 40000000000001 returned -22 [ 501.490187] binder_alloc: 10684: binder_alloc_buf, no vma [ 501.490206] binder: 10684:10688 transaction failed 29189/-3, size 0-0 line 3136 [ 501.490633] binder: undelivered TRANSACTION_ERROR: 29189 [ 501.490661] binder: undelivered TRANSACTION_ERROR: 29201 [ 501.494808] binder: 10681:10689 tried to acquire reference to desc 0, got 1 instead [ 501.497877] binder: 10681:10689 tried to acquire reference to desc 0, got 1 instead [ 501.591537] binder: 10681:10685 ERROR: BC_REGISTER_LOOPER called without request [ 501.600097] binder: 10681:10685 ERROR: BC_REGISTER_LOOPER called without request 03:33:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) write$binfmt_misc(r0, &(0x7f0000000040)={'syz1', "52a6f0a5a80e859267b6eb149322fca006dd3d74fb96"}, 0x1a) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 501.608589] binder: 10681:10685 got reply transaction with no transaction stack [ 501.616439] binder: 10681:10685 transaction failed 29201/-71, size 0-48 line 2921 [ 501.668346] netlink: 76 bytes leftover after parsing attributes in process `syz-executor5'. [ 501.681458] netlink: 76 bytes leftover after parsing attributes in process `syz-executor5'. [ 501.757011] binder: 10700:10702 tried to acquire reference to desc 0, got 1 instead [ 501.765876] binder: BINDER_SET_CONTEXT_MGR already set [ 501.773755] binder: 10700:10702 ioctl 40046207 0 returned -16 [ 501.847006] binder: 10705:10708 tried to acquire reference to desc 0, got 1 instead [ 501.855231] binder: 10705:10708 got transaction to context manager from process owning it [ 501.864105] binder: 10705:10708 transaction failed 29201/-22, size 0-0 line 3004 [ 501.879976] binder: 10706:10710 tried to acquire reference to desc 0, got 1 instead [ 501.892641] binder: undelivered TRANSACTION_ERROR: 29201 [ 501.924223] selinux_nlmsg_perm: 10 callbacks suppressed [ 501.924230] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10713 comm=syz-executor4 03:33:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/checkreqprot\x00', 0x323001, 0x0) ioctl$BLKTRACETEARDOWN(r0, 0x1276, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) ppoll(&(0x7f00000000c0)=[{r1}, {r1, 0x480}, {r1, 0x24}, {r2}], 0x4, &(0x7f0000000180), &(0x7f00000001c0)={0x81}, 0x8) 03:33:35 executing program 1: setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000788000)=0x6, 0x4) r0 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000380)) ioctl$sock_inet_SIOCGARP(r0, 0x8954, &(0x7f0000000180)={{0x2, 0x0, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'}) socketpair$inet(0x2, 0x3, 0x400, &(0x7f0000002b80)={0xffffffffffffffff}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000300)={0x0, 0x0}, &(0x7f0000000480)=0xfffffffffffffed0) lstat(&(0x7f0000003000)='./file0\x00', &(0x7f0000003040)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000030c0)={0x0, 0x0}, &(0x7f0000000200)=0xa) setresuid(r2, r2, r3) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$loop(&(0x7f0000003180)='/dev/loop#\x00', 0x400000000, 0x200000000082) r6 = memfd_create(&(0x7f0000000700)="d99d5c70249624bf3303dda9982af907365549d91472b86a88a7e250b2a2dfea0eb5b672c52fe8633779090c94b8011097d3f4eaa5a59a7a39f8b11622c40000000072618e1d", 0x3) ioctl$TIOCLINUX2(r6, 0x541c, &(0x7f00000003c0)={0x2, 0xffffffffffffffab, 0x0, 0x0, 0x0, 0x80000001}) pwritev(r6, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r5, 0x4c00, r6) sendfile(r5, r5, &(0x7f0000002b00), 0x2000005) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f0000002cc0)={'broute\x00', 0x0, 0x4, 0xd4, [], 0x5, &(0x7f0000002c00)=[{}, {}, {}, {}, {}], &(0x7f0000002dc0)=""/212}, &(0x7f00000002c0)=0x78) r7 = socket(0xa, 0x3, 0x0) setsockopt$IP_VS_SO_SET_ADD(r7, 0x0, 0x482, &(0x7f0000000080)={0x0, @empty, 0x0, 0x0, 'lblcr\x00'}, 0x2c) setsockopt$IP_VS_SO_SET_FLUSH(r7, 0x0, 0x485, 0x0, 0x0) getsockopt$inet6_mreq(r6, 0x29, 0x1c, &(0x7f0000002d40)={@remote}, &(0x7f0000002d80)=0x14) ioctl$TIOCGSID(r6, 0x5429, &(0x7f00000000c0)=0x0) futex(&(0x7f0000002b40)=0x2, 0x9, 0x2, &(0x7f0000002c80), &(0x7f0000002bc0)=0xffffffffffffffff, 0x1) ioctl$PERF_EVENT_IOC_REFRESH(r4, 0x2402, 0x7e3) process_vm_readv(r8, &(0x7f0000000400)=[{&(0x7f0000000140)=""/63, 0x3f}, {&(0x7f0000000580)=""/222, 0xde}], 0x2, &(0x7f0000002a80)=[{&(0x7f0000001680)=""/163, 0xa3}, {&(0x7f0000001740)=""/72, 0x48}, {&(0x7f00000017c0)=""/238, 0xee}, {&(0x7f00000018c0)=""/4096, 0x1000}, {&(0x7f00000028c0)=""/214, 0xd6}, {&(0x7f00000029c0)=""/84, 0x54}], 0x6, 0x0) ioctl$SIOCSIFMTU(r7, 0x8922, &(0x7f0000002f00)={'\x00', 0x3}) sendmmsg(r5, &(0x7f0000003340)=[{{&(0x7f0000000240)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @loopback}}}, 0x80, &(0x7f0000000440)=[{&(0x7f0000000380)}], 0x1, &(0x7f0000000400)=ANY=[]}}], 0x1, 0x4040000) ioctl$LOOP_CLR_FD(r5, 0x4c01) ioctl$LOOP_SET_FD(r5, 0x4c00, r6) 03:33:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0xfffffffffffffffb) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x17, 0x0, &(0x7f0000000140)=ANY=[@ANYRESOCT=r1], 0x0, 0x0, &(0x7f0000002000)}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000100)) r3 = dup2(r1, r0) ioctl$FICLONERANGE(r1, 0x4020940d, &(0x7f0000000080)={r3, 0x0, 0xfffffffffffffffd, 0x6, 0x5}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BLKRRPART(r3, 0x125f, 0x0) ioctl$EVIOCRMFF(r3, 0x40044581, &(0x7f0000000040)=0x100) ioctl$sock_inet6_tcp_SIOCATMARK(r2, 0x8905, &(0x7f00000001c0)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="046300000000000000000000000000000000000000e318c4b5d7e9dff8ca6cdf9b5c64aeb63303323f848892cbd25e126a2f21c3c99ad940954a0543c0ef1982a0f4d1979589cfe49c8e38059fa5dd4c065c4645c3a3be26385430ce8f4170baf4709b29b42a082dac12786ba5452900669316492eb295b6c58a8c390a96fe83332847fa0935f66702123ca7072b697cace9d867966845d84c8bc45375"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:35 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = inotify_init1(0x0) fcntl$setown(r1, 0x8, 0xffffffffffffffff) fcntl$getownex(r1, 0x10, &(0x7f0000000080)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x0, 0x0) ptrace(0x4207, r2) fremovexattr(r0, &(0x7f0000000040)=@random={'security.', "79616d300001178b00"}) tgkill(r2, r2, 0x2a) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={"79616d300001178b00", 0x4014}) tgkill(r2, r2, 0x39) ptrace$setregset(0x4209, r2, 0x20000004, &(0x7f0000000100)={&(0x7f0000000040)}) 03:33:35 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0xf}}, 0xffffffffffffff8e) r2 = memfd_create(&(0x7f0000000400)="e83779d80efa45bb7f48bebc95870bd0cd39bd2830ee47afe7b33fc778bde252c50d2e", 0x0) r3 = syz_open_dev$sndseq(&(0x7f0000042ff3)='/dev/snd/seq\x00', 0x0, 0x20002) r4 = dup2(r3, r2) ioctl$PERF_EVENT_IOC_RESET(r3, 0x2403, 0x401) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x0, 0x0, "7175657565310000000000000000313b0000000000000000000000000000000000000000060000000000ccbf7ddd00"}) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_mtu(r4, 0x0, 0xa, &(0x7f0000000500), 0x4) syz_genetlink_get_family_id$team(&(0x7f0000000240)='team\x00') r5 = add_key$user(&(0x7f0000001480)='user\x00', &(0x7f00000014c0), &(0x7f00000018c0), 0x0, 0xfffffffffffffffd) keyctl$invalidate(0x15, r5) memfd_create(&(0x7f0000000440)='\x00', 0x2) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000000180)=0x7b6cc922, 0x119) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5334, &(0x7f00000001c0)={0xf48b, 0x0, 0x0, 'queue1\x00'}) ioctl$EVIOCGID(0xffffffffffffffff, 0x80084502, &(0x7f0000001940)=""/4096) write$sndseq(r2, &(0x7f0000000000)=[{0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @connect}], 0xffffff76) r6 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000300)={0x3f, @multicast1, 0x4e23, 0x0, 'sh\x00', 0x8, 0x80000001, 0x11}, 0x2c) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r3, 0xc058534f, &(0x7f0000000480)={{0x0, 0x30000000000}, 0x1, 0x2, 0x0, {}, 0x2, 0x4}) ppoll(&(0x7f0000000280)=[{r6, 0x410}, {r1, 0x2001}], 0x2, &(0x7f00000002c0), &(0x7f00000003c0)={0x80000000}, 0x8) ioctl$TIOCGSID(r2, 0x5429, &(0x7f0000000080)) keyctl$get_security(0x11, r5, &(0x7f0000000340)=""/120, 0x78) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000540)={0x7, 0x1000, 0xfff, 0x7, 0x1f1}, 0x14) mmap(&(0x7f0000011000/0x6000)=nil, 0x6000, 0x0, 0x32, 0xffffffffffffffff, 0x0) 03:33:35 executing program 7: ioctl$BLKTRACESTART(0xffffffffffffffff, 0x1274, 0x0) r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x440800, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f00000000c0)={0x0, 0x6, 0x1}) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/dev_mcast\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000002d00)=[{{0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000380)=""/168, 0xa8}, {&(0x7f0000000600)=""/190, 0xbe}], 0x2, &(0x7f0000000780)=""/3, 0x3}}], 0x1, 0x0, &(0x7f0000002f00)={0x0, 0x989680}) pipe(&(0x7f0000000040)) preadv(r1, &(0x7f0000000140), 0x391, 0x0) 03:33:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00'], 0x0, 0x0, &(0x7f0000002000)}) accept4$unix(0xffffffffffffff9c, 0x0, &(0x7f0000000100), 0x80000) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="8a89465a"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:35 executing program 7: pipe2(&(0x7f0000f61000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000bc8000)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000d62fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) write$sndseq(r0, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x1c) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0x10, r1, 0x0) read(r1, &(0x7f0000000000)=""/126, 0x7e) ioctl$KDDISABIO(r0, 0x4b37) [ 502.053230] binder: BINDER_SET_CONTEXT_MGR already set [ 502.073697] binder: 10720:10730 unknown command 0 03:33:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r2, 0x0, 0x48c, &(0x7f0000000040)={0x2, 'irlan0\x00'}, 0x18) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f0000002000)}) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2000000, 0x20013, r1, 0x0) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) accept4$unix(r3, &(0x7f0000000180), &(0x7f0000000000)=0x6e, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) getrandom(&(0x7f0000000080)=""/245, 0x368, 0x3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 502.073872] binder: 10720:10730 ioctl c0306201 20007000 returned -22 [ 502.075215] binder: 10721:10731 unknown command 1514572170 03:33:35 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r0, &(0x7f0000000340)=[{&(0x7f00000001c0)=""/93, 0x5d}], 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0x40a85323, &(0x7f0000000000)={{0xb97, 0xfff}, 'port0\x00', 0x10, 0x1, 0x8, 0x87ae, 0xff, 0x64fe, 0x5, 0x0, 0x2, 0x2}) preadv(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000240)=""/200, 0xc8}], 0x1, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(0xffffffffffffffff, 0xc058534f, &(0x7f0000000140)={{0x81, 0x376}, 0x0, 0x3, 0x10001, {0x10001, 0x5}, 0x100000001, 0x6}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x551280, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r1, 0x54a0) epoll_pwait(r1, &(0x7f0000000380)=[{}, {}, {}], 0x3, 0x80000000, &(0x7f00000003c0)={0x101}, 0x8) [ 502.075223] binder: 10721:10731 ioctl c0306201 20007000 returned -22 [ 502.076427] binder: BINDER_SET_CONTEXT_MGR already set [ 502.076435] binder: 10721:10731 ioctl 40046207 0 returned -16 [ 502.077981] binder: BINDER_SET_CONTEXT_MGR already set [ 502.077989] binder: 10720:10730 ioctl 40046207 0 returned -16 [ 502.078715] binder_alloc: 10721: binder_alloc_buf, no vma [ 502.078734] binder: 10721:10731 transaction failed 29189/-3, size 0-0 line 3136 [ 502.089234] binder: 10720:10730 unknown command 0 03:33:35 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000340)={{{@in=@multicast2, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@rand_addr}, 0x0, @in6=@remote}}, &(0x7f0000000240)=0xe8) r1 = getuid() mount$9p_virtio(&(0x7f00000000c0)='port', &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='9p\x00', 0x304800, &(0x7f00000007c0)={'trans=virtio,', {[{@msize={'msize', 0x3d, 0xffffffff}}, {@access_uid={'access', 0x3d, r0}}, {@cache_fscache='cache=fscache'}, {@cachetag={'cachetag', 0x3d, '9p\x00'}}, {@uname={'uname', 0x3d, 'vboxnet1wlan0mime_type+ppp0$proc(vboxnet0'}}, {@privport='privport'}, {@access_client='access=client'}, {@cachetag={'cachetag', 0x3d, 'group_id'}}, {@dfltuid={'dfltuid', 0x3d, r1}}, {@msize={'msize', 0x3d, 0x3f}}]}}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r2 = socket(0x10, 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x2, 0x10000000000000) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c) connect$inet6(r4, &(0x7f0000000180)={0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}, 0x1c) setsockopt$inet6_IPV6_ADDRFORM(r4, 0x29, 0x1, &(0x7f0000000140), 0x4) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) ppoll(&(0x7f00000001c0)=[{r3, 0x20}, {r4, 0x1000}], 0x2, &(0x7f0000000240)={0x0, r5+30000000}, &(0x7f0000000280)={0x80000003}, 0x8) sendmmsg(r4, &(0x7f00000002c0), 0x4cc, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r3, 0x8919, &(0x7f00000002c0)={'ip6_vti0\x00', {0x2, 0x4e21}}) r6 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r2, r6, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuseblk(&(0x7f00000002c0)='/dev/loop0\x00', &(0x7f00000004c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000440)='fuseblk\x00', 0x2010000, &(0x7f0000000940)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=r1, @ANYBLOB=',group_id=', @ANYRESDEC=r7, @ANYBLOB=',allow_otheX,al_other,\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00']) 03:33:35 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) write$binfmt_aout(r0, &(0x7f0000000940)={{0x10f, 0x6, 0x1, 0x36d, 0x37d, 0x1, 0x221, 0xff}, "cceb099a4c9c569a3bc81a234dcd0b4de5300b4c80af64c2712846cf9b6b29f2c55d8985487946e775743b70107b49a9cfa21a2892ea2fba7f78e8ad5960155b6fbfd0f01db00dbda280652cb5e2c51807c68a250092a4e7ff532d5179dbd827ee1c3cab8370daeb23b6326424098c60e78070c92d599767924a300711c49573c2177437c2d312e86289c1961e80b110d107e3ac13dfe889a0", [[], [], [], [], [], [], [], [], []]}, 0x9b9) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) r3 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$describe(0x6, r3, &(0x7f00000000c0)=""/71, 0x47) 03:33:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0xb037) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 502.089246] binder: 10720:10730 ioctl c0306201 20007000 returned -22 [ 502.138349] blk_update_request: I/O error, dev loop4, sector 0 [ 502.138377] blk_update_request: I/O error, dev loop4, sector 255 03:33:35 executing program 1: r0 = socket$inet(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000eed000)={0x2, 0x1}, 0x10) syz_emit_ethernet(0x519, &(0x7f00000006c0)=ANY=[@ANYBLOB="aaaaaaaaaa200180c20000028100010086dd63c5e9f904df0001fe8000000000000000000000000000aafe80000000000000000000000000001d84170000000000000718000001000402070003000000000000000400000000000000014b264bd779aa4516c34bb54c3bde1b2ec3e889a1cbff91e3fe5eb87772a3e0f34fefced9e630258ef32ec4d78012e73d0a0f52abc69aa89507c9399e3b722925dd56cf47cda56a3e144ccce80750000008001209f7ffff0f000000000000fa0700000000000005000000000000000700000000000000be280000000000000800000000000000fffeffffffffffff020000000000000000000000000000000000000000000006000020670000003f00011165000000890000000000000005020001000000003b0400000000bdca072000000001060806000700000000000000ff7f00000000000001000000010000000401070000002f10010500000000fe80000000000000000000000000001bfe80000000000000000000000000001afe80000000000000000000000000001ffe8000000000000000000000000000aa00000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff000000001d1200000000000001050000000000c910ff01000000000000000000000000000104010952784161cef217f8b72a5bfbf6e859c8380b13e671235708a4123f87a66c8e251685c5b18a3f628a03222cc981b2a78a8d5b55a64ece112a815f71113f832cecdd3cd39ba9a93b7aa173750b24667aeafc78ef903321a9a9593d35165fe0d81dfce201fddea567b3d8a47ecc41636f9b2533df313134e6ad08de0000331c000000000000c910ff02000000000000000000000000000101010005020003176cfa57feb2614a77ba6b89a41e03d7ce9b1425048fea3729b375fadc9727a22cfde2f33960d7d08de6d23d1142594fdfb27a1ee0bd141f5c61f0515eb2b9df466f5456705d6313cd790ef671b98ba333afa259d95c8dc6b4c1b1a0479ea9c5b4b5ac2acf10ab003cef40327a6207380000005c0c0604002000000000000000080000000000000000000000000000002000000000000000070000000000000009000000000000000001000001000105000000000007100000000002ff3abb00000000000000008404000200000000ff020000000000000000000000000001fe8000000000000000000000000000bb01009078020000006102488f00080004fe8000000000000000000000000000bbfe8000000000000000000000000000bb00000418670000003f12040903082b0f00000000000000000000ffffac1414aafe8000000000000000000000000000bbfe8000000000000000000000000000bbff01000000000000000000000000000100000000000000000000000000000000fe80000000000000000000000000001dfe8000000000000000000000000000aaff02000000000000000000000000000100000000000000000000000000000000bc000121650000007f000000000000008700012867000000fddef504223c97685624fa864bcccc66848bdb1c21fea169f5e6a48c5c67a0c5f48c21c4f2bc86c3a4d1e7acd855055c6f8f6ad30b6f11256e8a047e1af53a011aac0ef4a20f13d034bccc524c46ced83789235d99dc85d3446c6e68de4638dcc83fbca5e43703cf2ab2d2c9cb0e9fdf8c9b52019ba9b41d09d39953be164bdf71d1d3c6223c862e7f65a7ce2e647138d9d994ae939cd73cac45455914c4a0ff97a98ee4e3a54a"], 0x0) sendto$inet(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000778000)={0x2, 0x1, @loopback}, 0x10) poll(&(0x7f0000000040)=[{r0}], 0x1, 0x1) [ 502.138395] blk_update_request: I/O error, dev loop4, sector 510 [ 502.138534] blk_update_request: I/O error, dev loop4, sector 0 [ 502.138543] buffer_io_error: 120 callbacks suppressed 03:33:35 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket(0x0, 0x803, 0xffc4) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f00000000c0)={'bridge_slave_0\x00'}) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000100)='veth0_to_bridge\x00', 0x10) connect$inet(r0, &(0x7f0000390000)={0x2, 0x0, @loopback}, 0x10) r1 = open(&(0x7f0000000000)='./file0\x00', 0x141046, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000140), &(0x7f0000000180)=0xc) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000440)=ANY=[@ANYRESDEC], 0x1) openat$autofs(0xffffffffffffff9c, &(0x7f0000000500)='/dev/autofs\x00', 0x200800, 0x0) ftruncate(r1, 0x10004) sendfile(r0, r1, 0x0, 0x72439a6b) [ 502.138551] Buffer I/O error on dev loop4, logical block 0, async page read [ 502.138728] blk_update_request: I/O error, dev loop4, sector 4 [ 502.138735] Buffer I/O error on dev loop4, logical block 1, async page read [ 502.266169] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10747 comm=syz-executor4 [ 502.288144] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10747 comm=syz-executor4 [ 502.307060] binder: BINDER_SET_CONTEXT_MGR already set [ 502.307069] binder: 10748:10757 ioctl 40046207 0 returned -16 03:33:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x40, 0x0) ioctl$EVIOCSABS2F(r2, 0x401845ef, &(0x7f00000000c0)={0x9, 0x2e, 0x9, 0x0, 0xfb, 0x7f}) r3 = dup2(r1, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000100)=[{0x4, 0x9}], 0x1) [ 502.311203] binder: BINDER_SET_CONTEXT_MGR already set [ 502.311213] binder: 10748:10757 ioctl 40046207 0 returned -16 [ 502.316186] binder: BINDER_SET_CONTEXT_MGR already set [ 502.316196] binder: 10750:10760 ioctl 40046207 0 returned -16 [ 502.322177] binder: 10750:10760 unknown command 0 [ 502.322185] binder: 10750:10760 ioctl c0306201 20007000 returned -22 [ 502.325349] binder: BINDER_SET_CONTEXT_MGR already set [ 502.325358] binder: 10750:10760 ioctl 40046207 0 returned -16 [ 502.327681] binder_alloc: 10721: binder_alloc_buf, no vma [ 502.327701] binder: 10750:10760 transaction failed 29189/-3, size 0-0 line 3136 [ 502.330613] blk_update_request: I/O error, dev loop4, sector 0 [ 502.330625] Buffer I/O error on dev loop4, logical block 0, lost async page write [ 502.330654] blk_update_request: I/O error, dev loop4, sector 8 [ 502.330663] Buffer I/O error on dev loop4, logical block 1, lost async page write [ 502.330686] blk_update_request: I/O error, dev loop4, sector 16 [ 502.330694] Buffer I/O error on dev loop4, logical block 2, lost async page write [ 502.330715] blk_update_request: I/O error, dev loop4, sector 24 [ 502.330725] Buffer I/O error on dev loop4, logical block 3, lost async page write [ 502.330747] blk_update_request: I/O error, dev loop4, sector 32 [ 502.330755] Buffer I/O error on dev loop4, logical block 4, lost async page write [ 502.330778] Buffer I/O error on dev loop4, logical block 5, lost async page write [ 502.330802] Buffer I/O error on dev loop4, logical block 6, lost async page write [ 502.330823] Buffer I/O error on dev loop4, logical block 7, lost async page write [ 502.590880] binder: BINDER_SET_CONTEXT_MGR already set [ 502.590889] binder: 10767:10773 ioctl 40046207 0 returned -16 [ 502.591399] binder: BINDER_SET_CONTEXT_MGR already set [ 502.591407] binder: 10767:10773 ioctl 40046207 0 returned -16 [ 502.591465] binder: 10767:10773 ioctl 8912 b037 returned -22 [ 502.591546] binder_alloc: 10721: binder_alloc_buf, no vma [ 502.591564] binder: 10767:10773 transaction failed 29189/-3, size 0-0 line 3136 [ 502.592007] binder: BINDER_SET_CONTEXT_MGR already set [ 502.592015] binder: 10767:10773 ioctl 40046207 0 returned -16 [ 502.596900] binder: BINDER_SET_CONTEXT_MGR already set [ 502.596908] binder: 10767:10775 ioctl 40046207 0 returned -16 [ 502.596971] binder: 10767:10773 ioctl 8912 b037 returned -22 [ 502.597012] binder_alloc: 10721: binder_alloc_buf, no vma [ 502.597027] binder: 10767:10775 transaction failed 29189/-3, size 0-0 line 3136 [ 502.599006] binder: BINDER_SET_CONTEXT_MGR already set [ 502.599014] binder: 10769:10774 ioctl 40046207 0 returned -16 [ 502.599983] binder: BINDER_SET_CONTEXT_MGR already set [ 502.599991] binder: 10769:10774 ioctl 40046207 0 returned -16 [ 502.704422] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10777 comm=syz-executor4 [ 502.748386] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10783 comm=syz-executor4 [ 502.795879] binder: BINDER_SET_CONTEXT_MGR already set [ 502.795888] binder: 10785:10791 ioctl 40046207 0 returned -16 [ 502.806277] binder: BINDER_SET_CONTEXT_MGR already set 03:33:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000000, 0x20110, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000100)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xc4, 0x0, &(0x7f0000000200)=[@transaction_sg={0x40486311, {{0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x40, 0x8, &(0x7f0000000080)=[@flat={0x77682a85, 0x10b, r1, 0x4}, @ptr={0x70742a85, 0x0, &(0x7f0000000040), 0x1, 0x1, 0x39}], &(0x7f00000000c0)=[0x28]}}}, @request_death={0x400c630e, 0x1, 0x1}, @reply_sg={0x40486312, {{0x2, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x38, 0x50, &(0x7f0000000140)=[@fda={0x66646185, 0x0, 0x1, 0xe}, @flat={0x77682a85, 0x10b, r2, 0x2}], &(0x7f0000000180)=[0x78, 0x58, 0x78, 0x38, 0x0, 0x0, 0x38, 0x38, 0x28, 0x48]}, 0x9}}, @clear_death={0x400c630f, 0x0, 0x1}, @enter_looper, @release={0x40046306, 0x3}], 0x96, 0x0, &(0x7f0000000300)="1382162ed03d04f7e6701455404b2f8f7382fd1dd4b18932fca0eda0404f09dcac0e7b9528dddafbeb65a3abeb8d2f2703294c507fbbaa53137fdff4626b04153713b67bca06f93a3498bb73d1603c4974076cc2cb4a0e7b652aaecb62c0b511c4888e85b45b74498562329963c4388624b370c6b7a5c15f14a1386ea94fbd8649da771c16cadd4297cb0bd8a76b07eb6b757c75429a"}) r3 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = dup2(r3, r0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:36 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = getpgid(0xffffffffffffffff) fcntl$lock(r1, 0x7, &(0x7f0000000140)={0x2, 0x0, 0x3, 0xff, r2}) r3 = dup2(r1, r0) getsockopt$IP_VS_SO_GET_DESTS(r3, 0x0, 0x484, &(0x7f0000000040)=""/185, &(0x7f0000000100)=0xb9) ioctl$sock_inet6_udp_SIOCOUTQ(r3, 0x5411, &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:36 executing program 1: r0 = creat(&(0x7f0000000040)='./file0\x00', 0xc39453ca63bdb715) r1 = add_key$user(&(0x7f0000000140)='user\x00', &(0x7f0000000180)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000280)="2261acf21ec099ae63bfd536faa72d572edd225efa8f47be9353d47ef1a793938c0dc6f308d4af82ebf579a8abb073da39c6eaac2398aa387d1250ff1bafc5eafcb1be1123589fee3e00b3f87c2f741b5b7baedfb9fd551e95bd1058c4174fb934c71f0a12c6ac4ae3e3428e33d989598515ec010610602014b5d6ffab1eadf5dd0dd377190bce5faa2445b073a83719bbcdae861f1ee13040b4331e0ae66092bc5093da31caaf", 0xa7, 0xfffffffffffffffe) keyctl$describe(0x6, r1, &(0x7f0000000280), 0x0) r2 = socket$netlink(0x10, 0x3, 0xf) writev(r2, &(0x7f0000000000)=[{&(0x7f0000ac9000)="290000002000190f00003fffffffda060200000000e80001040000040d001000ea1100000005000000", 0x29}], 0x1) acct(0x0) clock_gettime(0x0, &(0x7f00000000c0)={0x0, 0x0}) futimesat(r0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)={{0x77359400}, {r3, r4/1000+10000}}) 03:33:36 executing program 4: r0 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/pktcdvd/control\x00', 0x10000, 0x0) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000180)="9146a6f167962ae437589229294efb42608b9631ac40232007b287a4b16e8abb5b538ed82a0c69da7e2e501b33196e44667245aadd39e9ef8eb7fa346c3cf9bd5db1f0e8f93ceed103bb0c10b9a7036fd838eb08fb1717ee451053d011e634d8459e5b") perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:36 executing program 5: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000140)) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f00000000c0)=0x9) mkdir(&(0x7f0000000100)='./file0\x00', 0x122) bind(0xffffffffffffffff, &(0x7f0000557130)=@generic={0x0, "0103000000000000000000000000000009a979f321b30c7bc8790405c7bad62e0a53a632ed4938d36d73fb8f8401a3ff59829a2b0afe7ce43a4b2470a0c5216669ca021f6f65dcf160e7e58f358c0002f0000158d19bcb3151314a8ef1f1622ca5bdb9c8ead2000077aeb81c90001d6d7c980ee590c8b9f70dc136cb184a"}, 0x80) mremap(&(0x7f00005c5000/0x2000)=nil, 0x2000, 0x600000, 0x3, &(0x7f0000a00000/0x600000)=nil) socketpair$inet(0x2, 0x0, 0x9, &(0x7f0000000000)) dup2(0xffffffffffffff9c, 0xffffffffffffffff) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000240)='/proc/self/net/pfkey\x00', 0x0, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000880)={0x0, @remote, @broadcast}, &(0x7f0000000200)=0xfffffffffffffe77) 03:33:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 502.806286] binder: 10785:10791 ioctl 40046207 0 returned -16 [ 502.806524] binder_alloc: 10721: binder_alloc_buf, no vma [ 502.806542] binder: 10785:10791 transaction failed 29189/-3, size 0-0 line 3136 [ 503.115663] binder: undelivered TRANSACTION_ERROR: 29189 [ 503.121225] binder: undelivered TRANSACTION_ERROR: 29189 [ 503.126705] binder: 10715:10726 ioctl 40046207 0 returned -16 [ 503.135283] binder: undelivered TRANSACTION_ERROR: 29189 [ 503.142021] binder: undelivered TRANSACTION_ERROR: 29189 [ 503.148131] binder: undelivered TRANSACTION_ERROR: 29189 [ 503.189297] binder: 10798:10804 ioctl 5411 20000180 returned -22 [ 503.197134] binder: 10798:10806 ioctl 5411 20000180 returned -22 [ 503.211532] binder: 10802:10808 tried to acquire reference to desc 0, got 1 instead [ 503.219895] binder: 10802:10808 got transaction to context manager from process owning it [ 503.228748] binder: 10802:10808 transaction failed 29201/-22, size 0-0 line 3004 [ 503.249597] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10805 comm=syz-executor4 [ 503.266958] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10805 comm=syz-executor4 [ 503.280093] binder: undelivered TRANSACTION_ERROR: 29201 [ 503.394280] binder: 10818:10820 got transaction to invalid handle [ 503.400793] binder: 10818:10820 transaction failed 29201/-22, size 64-8 line 3013 [ 503.409967] binder: 10818:10820 tried to acquire reference to desc 0, got 1 instead [ 503.419877] binder: BINDER_SET_CONTEXT_MGR already set [ 503.422324] binder: 10818:10822 got transaction to invalid handle [ 503.422342] binder: 10818:10822 transaction failed 29201/-22, size 64-8 line 3013 [ 503.439734] binder: 10818:10820 ioctl 40046207 0 returned -16 [ 503.439821] binder: 10818:10822 tried to acquire reference to desc 0, got 1 instead [ 503.439975] binder: BINDER_SET_CONTEXT_MGR already set [ 503.439982] binder: 10818:10822 ioctl 40046207 0 returned -16 03:33:38 executing program 7: r0 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r1 = socket$inet6(0xa, 0x3, 0x2c) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x3}, 0x1c) sendmmsg(r1, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002d40)}}, {{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000800)="cd", 0x1}], 0x1, &(0x7f0000000140)}}], 0x2, 0x0) ftruncate(r0, 0x2081fc) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) madvise(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x2) setsockopt$inet6_MRT6_DEL_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd3, &(0x7f00000048c0)={{}, {0xa, 0x0, 0x0, @mcast1}}, 0x5c) fdatasync(r2) madvise(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x9) 03:33:38 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000380)=@req3={0x0, 0x7fff800000, 0x2, 0x10001, 0x6}, 0x1c) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000500)=0x3, 0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000000280)='./file1\x00', &(0x7f0000000180)='mslos\x00', 0x5010, &(0x7f0000000380)) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') clock_gettime(0x0, &(0x7f0000000340)={0x0}) mq_timedreceive(0xffffffffffffffff, &(0x7f00000003c0)=""/187, 0xbb, 0x7, &(0x7f0000000480)={r2}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000140)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x84, &(0x7f0000000080)=ANY=[]) r3 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r5 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r5, 0x4, 0x6100) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) sendfile(r4, r4, &(0x7f00000000c0), 0x8080fffffffe) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af) r6 = gettid() setpriority(0x0, r6, 0x0) unshare(0x8000000) r7 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x5}) bind$inet(r1, &(0x7f0000000300)={0x2, 0x3, @remote}, 0x10) mq_timedsend(r7, &(0x7f0000000100), 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000008c0)=ANY=[], 0x0) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f0000001000)=ANY=[@ANYBLOB="7f454c4600706a5ce1a2ee467d3bca22f507643a066104010000000000000200000000000040000000000000000c02000000000000a6d10000030038000200ffffffff468051e57464030000000300000000000000bc08000000000000f9ffffffffffffffff7f0000000000000600000000000000000800000000000005000000020000006f000000000000000000000000000000ea2b000000000000080000000000000003000000000000000800000000000000f8d1cf6bc8252c025b5f92a84bb4d5efd7201c0b3858f135eeae2dc7f0e87b4cb7c2ebe8e1bf26d90204e8796ae2234ab4507f89e0a927c56e06ac8486242f23306477b3ced713d9ccd7a0f1572c2cfeceaf21bfb67974157e7a4e10510b1d74ca0f796a92f62c8102c33ef139e0cf2ccd4388e8404194afc7dcb3c0580904a76736e493f5c3e2c8d91d510485793916f26e041f6b30857e8c9b55fe64259328116a71513c065b05319d42f98f000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000008f0000000000000000000000000000000000000000000000000000000000000000000000000000001e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ff00000000000000000000000000000000000000000000000000db0000000000000000000000000000000000000000bb4243dbcbc2188b0017487b2e533a58643fe24b175f8e919e52849e39389043525d3ddd494ae985e53468473c711971a0f1c6201ef789867a6a6a43da1331e65f4e1a7c88aea52f23a6494510e218d2997413efe8cfa6077c785f3c319061c37fa798884e7c5c982d909d1c9d69b8"], 0x418) 03:33:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="05631840afafa2020237"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000240)={0x0}, &(0x7f0000000280)=0xc) sched_setaffinity(r3, 0x8, &(0x7f00000002c0)) write$P9_RSTAT(r2, &(0x7f00000001c0)={0x6a, 0x7d, 0x1, {0x0, 0x63, 0x9, 0x8, {0x3, 0x4, 0x1}, 0x4000000, 0x3, 0x8, 0xffffffffffffff81, 0x4, 'eth1', 0x12, 'vboxnet1selfvmnet1', 0xd, '/dev/binder#\x00', 0xd, '/dev/binder#\x00'}}, 0x6a) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000000)=0x4, 0x4) ioctl$SG_GET_SCSI_ID(r2, 0x2276, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="04631f40000000001b2b836e50c993303c89aba52251c22689c9c9c371ed3076fe98d451065ff9546183a65fdfc0d5efa1cafec32e47fcb64c427e4cc1ce77f4b10eaf426a845f6a823f47fee17521ccb09e5092a5b883827d4b9050d02ff7740ccff1492236bf644acf55aa1e135f4a5ea38d9186e5c1d914830a0e1c12c6256d9034c9d7551017c418ddfd473932f82ef5418ec083ae7e8a1de215066dd905ba3db797d848c775dd34142711d0d69f281b0e2022cda27ba598ffdc7eafad243eae3e5bc2"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:38 executing program 5: r0 = open(&(0x7f0000000240)='./file0\x00', 0x101000, 0x40) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000280)={'ipvs\x00'}, &(0x7f00000002c0)=0x1e) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x0, &(0x7f0000000000)=0x1, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) ioctl$EVIOCGVERSION(r3, 0x80044501, &(0x7f0000000180)=""/160) ioctl$EVIOCGSW(r0, 0x8040451b, &(0x7f0000000540)=""/131) bind$inet(r2, &(0x7f0000000400)={0x2, 0x4e23, @multicast2}, 0x3) sendto$inet(r2, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) pipe2(&(0x7f0000000480)={0xffffffffffffffff}, 0x800) r5 = getpid() getsockopt$inet6_tcp_buf(r4, 0x6, 0x1d, &(0x7f0000000300)=""/168, &(0x7f00000003c0)=0xa8) ioctl$sock_SIOCOUTQNSD(r2, 0x894b, &(0x7f00000000c0)) write$cgroup_pid(r4, &(0x7f0000000100)=r5, 0x12) getsockname(r2, &(0x7f00000004c0)=@pppol2tpv3in6, &(0x7f0000000440)=0x80) fcntl$setlease(r2, 0x400, 0x1) shutdown(r2, 0x1) 03:33:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TUNSETLINK(r2, 0x400454cd, 0xfc162be6dd6de566) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10) clock_adjtime(0x4, &(0x7f0000000140)={0x5, 0x100, 0x6, 0xb69, 0x4a, 0x9b, 0x4, 0x7, 0x55a, 0x7, 0x8, 0x2, 0x0, 0x3, 0x7, 0x8e4, 0x7, 0x6, 0x6, 0x3, 0x80000000, 0x0, 0x1, 0x8001, 0x100000000, 0x2}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:38 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000011440)={0x0, @rand_addr, @multicast1}, &(0x7f0000000040)=0x2) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:38 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000fdb000)='ubifs\x00', 0x1003, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000187ff8)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000e7000)) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000002200)=""/4096, 0x1000}], 0x1, 0x0) ioctl$int_out(0xffffffffffffffff, 0x2, &(0x7f00000001c0)) utimes(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r0) 03:33:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x1ff) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f00000000c0)={0x5, &(0x7f0000000080)=[{0x0, 0x7fffffff, 0x5, 0x81}, {0x8, 0xfffffffffffffffb, 0xffffffffffffffff, 0xfff}, {0xfff, 0x2, 0xffffffff, 0x2}, {0xffffffffffff4b24, 0x7, 0x6b0, 0x7d5c}, {0xc3, 0x101, 0x1, 0x7ae}]}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 505.158810] binder: 10828:10833 ioctl 40046205 1ff returned -22 [ 505.163231] binder: 10824:10837 ioctl 400454cd fc162be6dd6de566 returned -22 [ 505.163691] binder: 10824:10837 tried to acquire reference to desc 0, got 1 instead [ 505.163701] binder: 10824:10837 got transaction to context manager from process owning it [ 505.163712] binder: 10824:10837 transaction failed 29201/-22, size 0-0 line 3004 [ 505.173696] binder: 10829:10835 unknown command 1075340037 03:33:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) socketpair(0x5, 0xa, 0x80000000, &(0x7f0000000040)={0xffffffffffffffff}) r3 = socket$nl_route(0x10, 0x3, 0x0) connect$l2tp(r2, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x0, r3, {0x2, 0x4e22, @broadcast}, 0x4, 0x4, 0x1, 0x4}}, 0x2e) r4 = dup2(r1, r0) ioctl$TUNGETFEATURES(r4, 0x800454cf, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 505.173705] binder: 10829:10835 ioctl c0306201 20007000 returned -22 [ 505.182861] binder: 10829:10835 ioctl 2276 20000140 returned -22 [ 505.182981] binder: 10829:10835 unknown command 1075798788 03:33:38 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, r0, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB='trans=rdma,port=0x0000000000000000,timeout=0x0000000000000001,sq=0xffffffff86abde1d,timeout=0x00000000000K0000,\x00']) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) mkdirat(r2, &(0x7f00000000c0)='./file1\x00', 0x8) [ 505.182989] binder: 10829:10835 ioctl c0306201 20000680 returned -22 [ 505.193111] binder: 10829:10835 unknown command 1075340037 [ 505.193119] binder: 10829:10835 ioctl c0306201 20007000 returned -22 [ 505.201215] binder: undelivered TRANSACTION_ERROR: 29201 [ 505.206556] binder: 10829:10835 ioctl 2276 20000140 returned -22 [ 505.212966] binder: 10829:10838 unknown command 1075798788 [ 505.212975] binder: 10829:10838 ioctl c0306201 20000680 returned -22 [ 505.213706] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10834 comm=syz-executor4 [ 505.238960] binder: BINDER_SET_CONTEXT_MGR already set [ 505.238969] binder: 10828:10839 ioctl 40046207 0 returned -16 [ 505.239113] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10840 comm=syz-executor4 [ 505.349314] binder: 10828:10839 ioctl 40046205 1ff returned -22 03:33:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 505.356132] binder: 10828:10839 tried to acquire reference to desc 0, got 1 instead 03:33:38 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') mount(&(0x7f000000a000)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f000000c000)='ramfs\x00', 0x0, &(0x7f000000a000)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000811ffa)='bdev\x00', 0x100000, &(0x7f0000444000)) mount(&(0x7f0000fb6000)='./file0\x00', &(0x7f0000d78000)='.', &(0x7f0000fdb000)='ubifs\x00', 0x1003, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000187ff8)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f00000e7000)) preadv(r1, &(0x7f0000000040)=[{&(0x7f0000002200)=""/4096, 0x1000}], 0x1, 0x0) ioctl$int_out(0xffffffffffffffff, 0x2, &(0x7f00000001c0)) utimes(&(0x7f0000000080)='./file0\x00', &(0x7f0000000180)={{0x0, 0x7530}}) close(r0) [ 505.428132] binder: 10849:10852 tried to acquire reference to desc 0, got 1 instead [ 505.436091] binder: 10849:10852 got transaction to context manager from process owning it [ 505.445121] binder: 10849:10852 transaction failed 29201/-22, size 0-0 line 3004 03:33:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_netdev_private(r3, 0x89f8, &(0x7f00000001c0)="0097d20a02f6b73870648ef4a2d27f57ecba461fe7f100") connect(r2, &(0x7f0000000200)=@llc={0x1a, 0x5, 0x3, 0x7, 0x4, 0x8, @link_local}, 0x80) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0500ed00"], 0x0, 0x0, &(0x7f00000000c0)}) r4 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="046304400000000011634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f00000002c0)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[], @ANYBLOB="2a00000000edf57cd74423034918be4975d6810dc2d0f45c283352a0466c000000"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:38 executing program 5: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) fchmod(r1, 0x0) setsockopt$sock_int(r0, 0x1, 0x200000010, &(0x7f0000000080), 0x4) 03:33:38 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0463044000000000956d8e55ecf2064016c9c26cbb094e128d1884f0707760f75c058493dfde0000000000000000000000000073f43f8390a6e59499b6f1f5e82013ec1731f42fcc4e978a9d9672617cb92057c59cac18a9bff9b091a11c464dabb46cd4e51121acaaf01802a2e77d85b8a394bded446ef6cf"], 0x0, 0x0, &(0x7f00000006c0)}) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1c, &(0x7f0000000040)={@mcast1}, &(0x7f0000000080)=0x14) 03:33:38 executing program 7: r0 = syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0xa4, 0x100) r1 = memfd_create(&(0x7f0000000140)="a14465762f6c6f6f7023000579670d052cacf0db0d6dfb569130d22bb8160fdfabb57b2a6b8b705a76cd073cc4b4f783fb7877ca467f678171b2527c7a779b1ecb15ab2a9f246d6587aef8814b11ee21f2559c809a677ddb90208573bedaa63b5ade41081251a28f6a317489c7c372b989ffc77fbcac00321d0626e2cf2e174c0000000000000000000062d28add5b0dad309cd6a3dfcab5e5f898c29f7b7c17b5dfa3423e62a467f7324c485bfcc7a3dd42cd39a6786e17583b13ffdcb1f0f17189d2262c8b8c226b2e06805b511491a9235ffd50251f0f2cc00134", 0x3) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x34, 0xffffffffffffffff, 0x4) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000000)=0x7fe, 0x1000000ff) sendto$inet6(r3, &(0x7f00000000c0)="6a725a5f62d02a6be55afd02d999", 0xe, 0x0, &(0x7f0000000040)={0xa, 0x0, 0x4, @dev}, 0x1c) sendmsg$nl_xfrm(r1, &(0x7f0000000340)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@flushsa={0x20, 0x1c, 0x100, 0x70bd2c, 0x25dfdbfd, {0xff}, [@lastused={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x40000}, 0x40080c0) ioctl$LOOP_SET_BLOCK_SIZE(r1, 0x4c09, 0x101) recvmmsg(r3, &(0x7f0000000080), 0xb, 0x2000, &(0x7f0000000380)={0x77359400}) sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00005a1000/0x200000)=nil, 0x200000, 0x1fffffe, 0x8031, 0xffffffffffffffff, 0x0) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000480)) [ 505.470143] binder: 10850:10853 ioctl 800454cf 200000c0 returned -22 [ 505.483133] binder: undelivered TRANSACTION_ERROR: 29201 [ 505.493779] binder: 10850:10857 ioctl 800454cf 200000c0 returned -22 [ 505.581866] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10861 comm=syz-executor4 [ 505.600686] binder: 10860:10863 tried to acquire reference to desc 0, got 1 instead [ 505.610463] binder: BINDER_SET_CONTEXT_MGR already set [ 505.616548] binder: 10860:10863 ioctl 40046207 0 returned -16 [ 505.620153] binder: BINDER_SET_CONTEXT_MGR already set [ 505.620162] binder: 10860:10866 ioctl 40046207 0 returned -16 [ 505.622361] binder: tried to use weak ref as strong ref [ 505.622371] binder: 10860:10864 Acquire 1 refcount change on invalid ref 0 ret -22 [ 505.687096] binder: 10868:10872 unknown command 15532037 [ 505.692744] binder: 10868:10872 ioctl c0306201 20007000 returned -22 [ 505.702006] binder: 10868:10872 got transaction to context manager from process owning it [ 505.710626] binder: 10868:10872 transaction failed 29201/-22, size 0-0 line 3004 [ 505.743013] binder: undelivered TRANSACTION_ERROR: 29201 03:33:39 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000380)=@req3={0x0, 0x7fff800000, 0x2, 0x10001, 0x6}, 0x1c) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000500)=0x3, 0x4) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000000280)='./file1\x00', &(0x7f0000000180)='mslos\x00', 0x5010, &(0x7f0000000380)) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='mountinfo\x00') clock_gettime(0x0, &(0x7f0000000340)={0x0}) mq_timedreceive(0xffffffffffffffff, &(0x7f00000003c0)=""/187, 0xbb, 0x7, &(0x7f0000000480)={r2}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000140)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x84, &(0x7f0000000080)=ANY=[]) r3 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r3) r4 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) r5 = creat(&(0x7f0000000700)='./bus\x00', 0x0) fcntl$setstatus(r5, 0x4, 0x6100) write$cgroup_type(r5, &(0x7f0000000200)='threaded\x00', 0xfffffeb3) sendfile(r4, r4, &(0x7f00000000c0), 0x8080fffffffe) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000100), 0x921b527a62bfd8af) r6 = gettid() setpriority(0x0, r6, 0x0) unshare(0x8000000) r7 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x0, 0x0, &(0x7f0000664fc0)={0x0, 0x1, 0x5}) bind$inet(r1, &(0x7f0000000300)={0x2, 0x3, @remote}, 0x10) mq_timedsend(r7, &(0x7f0000000100), 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000008c0)=ANY=[], 0x0) recvmsg(r0, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f00000002c0)=""/20, 0x14}, 0x100) write$binfmt_elf64(r0, &(0x7f0000001000)=ANY=[@ANYBLOB="7f454c4600706a5ce1a2ee467d3bca22f507643a066104010000000000000200000000000040000000000000000c02000000000000a6d10000030038000200ffffffff468051e57464030000000300000000000000bc08000000000000f9ffffffffffffffff7f0000000000000600000000000000000800000000000005000000020000006f000000000000000000000000000000ea2b000000000000080000000000000003000000000000000800000000000000f8d1cf6bc8252c025b5f92a84bb4d5efd7201c0b3858f135eeae2dc7f0e87b4cb7c2ebe8e1bf26d90204e8796ae2234ab4507f89e0a927c56e06ac8486242f23306477b3ced713d9ccd7a0f1572c2cfeceaf21bfb67974157e7a4e10510b1d74ca0f796a92f62c8102c33ef139e0cf2ccd4388e8404194afc7dcb3c0580904a76736e493f5c3e2c8d91d510485793916f26e041f6b30857e8c9b55fe64259328116a71513c065b05319d42f98f000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000008f0000000000000000000000000000000000000000000000000000000000000000000000000000001e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ff00000000000000000000000000000000000000000000000000db0000000000000000000000000000000000000000bb4243dbcbc2188b0017487b2e533a58643fe24b175f8e919e52849e39389043525d3ddd494ae985e53468473c711971a0f1c6201ef789867a6a6a43da1331e65f4e1a7c88aea52f23a6494510e218d2997413efe8cfa6077c785f3c319061c37fa798884e7c5c982d909d1c9d69b8"], 0x418) 03:33:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x4, 0xfffffffffffffffd, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) socket(0x3, 0x6, 0xe1ca) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0xc, 0xffffffffffffffff, 0x4) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000180)={r0, 0x0, 0x6, 0x6, 0x8}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="6a10870f10b17948e21af591aed35cfdd2887bcd9da94076f5bf5b7f32b5e6c738b9953f472d825c4faf48819f56b8632730a8edcaf678c59e86e8dfbdbf88fe66b01ec37cb1b2a233d76595e3358b13c977f47cb1059c2931277029b434f1bec4ade97a2f1f3b546ed162f880781da9cd9b065b549dbaf4853e3dff97"]) ioctl$SG_GET_ACCESS_COUNT(r2, 0x2289, &(0x7f00000000c0)) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="058a765d4bfe8c15139a4347e879a84fab60abaee05c7d75daa0f365babe23c2aa9bc766aa45e04134abe407000000000000007474768a7c76c06e75689f4e60d3cd3f2481d7585f18129ff83df2f7410a27a5e5506e21a9b2c0f12ba74077565c33a1618b22be0f4ce47b845c7bb5e39afee0e524c4364e309d660fdaff2791dcfc0a0a3b2342b953e2368bba00000000000000000000000000000000"], 0x0, 0x0, &(0x7f0000002000)}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000000)={0x77359400}, 0x10) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0000fd1c3014d11b559a5d55ad53b9eb432ece590b1ccfb924d042c25e38817d9040f48b6baa9cf8391d930149beaa2d5ed638310d23d418500506bbc91ae82f7197cc242c73078a289ac126f3dfa83205278a35fa3dadf5423317944a591ba0c0f604cab084b368920cfeffb8ae389d3b7a86f9916706e4f294d599b4fbdbfd070300d1f2802f943831b491626765d22ffcad37be43eb680f634603d771a164008bfc98d0b5ee1a682ad31654dc0791f48f25f87a2595e25b90d6001037f3c91f68392c4fc89bcc5a1df0912d177180a243d98c1b9e2274cc49269466a3ebd396a9864c0e9d27725223"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) write$P9_RSETATTR(r2, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0x7) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="0463044000040000"], 0x96, 0x0, &(0x7f00000006c0)}) 03:33:39 executing program 5: syz_open_dev$sndtimer(&(0x7f0000000000)='/dev/snd/timer\x00', 0x0, 0x250100) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) ptrace$getregs(0xffffffffffffffff, r0, 0x3, &(0x7f0000000080)=""/105) clock_gettime(0x7, &(0x7f0000000100)) pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$P9_RCREATE(r1, &(0x7f0000000180)={0x18, 0x73, 0x2, {{0x64, 0x4, 0x3}, 0x5}}, 0x18) futex(&(0x7f00000001c0), 0x7, 0x1, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000240), 0x0) ioctl$PPPIOCSMRU(r1, 0x40047452, &(0x7f0000000280)=0x6) sendmsg$nl_netfilter(r1, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000300)={0x8c, 0x5, 0x7, 0x4, 0x70bd26, 0x25dfdbff, {0xb, 0x0, 0x5}, [@generic="88baab8254355e110843e761ae2b7a2d1dd619fb5da8b320bad4bed0581f3f564d238445f9c01cb1062063b0c20bae61b2f3198b4c07a8d86b6541066efe8d1dbcd11fb6726b8013f74a69d0b091eeb8842629700c6e20458ca5f4d79aa8402dc9cbecdd6d82259b2d030108d4", @typed={0x8, 0x6, @ipv4=@remote}]}, 0x8c}, 0x1, 0x0, 0x0, 0x4}, 0x50) clock_gettime(0x7, &(0x7f0000000440)) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000480)={{{@in=@remote, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000580)=0xe8) setuid(r3) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r2, 0xc08c5335, &(0x7f00000005c0)={0x7fff, 0x7fff, 0x7ff, 'queue1\x00', 0x3}) ioctl$EVIOCGMTSLOTS(r2, 0x8040450a, &(0x7f0000000680)=""/120) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f0000000700)={0xa6ac, 0x3f, 0x3}) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000740)={'ip6_vti0\x00', 0x101}) getsockopt$inet_mreq(r2, 0x0, 0x24, &(0x7f0000000780)={@broadcast, @local}, &(0x7f00000007c0)=0x8) ioctl$TCSBRKP(r2, 0x5425, 0x9) ioctl$TUNGETVNETHDRSZ(r2, 0x800454d7, &(0x7f0000000800)) ioctl$PIO_CMAP(r2, 0x4b71, &(0x7f0000000840)={0x7f, 0x4, 0xffffffff, 0x6, 0x5, 0xe724}) write$selinux_user(r1, &(0x7f0000000880)={'system_u:object_r:dhcpd_state_t:s0', 0x20, 'root\x00'}, 0x28) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x40082406, &(0x7f00000008c0)='ip6_vti0\x00') ioctl$RTC_WKALM_RD(r2, 0x80287010, &(0x7f0000000900)) ioctl$UI_SET_ABSBIT(r1, 0x40045567, 0x1) ioctl$RNDZAPENTCNT(r1, 0x5204, &(0x7f0000000940)=0x1) clock_gettime(0x0, &(0x7f0000000980)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000a00)={0x0, 0x0}) write$sndseq(r2, &(0x7f0000000ac0)=[{0x80, 0x30, 0x8, 0x3c, @time, {0x100000001, 0x100000000}, {0x80000001}, @quote={{0x5, 0x2}, 0x2, &(0x7f00000009c0)={0x1, 0x9, 0x4, 0x2, @time={r4, r5+30000000}, {0x7, 0x9}, {0x4, 0x5}, @raw8={"50c55aa8fe5857c68e58355a"}}}}, {0x4353, 0x2, 0x3e0000000000, 0xcd4c, @time={0x77359400}, {0x5, 0x1000}, {0x2, 0x8}, @result={0x74684e58, 0x1}}, {0xfffffffffffffffe, 0x6, 0x0, 0x3, @tick=0xcc48, {0x1, 0x6d3f5552}, {0x80000000, 0xa53f}, @time=@tick=0xffff}, {0x3, 0xb643, 0x1, 0x7, @time={r6, r7+30000000}, {0x1000, 0x7}, {0x2, 0x7fffffff}, @queue={0x5d, {0x9, 0x7}}}, {0x23, 0x5, 0x7, 0x2, @tick=0x100000000, {0x2, 0x54b}, {0x1, 0x2}, @ext={0x68, &(0x7f0000000a40)="9e92718be3702feaa8ea91c22e1d25016112d6d28b3534551d63403476533723f5008a0cf44963c2841806c3bdabdccd6dc41f30be5fc9232b2aec51b1445ace7636ebf0b1ba1b3c1bfa0a4db78eab1d1ecd479a7f806df4b65d589b4409da54d49ace75ace51d64"}}, {0x92c3, 0x6, 0x3, 0x3, @tick=0xfffffffffffffeff, {0x0, 0x5}, {0xdbb1, 0x3}, @time=@time}], 0x120) ioctl$TIOCSTI(r2, 0x5412, 0x400) socket$inet_tcp(0x2, 0x1, 0x0) 03:33:39 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_MCAST_MSFILTER(r0, 0x0, 0x30, &(0x7f0000000140)=ANY=[@ANYBLOB="000000000000000002000900f5ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000056020000"], 0x59) 03:33:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="046304400000000011634840000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f00000002c0)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[], @ANYBLOB="0000000000eaf500"], 0x0, 0x0, &(0x7f00000006c0)}) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x800, 0x0) ioctl$sock_SIOCDELDLCI(r3, 0x8981, &(0x7f0000000080)={'team0\x00', 0x9}) 03:33:39 executing program 7: r0 = socket$inet6(0xa, 0x100000003, 0x11) r1 = socket$inet6(0xa, 0x0, 0x2) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") sendto$inet6(r0, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @loopback={0x0, 0x8}}, 0x1c) getrusage(0x1, &(0x7f00000001c0)) 03:33:39 executing program 7: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xfffffffffffffffb, 0x73}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) clone(0x24000000, &(0x7f0000000140), &(0x7f0000000800), &(0x7f0000000640), &(0x7f0000000000)) socket$inet6(0xa, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x1c) waitid(0x0, 0x0, &(0x7f0000000900), 0x4000000c, &(0x7f0000000280)) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r0) setsockopt$inet_udp_int(r2, 0x11, 0x0, &(0x7f0000000b80), 0x4) r3 = syz_open_dev$sg(&(0x7f0000005000)='/dev/sg#\x00', 0x0, 0x8002) write(r3, &(0x7f0000000000)="b63db85e1e8d020000feff00003ef0011dcc606aed5ed2bc7018cebc9bc2feffffffffffffffe22c9b160096aa1fae1a", 0x30) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000800)={0x0, 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000000780)=[{{&(0x7f0000000140)=@nl=@proc, 0x80, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/102, 0x66}, {&(0x7f0000000240)=""/104, 0x68}, {&(0x7f00000002c0)=""/184, 0xb8}], 0x3, &(0x7f00000003c0)=""/253, 0xfd, 0x7fffffff}, 0x100000001}, {{&(0x7f00000004c0)=@pppol2tpv3in6, 0x80, &(0x7f0000000740)=[{&(0x7f0000000540)=""/148, 0x94}, {&(0x7f0000000600)=""/40, 0x28}, {&(0x7f0000000640)=""/207, 0xcf}], 0x3, 0x0, 0x0, 0x3}, 0x18}], 0x2, 0x40000100, &(0x7f0000000840)={r5, r6+10000000}) fcntl$notify(r4, 0x402, 0x20) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000c40)='/dev/ashmem\x00', 0x101441, 0x0) ioctl$EVIOCGBITSW(r4, 0x80404525, &(0x7f00000000c0)=""/35) ioctl$SG_GET_ACCESS_COUNT(r2, 0x2289, &(0x7f0000000c80)) sendmsg$unix(r4, &(0x7f0000000b40)={&(0x7f0000000880)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000b00)=[{&(0x7f0000000a40)="a75cbebc2c59d9fa330301171ef5ca011ba22c42f984ea25ca1bc9c2b7c665754095bf0a01deb318a473f52605d58ab43caedc14f080b2bea308f55baf28e58f61536f47b37452e80f73ea1dc63ae07a89e326fe31baae022399139129ffcb4a0054bab686c26c92dd4affd771f652770b99e5eb77a1082b402a8e6a631824e06f6c0c9fcbd4fd48521a309875b59faf0ec162", 0x93}], 0x1, 0x0, 0x0, 0x20004000}, 0x80) getrlimit(0xc, &(0x7f0000000c00)) [ 506.117663] binder: 10890:10896 unknown command 1568049669 [ 506.125523] binder: 10890:10896 ioctl c0306201 20007000 returned -22 [ 506.134381] binder: 10888:10894 tried to acquire reference to desc 0, got 1 instead [ 506.134391] binder: 10888:10894 got transaction to context manager from process owning it 03:33:39 executing program 5: r0 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) close(r0) r1 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x0, 0x105082) r2 = memfd_create(&(0x7f00000003c0)="000000008c00000000000000000000", 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='bond_slave_1\x00', 0x10) pwritev(r2, &(0x7f00000001c0)=[{&(0x7f00000000c0)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r0, 0x0) madvise(&(0x7f0000004000/0x2000)=nil, 0x2000, 0x9) 03:33:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\b\x00\x00\x00'], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:39 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x501400, 0x0) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000180)={0x2, @tick=0x101, 0x1, {0x1, 0x101}, 0x5, 0x3, 0xfffffffffffffff8}) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="7472616e733d72646d612c706f72743d3078303030303030303030303030303030302c74696d656f75743d3078303030303030303030303030303030312c73713d3078666666666666666638366162646531642c74696d656f75743d3078303030303030303030303030303030302c005c03a48c681f41263be7b60460afe10634346105a1b2445ae249c88a8208c0f2bb7d393c9fca9cb0f63354030c41cc694c3d04c485a5d85e6e8ff74ec2840e0bb2c005e3208100771edc2f0d94e01e136ab0793aeebae60da08d1c79547f159c1e49f9b6ccfa"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 506.134404] binder: 10888:10894 transaction failed 29201/-22, size 0-0 line 3004 [ 506.173281] binder: 10892:10907 unknown command 486342656 [ 506.179455] binder: undelivered TRANSACTION_ERROR: 29201 [ 506.179463] binder: BINDER_SET_CONTEXT_MGR already set [ 506.179471] binder: 10890:10896 ioctl 40046207 0 returned -16 [ 506.186195] binder: 10890:10896 unknown command 1568049669 [ 506.186204] binder: 10890:10896 ioctl c0306201 20007000 returned -22 [ 506.186253] binder: BINDER_SET_CONTEXT_MGR already set 03:33:39 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000040)={0xffffffffffffff5c, 0x0, &(0x7f0000000900), 0x0, 0x0, &(0x7f0000000080)="0300c4ee051799d71198a60ce3b6587500000000004afc3881cdcc48e9130a67b88c74999b90b533ec224afc83a9bdcd654156d7c716110b79e6a4d1206eca0e59ba8ce0beda3e9578cf507e833af9574ac5614b2e478cb3ad674d004d600894f84eb248176f5dd1adc6340c7a9870629de421612be68f9362f85def0b290059ddc87fca99"}) [ 506.186261] binder: 10890:10911 ioctl 40046207 0 returned -16 [ 506.222153] binder: 10892:10907 ioctl c0306201 20007000 returned -22 [ 506.223213] binder: 10892:10912 IncRefs 0 refcount change on invalid ref 1024 ret -22 [ 506.239046] binder: 10892:10907 unknown command 486342656 [ 506.242243] binder: 10892:10913 IncRefs 0 refcount change on invalid ref 1024 ret -22 [ 506.253130] binder: 10892:10907 ioctl c0306201 20007000 returned -22 03:33:39 executing program 1: r0 = socket$inet(0x10, 0x3, 0xc) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) sendmsg(r0, &(0x7f0000011fc8)={0x0, 0xffffffffffffffed, &(0x7f00000000c0)=[{&(0x7f0000000000)="2400000002031f001cfffd946fa2830020200a000900010001e700000000a3a20404ff7e", 0x24}], 0x1}, 0x0) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000080)={0x4, &(0x7f0000000040)=[{0xff, 0x1}, {0x2, 0x2a0}, {0x3, 0xfffffffffffffffa}, {0x6, 0x9}]}) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ashmem\x00', 0x2, 0x0) fcntl$setflags(r0, 0x2, 0x1) sendmsg(r0, &(0x7f0000001840)={0x0, 0x0, &(0x7f0000004000)=[{&(0x7f0000000640)="2400000002031f001cfffd946fa283005b580a000900020009000000000000000404ff7e", 0x24}], 0x1}, 0x0) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000140)={0x5, &(0x7f0000000100)=[{0x7, 0x1}, {0x80000001, 0x6}, {0x5, 0xfffffffffffffffe}, {0x8de211c, 0x8}, {0x2000000020000, 0x3}]}) 03:33:39 executing program 5: perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x100}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x4) epoll_wait(r0, &(0x7f0000000300)=[{}], 0x1, 0x3) unshare(0x800060000000) ioctl$sock_ifreq(r0, 0x0, &(0x7f0000000000)={"73797a6b04436c6564391f8edbf1978d", @ifru_map}) r1 = socket$inet(0x2, 0x3, 0x2) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000640)={0x0, 0x0, 0x0}, &(0x7f0000000680)=0xc) r4 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000880)='/selinux/checkreqprot\x00', 0x40000, 0x0) setsockopt$inet_int(r1, 0x0, 0xca, &(0x7f0000000000), 0x10) r5 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/snmp6\x00') r6 = mq_open(&(0x7f00000003c0)='/dev/fuse\x00', 0x800, 0x2, &(0x7f0000000400)={0xa0, 0x5, 0x9, 0x54c, 0x42, 0x5, 0x0, 0x3f}) mmap$binder(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20030, r0, 0x0) r7 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000140)='/dev/fuse\x00', 0x2, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f00000007c0)={{0x2, 0x4e20, @local}, {0x0, @remote}, 0x44, {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x10}}, 'veth1_to_bond\x00'}) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r5, 0x6, 0x21, &(0x7f0000000180)="986c038e24cc378daa1627434ca47369", 0x10) keyctl$describe(0x6, 0x0, &(0x7f0000000340)=""/71, 0x47) fcntl$F_GET_FILE_RW_HINT(r6, 0x40d, &(0x7f0000000100)) ioctl$TIOCMBIS(r5, 0x5416, &(0x7f0000000040)=0x80000001) setfsuid(r2) fchown(r1, r2, r3) ioctl$BLKFLSBUF(r4, 0x1261, &(0x7f0000000280)=0x7) ioctl$FIBMAP(r7, 0x1, &(0x7f0000000440)=0x4) dup3(0xffffffffffffffff, r5, 0x80000) ioctl(0xffffffffffffffff, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f762070") mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$TCSETAW(r5, 0x5407, &(0x7f0000000240)={0x798, 0x80, 0x7f, 0x100, 0x7, 0x2, 0x4, 0x100000001, 0x4, 0x8}) [ 506.418271] binder: 10919:10924 tried to acquire reference to desc 0, got 1 instead [ 506.435846] binder: 10921:10928 unknown command 8 [ 506.435855] binder: 10921:10928 ioctl c0306201 20007000 returned -22 [ 506.437371] binder: 10921:10928 got transaction to context manager from process owning it [ 506.437383] binder: 10921:10928 transaction failed 29201/-22, size 0-0 line 3004 [ 506.475587] binder: undelivered TRANSACTION_ERROR: 29201 [ 506.537755] binder: BINDER_SET_CONTEXT_MGR already set [ 506.543518] binder: 10919:10924 ioctl 40046207 0 returned -16 [ 506.597797] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. [ 506.621753] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. [ 506.633970] netlink: 4 bytes leftover after parsing attributes in process `syz-executor1'. 03:33:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) r3 = getpgrp(0xffffffffffffffff) fcntl$setown(r1, 0x8, r3) 03:33:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0563045b2eeb71456ee87f9c00"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7472616e733d72646d612c706f72743d30783030303030303030303030303030301f2c74696d656b75743d3078303030303030303030306666666638366162646531642c74696d650ca5e9ff3078303030303030303030303030303030302c000000000000000052c0394752797cc400"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:40 executing program 6: pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0xffffffffffffffca}, 0x7) socketpair(0x2, 0x7, 0x7f, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(r3, &(0x7f0000000180)='./file0\x00', 0x1) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="7472616e733d66642c7266646eaa468d3bb22c13b0ba0073749dc40333847a6d777e52341b7267e9df64dbfde77b3d8d6ed6825c9a8c195bb02260580839ecc13f5638c9b5533582b8fb128c076395494dd7d114f274ef7b07704cbe1b17998c74806f2f62f0727bee53cf2b1fd6ce113429d72baa77df2a2a7a71bf193ff8738285f1b5ec7f70c09a77769b44705a75b467991d329ffc5eed881e1b5be3ca9898efd2a272d5481989224269f5a87ecd65e079dd5df74001abd2", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',version=9p2000.u,\x00']) write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a000000290100000000000000000000b5c8bdbed0770cf084fe43b7ef984c3e0000a73d11108f872400"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) r4 = gettid() mkdir(&(0x7f0000000600)='./file0\x00', 0x10) waitid(0x1, r4, &(0x7f00000002c0), 0x2, &(0x7f00000004c0)) accept4(r2, &(0x7f0000000580)=@vsock={0x28, 0x0, 0x0, @my}, &(0x7f0000000300)=0x80, 0x80000) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB="6f3d00c2d633c4ece240d0ef4c607985b75799217b86ef051720f90f93b1a8b302", @ANYRESHEX=r1, @ANYBLOB=',\x00']) execve(&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0), &(0x7f0000000680)) 03:33:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0xfffffffffffffffe) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000140)={0x0}) r3 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x4010, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0xc8, 0x0, &(0x7f0000000200)=[@request_death={0x400c630e, 0x0, 0x4}, @acquire_done={0x40106309, r2}, @reply_sg={0x40486312, {{0x1, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x58, 0x38, &(0x7f0000000080)=[@fda={0x66646185, 0x7, 0x3, 0x30}, @fda={0x66646185, 0x6, 0x2, 0x21}, @flat={0x77622a85, 0x100, r3, 0x2}], &(0x7f0000000100)=[0x70, 0x40, 0x78, 0x48, 0x20, 0x0, 0x18]}, 0x7}}, @exit_looper, @transaction_sg={0x40486311, {{0x2, 0x0, 0x2, 0x0, 0x1, 0x0, 0x0, 0x0, 0x48, &(0x7f0000000140), &(0x7f0000000180)=[0x38, 0x40, 0x0, 0x0, 0x0, 0x30, 0x48, 0x30, 0x78]}, 0xfffffffffffffff9}}, @acquire={0x40046305, 0x2}], 0x1c, 0x0, &(0x7f0000000300)="7f73bf2a24036d631d1e98e5156359dd044d3bd2be62642e7205c748"}) r4 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:40 executing program 1: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000001140)='./file0\x00', 0x3) write$binfmt_script(r1, &(0x7f0000000440)={'#! ', './file0', [], 0xa, "60c36302cd61bad5b8d6ef589ce683d5ff3ce1067c8c9536b474998722fe6b6c"}, 0x2b) close(r1) fstatfs(r0, &(0x7f0000000680)=""/197) syz_mount_image$iso9660(&(0x7f0000000280)='iso9660\x00', &(0x7f0000000380)='./file0\x00', 0x186, 0x1, &(0x7f00000005c0)=[{&(0x7f0000000500)="990f62d0589aca9cc618082ef2f5602264e2831c578ade37b3969449344d1ce3038fc644a0942072bdbd380c6fa6a11a68fd320dfd6205599cd12bbb0259a6c2d108f77d055a23b591f26b", 0x4b, 0x1}], 0x40, &(0x7f0000000640)=ANY=[]) getsockopt$ARPT_SO_GET_ENTRIES(r1, 0x0, 0x61, &(0x7f00000001c0)=ANY=[@ANYBLOB="66696c74657200000000000000000000000000000000000000100000000000004b000000584ecd703035dca603c8266238be6852a9b7e67cd757e5c7d1275d4cf325c5e74ac48dad8c0000006271060ad96fe7fc07f62698328bdb2ae230b846e73e0fbb550581699a3cf44d119560e1f06dfff59b056e31f7a13a6eaab6b60018667ac1d432b499ac98bcfeb2aa5c393caa254544179281c3b2bad6fffe00000000000000"], &(0x7f0000000140)=0x1) ioctl$VT_ACTIVATE(r1, 0x5606, 0x5) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/user\x00', 0x2, 0x0) syz_read_part_table(0xffffffff00000000, 0x1, &(0x7f00000000c0)=[{&(0x7f0000000000)="000000000000000000000000000000000000000000000000e0e415320000000002009c0126000100000064000000000127008e030c0065000000640000000003b50d0ebf3100c900000064000000007d54c0a92020002d010000df40000055aa", 0x60, 0x1a0}]) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000000340)={@multicast1, @broadcast}, &(0x7f00000003c0)=0xc) 03:33:40 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8a00, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000080), &(0x7f0000000140)=0x8) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x2, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f00003b9fdc)) r2 = syz_open_pts(r1, 0x0) write$binfmt_aout(r1, &(0x7f0000001200)=ANY=[@ANYBLOB="0000000346030000fc0200000104000049010000552659230000000000000000271926da5887d103d78bd513"], 0x2c) ioctl$TCSETSF(r2, 0x5404, &(0x7f00000000c0)={0xffffffffffffffc0}) ioctl$TCSETSF(r2, 0x5412, &(0x7f0000000040)) 03:33:40 executing program 7: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x40040, 0x0) ioctl$BLKREPORTZONE(r0, 0xc0101282, &(0x7f0000000040)={0x7, 0x5, 0x0, [{0x7fff, 0x1, 0x1, 0x101, 0x17f2, 0xe42, 0xd41}, {0x8, 0x1, 0x25e2, 0x6, 0x3, 0x1, 0x9}, {0x6, 0x3, 0x6, 0x3, 0x1, 0x2, 0x6}, {0x4, 0x9, 0x6f76, 0x0, 0x7, 0x2, 0x9}, {0x3, 0xd5ff467000000, 0x85, 0x1, 0x5, 0x100000000, 0x2}]}) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/mls\x00', 0x0, 0x0) getsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000200), &(0x7f0000000240)=0x4) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000280)) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000300)=0x1) write$P9_RXATTRWALK(r0, &(0x7f0000000340)={0xf, 0x1f, 0x1, 0x4}, 0xf) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000380)={&(0x7f0000fff000/0x1000)=nil, 0x1000}, &(0x7f00000003c0)=0x10) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000400)) ioctl(r0, 0x0, &(0x7f0000000440)="b6410bb19be4313c142afee61a0c5ff0c9145782f71ecbabb4bc8910ffe788f2030fada9b0d6f834d3c26391d58bbbe099e5979e9e2e2b4df866c7d4846cf740f25b0f4facd2a9e19e76d5ec2252083add0fefb26b960bb1751abfe73e1fabdf5b1c5ec816cd025748560831dc334c020340066fc9b0f67eb7aa086433c2504acfeeefac995aacb9bb7783f1816080f79102cd47ce4b7f0e6f81a7995fcf0e071b03038e5dfee3b266a1e40e18d5d5d321deb98e8836ee52fcf38e45c02262db1b839f7913fefe") setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000540)='dummy0\x00', 0x10) ioctl$sock_proto_private(r1, 0x89e1, &(0x7f0000000580)="396527d4addf8e1396b2f512f97b4ed3019046d47a902f16ba14bcc8c01f37e848e3750ea0db0a4f401bb60091f9a9e80a31edf02b05880c0abc0b73e3e7d2cee4fdccc8d63bdd9a60995ae4f77922d38b9e2f0e90afda7dcd51e10b49a26c576404d7d8b37c287e391066372fe586408a7586742d184328f7c0cb7bfd1bf52bca3ef59fcd44647fb39c578a33caf12929914c9389473f876f39fec7a0378595808034dc76eea31ffca3a487a159d3c066aff57a080512bfb4ac9c56a1a0c425e5469b198be51669328834bcd528f8546c6499916456d8") write$P9_ROPEN(r0, &(0x7f0000000680)={0x18, 0x71, 0x2, {{0x2, 0x4, 0x3}}}, 0x18) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f00000006c0)={0x0, 0x0, 0xfff, 0x200}) write$UHID_GET_REPORT_REPLY(r1, &(0x7f0000000700)={0xa, 0x5, 0x7ff, 0x6786cdaa}, 0xa) write$binfmt_script(r0, &(0x7f0000000740)={'#! ', './file0', [{0x20, "2ff925706f7369785f61636c5f6163636573737472757374656463707573657470726f6373656c696e75782327"}, {0x20, '[loeth0'}, {0x20, "146b657972696e67"}, {0x20, 'dummy0\x00'}], 0xa, "5ac30c098710a1681ce3dcc6dd7da2cd7bac373be3594fd993a4fdb81146f411e54b548f9658bc02aaba2336e8867a392979d4858c57ed30200ff7fb74f9e826560cefbc10d33bbe9ad1cfd49abf9b95ea1cedbbfb60220f617f46383f1699110899a35369f4061b9e1f406e4a42b73baa834470bf723739f5283f2a31a2fc9e88bd546576eaac911b8fcab1321ac9d1aa8b28186c6454c7cabb9cc81d0139cb3b54a3079738502b8d69a3163df6f8c97524f325ed2045d9301e3eb3a32263276c550e9a18de3c7f8976d68a9b4e32abac537b27c2c7801d0cb31c5e773f44d1a45ea0dd75587b6e1b"}, 0x13b) open(&(0x7f0000000880)='./file1\x00', 0x2, 0x2) sendmsg$nl_generic(r0, &(0x7f0000000d00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x20000002}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000900)={0x3b0, 0x2d, 0x300, 0x70bd28, 0x25dfdbfc, {0x14}, [@nested={0xe4, 0x4b, [@generic="2af1dead218f6d30b9565d8fb29d58bb1218693709846009253f122c599968cb5eedfe2fc06be58f0d4c24d201b55bda49111b5e4905fe2357e2dbdd7c622e6be1d707a766e8b8e9a7a27328520a5f736c49873d0d8cb047e27138bdc976afc6227dd26434420996e65036a2302485f38078c724942d2b2b180163215c3d8c43e67f6754e0881e006ad9604a3ecb0f91635d62078849fe5e00a01603088aa710ceed30d0c8b8403a301b54bcf1464b08c6fb847af0f08cddf8e10d1a15a51351f939f5b464d65f591799912420667015e766a1d260e30a413fcabfa34812e6"]}, @nested={0x274, 0x6f, [@typed={0x8, 0x41, @fd=r0}, @typed={0xc, 0x73, @u64=0x7f}, @generic="62b8ac4b4b5acf9e07bd8780bae26de40bc81579a21fddb2ef49ffd68bcc6caa47d4f0956c74ab05d6b99829b27cb5b9b00b38477c86f82a300098df32fda7c5be53992d5f4efcea86d8958ea8227cc7225b37fd4174ec525d975e3a91d9ad95c25cc399e49d7802812fb83e7098ed7989c2214516455480220577cae321886a95b4e08f8e4d3a7a80aa5a9c542554ee180aa84a7d251b09f8a0b8890dc6cc0de0a7", @typed={0x8, 0x50, @u32=0x9}, @generic="85363ea3eccb4caa1e6e236114da7087ac925d54e0a4c39caae232a74c1c358d98bcfb0eaf85a503343b5d5d69de5c8a94f74d04501b70e9fe57eb344afeb8c54c587c88bb592b59e720e2029db650e58dd1d2704ad4dcbaf72938d1e3cbb301039521a4c7c9ebf1f7dd6d52cb9e2273d1920be54c837fbd81b0bdcd7bd16417f1d0d7370f9d09ad2f803be21375142215f34b1fcd421847a5d609a5bad1613196905d1dc359e2f10dbc20", @typed={0x50, 0x61, @binary="e11034b7f6a3f216cdcce023a30adc8a2fdbc92009ce86eca94a2e06d52491795223bad3a42d32a3c9debadfb2e52f1658fd0c880736fd5b967ef3603324c78f314bab18fd7a10544b"}, @generic="8f9da7d0b392cbdd004f2181bcdfc73fd4893c01efda43f317e28ca2951bdabd886de108e4f9e8", @generic="cc83896e21dafb7988e5f042004aefc0c6416313ddf5ac05f03174f189fefb02382f888d0499b6b9d6ade74b2e6bebc8983acad67e5eb0692be1f6cf9d3d89cb1cc06765d9f57bbc615a10125d4d82393140f5d3b59d4c251743230693979419eb0f237a9a4fb1d9f2ae9ff4e3eb4686a587be33bebc03efd31de308377503b45c3419dde2dcb8ed6260a0788e"]}, @nested={0x30, 0x24, [@generic="adb992e0e6bf83624e3aea", @typed={0x14, 0x52, @ipv6=@mcast2}, @typed={0xc, 0x62, @u64=0x1}]}, @typed={0x14, 0x5d, @ipv6}]}, 0x3b0}, 0x1, 0x0, 0x0, 0x20004080}, 0x81) getsockname(r0, &(0x7f0000000d40)=@can={0x1d, 0x0}, &(0x7f0000000dc0)=0x80) connect(r0, &(0x7f0000000e00)=@can={0x1d, r3}, 0x80) r4 = pkey_alloc(0x0, 0x2) pkey_free(r4) ioctl$RTC_WIE_ON(r0, 0x700f) r5 = getpid() sched_rr_get_interval(r5, &(0x7f0000000e80)) utimensat(r1, &(0x7f0000000ec0)='./file0/file0\x00', &(0x7f0000000f00)={{0x77359400}, {0x77359400}}, 0x0) syz_mount_image$btrfs(&(0x7f0000000f40)='btrfs\x00', &(0x7f0000000f80)='./file1\x00', 0x6, 0x8, &(0x7f0000001380)=[{&(0x7f0000000fc0)="e8db5c982b44fbb986a12bb6a2aa5ae3b4becca885820581cc556f907fc63920e75d33d23e542cc88cd901448aa600aa592361e7a40062658f4b70bbb66196bcd4ec21baed679600417af1c7e193d2b05b7bf6220a0a044b96c0d7e589fcd78a1490062e07d7cb8d150c410958cf675e37afff86a481d854587de6e142a1fd2bf0b695a4da478b6b3a439db43a55c7652bba94995d3658bde2c403e78f13d3aa4ceb2db177d0e6", 0xa7, 0x1ff}, {&(0x7f0000001080)="238788c029dd8691c1c4aa0ef987bede7264a272aa309f6958355a477cdfe5c0dc9f91322a22a192d003c88cda0afcda72f572e4fa0216a35d82c23949534743160010555d4d3bd9405fbec79c73912611638293ebc3c7a7b3cc31c1c988220f1a951c03ec36d215ae4c527f2c05c32c16c27cfea131c284f55b0f4986720c68cf3bc11abb40205c11c1744877d156298a197bfe5c612de652a88f965f7b7ca2f9cfb2e2cebfdd990af2cb79ec", 0xad, 0x9}, {&(0x7f0000001140)="14addbe1b8ec96c52cc3ae2236a26092eeb69832b9c25cb24acad4758fcec311a47a4205dce866b6ca681a74e1f2ffa653e2c9f18aae71ceda31ce2564eae0c50a46724fe5f7b2c5b0496e349a92de0aa830a04aedc99e9ec5f95d04d6c70169", 0x60}, {&(0x7f00000011c0), 0x0, 0x4}, {&(0x7f0000001200)="dd02fc223036b5de59fc381c1acbdf2e1fab9902dfcb793255d79708442a9a9233d254871c71c750d81e4885af0a9546383a780d2a820d1df1c72eeb737220", 0x3f, 0x1}, {&(0x7f0000001240)="680b3aedcd44526db47497f5c0291c35c8f4d7fa151a1d8df51acf6e70f3e85a83cb3c218b5b01365e25bf2ebf46e62a267f28820e5057b1dc424d3ab8bcd11afd74e3af6dfb749da71a4a248ad52c4b0d13ba9720ac1d811b9724fc76190b089a2fe16284420555ac89e8421dff93652d0bc5fb459c5ef6d471d420e9f224f8497ba46a6b34d67181cab030b6df2160414a60f2cc296295bcc5a0d6c066d6e81450779b7cb88aab394545beaf23e439af086cd802d6df", 0xb7, 0x40}, {&(0x7f0000001300)="ef", 0x1, 0x3f}, {&(0x7f0000001340)="64b2d26bceb892c60b7d4049933fd6d05420a6934a662e9b3c01d1f0379c9befd33e6d3d7fbd82389441aee63f6e3e2e57ad426a", 0x34, 0x8}], 0x10000, &(0x7f0000001440)={[{@check_int='check_int'}, {@datacow='datacow'}]}) pivot_root(&(0x7f0000001480)='./file0\x00', &(0x7f00000014c0)='./file0\x00') r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001540)='IPVS\x00') sendmsg$IPVS_CMD_GET_INFO(r1, &(0x7f0000001640)={&(0x7f0000001500), 0xc, &(0x7f0000001600)={&(0x7f0000001580)={0x68, r6, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_DEST={0x4c, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xbf3}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x100000000}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xfffffffffffff225}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x911313c7a0faa76f}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) 03:33:40 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x0, 0x0) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000140)={0x1}) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) ioctl$LOOP_CTL_GET_FREE(r3, 0x4c82) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) timer_create(0x5, &(0x7f0000000080)={0x0, 0x1, 0x2}, &(0x7f00000000c0)=0x0) timer_delete(r4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$sock_SIOCINQ(r3, 0x541b, &(0x7f0000000240)) getsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000180)={@rand_addr, @empty, 0x0}, &(0x7f00000001c0)=0xc) bind$packet(r1, &(0x7f0000000200)={0x11, 0xc, r5, 0x1, 0x449, 0x6, @remote}, 0x14) remap_file_pages(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x0, 0x31043) ioctl$sock_SIOCINQ(r3, 0x541b, &(0x7f0000000040)) 03:33:40 executing program 7: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x400000, 0x0) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f00000001c0)={0x85, 0x2cc8ef1, 0x7, 0x6}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001580)={'lo\x00', 0x0}) r3 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x8, 0x80) mkdir(&(0x7f0000000100)='./file0\x00', 0x81) setsockopt$inet_mreqn(r3, 0x0, 0x24, &(0x7f0000000080)={@broadcast, @multicast2, r2}, 0xc) sendmsg$nl_route(r0, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="280000001c251f1b7b320ed7d7fa000000000002000000000000000000", @ANYRES32=r2, @ANYBLOB="fcff00000c0001000180c20000000000"], 0x2f2}, 0x1, 0x0, 0x0, 0x1000000000000}, 0x0) 03:33:40 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@common=@privport='privport'}, {@rq={'rq', 0x3d, 0x7fff}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="80d2"]) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:40 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdir(&(0x7f0000000080)='./control\x00', 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000043fe0)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = creat(&(0x7f0000000000)='./control/file0\x00', 0x0) write$sndseq(r2, &(0x7f0000011fd2)=[{0x0, 0x0, 0x0, 0x0, @time, {}, {}, @time=@time={0x77359400}}], 0x30) r3 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) lseek(r2, 0xffffffffffffff7b, 0x4) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x1c9c380}, {0x0, 0x9}}, &(0x7f0000000040)) tkill(r3, 0x1004000000016) close(r1) [ 507.343546] binder: 10958:10967 unknown command 1527014149 [ 507.350905] binder: 10961:10968 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 507.350919] binder: 10961:10968 BC_ACQUIRE_DONE node 976 has no pending acquire request 03:33:40 executing program 1: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000580), 0xc, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c0000001000d00000f9ffffffffffffff000000", @ANYRES32=r3, @ANYBLOB="00000000000000000c000200aaaaaaaaaaaa0000"], 0x2c}}, 0x0) [ 507.350930] binder: 10961:10968 got reply transaction with no transaction stack [ 507.350942] binder: 10961:10968 transaction failed 29201/-71, size 88-56 line 2921 [ 507.351375] binder: BINDER_SET_CONTEXT_MGR already set [ 507.351384] binder: 10961:10968 ioctl 40046207 0 returned -16 [ 507.352637] binder: 10961:10974 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 507.352650] binder: 10961:10974 BC_ACQUIRE_DONE u0000000000000000 no match [ 507.352658] binder: 10961:10974 got reply transaction with no transaction stack [ 507.352667] binder: 10961:10974 transaction failed 29201/-71, size 88-56 line 2921 [ 507.354467] binder: undelivered TRANSACTION_ERROR: 29201 [ 507.354488] binder: undelivered TRANSACTION_ERROR: 29201 [ 507.368209] selinux_nlmsg_perm: 3 callbacks suppressed [ 507.368218] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10966 comm=syz-executor4 [ 507.374043] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=10966 comm=syz-executor4 [ 507.390010] binder: 10958:10976 got transaction to context manager from process owning it [ 507.390023] binder: 10958:10976 transaction failed 29201/-22, size 0-0 line 3004 [ 507.510951] binder: 10958:10967 ioctl c0306201 20007000 returned -22 03:33:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x4, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 507.556100] binder: undelivered TRANSACTION_ERROR: 29201 03:33:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) read(r1, &(0x7f0000000940)=""/4096, 0x1000) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x8, 0x0, &(0x7f0000000180)=ANY=[@ANYPTR64=&(0x7f0000000080)=ANY=[@ANYRESOCT=r1, @ANYPTR64=&(0x7f0000000040)=ANY=[@ANYRES64=r0, @ANYRES16=r1, @ANYPTR64], @ANYRES64=r1, @ANYBLOB="2357a49d56e674c9e5195b12d09e1f87bcd8958a0b2923dfa8d7a4ec6613deeb6e53f553e8e955881640d7e4088c6b3f39b5be8ecbe1e609d54624ad1dc7c82cf2ce3af6bbd942bec66a0212291f28fbf313e71cfe79151b70f66ee5460ed7ee8b2c8a1c0a75ff1f7fa83de55c5e2ddf563c2517fa769e708db3c3839d4c0690f7372de45a2dd79abdf99c1ea5890449044c2c432f160b91c3cbe1bba6c0ca3e75fd111d2573"]], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="046304400000000076c5d77c664e2a3f0702646b8062bdad25c1c24bdaf3b3693642e0a05e6cd828a7b65727e7ab2744f4293bd61e4dd554716ffbb619ec990f96efb7a0d1c276a2b8cb03626fea853a6f4fb0dfb91572b46b6b0d6da596527eee0000000000000000"], 0x0, 0x0, &(0x7f00000006c0)}) [ 507.698470] 9pnet: Insufficient options for proto=fd [ 507.706257] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=9500 sclass=netlink_route_socket pig=10990 comm=syz-executor7 [ 507.707556] 9pnet: Insufficient options for proto=fd [ 507.722057] binder: 10983:10993 ioctl 4c82 0 returned -22 [ 507.722441] binder: 10983:10993 tried to acquire reference to desc 0, got 1 instead 03:33:41 executing program 6: r0 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r0, 0x8200) openat$cgroup_ro(r0, &(0x7f0000000080)='memory.stat\x00', 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r1, 0x0) r2 = inotify_init1(0x0) fcntl$setown(r2, 0x8, 0xffffffffffffffff) openat$cgroup_ro(r1, &(0x7f0000000040)='memory.current\x00', 0x0, 0x0) fcntl$getownex(r2, 0x10, &(0x7f000045fff8)={0x0, 0x0}) ptrace$setopts(0x4206, r3, 0x0, 0x0) ptrace(0x4207, r3) ptrace$getregset(0x4205, r3, 0x202, &(0x7f0000000000)={&(0x7f0000002100)=""/4096, 0x1000}) [ 507.722526] binder: 10983:10993 ioctl 541b 20000240 returned -22 [ 507.723245] binder: 10983:10993 ioctl 541b 20000040 returned -22 [ 507.727793] binder: BINDER_SET_CONTEXT_MGR already set [ 507.727801] binder: 10983:10993 ioctl 40046207 0 returned -16 [ 507.728615] binder: 10983:10993 ioctl 4c82 0 returned -22 [ 507.728724] binder: BINDER_SET_CONTEXT_MGR already set [ 507.728731] binder: 10983:10998 ioctl 40046207 0 returned -16 [ 507.728880] binder: 10983:10998 ioctl 541b 20000240 returned -22 03:33:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') getsockopt$packet_buf(r1, 0x107, 0x6, &(0x7f0000000180)=""/88, &(0x7f00000000c0)=0x58) sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:41 executing program 7: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rfkill\x00', 0x0, 0x0) ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000340)=0x110) r1 = inotify_init1(0x800000080000) fcntl$setstatus(r1, 0x4, 0x72109c5fef5d34d3) r2 = gettid() rt_sigprocmask(0x0, &(0x7f000003b000)={0xfffffffffffffffe}, 0x0, 0x8) fcntl$setownex(r0, 0xf, &(0x7f00000003c0)={0x0, r2}) openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0xfffffffffffffe55) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x0, @random="59a310eebccc"}, 0x0, {0x2, 0x4e24, @dev}, 'team0\x00'}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000140)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f0200f5ab26d7a071fb35331ce39c5a") r4 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x1, 0x82) r5 = memfd_create(&(0x7f0000000100)="74086e750000000000000000008c00", 0x0) pwritev(r5, &(0x7f0000000340)=[{&(0x7f0000000040)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, r5) sendfile(r4, r4, &(0x7f0000000000), 0x2000005) ioctl$LOOP_CLR_FD(r4, 0x4c01) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000380)='/dev/sequencer\x00', 0x40, 0x0) ioctl$LOOP_SET_FD(r4, 0x4c00, r5) prlimit64(0x0, 0xb, &(0x7f000002fff0), 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000002c0)={0x0, @loopback, @loopback}, &(0x7f0000000440)=0xc) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000480)={{{@in=@local, @in6=@mcast2, 0x4e21, 0xa504, 0x4e20, 0x7, 0xa, 0x20, 0x20, 0x0, r6, r3}, {0x800, 0x3, 0x6, 0xed, 0x3ff, 0x4, 0x1ff, 0xfff}, {0x3, 0x1, 0x5d4, 0x1}, 0xffff, 0x6, 0x1, 0x1, 0x0, 0x2}, {{@in6=@remote, 0x4d5, 0x3f}, 0xa, @in=@broadcast, 0x3501, 0x0, 0x3, 0xfffffffffffffffa, 0x9, 0x0, 0xd4b4}}, 0xe8) ioctl$BLKFRASET(0xffffffffffffffff, 0x1264, &(0x7f0000000280)=0x8) 03:33:41 executing program 1: mprotect(&(0x7f000004a000/0x4000)=nil, 0x4000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_user(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/user\x00', 0x2, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x100082) r2 = memfd_create(&(0x7f0000000380)="000000000000000100000001000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30544d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6201004dbea37aabd3eb9888c4c629419f50937a6848e0d281dbee568c4de9a036c26f1922f64971d4df97fbab04e8ce4938b31dcf259b4bc60901e18661fab8fb2988cd2bc260c2f572353e6bb0a002fc164d4f189b068062d10100000000000000400c0c4ca57b546b9430172ea5362ee0141b3df06ad235e815d89eead3d9473409c09c2e27a952337a24f20188c013123cc0316a33d8b443453773e4a09edd8031124dee13ce9c75288f2ec833c7e66af5b19a00000000000000", 0x0) pwritev(r2, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r2) ioctl$LOOP_SET_CAPACITY(0xffffffffffffffff, 0x4c07) getegid() fstat(0xffffffffffffffff, &(0x7f00000007c0)) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000a00)={{{@in=@loopback, @in6=@mcast1}}, {{@in=@multicast2}, 0x0, @in6=@mcast2}}, &(0x7f0000000b00)=0xe8) r3 = socket$inet6(0xa, 0x802, 0x1) r4 = add_key$keyring(&(0x7f0000000740)='keyring\x00', &(0x7f0000000780)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffffd) add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000540)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000640)="1de28d2865ab2bfb482064900f56b00af69ba2f7eb9e348e0e8cfe8944449900873750296d598667335d943f85b98449caee2ac2eab1fa7a67ac973bf84469029607808b776915b16a80f5707323e976ec89ce162c9b9dcca3d3a6d54a73425fb0458a64f39f57359d7972644fc84b5b75a4eee1790cdc69886f738c433f406f2ba5b892c337b38ca59764d8cc89c313d0b1fc40036d40d245f9eaccacf60da4028d4b307fc2cc1f8552fe87a64706d6fa8fe94742aa4e8098206b3c105453dc0ff96afb949312038e2ffd3c1b37e72d8dbe5ac7dd22cdd2933a495272ead839ae135e40394db5496be3f53d44b92289", 0xf0, r4) ioctl(r3, 0x4000008912, &(0x7f0000000000)) sendfile(r1, r2, &(0x7f0000000240)=0x4800, 0x20000102000007) r5 = add_key$keyring(&(0x7f00000005c0)='keyring\x00', &(0x7f0000000600)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0xfffffffffffffff8) add_key$user(&(0x7f00000000c0)='user\x00', &(0x7f0000000580), &(0x7f0000000b40), 0x0, r5) fadvise64(0xffffffffffffffff, 0x0, 0x0, 0x0) request_key(&(0x7f0000000200)='asymmetric\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x3}, &(0x7f0000000280)="5e2a657468312c2e242826eb2a73656c696e75785b7b00", 0xfffffffffffffffb) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x0) utime(&(0x7f0000000880)='./file0\x00', &(0x7f00000008c0)={0x8}) r6 = gettid() fcntl$getown(r1, 0x9) getpid() ioctl$sock_FIOGETOWN(r3, 0x8903, &(0x7f0000000180)) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000004c0), &(0x7f0000000840)=0xc) r7 = getpgrp(r6) getpgrp(r7) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000500)='/selinux/user\x00', 0x2, 0x0) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000900)="dbea404856f07b7fc986aa40e54597be3492fda6b9587e000eee49bf4b645c2755f0008e876e3e9b9eef1b649e0cc64be2253b57bcae31aade54adacc0961691d89d7e69bdfa5e2147", 0x49) inotify_init1(0x80000) [ 507.729012] binder: 10983:10998 ioctl 541b 20000040 returned -22 [ 507.752501] 9pnet: Insufficient options for proto=fd [ 507.757956] 9pnet: Insufficient options for proto=fd [ 507.789481] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11002 comm=syz-executor4 [ 507.792567] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11002 comm=syz-executor4 [ 507.860656] binder: 11000:11006 tried to acquire reference to desc 0, got 1 instead [ 507.869003] binder: 11000:11006 got transaction to context manager from process owning it [ 507.877490] binder: 11000:11006 transaction failed 29201/-22, size 0-0 line 3004 [ 507.890486] binder: BINDER_SET_CONTEXT_MGR already set [ 507.895870] binder: 11000:11006 ioctl 40046207 0 returned -16 [ 507.901943] binder: BINDER_SET_CONTEXT_MGR already set 03:33:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r2, r1) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000080)={0x7fffffff, 0x0, 0x5, 0x3, 0x9, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@acquire={0x40046305, 0x2}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:41 executing program 5: mmap(&(0x7f0000000000/0xa73000)=nil, 0xa73000, 0x2, 0x32, 0xffffffffffffffff, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) r1 = getpgrp(r0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/commit_pending_bools\x00', 0x1, 0x0) accept$packet(0xffffffffffffff9c, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000280)=0x14) setsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f00000002c0)={@dev={0xfe, 0x80, [], 0xa}, r3}, 0x14) close(0xffffffffffffffff) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x0) r4 = openat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x10000, 0x100) write$FUSE_INTERRUPT(r4, &(0x7f0000000080)={0x10, 0x0, 0x5}, 0x10) r5 = gettid() rt_sigprocmask(0x0, &(0x7f00000000c0)={0xfffffffffffffffe}, 0x0, 0x8) rt_tgsigqueueinfo(r1, r5, 0x33, &(0x7f0000000180)={0x0, 0x0, 0x2ffff}) openat$fuse(0xffffffffffffff9c, &(0x7f0000000300)='/dev/fuse\x00', 0x2, 0x0) getsockopt$inet6_int(r4, 0x29, 0x49, &(0x7f0000000380), &(0x7f00000003c0)=0x4) getsockopt$IPT_SO_GET_INFO(r4, 0x0, 0x40, &(0x7f0000000100)={'mangle\x00'}, &(0x7f00000001c0)=0x54) rt_sigtimedwait(&(0x7f0000a70000)={0x7fffffffffffff66}, &(0x7f0000a72ff0), &(0x7f0000a72000)={0x77359400}, 0x8) 03:33:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) r3 = gettid() ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r3, 0x10, &(0x7f0000000040)={0x10000}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 507.907755] binder: 11000:11013 ioctl 40046207 0 returned -16 [ 507.913899] binder_alloc: 11000: binder_alloc_buf, no vma [ 507.919978] binder: 11000:11011 transaction failed 29189/-3, size 0-0 line 3136 [ 507.928093] binder: undelivered TRANSACTION_ERROR: 29189 [ 507.933874] binder: undelivered TRANSACTION_ERROR: 29201 03:33:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="057f0440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="046304000000000078c529177c6d1bec6f15c59fee1ec2a826f140479cd533f0d8b233bf4ba432b16fad9dd2dd27b0f64963b34b72e9f0862a90204040be044d349098fa8a9a2a7f86332895c4501d4faad75f9a504165315af1cd8f25952bcfd424ddf54e9deaba0f5ac33f086487b078130bd672546dfcce3ba220d5cf503c9caadf6741b02e2e35"], 0x0, 0x0, &(0x7f00000006c0)}) [ 508.073913] binder: 11017:11018 unknown command 536871040 [ 508.079781] binder: 11017:11018 ioctl c0306201 20007000 returned -22 [ 508.092259] binder: BINDER_SET_CONTEXT_MGR already set [ 508.098200] binder: 11017:11018 ioctl 40046207 0 returned -16 [ 508.098761] binder: BINDER_SET_CONTEXT_MGR already set [ 508.098769] binder: 11017:11024 ioctl 40046207 0 returned -16 03:33:41 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7472616e733d72646d612c706f72743d3078303030303030303030303030303030302c74696d656f75743d307830b030303030303030303030303030312c73713d307866664d666666666638366162646531642c74696d656f75743d3078303030303030303030303030303030302c00"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 508.177055] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11028 comm=syz-executor4 [ 508.204922] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11039 comm=syz-executor4 03:33:41 executing program 6: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = fcntl$getown(0xffffffffffffffff, 0x9) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f00000000c0)={'tunl0\x00', {0x2, 0x4e20, @rand_addr=0x401}}) fcntl$lock(r0, 0x7, &(0x7f0000000080)={0x2, 0x7, 0x52, 0x3, r1}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/udplite6\x00') getdents64(r2, &(0x7f0000000280)=""/121, 0x79) r3 = gettid() fcntl$lock(r2, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xffffffffffffff81, r3}) 03:33:41 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:41 executing program 7: r0 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x80000) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000340)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) setxattr(&(0x7f00000000c0)='\x00', &(0x7f0000000480)=ANY=[@ANYBLOB], &(0x7f0000000140)='\x00', 0x1, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000180)) mount(&(0x7f00000000c0)='./file0/bus\x00', &(0x7f0000027000)='./file0\x00', &(0x7f00000002c0)='proc\x00', 0x0, &(0x7f000000a000)) add_key$user(&(0x7f0000000100)='user\x00', &(0x7f00000001c0), &(0x7f0000000300), 0x0, 0xffffffffffffffff) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000c40)=ANY=[@ANYBLOB="01040000000000000a004e237f00000000000000000000000000ffffac1414aa8d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000080000000a004e210900000000000000000000000000ffff7f00000100080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2209000000fe80000000000000000000000000000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2202000000fe8000000000000000000000000000bb01000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e240001800000000000000000000000ffff0000000001000000000000000000000000000000002a56dc7100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2100000000fe8000000000000000000000000000aa99960000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000ff010000ff01000000000000000000000000000100020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e240100010000000000000000000000000000000000ff010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e233200000000000000000000000000000000000000ffffff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d3181cf7d6cd3f5145f74bf884c5852763812ca9862aa3c6872200c315bb45b7324e648653ff50bd91806d1830ae3bdc3080393df8008ba6ddb97200bc067f0ff4b0a20f9779551003463c326d2991"], 0x490) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40020000) creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000300)) add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000400)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000480), 0x0, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000240)) [ 508.243655] binder: 11030:11045 ioctl 401845e0 20000080 returned -22 [ 508.258754] binder: 11030:11045 Acquire 1 refcount change on invalid ref 2 ret -22 [ 508.272961] binder: 11030:11045 got transaction to context manager from process owning it [ 508.283807] binder: 11030:11045 transaction failed 29201/-22, size 0-0 line 3004 03:33:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f0000000080)) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r2, r1) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000080)={0x7fffffff, 0x0, 0x5, 0x3, 0x9, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@acquire={0x40046305, 0x2}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 508.342059] binder: undelivered TRANSACTION_ERROR: 29201 03:33:41 executing program 1: socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000006c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x20601, 0x0) close(r1) pipe2$9p(&(0x7f0000000080), 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000140)={{{@in=@broadcast, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@local}}, &(0x7f0000000300)=0x15) r3 = gettid() setsockopt$ARPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x61, &(0x7f0000000340)={'filter\x00', 0x4}, 0x68) sendmsg$nl_generic(r1, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x480}, 0xc, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="54000000330000022abd7000fddbdf25080000002800700008002600", @ANYRES32=r2, @ANYBLOB="08002b04", @ANYRES32=r3, @ANYBLOB="14003f000000000000000000000000000000000018002a0014002900fe8000000000000000000000000000aa"], 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000814) [ 508.422061] binder: 11054:11060 unknown command 1074036485 [ 508.427920] binder: 11054:11060 ioctl c0306201 20007000 returned -22 [ 508.435669] binder: BINDER_SET_CONTEXT_MGR already set [ 508.441069] binder: 11054:11060 ioctl 40046207 0 returned -16 [ 508.447598] binder: 11054:11060 unknown command 287492 [ 508.452983] binder: 11054:11060 ioctl c0306201 20000680 returned -22 [ 508.460491] binder: BINDER_SET_CONTEXT_MGR already set [ 508.460973] binder: 11054:11061 unknown command 1074036485 03:33:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f0000000040)=0x0) r3 = memfd_create(&(0x7f0000000800)='\':eth1[\x00', 0x1) write$P9_RREMOVE(r3, &(0x7f0000000840)={0x7, 0x7b, 0x1}, 0x7) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rfkill\x00', 0x0, 0x0) write$uinput_user_dev(r4, &(0x7f0000000280)={'syz1\x00', {0x2, 0x2, 0xc5, 0xb78}, 0x11, [0x94, 0x1, 0x8, 0x719, 0x2, 0x9, 0x82, 0x1ff, 0xb, 0xa7c1, 0xaa, 0x1, 0x435, 0xffffffffffffffe0, 0x1, 0x1, 0x401, 0x400000000, 0x4, 0x2, 0xfff, 0x0, 0xffff, 0x8001, 0x2, 0x7ff, 0xc837, 0x200000000, 0x7f, 0x77, 0x6, 0x3, 0x3ff, 0x1a, 0x0, 0x4, 0x9, 0x8, 0x7fff, 0x3fe000000000, 0x0, 0x800, 0x7, 0x3, 0x200, 0x20, 0x0, 0x20000000000000, 0x2, 0x1, 0x7, 0x6ffa, 0x5, 0xf8d, 0x4, 0x6, 0x1f, 0x1, 0xcb, 0x6, 0x2, 0x5, 0x525, 0xc3cd], [0xffffffffffffffff, 0x6, 0x6, 0x8, 0x2, 0x1, 0x6, 0x1, 0x5, 0x8000, 0x0, 0x8, 0x70000, 0x7fffffff, 0x0, 0x0, 0x8000, 0x3e752b89, 0x100000000, 0x3ff, 0x1000, 0x1, 0x3d8d7705, 0x80000001, 0x2, 0x0, 0x1, 0x2, 0x800, 0xc5, 0xfffffffffffffff7, 0x80000001, 0x2, 0x6, 0x3, 0x9, 0x10000, 0x1, 0x604, 0x1, 0x9, 0xffffffffffffe8e5, 0x7ff, 0x2, 0x7fffffff, 0x4, 0x54431ba1, 0x7, 0xf44e, 0x7, 0xfffffffffffff7c8, 0x10000, 0x9, 0xfffffffffffffffa, 0x0, 0x9, 0x7fffffff, 0x0, 0x401, 0xffffffffffffffff, 0x4, 0x7, 0x7, 0x4000000000000], [0x1, 0x400, 0x0, 0x4, 0x8, 0xfffffffffffffb80, 0x4e, 0xff, 0x7, 0xffffffff00000001, 0x3, 0x3, 0x0, 0x4, 0x40, 0x7, 0x7, 0x6, 0xae7c, 0x101, 0xfffffffffffffffb, 0x1ff, 0x0, 0x4f94, 0x7f, 0x9, 0x1, 0xb47, 0x100000000, 0x7fff, 0x7, 0xc4, 0x1, 0x3, 0xfff, 0x6, 0x2c8, 0x9, 0x7ff, 0x9, 0x100, 0x6, 0xc39c, 0x5, 0x1f40, 0x61, 0x4000000, 0x80000001, 0x20, 0x2, 0xda50, 0x2c31, 0x2d38, 0x8, 0x4, 0xfffffffffffffc00, 0x5, 0x4, 0x7, 0x7f, 0x8, 0x9, 0x6ae46bd6, 0xfffffffffffffffb], [0x2, 0x100, 0x5, 0xb28, 0x7, 0xe9f6, 0xa3e1, 0x2, 0x800, 0x6d, 0xad, 0x6, 0x3, 0x4, 0x1, 0x6, 0xfffffffffffffffa, 0xfffffffffffffff8, 0x3, 0x3, 0x6, 0x8, 0xffffffffffffffff, 0x3f, 0x2, 0x9, 0x8000, 0x7f, 0x6, 0x6, 0x7, 0x800, 0x5, 0x6, 0x9, 0x3, 0x5, 0x4, 0x200, 0x8, 0x6, 0x7, 0x0, 0x1, 0xffffffffffffff53, 0x4, 0x38b, 0x1, 0x9d, 0xffffffffffffffff, 0xfffffffffffffffe, 0x88b4, 0x7, 0x100000001, 0x5, 0xdf, 0x4, 0x8, 0x5, 0x9, 0xfffffffffffffff8, 0x7ff, 0x8]}, 0x45c) ptrace$getregs(0xe, r2, 0x5, &(0x7f0000000080)=""/215) r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/enforce\x00', 0x8000, 0x0) ioctl$sock_inet_SIOCRTMSG(r5, 0x890d, &(0x7f00000001c0)={0x4, {0x2, 0x4e22, @broadcast}, {0x2, 0x4e20, @multicast2}, {0x2, 0x4e20, @loopback}, 0x4, 0x6, 0x4, 0x9, 0x9, 0x0, 0x6, 0x5, 0x4}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000880)=ANY=[@ANYBLOB="00a88a4027e9d6b5e082872a3db411b710cf09eb3ae35b13ba42f6f9e8e9044caa174f46fd70feb2120d5caf4b4da1bcc3db47c71fb388a0cf74432baf791f9103c380dc30a4c741452277c6d68facbff921a09de4881cb484af60ad28e85c4186b2c5e277759bd079384c19aaf9b5c0b9c1e762aa9783d0b1b459371646c8b99f64e2d38469f5951ca1e30931cd285d3445320602a69644f3734b4742f8583ec0d737c6451ef649594ce0f9b127830b91a535649ab8969df50412a2552fbd493f5d5ad9bf8a28ef74ac62bc935343c8219a1e514b08520fde78d9e558aef1f353eebc40ba5f91dace8abce7f96bdd764cf53d"], 0x0, 0x0, &(0x7f0000002000)}) dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) wait4(r2, &(0x7f0000000700), 0x60000002, &(0x7f0000000740)) dup(r0) [ 508.460981] binder: 11054:11061 ioctl c0306201 20007000 returned -22 [ 508.461114] binder: 11054:11062 unknown command 287492 [ 508.461122] binder: 11054:11062 ioctl c0306201 20000680 returned -22 [ 508.490515] binder: 11054:11060 ioctl 40046207 0 returned -16 [ 508.490524] binder: BINDER_SET_CONTEXT_MGR already set [ 508.490543] binder: 11054:11061 ioctl 40046207 0 returned -16 03:33:41 executing program 6: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x101000, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00'}, &(0x7f0000000340)=0xd3bcfe9f) set_thread_area(&(0x7f0000000100)={0x82f8, 0xffffffff, 0x4000, 0x0, 0x0, 0x6, 0xff, 0x1, 0x0, 0x8768}) r1 = perf_event_open(&(0x7f0000000040)={0xffffffffffffffff, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0xfffffffffffffffd, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x131, 0x3ff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x4020000, &(0x7f0000000400), &(0x7f00000004c0), &(0x7f0000000500), &(0x7f0000000540)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg(r2, &(0x7f000000d8c0)=[{{0x0, 0x0, &(0x7f00000002c0)}}], 0x388, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000240)=@file={0x0, './file0\x00'}, 0x6e) dup2(r2, r3) pwrite64(r1, &(0x7f0000000140)="2cbd8d59c3b86c0b81b641e301efceaaefbf3cd8774f99f23ca78ae7cab20ca4f83248dd0d36d251b5dc2f43adeb17f67bc4099611b0eed22150cd86541a74311805ae7122b3680a0abb27ff438406549778139ba428a1de0a6a612a408d890c3fe4736a4048", 0x66, 0x0) 03:33:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r2, r1) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000080)={0x7fffffff, 0x0, 0x5, 0x3, 0x9, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@acquire={0x40046305, 0x2}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 508.598531] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11071 comm=syz-executor4 [ 508.614976] binder: BINDER_SET_CONTEXT_MGR already set [ 508.625795] binder: 11068:11075 ioctl 40046207 0 returned -16 03:33:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) preadv(r0, &(0x7f0000000540)=[{&(0x7f0000000080)=""/211, 0xd3}, {&(0x7f0000000180)=""/12, 0xc}, {&(0x7f00000001c0)=""/98, 0x62}, {&(0x7f0000000240)=""/126, 0x7e}, {&(0x7f00000002c0)=""/12, 0xc}, {&(0x7f0000000300)=""/53, 0x35}, {&(0x7f0000000340)=""/174, 0xae}, {&(0x7f0000000400)=""/98, 0x62}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000000480)=""/139, 0x8b}], 0xa, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="750e1b", @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="9ebb542e"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$IOC_PR_PREEMPT(r2, 0x401870cb, &(0x7f0000000040)={0x0, 0x6, 0x7fffffff, 0x963}) [ 508.632923] binder: 11070:11078 ioctl 127b 20000080 returned -22 [ 508.633146] binder: 11070:11078 tried to acquire reference to desc 0, got 1 instead [ 508.633156] binder: 11070:11078 got transaction to context manager from process owning it [ 508.633167] binder: 11070:11078 transaction failed 29201/-22, size 0-0 line 3004 [ 508.656040] binder: undelivered TRANSACTION_ERROR: 29201 [ 508.723080] IPVS: Creating netns size=2536 id=79 03:33:42 executing program 1: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7472616e733d72646d612c706f72743d3078303030303030303030303030303030302c74696d656f75743d307830b030303030303030303030303030312c73713d307866664d666666666638366162646531642c74696d656f75743d3078303030303030303030303030303030302c00"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = accept$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @ipv4}, &(0x7f0000000080)=0x1c) listen(r1, 0x6) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) r3 = dup2(r2, r0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @multicast1}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 508.805958] binder: 11083:11088 unknown command 1082828800 [ 508.814729] binder: 11083:11088 ioctl c0306201 20007000 returned -22 [ 508.826617] binder: BINDER_SET_CONTEXT_MGR already set [ 508.832027] binder: 11083:11088 ioctl 40046207 0 returned -16 [ 508.838905] binder: 11083:11088 unknown command 1082828800 [ 508.844804] binder: 11083:11088 ioctl c0306201 20007000 returned -22 [ 508.896393] IPVS: Creating netns size=2536 id=80 03:33:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) dup2(r2, r1) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000080)={0x7fffffff, 0x0, 0x5, 0x3, 0x9, 0x8}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@acquire={0x40046305, 0x2}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:42 executing program 6: r0 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r0, 0x81fc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) madvise(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0) getresuid(&(0x7f00000004c0), &(0x7f0000003280), &(0x7f00000032c0)) 03:33:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x2c) listen(r2, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 508.938822] binder: 11096:11104 tried to acquire reference to desc 0, got 1 instead [ 508.938850] binder: 11101:11108 unknown command 777304990 [ 508.938857] binder: 11101:11108 ioctl c0306201 20007000 returned -22 [ 508.939126] binder: 11101:11108 IncRefs 0 refcount change on invalid ref 0 ret -22 03:33:42 executing program 7: r0 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x80000) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000340)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) ftruncate(r1, 0x8200) r2 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) setxattr(&(0x7f00000000c0)='\x00', &(0x7f0000000480)=ANY=[@ANYBLOB], &(0x7f0000000140)='\x00', 0x1, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x800002, 0x11, r2, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x0, 0x0, @local, 0x4}, 0x1c) sendmmsg(r3, &(0x7f0000007e00), 0x136a88c8311572c, 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rfkill\x00', 0x0, 0x0) ioctl$KDGKBTYPE(r2, 0x4b33, &(0x7f0000000180)) mount(&(0x7f00000000c0)='./file0/bus\x00', &(0x7f0000027000)='./file0\x00', &(0x7f00000002c0)='proc\x00', 0x0, &(0x7f000000a000)) add_key$user(&(0x7f0000000100)='user\x00', &(0x7f00000001c0), &(0x7f0000000300), 0x0, 0xffffffffffffffff) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000c40)=ANY=[@ANYBLOB="01040000000000000a004e237f00000000000000000000000000ffffac1414aa8d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000080000000a004e210900000000000000000000000000ffff7f00000100080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2209000000fe80000000000000000000000000000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2202000000fe8000000000000000000000000000bb01000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e240001800000000000000000000000ffff0000000001000000000000000000000000000000002a56dc7100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2100000000fe8000000000000000000000000000aa99960000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000ff010000ff01000000000000000000000000000100020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e240100010000000000000000000000000000000000ff010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e233200000000000000000000000000000000000000ffffff7f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d3181cf7d6cd3f5145f74bf884c5852763812ca9862aa3c6872200c315bb45b7324e648653ff50bd91806d1830ae3bdc3080393df8008ba6ddb97200bc067f0ff4b0a20f9779551003463c326d2991"], 0x490) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40020000) creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000300)) add_key$user(&(0x7f00000003c0)='user\x00', &(0x7f0000000400)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000480), 0x0, 0x0) socketpair$packet(0x11, 0x2, 0x300, &(0x7f0000000240)) 03:33:42 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_buf(r2, 0x107, 0x0, &(0x7f0000000080)="db02df63247a953d1050", 0xa) perf_event_open(&(0x7f0000000340)={0x1, 0xfffffffffffffea5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x0, 0x0, r1, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x402, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r3, 0x5) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r4 = socket(0x10, 0x2, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') ioctl$UI_ABS_SETUP(r5, 0x401c5504, &(0x7f0000000180)={0x2, {0x5a, 0x7, 0x3a1, 0x4, 0xffff, 0x8}}) sendfile(r4, r5, &(0x7f0000000000), 0x80000002) fcntl$getown(r0, 0x9) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 508.939189] binder: 11101:11108 ioctl 401870cb 20000040 returned -22 [ 508.962527] binder: 11101:11108 unknown command 777304990 [ 508.962538] binder: 11101:11108 ioctl c0306201 20007000 returned -22 [ 508.962790] binder: 11101:11108 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 508.962822] binder: 11101:11109 ioctl 401870cb 20000040 returned -22 [ 509.002903] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11110 comm=syz-executor4 [ 509.020361] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11110 comm=syz-executor4 [ 509.051534] binder: 11096:11104 got transaction to context manager from process owning it [ 509.062991] binder: 11096:11104 transaction failed 29201/-22, size 0-0 line 3004 03:33:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="eb040440"], 0x0, 0x0, &(0x7f0000002000)}) syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x100000000, 0x7f) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x8000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 509.091478] binder: undelivered TRANSACTION_ERROR: 29201 03:33:42 executing program 1: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="f00000001000000328bd7000fbdbdf25110000008c97bcf6280dadcefec6f13c2e99a1c4ecff50c54addfd5420f76024e988817acae349dc5a3205d60a9d9a14b402cc2f234f2849614eeaf79d840f7ecb3caf8018fa7663944f4bcca0b7aada1829e263df7dce571d583f21b7c6da5ea433de378cb555c0f8a7b1681b73b144f4ea5ac32375c7185dbe54aa4717804c5c6c66623f334e3a215dcc04ba1448d65921863bf6460d4ce827779ab5e662a3c88bd68b7ef3a09e94e7ddf48d8c06dcbb8282e5ec70e81652f5884dd64e950315443c2cfdab50d69cfe0fc352acdfa0717a786074bff2d2a871a07155a02b0d8e4a60ebf300"], 0xf0}, 0x1, 0x0, 0x0, 0x20008004}, 0x4) bind$unix(r0, &(0x7f0000003000)=@abs={0x1, 0x0, 0x4e22}, 0x6e) listen(r1, 0x0) connect(r0, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/fib_trie\x00') sendfile(r0, r2, &(0x7f0000000000), 0x800000bf) 03:33:42 executing program 2: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/conntrack\x00', 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000080)={0x11, @multicast1, 0x4e21, 0x3, 'sed\x00', 0x0, 0xfffffffffffffffb, 0x1d}, 0x2c) r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0549f8e66da9031afd40630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r1) setsockopt$l2tp_PPPOL2TP_SO_SENDSEQ(r0, 0x111, 0x3, 0x0, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 509.118253] binder: BINDER_SET_CONTEXT_MGR already set [ 509.123794] binder: 11114:11117 ioctl 40046207 0 returned -16 [ 509.131036] binder: BINDER_SET_CONTEXT_MGR already set [ 509.136568] binder: 11114:11117 ioctl 40046207 0 returned -16 [ 509.139656] binder: BINDER_SET_CONTEXT_MGR already set [ 509.139666] binder: 11114:11120 ioctl 40046207 0 returned -16 [ 509.139749] binder: BINDER_SET_CONTEXT_MGR already set [ 509.139756] binder: 11114:11120 ioctl 40046207 0 returned -16 03:33:42 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) socket$inet6(0xa, 0x2, 0xffffffffffffffff) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000480), 0x0, 0x20000000, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snapshot\x00', 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000140)={0x10, 0x0, 'client1\x00', 0xffffffff80000001, "8a5a039e583f4688", "5450fca9648b9697f9db4e176283f3cedd973811589fd8a67b7422c8a19f7499"}) r3 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) getsockname$unix(0xffffffffffffffff, &(0x7f0000000400), &(0x7f0000000100)=0x6e) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local, @dev}, 0xc) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000380), 0x35b) dup2(r3, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r4, 0x29, 0x15, &(0x7f00000002c0)={@ipv4={[], [], @rand_addr=0x8}, r6}, 0x14) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r2, 0xc0305302, &(0x7f0000000680)={0x6, 0x1, 0x6, 0x8001, 0x7ff, 0x8}) syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x10000010002) fcntl$getownex(r1, 0x10, &(0x7f0000000340)) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000200)={@mcast2, 0x2, 0x0, 0x3, 0x1, 0x80000000, 0x0, 0x74}, &(0x7f0000000240)=0x20) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e22}, 0x10) 03:33:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="046304ea30043c00"], 0x0, 0x0, &(0x7f00000006c0)}) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) 03:33:42 executing program 6: socket$inet6(0xa, 0x1000000000002, 0x0) getrandom(&(0x7f0000000180)=""/40, 0xffffffffffffff59, 0x0) [ 509.312045] binder: 11132:11140 unknown command 1074005227 [ 509.318184] binder: 11132:11140 ioctl c0306201 20007000 returned -22 [ 509.327902] binder: 11132:11140 ioctl 8912 8000 returned -22 [ 509.335891] binder: 11132:11140 got transaction to context manager from process owning it [ 509.347007] binder: 11132:11140 transaction failed 29201/-22, size 0-0 line 3004 [ 509.356145] binder: BINDER_SET_CONTEXT_MGR already set [ 509.361911] binder: 11132:11143 unknown command 1074005227 [ 509.361920] binder: 11132:11143 ioctl c0306201 20007000 returned -22 [ 509.374835] binder: BINDER_SET_CONTEXT_MGR already set [ 509.377234] binder: 11132:11144 ioctl 8912 8000 returned -22 [ 509.386671] binder: 11132:11140 ioctl 40046207 0 returned -16 [ 509.394596] binder: 11138:11145 unknown command -419935995 [ 509.394604] binder: 11138:11145 ioctl c0306201 20007000 returned -22 03:33:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) write$selinux_create(r2, &(0x7f0000000040)=@objname={'system_u:object_r:locale_t:s0', 0x20, 'unconfined', 0x20, 0xc893, 0x20, './file0\x00'}, 0x46) 03:33:42 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB='trans=rdma,port=0x0000000000000000,timeout=0x0000000000000001,sq=0xffffffff86abde1d,timaout=0x0000000000000008,\x00']) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:42 executing program 1: r0 = dup(0xffffffffffffffff) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/netlink\x00') sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000004c0)='vcan0\x00') r3 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) sendto$inet(r3, &(0x7f0000000100)="25908c00000000002d0000000000000000005be60f890a595b05a2b2baaa44fe76dd6f5fbd7c311bf14ae51e899840e15371a8eea38911b7d218fa3f359ccffb89d228014598a078b1f89925dc50f1c675", 0xfffffffffffffec8, 0x20000000, 0x0, 0x6f) epoll_ctl$EPOLL_CTL_MOD(r3, 0x3, r1, &(0x7f0000000340)={0x60002004}) r4 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4) bind$inet(r4, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0xfe83) write$9p(r2, &(0x7f0000000400)="f6110892f57227e4f3246e09436754dfcdfc59f4af88e13a614e4aea845a3f1d06c2cf1141e5bfa6fa07a5bc1d47ea712bcd4b6ebc92ef0295586c8ae71cb96da96474613fada784e297725e751bbc9cd26ddfadf9feb49e5ea2173732ec541ff4e4", 0x62) sendto$inet(r4, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) getresuid(&(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000480)) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, &(0x7f0000001600)="2936b9edc73b61338b93483304828d9f53f1cf81bdb3b44194e22327f05289f5d7502341f91ac52ba78792566d9efb1adda9bcc33a075aef12890a28eb989f1867c48698e5dac336296ab6a06ec87620eb57bd88756d3630d6748677f6c6fa51b72409ae50930f10c415ef92e106a6a4474a00f246f97d0dbae3e4291a7f2eac9495c3ed12d6e52d7dda69707367f6ab5f9429df60f4ca297d431495ca88b1ce5ac9c63efbcb67ac3e092ca1ea184cc2a72527a173b4127af57474c73a2c45732592af3797c542909ae2be74c88e3506f2ccb0e68813dc53288d5fea082f4e6cee603ca170a882ccef6c3dffddf17b4d9e7e5f863547c6fd78c43284d29a38a55b150ce81cf4a880e44909f996b69232b16fd6de91af9c689400aae55cb99360cae52b6f4436744e257b6e81206e2a1000be4e436e19ec2cc22818a1aa5c683ffbdd620882b018bea0cb812a3f9348918685923820d207bbc62e3d5cea6a32be69cf4c9b3e54adc84101f94c725bc26b6e090a514476dc8b57fc95113eec24ced4309a9fb7f45b92d242e390b09b18bb928ba33f55962b8cbab06f5dce999d930e16141a5179617b0fdd3fab281018d55c5486e1bb796481f5e76a2d05a64f3bd2ce2c3260e6c8690fa70aef9970594589d280232c48ad2bd5e7b4f4d21de1635608e3f9a3d6da3392519b7813f0f096070e6be16be603bfbc92ddf1990031a66a60fa38fafdcaa1d221872e584bd632d51aaa395e33653db2d3c53313504dc7f2021ab064c99332f25c633c14df2b42be566f6d6c69d88fac889afc0dfe6e27739c7b38393cc8d2386eed4631fb5c5442f2e5794e1ff5475a0ce9eba7bdc772c73f735a748105924f0e6142de780985af3851094ff29641ab6429ea9ffb519abc914a046c0aa28412ea5302af3a06017891f4d5a611e36e1bdd6ace2950b380801824891918cc55f77051de2545b988ebcb9f898788a938ef955436712262d0fa6603d674cb892897e57a4b33ab4a9785d2c0732bddf4834cf3d0246ec71deedb4dc092f911762b063f58275bc9c840f87fe743ed6eff5776a7e76601c5be4b5fcd4c67add29241c9e933c80ae6c3d9cc92026dec0c78c01547e8c15a9ebffbc5855142fea0c4ff1f71488ec249574094a3e8a3c4401cbcbf52466b6c624c1aa3fbf8df16ee36c8fcea8877ed894c0da6d323b180ff3940976bf3c0e069a0b86a4edb016df6a0da9163057fa23aef78e19d1e050911ea9a93f9f3bdfc72d9d36bdaa89540c340bbbd19e64959c90b51580bd5b91d583665ad2a8bfe5f187a02dfda997785bfcf84399c07aa6172e13a051351445b21d4928334cc3c48570322583767dddd3550eb3ae9e2c691338ed0d904b7474d5156e1252cf6b838587a1fc720727867876fc6c5308481c08683af797e8c1528259d30dc769c27c0f95dd7570c9a39bd4fe90e34b5520f771a9b1ba0e5af08e0115488293316386e592196a8f8c46254b57688671f368132b4e348cd46a87d8babcc99e7d3651baba3acad48779d8b799e74af0d5bcb5a5c5cf853280edc63c619aef35adadb21781f30b66da00b1daf4aa10c611e994b0bb69c75d214873934d33353ae569719d0f002e27afb4e82ce9d43ddf7f636079d28b5972ada4815ff1853ec445716f348c7f17feed4430ff5e52b6ed39b70bdf9bb6cbcf5c454e7977b0729902287af6728e4a879786dc6c661b323a1e576abb452ddb35ba941b6cf7476fb5063d481c1e2cd4b6223092352f0d669cb792fa6f33e59f2b0bcf519894bf68ba32ffeadd1730703c79d07a62df57a94a02d54c26c7a8148a3f69521c16787d9a488ebc432d9ea9581a3bb24d3693aec6ea37f49e4b8f1a768696bf03f4838c37b3844a4494fa2be968dd8a28f01d7d2d840fbc0e574e4a42d30bb8bf978f6ea56f5c2cc201ba8572175758936585a77dd8ea2e5083cf9fc496f0df82a270bb75349e0f4e9cab262fb235785daf9d253c4f6e5596227309685639f12c3eb59032f3d62a269ea42589223b95e0436e14fd6cccf047d94d497521185c30f2f26c2dac75b51269973d60bd0c6c2dd3755988d96a22aea57a1c646987d77d7b0fb471d94a3731e8d26488e043f82791030341536ad2e4bcd34265638dc267c8855849456778ebe6d4039cd49337ad859cf2f27abd96020b2ad0c1618e163c70188fec96d699d1a709dda7f0ad473561152c2c3864f7df7c1aac39a39eb09752a4b5f18655cb7a15fd8b9c7dbe1d378af0efef300ba052bccfe1c3d22a201c72c32b3487567bbb9424b3bb1c76979dae3872aa0a90439e6bb37493dd07d559a8ae184abf3c7103f29d2a1f40ed161aea0b072d78acb13a8cd137fa8a3a1e231a793b926291190fd0fd5790e23ee18b0379a675efa98bfff623e6b676e877f78b22a3b29b2ee4724ad4b41375e2f340eb03b88e173126707c30f45eb930afb95118a03ee24af721aec391cc2941b4c141a8df23e549c419bd3245123d6193e9bccfc748b2c2af6f53c4d22fb9948d20ca7f7291f0513704a2b2935fe2230caf5df826051af5b4189045b278584dea7c47b2529e340181deff724f983c1c0a3e7cd0da22697071160c50c0de6a35c3df94c9316d8480b4ff6fb528875bcf46a1e6e3ab22df1ad8b7932d0c6b945c8d0f642c1d2e09c37d4363b8bef3246e82ae062bc2bb38c6d3713d051b8ecf9f450bfd4764f272b3dabc931d13b0a60fe11a9e6632bab1b2f14624b8ba90d804530e409796bf921e9f705e1b402a9caaee890a722f05c20c7b9daa8b95fe0dcf7bdd8d32a07c9cc98f6841daa94b14556595c19688fd2c267fc31ba250a694218e5f468644efad37d129a4b82bf7f61a6de376d1dbd30a0f7062bde2cb774dc351e757c1cd3415b30a78acad4a034805d57013269d1f07b563a0abd013406c4e40e014b770ff6f4d945982acba1bf02fbb658bfc243bd86b336ab1640b2fdc2433ab3170222d8d3c553de94ec6246c3c9d8c64ed0276c50d7cabc37351fd2a837ccc3ee9d625e0652cd3e273fe7df9ba88fd27e408a404a395145d3150bf906ba3f3b32247fb1030a65f8be94ebf2d8026a7a0a348fb483e3df0ba1eb9816eb3477c1b8e4562c65205be16167c9ccb0820d5d16bcc1e161dda339511d65c9124389cc18d1c29a605aad7511f1f6305e329248ba57d5fb90dcd82056bf9fa283a705fa0c8c3f199ed510c9453aceae0a254a8c87218b770c647b216fc491e26e795716d1d47cb7c960f76869499425fb5cadd19fb746852fa35455d60c0bfe64b56c083cbb4b4503e25efe1903ecc710c07a1f8b4f6634a666f431d1468d35da4e0fd0e6b200975ac74e0acf6763891701de06b08c8d4e03c9bb902cb7e7fc8e96d57fbd78f02c80c121f5e56d334102732dac464eef11b948dbd2994ec46bbd436d0bf7a723cb5867294969cc99ccb9aaa10d48d54a17b9146a2b05cb7a8f4e15fbb70e200dd8c0d2d9db5d2a60550a5653e5fc6b1248daf19a8eb227210e9581784f1fe99d5e183514dfc4404facb23c23eb8843854e07986d7ec6cadef025aef267bf097e01383ca609f291c9ffa19450eb5d38385b49b3375b55ef474ff33b095305f31bad61036a5dd6726d5c90560aff39c2309d7f823a9f22c92a711db83580fba781121e262772ff6abd5155be128670cc8d0dacff141824246c2ee0f6b5e284d9493ab1b8013fb491c6eedcb9867deda3e2a18e60f22d3787dc40bf35775a2383cde97faa548564cceb685ae59708e98f686b83bbcbdff71a73f826117478235645e3ebfee0069d3b0ec767739c2dcd3a65aa7e8f12408a1cca5c10f35eb90f6bae1edd0df2ff1768123e5827dc4a88358d5eaf8b8f11107cfc098dd71a41835ec9199aa830c1cd9a06bdb62553f68faa29e7986a7be7f4cf395666f278561008f588596c912b12b2bcb6f29029fd9c4fbe02e4184847f58ba8b533185509d0b4649d7ca49599c31ebcf8d101982010c7d47c8a043dbc7a3b3b809f1a2222d1fc5c91f72cf74c9119f988a3b001efd8d1a212eff6467d319e0d40f85ab81f12afe52ce2bcc85952f2d277542b823c030f51559f2dda70044673346834d057526a5bac0185c85c76cbadd79d6c0716126909fd8cd4002a916fcb501ec6eed4c434d46c4ee1b9e5e2e3e284b8a030ffc78a8aeb4ae030b24d2b71e816764482dfcdd2bf71cd99e2a7eea6e25eeefa0f469dbab1e8999d1eb7ff65a0d52ea79ac378620e1fd081757e43beff7dba84609073708261757aca0f9105c40023304b9eb375814fc2b4e5b48e9cf30108ffc12c5b20af9cc39796f78d410bccee47371daa277ed5bdf3a57156e0b30b87fe5174e3fc3e8f163247c1e42c51794950b809ae26edb29ee302fccae8eebdc305ab66564a642964abbe176f091e379617c0f956d2da4f9500390ffb9eafd5494615574b0a2edf1a181e489941c5b35d7f88301fbcb2580a8ab0e372a2048a7334091a8307da2e3c25ea25a03cca90d3ed02bd947b2723b346ff954fc0200e304c5ea05242816b62f9dd094f12c37b6d82b5d911c53ca34b20e543131a4ea29cf43226c26f611f64fad06a832f6518d5491d921386395c3c1f01eba368bf866c3791292ce4e5caeab0788ff23be410f133a7b7d6575c81427c18051d596c389d51fe86045df31162023e017feaace75fc20f2cda79febc8fc3afff09cc9a33a839cf6dab08d70a64ce04216e606e8b26c882b03dfc96e6bfd7ffe1c8a2e377cc40e0623296bf582d86d8d236214fe0351916b45bdfa3d0ba90be70d425fbae6093b30fb759b6f397ddf5c4b7b0d2c82b5217cabce986d374b4db3c059112c74c7d9050059b47b795c605eb1ef2411fad9605057714fe072689b6041e28e07b91c2c5d460a76b1e6a31789ea390b97bc64f5f0e867e253d34bc4bcfdbc766eefdaa86c42a6664697dbc242bb747828372f4469c826e70e7e8c1719c175bccd21feb5c869c10130d5c66b071b6f386867441fcc6fe9832c784d0925b7277f48541f1fb3241c1a13cb2f4c94376066fe37c1f30cb58c3cfc1ab45aa2ca761489be16e08ade68c61985aae7aae64aaa1c9da42fc48d0ba27a88bda4d47e06ddd280f8659f520c05e0c6189e691e78ca207a817de93d7b4e5810c133b676e2a2258e0f74571d50b7c676751884cb2e0f1eaf698b15d37362f74e63c4e4ca46abc59c67cc7fac6fb789c05bb75c069560a5b1704863e76f34ee69a98c3d0d40daf042459fc5c50db3e63b3e4a0250d3d5f769252bc1ca63af6001fa340733c526502c1dca7ab18b55d3f565205e511a17ac46e85daa581dcbf6ef42ea096cdbcd2f6b77c0ec9a35d9dad0cd3e611d8e2eb9fbf22a9f002c433c6545cfc0032d701b7d3d2e24e087f0395c061d9e26e35f26108f6ca0cf77d65ed5c9738dd5dc4a90bd7af46f23bbae334bb7caf2e5b0d7a1ee5ff011c3320e89eb75b9a1d1624300e016b6c282cb684125803694083c57dce5bb73e2f4c7d42a0887a8f04ea54c53f58a69de2f1cac548844b14bb511b11821aef2420ebd3c70c2b175192184d139a23c5065c660e409343ea5ebdac12f6e222482d05f75de23873059d3d624dced79cf766b9d4364b7c6d736af9f123ede51e3b0d583bf4abf9f47255754b09ecc009466273765d2d8edd1567f8240f1a9055d9a664949f88d1f3318f0a772368c641fed6e041c8945534f919bf890fdb808dbc8285dea264c336c3d7053ab85d7d6285f609986de39ef8ccfb9f90eb") sendto$inet(r4, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) ioctl$int_in(r4, 0x5421, &(0x7f0000000180)=0x29) [ 509.394968] binder: BINDER_SET_CONTEXT_MGR already set [ 509.394975] binder: 11138:11145 ioctl 40046207 0 returned -16 [ 509.401232] binder: BINDER_SET_CONTEXT_MGR already set [ 509.401240] binder: 11138:11145 ioctl 40046207 0 returned -16 [ 509.402199] binder: 11138:11146 unknown command -419935995 [ 509.402207] binder: 11138:11146 ioctl c0306201 20007000 returned -22 [ 509.408204] binder: BINDER_SET_CONTEXT_MGR already set 03:33:42 executing program 5: r0 = socket$inet6(0xa, 0x1, 0x0) socket$inet6(0xa, 0x2, 0xffffffffffffffff) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendto$inet6(r0, &(0x7f0000000480), 0x0, 0x20000000, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snapshot\x00', 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000300)) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_CLIENT(r2, 0xc0bc5351, &(0x7f0000000140)={0x10, 0x0, 'client1\x00', 0xffffffff80000001, "8a5a039e583f4688", "5450fca9648b9697f9db4e176283f3cedd973811589fd8a67b7422c8a19f7499"}) r3 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x1000000000002, 0x0) getsockname$unix(0xffffffffffffffff, &(0x7f0000000400), &(0x7f0000000100)=0x6e) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet_mreqsrc(0xffffffffffffffff, 0x0, 0x27, &(0x7f0000000000)={@multicast2, @local, @dev}, 0xc) setsockopt$inet6_IPV6_ADDRFORM(r5, 0x29, 0x1, &(0x7f0000000380), 0x35b) dup2(r3, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000280)={'team0\x00', 0x0}) setsockopt$inet6_mreq(r4, 0x29, 0x15, &(0x7f00000002c0)={@ipv4={[], [], @rand_addr=0x8}, r6}, 0x14) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r2, 0xc0305302, &(0x7f0000000680)={0x6, 0x1, 0x6, 0x8001, 0x7ff, 0x8}) syz_open_dev$sndseq(&(0x7f00000003c0)='/dev/snd/seq\x00', 0x0, 0x10000010002) fcntl$getownex(r1, 0x10, &(0x7f0000000340)) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000200)={@mcast2, 0x2, 0x0, 0x3, 0x1, 0x80000000, 0x0, 0x74}, &(0x7f0000000240)=0x20) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e22}, 0x10) 03:33:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="d62fdf83"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) inotify_init() ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BLKROTATIONAL(r2, 0x127e, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 509.408211] binder: 11138:11146 ioctl 40046207 0 returned -16 [ 509.467597] binder: 11132:11143 ioctl 40046207 0 returned -16 [ 509.467772] binder_alloc: 11132: binder_alloc_buf, no vma [ 509.467793] binder: 11132:11144 transaction failed 29189/-3, size 0-0 line 3136 [ 509.473550] binder: undelivered TRANSACTION_ERROR: 29201 [ 509.492948] binder: undelivered TRANSACTION_ERROR: 29189 03:33:42 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) fsync(r1) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 509.539847] binder: 11154:11157 unknown command -368811260 [ 509.546194] binder: 11154:11157 ioctl c0306201 20000680 returned -22 [ 509.562057] binder: 11154:11158 unknown command -368811260 [ 509.572211] binder: 11154:11158 ioctl c0306201 20000680 returned -22 03:33:43 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7472616e733d72646d61c6016f72743d3078303030303030303030303030303030302c74696d656f75743d3078303030303030303030303030303030312c73713d3078666666666666666638366162646531642c74696d656f75743d3078303030303030303030383030303030302c00"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r0, &(0x7f0000000000)=0x5e, 0x80000000) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x84840, 0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) getdents64(r2, &(0x7f0000000040)=""/111, 0x6f) 03:33:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) [ 509.654541] binder: 11161:11166 tried to acquire reference to desc 0, got 1 instead [ 509.674554] binder: 11165:11170 unknown command -2082525226 [ 509.674564] binder: 11165:11170 ioctl c0306201 20007000 returned -22 [ 509.676913] binder: 11165:11170 ioctl 127e 20000080 returned -22 [ 509.676995] binder: 11165:11170 got transaction to context manager from process owning it [ 509.677007] binder: 11165:11170 transaction failed 29201/-22, size 0-0 line 3004 [ 509.701454] binder: undelivered TRANSACTION_ERROR: 29201 [ 509.827854] binder: 11179:11182 tried to acquire reference to desc 0, got 1 instead [ 509.827864] binder: 11179:11182 got transaction to context manager from process owning it [ 509.827876] binder: 11179:11182 transaction failed 29201/-22, size 0-0 line 3004 [ 509.854098] binder: undelivered TRANSACTION_ERROR: 29201 [ 509.882948] binder: BINDER_SET_CONTEXT_MGR already set [ 509.888512] binder: BINDER_SET_CONTEXT_MGR already set [ 509.894112] binder: 11161:11174 ioctl 40046207 0 returned -16 [ 509.900731] binder: 11161:11166 ioctl 40046207 0 returned -16 [ 509.915203] IPVS: Creating netns size=2536 id=81 03:33:43 executing program 7: r0 = openat$ion(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ion\x00', 0x0, 0x0) ioctl$ION_IOC_ALLOC(r0, 0xc0184900, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xffffffffffffff9c}) 03:33:43 executing program 0: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/loop-control\x00', 0x80, 0x0) r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1, 0x2813, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0xef, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x54, 0x0, &(0x7f0000000100)}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x40400, 0x0) write$FUSE_WRITE(r2, &(0x7f00000000c0)={0x18, 0xfffffffffffffff5, 0x2, {0x9d}}, 0x18) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:43 executing program 5: r0 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_int(r0, 0x0, 0xc, &(0x7f0000000280)=0x40000000000800, 0x4) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x8080, 0x0) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000380)=0x2) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000240)=0x1ff) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000469ffc)=0x7fe, 0x4) setsockopt$inet_opts(r0, 0x0, 0x8, &(0x7f00000002c0)="a9", 0x1) connect(r0, &(0x7f0000000300)=@generic={0x5, "53e4fafb98c1a6d8373855a532a4c437c89afb9d0a6ac59bd1b67baf3eaba6c48be7a29cbb75e48c913200aa9b5716cd7c2c6fccacc67dbc89b2415e37ead88a2d718048219963c8060f2fa477ddb01a68321e82cd0a0795446f96d309c5977b6fb0bd9606d6035b9304bf47201816f86661c5ceb1e5abbef2c019e6c230"}, 0x80) sendto$inet(r0, &(0x7f00000000c0), 0x0, 0x0, &(0x7f0000000100)={0x2, 0x4e24, @local}, 0x10) recvfrom$inet(r0, &(0x7f0000000140)=""/248, 0x226, 0x40040012000, 0x0, 0xcd) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40602, 0x0) ioctl$UI_DEV_SETUP(r2, 0x405c5503, &(0x7f0000000040)={{0xffffffff, 0x7ff, 0x101, 0x7fffffff}, 'syz0\x00', 0x13}) 03:33:43 executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000240)) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) read(r1, &(0x7f0000000040)=""/41, 0x29) setsockopt$inet_mreqsrc(r2, 0x0, 0x4, &(0x7f0000013ff4)={@local, @rand_addr, @multicast2}, 0xc) r3 = pkey_alloc(0x0, 0x1) pkey_free(r3) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000080)={0x0, {{0x2, 0x4e22, @rand_addr=0x3}}}, 0x88) ioctl$UFFDIO_WAKE(r1, 0x8010aa02, &(0x7f0000000000)={&(0x7f0000012000/0x200000)=nil, 0x200000}) 03:33:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x4200000000000802) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e20, @rand_addr=0xfd}, 0x10) r3 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r2 = socket(0x10, 0x2, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r2, r3, &(0x7f0000000000), 0x80000002) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f00000000c0)={0x2e, 0x36, 0x9, 0xd, 0x3, 0x4, 0x3, 0x10e}) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x208000, 0x0) ioctl$sock_inet6_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000080)) r3 = dup2(r1, r0) fadvise64(r0, 0x3, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 510.147918] binder: 11194:11200 tried to acquire reference to desc 0, got 1 instead [ 510.157490] binder: 11194:11200 got transaction to context manager from process owning it [ 510.166796] binder: 11191:11202 unknown command 0 [ 510.166805] binder: 11191:11202 ioctl c0306201 20007000 returned -22 [ 510.168480] binder: 11196:11203 tried to acquire reference to desc 0, got 1 instead [ 510.169024] binder: BINDER_SET_CONTEXT_MGR already set [ 510.169032] binder: 11196:11203 ioctl 40046207 0 returned -16 [ 510.172401] binder: 11191:11202 unknown command 0 [ 510.172409] binder: 11191:11202 ioctl c0306201 20007000 returned -22 [ 510.184346] binder: BINDER_SET_CONTEXT_MGR already set [ 510.184355] binder: 11196:11206 ioctl 40046207 0 returned -16 [ 510.244663] binder: 11194:11200 transaction failed 29201/-22, size 0-0 line 3004 03:33:43 executing program 6: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) pause() r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000000500)=0x0) timer_settime(r2, 0x0, &(0x7f0000000000)={{0x0, 0x1c9c380}, {0x77359400}}, &(0x7f0000040000)) tkill(r1, 0x1000000000016) 03:33:43 executing program 5: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x0, 0x0) ioctl$SG_GET_RESERVED_SIZE(r0, 0x2272, &(0x7f00000000c0)) mkdir(&(0x7f0000000180)='./file1\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5faf, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x7ff, 0xffffffffffff0001}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f00000004c0)={'filter\x00'}, &(0x7f0000000340)=0x78) r1 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x0) r2 = memfd_create(&(0x7f0000000380)="000000000000000100000001000000768e05f7c155ad7dc6947c573e5a69244e76382c0aa63d575ea3597f8b1728277ef76b30544d7ba92dcf978f1f81dc1b7f8f7b3451dada02ecb4f1ddcc8b5241da8945666e0073c25a6201004dbea37aabd3eb9888c4c629419f50937a6848e0d281dbee568c4de9a036c26f1922f64971d4df97fbab04e8ce4938b31dcf259b4bc60901e18661fab8fb2988cd2bc260c2f572353e6bb0a002fc164d4f189b068062d10100000000000000400c0c4ca57b546b9430172ea5362ee0141b3df06ad235e815d89eead3d9473409c09c2e27a952337a24f20188c013123cc0316a33d8b443453773e4a09edd8031124dee13ce9c75288f2ec833c7e66af5b19a00000000000000", 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, r2) open(&(0x7f00000002c0)='./file1\x00', 0xfffffffffffffffb, 0x80) ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000180)=0x5bb9) mount$9p_xen(&(0x7f0000000040)='/\x00', &(0x7f0000000200)='./file1\x00', &(0x7f00000002c0)='9p\x00', 0x7048, &(0x7f0000000540)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000100)='ext-\x00', &(0x7f0000000140)='./file1\x00', 0x0, 0x0, &(0x7f0000001800), 0x820, &(0x7f0000000240)) 03:33:43 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x101000, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000040)={&(0x7f0000fed000/0x10000)=nil, 0x10000}, &(0x7f0000000080)=0x10) r2 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$setlease(r2, 0x400, 0x2) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="05630440a230b74ce79b270815d6fee1f4c2b6cd18574f73f0598424db3eac3ac94ca32eeb6bb8021efe0f4f1c3c1c3e7870e6e897682ae89b8adedd43c0ea465477bebe34a5d9cecf3f728a26f9beb0f4911095ea14efcc8b1454dbfeaf2caf6383e772596e317a4cde47975fce918b2320e74a83f2d9e49f0f87c43c1382f377a12a"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_RLCREATE(r1, &(0x7f00000000c0)={0x18, 0xf, 0x1, {{0x40, 0x4, 0x6}}}, 0x18) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="4aacc43b17afc61f6876f6e0e4eceaf73e75ad77ff019183012c333d8d3071a31ce7e18d242af020f553dbe21fab2bb88bcd618024869f3089bcaff45f74a68caec1fa072c9ed44774e1554f46f2e8820588cd15943138be785d18575d0cd81c25722d27a4ebb9784a2b8c68e6e4f6b97d0d7b388becfb7d7b8f186f504a2ec695a02d07"], 0x0, 0x0, &(0x7f0000002000)}) sendfile(r0, r0, &(0x7f0000000040), 0x1) r3 = dup2(r2, r2) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB='S\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:43 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7472616e733d72646d612c706f72743d3078303030303030303030303030303030302c74696d506f75743d30783030303030303030312c73713d3078666666666666666638366162646531642c74696d656f7574001000000000000030303030303030303030302c00"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') getsockname(r1, &(0x7f0000000180)=@hci, &(0x7f00000000c0)=0x80) sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x810, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0xcc, 0x0, &(0x7f0000000180)=[@dead_binder_done={0x40086310, 0x1}, @increfs, @transaction={0x40406300, {0x4, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x20, &(0x7f0000000080), &(0x7f00000000c0)=[0x18, 0x38, 0x38, 0x0]}}, @dead_binder_done={0x40086310, 0x3}, @exit_looper, @release={0x40046306, 0x2}, @reply_sg={0x40486312, {{0x3, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x30, 0x38, &(0x7f0000000100)=[@flat={0x77622a85, 0x1, r1, 0x2}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f0000000140)=[0x20, 0x38, 0x0, 0x0, 0x38, 0x38, 0x38]}, 0x3}}, @request_death={0x400c630e, 0x4, 0x3}], 0xec, 0x0, &(0x7f0000000280)="e80351b4b15c1d8aad3313b3c8e2b4160ea3e84b637270c09dd0c9e04b0e3996c454f2b92a88c8c7808855aee660e9f1588298fc34c0858ffdd130fbd7f3fe9055189fc2b896a0a2c8725ec740d55a62ed85c516c1516dcfd06358738a8dd747e44fff43d4ce1eb9d2bbf589096af9932aaa2532cd7bb19e7d5c04daac9f288ae79bf9f8e43c129e903c215c411c4e2b1cf63afe895d0207d7c906148a9dd061c81102fb08f01581f7af5ffa23f198f38d3fa13071de82b32685b5f49612e5075579194383b361b878633444c9d8b7c81bd90a5c91dc5b6151ec6d6ab4f41db644d87ce438e5edb7557ab81e"}) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000400)='/dev/rtc0\x00', 0x400000, 0x0) ioctl$sock_inet6_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000000440)) r4 = dup2(r2, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r5, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xfffffffffffffef1, 0x0, &(0x7f0000000900), 0x14, 0x0, &(0x7f0000000080)="32910200000000000000f6516bd7c3664a2c4c24"}) ioctl$UI_END_FF_ERASE(r4, 0x400c55cb, &(0x7f0000000000)={0x2, 0x80, 0x7f}) [ 510.278452] binder: undelivered TRANSACTION_ERROR: 29201 [ 510.284436] FAULT_FLAG_ALLOW_RETRY missing 30 [ 510.289342] CPU: 0 PID: 11208 Comm: syz-executor1 Not tainted 4.9.124-g09eb2ba #31 [ 510.297041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 510.306385] ffff8801a500f4a0 ffffffff81eb95e9 0000000000000002 0000000000000000 [ 510.314383] ffff8801bdf21980 ffff8801a500f670 0000000000000000 ffff8801a500f698 [ 510.322423] ffffffff81cbfdab 00000000000074a6 ffff880197798930 ffff8801bdf21a8c [ 510.330413] Call Trace: [ 510.332979] [] dump_stack+0xc1/0x128 [ 510.338321] [] handle_userfault.cold.18+0x3e/0x51 [ 510.344792] [] ? trace_hardirqs_on+0x10/0x10 [ 510.350827] [] ? userfaultfd_ioctl+0x2540/0x2540 [ 510.357212] [] ? handle_mm_fault+0x12e6/0x2a00 [ 510.363420] [] ? handle_mm_fault+0x221f/0x2a00 [ 510.369631] [] handle_mm_fault+0x222d/0x2a00 [ 510.375688] [] ? depot_save_stack+0x12a/0x470 [ 510.381812] [] ? vm_insert_mixed+0x280/0x280 [ 510.387856] [] ? __lock_is_held+0xa2/0xf0 [ 510.393635] [] __do_page_fault+0x5af/0xd50 [ 510.399496] [] ? mm_fault_error+0x2c0/0x2c0 [ 510.405450] [] ? trace_hardirqs_off_thunk+0x1a/0x1c [ 510.412106] [] do_page_fault+0x27/0x30 [ 510.417638] [] page_fault+0x28/0x30 [ 510.422903] [] ? copy_user_generic_unrolled+0x86/0xc0 [ 510.429722] [] ? ip_options_get_from_user+0xbb/0xe0 [ 510.436410] [] do_ip_setsockopt.isra.14+0x1771/0x2b10 [ 510.443244] [] ? ip_ra_control+0x420/0x420 [ 510.449121] [] ? trace_hardirqs_on+0x10/0x10 [ 510.455183] [] ? trace_hardirqs_on+0x10/0x10 [ 510.461228] [] ? trace_hardirqs_on+0x10/0x10 [ 510.467273] [] ? trace_hardirqs_on+0x10/0x10 [ 510.473319] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 510.479643] [] ? trace_hardirqs_on_caller+0x38b/0x590 [ 510.486470] [] ? release_sock+0x14e/0x1c0 [ 510.492263] [] ? trace_hardirqs_on+0xd/0x10 [ 510.498218] [] ? __local_bh_enable_ip+0x6a/0xd0 [ 510.504517] [] ? _raw_spin_unlock_bh+0x30/0x40 [ 510.510747] [] ? release_sock+0x14e/0x1c0 [ 510.516535] [] ? selinux_netlbl_socket_setsockopt+0x8c/0x340 [ 510.523974] [] ? selinux_netlbl_sock_rcv_skb+0x480/0x480 [ 510.531051] [] ip_setsockopt+0x3a/0xb0 [ 510.536581] [] tcp_setsockopt+0x88/0xe0 [ 510.542188] [] sock_common_setsockopt+0x9a/0xe0 [ 510.548486] [] SyS_setsockopt+0x166/0x260 [ 510.554263] [] ? __fget+0x47/0x3b0 [ 510.559439] [] ? SyS_recv+0x40/0x40 [ 510.564695] [] ? security_file_ioctl+0x8f/0xc0 [ 510.570908] [] ? do_syscall_64+0x48/0x490 [ 510.576694] [] ? SyS_recv+0x40/0x40 [ 510.581950] [] do_syscall_64+0x1a6/0x490 [ 510.587652] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb 03:33:44 executing program 7: syz_open_pts(0xffffffffffffffff, 0x0) r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f00000006c0)=""/63) sendto$inet(r1, &(0x7f0000000000), 0x1be, 0x80000000200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) writev(r1, &(0x7f0000001400)=[{&(0x7f00000013c0)='8', 0x1}], 0x1) fcntl$setstatus(r0, 0x4, 0x6800) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='veth1_to_bond\x00', 0x10) r3 = socket(0xa, 0x2, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000140)={{{@in, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@local}}, &(0x7f0000000240)=0xe8) r6 = accept(r1, &(0x7f0000000280)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000300)=0x80) getsockopt$inet_mreqn(r1, 0x0, 0x24, &(0x7f0000000340)={@local, @loopback, 0x0}, &(0x7f0000000380)=0xc) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f00000003c0)={{{@in=@multicast1, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@rand_addr}}, &(0x7f00000004c0)=0xe8) getsockopt$inet_int(r6, 0x0, 0x33, &(0x7f0000000700), &(0x7f0000000740)=0x4) accept$packet(r0, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000540)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000580)={{{@in6=@ipv4={[], [], @multicast1}, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000680)=0xe8) accept4$packet(r0, &(0x7f0000000780)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000007c0)=0x14, 0x80000) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000ac0)={{{@in=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@loopback}}, &(0x7f0000000bc0)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000d80)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@remote}}, &(0x7f0000000e80)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r3, &(0x7f0000001200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000011c0)={&(0x7f0000000ec0)={0x2d4, r4, 0x600, 0x70bd29, 0x25dfdbff, {}, [{{0x8, 0x1, r5}, {0x7c, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r7}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x234, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r11}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r13}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x38}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}]}}]}, 0x2d4}, 0x1, 0x0, 0x0, 0x40000}, 0x2a0b4290a86fd89e) r15 = dup2(r3, r1) ioctl$BINDER_SET_CONTEXT_MGR(r15, 0x40046207, 0x0) 03:33:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x18) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = request_key(&(0x7f0000000080)='id_resolver\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000100)='memory.events\x00', 0xfffffffffffffffb) keyctl$read(0xb, r3, &(0x7f00000006c0)=""/4096, 0x1000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = dup2(r2, r0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB], 0x0, 0x0, &(0x7f00000006c0)}) socket(0xa, 0x3, 0x5) 03:33:44 executing program 5: r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f00000009c0)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000200)="2c0271ca8b080aae3300bfa4def38003", 0x10}], 0x1, &(0x7f0000000140)}, 0xc100) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/context\x00', 0x2, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f0000000040)={'filter\x00', 0x5, [{}, {}, {}, {}, {}]}, 0x78) r1 = memfd_create(&(0x7f00000002c0)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cdc21d28", 0x0) pwrite64(r1, &(0x7f0000000280)="df", 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x4, 0x11, r1, 0x0) write(r0, &(0x7f0000001480)="315602e340961e1e6fa59033d79acf3337e6f077c142e053f33b91e63dea1de22a51c7a9912b0e37913342a45531e6658b91dc1a1506da83b2df055fee6750e8f1ef3cd93be6a73969237df2b400d071dfb0c8ee97926c83bb877660c1611372fe5f125444fcfdb535b7647d159944c4ad244be807adb78124f4bad832af462474724466862c244d86c888372ab824a5b65fb558ae938276501174d6c9db1298d1e31019e5e9f89478e2dc6c6885d4a1759c4779f2b4ba7ed17e841b81d918e55f800768573e148073dd11971d10b31cc5849c9a438dd31cd4d1ccd5ed75556991740f643f1c91c26801d1691af894be5e88091388ff92f1313a2593af3471f2c855bd4888b65e9125c755ae7a17347a68714790b0cf54f3721b708e69fee8aeb0aa8be9021bf08527c566deba7661e48893ce809d5ebf830af035ccf6dc2d11cfdc10e047ab4fa4a660af73601e4cdf1a6efb826d645ddf88b698352307a61cb57a3d57acce96d7615ee9d9d48bdb1e019cee40e0d1eb83b80e719ad75468d13d7923c57e447d1a17b1e8b4f6c334075e48ce514df5433c931f851e040f6630673c3138ca36151e1ee5f2586ce27176df8d69978cbce0496a1c1e9bf03ac39b58070031ecae121b3f08137ad41de4a6c79d3d178998b7f963315e74b2956579fa63d2d52a77d277c92def04a63cf17f8bd947c848edfb5947098a915e3da948e3170daf5782f0382e54f879a868cb73979fc5b4e0b162bb57d8dda7bf32dd546e6f10b21ffe57e2121cb2282b98c7784ecdaaf9e4ca44258ab231b7fd8804cbb552986ae8a7d0779a288921402b54eeb7add6412b4454ad94dd1af74123f07d361d513c198b82cd8519ea70d0f33bde02a6f2ff998c218a13f34527c3f16d0670c9457f6cee097cb6fab2c7ccbdb9f4621a9439cc58c830fa1c11d71b47ab25f79b210937f42fad601111391fd58146e12f2ac9cb36b9d1a59446b3ba805470d5f1e2ae948a711501ce99343435fe71bfa3ef08dfa430360ffae0452a1b4159180b03c344aee53dc1eb68882cd73b1bd9b0bc8068aced23883d03b9dfb8d4c3629cf22db24081743c2375f21732df1ee42a91ff641201c1b7b2707952c14d2af49e071cf3f531d5996970fab8734ea3d80b0a5340f21a2cb3dff29f9d810159ed5d31ea15768cad265c1b4cb091476254be6620697b9901b2bfbb3856b21d1c4475f65ff88ad67a74ea8c940f759e58ef7dad010c6d7ff4e8f5a7546eb8a1eb888e8ff41a8a11494f79d1ff9d25d6f6993f49e3de2c72136cecc7a9a3f9cf89d073fadbe51bfd6e90a99071f56726c694f31d8e6d95d4b863f8463541c6f136c01e87d798610e1b2f8f6e1a3e969f550cc432c27f7f0d2924726970889d073ceae3696e4d5cbf47e7f8aed7095e23a0a2e65d50b988eb795d470a6d989308a3570be886b67ecb0c087a96709b502eb351cb347fe9928aec905bbf662cdbcd3726e55b7eae762d40caca2d4597376814c831b691b4aaee9506f7dd238f1dec4906abe034cb126ae359a3e398dc8f008d32342579d711cfd4b6b0ee79895ad92a79616ebda359b4c755aa3964a02225b4bb0929d7115b452e5251914bc6ecca0cc7ff30cdff635091119b1ed3ec3631efb9338774be5fb09cfb8131ce87a2f08b4832a9328bafa40d3bf50d07d4f7e78637a7b5262039c8924caaa0d194e5e45de3e52f371af06259d14e6817297ca4f4ddb21e2063b9eb210e74b6320cac9c0f1e52439eb188fcc424d739362e42926a577f1d35c7158cb963f9d0c91eb5841a3cc4f09445e8354b8a6f81294319d9e9d382d4b3bd704f71a04f2d51f1efc103a5337ac8095aa78bbb2a8ff39b2b4c8ddb15ed3a22deac3d3aab105761d9918120cbf5fa409ae8b0816f8009facb38c6f9c22c48e1b935f2215d5cc350b15363292562d8b959850cf72ba206ac6979be540a60d2cfa41a6b7ac6248c25ed4d1953c3251dcc4330df97c34b49be158fa317", 0x591) [ 510.780376] binder: 11212:11216 Acquire 1 refcount change on invalid ref 1287073954 ret -22 [ 510.789865] binder: 11212:11216 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 510.799099] binder: 11212:11218 Acquire 1 refcount change on invalid ref 1287073954 ret -22 [ 510.808252] binder: 11212:11218 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 510.856643] binder: 11214:11222 unknown command 1002744906 [ 510.862979] binder: 11214:11222 ioctl c0306201 20007000 returned -22 [ 510.870980] binder: BINDER_SET_CONTEXT_MGR already set [ 510.876359] binder: 11214:11222 ioctl 40046207 0 returned -16 [ 510.883180] binder: 11214:11222 unknown command 83 [ 510.888150] binder: 11214:11222 ioctl c0306201 20000680 returned -22 [ 510.895998] binder: BINDER_SET_CONTEXT_MGR already set 03:33:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x0, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000080)={{{@in, @in=@local}}, {{@in=@loopback}, 0x0, @in6=@mcast1}}, &(0x7f0000000180)=0xe8) r3 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 510.901326] binder: 11214:11222 ioctl 40046207 0 returned -16 [ 510.902480] binder: 11214:11226 unknown command 1002744906 [ 510.902488] binder: 11214:11226 ioctl c0306201 20007000 returned -22 [ 510.912174] binder: BINDER_SET_CONTEXT_MGR already set [ 510.912182] binder: 11214:11227 ioctl 40046207 0 returned -16 03:33:44 executing program 1: r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x40) ioctl$fiemap(r0, 0x40086602, &(0x7f0000000440)=ANY=[]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) ptrace$setregs(0xd, r1, 0xffffffff, &(0x7f0000000240)="cb69a7da32c67f2112ed19f06151840dd36f630f06bd1d2f98c64437e79cce240b52f2dd8de233e3b933fa6e912e84331a48d3cd93b56b16414f10fcbc0db6fb87bfd1996ea3a0649cb57866fc7c7f32c8057a1efcb165a0e485af50337c8e5c2d4ef010d1e27ad3398e6e676288f7727380b74666e17dbd23b46379b61e8b9d2bd902093145f8bed16eb33f5f8cf1ce447b1a98306c6957f7abb035b68ada28d79fdbe4549b6f26d89a957630bab06b728d0d5bd4a046911f") write$P9_RRENAME(r0, &(0x7f0000000000)={0x7}, 0xfffffd37) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x2, 0xc) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000100)) write(r3, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f305010008000100010423dcffdf00", 0x1f) write(r3, &(0x7f0000000000)="1f", 0x1) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000200)=0x38000, 0xffec) write$sndseq(0xffffffffffffffff, &(0x7f0000000340)=[{0xffffffffffffffff, 0x1, 0x0, 0x0, @tick, {}, {}, @time=@time={0x0, 0x989680}}], 0x30) ioctl$FS_IOC_FSSETXATTR(r0, 0x6609, &(0x7f00000004c0)) r4 = geteuid() ioctl$TUNSETOWNER(r0, 0x400454cc, r4) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000380)) write(r2, &(0x7f0000000400)="1c4b5a531506e5bd520d304ff4fc9864c980720ab5a629a6ae49fd36959169d03ff4a7b844b4e031b0a8c83cd096add401798aa03adcf264f7f9528afc652f65340aaab87a27537c8580e5f2ca42e88eacfb5a95e41e6ae5c9bb0462456c55de65dba5b0338bd12615e8b48ebd4be295fea2b41e5a546553dfeba448f8f1ae8547ec9c13d71d43e6dd353da762138826928fb1f6599e0d997bdb35c859b081fd5afa9629d600c855c9fb7782e1f29f028fb03bc921cde43348d6767520dc6466", 0xc0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f00000001c0)={'icmp6\x00'}, &(0x7f0000000300)=0x1e) fsync(r0) accept4$inet6(r3, 0x0, &(0x7f00000000c0), 0x800) 03:33:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f00000000c0)={r0, 0x0, 0x0, 0x2, 0x101}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 510.950062] binder: 11224:11229 BC_DEAD_BINDER_DONE 0000000000000001 not found [ 510.960269] binder: 11224:11229 got transaction to invalid handle [ 510.966824] binder: 11224:11229 transaction failed 29201/-22, size 0-32 line 3013 [ 511.038287] binder: 11224:11236 ioctl 400c55cb 20000000 returned -22 03:33:44 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000001c0)={0x215, 0x0, &(0x7f0000000000)=ANY=[], 0x0, 0x0, &(0x7f00000000c0)="81ef4f74435e3238c8f9dc80b3d958fd5a73df3edb05817f0d25ddd7fb6e8619863ced856e94a789d658ed7b656e527a2a4f23bbb551f276325bd2d32c3da052afc6569685ba4b9a4c2685fdc90a8b621683217ccb91069a04c6ff3af0849406ddcfdd15b2e5676cfa6d5e14c2ae419002fe3fe636db2ddae16ac34282614743ee9d90759bb9d37ee6265b4b1247b32b3aa190df4c63d7ca5d107c2c46e2677fc97c7c15258557fecc068c86b9a609c946399047d0216e486c6b37d0d1de64a6ad07f4da77a48a394573b04c4df905f66c09"}) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80, 0x0) ioctl$SG_SET_KEEP_ORPHAN(r2, 0x2287, &(0x7f0000000080)=0x200) r3 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:44 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = fcntl$dupfd(r0, 0x0, r0) userfaultfd(0x80000) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, &(0x7f0000a88f88), 0xfffffffffffffe6e, 0x20000000, &(0x7f0000e68000)={0x2, 0x4004e23, @local}, 0x10) recvmmsg(r1, &(0x7f0000003600)=[{{&(0x7f0000000280)=@alg, 0x80, &(0x7f0000000180)=[{&(0x7f0000000100)=""/49, 0x31}, {&(0x7f0000000380)=""/190, 0xbe}], 0x2}}], 0x1, 0x0, &(0x7f0000003740)={0x0, 0x989680}) recvmsg(r1, &(0x7f00000001c0)={&(0x7f0000000040)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, 0x15, &(0x7f0000000200)=[{&(0x7f0000000640)=""/188, 0xbc}], 0x1, &(0x7f0000000700)=""/95, 0x5f}, 0x10142) [ 511.097268] binder: 11238:11242 unknown command 0 [ 511.102462] binder: 11238:11242 ioctl c0306201 20000680 returned -22 [ 511.118058] binder: 11238:11242 unknown command 0 [ 511.122997] binder: 11238:11242 ioctl c0306201 20000680 returned -22 03:33:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x0, 0x0) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r1, 0x111, 0x1, 0x9, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x8000, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 511.169446] binder: 11240:11251 tried to acquire reference to desc 0, got 1 instead [ 511.178290] binder: BINDER_SET_CONTEXT_MGR already set [ 511.183770] binder: 11240:11251 ioctl 40046207 0 returned -16 [ 511.190066] binder: BINDER_SET_CONTEXT_MGR already set [ 511.196414] binder: 11240:11251 ioctl 40046207 0 returned -16 [ 511.280178] netlink: 3 bytes leftover after parsing attributes in process `syz-executor1'. 03:33:44 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) stat(&(0x7f00000006c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$iso9660(&(0x7f0000000180)='iso9660\x00', &(0x7f0000000340)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x3, 0x4, &(0x7f00000004c0)=[{&(0x7f00000003c0)="cde4a3cbaf804de5fe7fbe070b4a226b41de4fcd97e1050b87a33bb00cbf22d140c14b159e7563df28932fae9fc964edbd0345b25a5337d7c5845370c141d8eb1f70f72399375da6622e39f45ec3c7e4d95a4cf7ff96d44601106bb2c003e6452b4c03ead8ae207b84845fa30dd44d88bffb1792cb6404eb7dd4fb55dfcf14f4505e8277cd0e156b2df35afc23d7ceb8e97e4ee97edc7d", 0x97, 0x4}, {&(0x7f00000001c0), 0x0, 0x1}, {&(0x7f00000007c0)="5e84a04e90704d7b89fda1b58fca5b6e6290944feb3e7d5991811c696d3a1888d18006ad3481ec69efe96517deac3172531823beb17e8a702fd135553906318d6ae206ce33acfc7a9ff034ad9f5d674202272fe30b97619f41cf7a927a3cdc7eea9e1460f3186e3fde2906812afbf25e38091ac04b25ffd7c69d9e2ed4d07ad01695d1aab8862c6a3c87326a485051b121a9559764d1855f7603dc4058b06b3ea054c11459de5c2a7c1b61264b7f7353d713971a8ba64f495fda301f7597489c9e36394b7633a62d62", 0xc9, 0x2}, {&(0x7f0000000240)="ba655c75f33047f9dc43c20b401344586b774645d2590a0050d7eceb816a443d8f17", 0x22, 0x1ff}], 0x100000, &(0x7f00000002c0)={[{@map_normal='map=normal'}, {@gid={'gid', 0x3d, r0}}]}) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') signalfd(r2, &(0x7f00000000c0)={0x1}, 0x8) sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 511.365679] binder: 11258:11266 unknown command 0 [ 511.381721] binder: 11258:11266 ioctl c0306201 200001c0 returned -22 [ 511.394096] binder: 11258:11266 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 511.408520] binder: 11258:11266 unknown command 0 [ 511.413482] binder: 11258:11266 ioctl c0306201 200001c0 returned -22 [ 511.439839] binder: 11264:11273 tried to acquire reference to desc 0, got 1 instead [ 511.449049] binder: BINDER_SET_CONTEXT_MGR already set [ 511.455018] binder: 11264:11273 ioctl 40046207 0 returned -16 [ 511.461413] binder: BINDER_SET_CONTEXT_MGR already set [ 511.461422] binder: 11264:11275 ioctl 40046207 0 returned -16 [ 511.650295] 9pnet: Could not find request transport: rdma [ 511.784782] 9pnet: Could not find request transport: rdma [ 511.851779] netlink: 3 bytes leftover after parsing attributes in process `syz-executor1'. 03:33:47 executing program 6: r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$unix(0x1, 0x400040000000001, 0x0) bind$unix(r1, &(0x7f0000003000)=@abs={0x1}, 0x8) listen(r1, 0x0) connect(r0, &(0x7f0000985ff8)=@un=@abs={0x1}, 0x8) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/ip_mr_vif\x00') sendfile(r0, r2, &(0x7f0000000000), 0x800000bf) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000040)={'bond_slave_1\x00', {0x2, 0x4e24, @rand_addr=0x5}}) 03:33:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="046304400010ab897e5f29d19b0ce9ba4040e400207b9bca68241e3b2008eb5ff310290ebdd018d06d415b77a705ae1c0aeb022197e6b4da9145fa212b476377c848e31375233ae50ed0a41e7d8a8636d18258ec03d69738af05b734977993bee4cc5b96af83fecda46fa476a6aa8b8b3c4d72780ca80860dc6eca157e1c8f1e832b373d93653a79f93aba04aa31aed0bce4917f72072c03dbef3e"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:47 executing program 5: prctl$setmm(0x23, 0xb, &(0x7f0000012000/0x3000)=nil) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x80, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000080)=""/126) mkdir(&(0x7f0000000000)='./file0\x00', 0x2) 03:33:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$sock_inet_SIOCGIFBRDADDR(r2, 0x8919, &(0x7f0000000000)={'team0\x00', {0x2, 0x4e21, @local}}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) mount$9p_rdma(&(0x7f0000000100)='127.0.0.1\x00', &(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x2000000, &(0x7f00000001c0)={'trans=rdma,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@rq={'rq', 0x3d, 0xc0}}, {@common=@access_client='access=client'}, {@rq={'rq', 0x3d, 0x8}}, {@common=@afid={'afid', 0x3d, 0x3}}, {@rq={'rq', 0x3d, 0x100}}]}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x400200) readahead(r3, 0x8000, 0x3) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0463044000000000114d56b4ca7fef63aba2cb05c814bc88c82578ee8e4840100000000000000000000000000000000000000000000000200000000000", @ANYPTR=&(0x7f00000002c0)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[], @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:47 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0xfffffffffffffffe}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) 03:33:47 executing program 1: r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x40) ioctl$fiemap(r0, 0x40086602, &(0x7f0000000440)=ANY=[]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) ptrace$setregs(0xd, r1, 0xffffffff, &(0x7f0000000240)="cb69a7da32c67f2112ed19f06151840dd36f630f06bd1d2f98c64437e79cce240b52f2dd8de233e3b933fa6e912e84331a48d3cd93b56b16414f10fcbc0db6fb87bfd1996ea3a0649cb57866fc7c7f32c8057a1efcb165a0e485af50337c8e5c2d4ef010d1e27ad3398e6e676288f7727380b74666e17dbd23b46379b61e8b9d2bd902093145f8bed16eb33f5f8cf1ce447b1a98306c6957f7abb035b68ada28d79fdbe4549b6f26d89a957630bab06b728d0d5bd4a046911f") write$P9_RRENAME(r0, &(0x7f0000000000)={0x7}, 0xfffffd37) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x2, 0xc) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000100)) write(r3, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f305010008000100010423dcffdf00", 0x1f) write(r3, &(0x7f0000000000)="1f", 0x1) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000200)=0x38000, 0xffec) write$sndseq(0xffffffffffffffff, &(0x7f0000000340)=[{0xffffffffffffffff, 0x1, 0x0, 0x0, @tick, {}, {}, @time=@time={0x0, 0x989680}}], 0x30) ioctl$FS_IOC_FSSETXATTR(r0, 0x6609, &(0x7f00000004c0)) r4 = geteuid() ioctl$TUNSETOWNER(r0, 0x400454cc, r4) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000380)) write(r2, &(0x7f0000000400)="1c4b5a531506e5bd520d304ff4fc9864c980720ab5a629a6ae49fd36959169d03ff4a7b844b4e031b0a8c83cd096add401798aa03adcf264f7f9528afc652f65340aaab87a27537c8580e5f2ca42e88eacfb5a95e41e6ae5c9bb0462456c55de65dba5b0338bd12615e8b48ebd4be295fea2b41e5a546553dfeba448f8f1ae8547ec9c13d71d43e6dd353da762138826928fb1f6599e0d997bdb35c859b081fd5afa9629d600c855c9fb7782e1f29f028fb03bc921cde43348d6767520dc6466", 0xc0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f00000001c0)={'icmp6\x00'}, &(0x7f0000000300)=0x1e) fsync(r0) accept4$inet6(r3, 0x0, &(0x7f00000000c0), 0x800) 03:33:47 executing program 7: r0 = socket$key(0xf, 0x3, 0x2) creat(&(0x7f0000000080)='./file0\x00', 0x80) sendmsg$key(r0, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000000)=ANY=[@ANYBLOB="020300fd0a0000000000000000000000030006000000000002000000e0000001000008000000000002000100000000000000000000000000030005000000000002000000e0000033fc127527da095600"], 0x50}}, 0xffffffffffffffff) [ 513.911990] binder: 11292:11300 tried to acquire reference to desc 0, got 1 instead [ 513.920065] binder: 11292:11300 unknown command -1269412591 [ 513.926231] binder: 11292:11300 ioctl c0306201 20000680 returned -22 [ 513.938595] binder: 11294:11302 IncRefs 0 refcount change on invalid ref -1985277952 ret -22 [ 513.940184] binder: 11298:11303 ioctl 8919 20000000 returned -22 03:33:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) getgid() r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:47 executing program 7: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000080)) r0 = dup(0xffffffffffffff9c) r1 = openat$cgroup_ro(r0, &(0x7f0000000680)='memory.current\x00', 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) socket$inet(0x10, 0x3, 0xc) setpriority(0x0, 0x0, 0x0) mq_timedreceive(0xffffffffffffffff, &(0x7f0000001380)=""/164, 0xa4, 0x0, 0x0) r2 = fcntl$getown(0xffffffffffffffff, 0x9) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/181, 0xfe73, 0x0, &(0x7f0000000000)) sysfs$3(0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000180)=0x40000000000074, 0x315) r4 = epoll_create1(0x0) fcntl$lock(r4, 0x25, &(0x7f00000000c0)) ptrace$cont(0x1f, r2, 0x4, 0xffffffff80000000) connect$l2tp(r1, &(0x7f0000000780)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x0, 0x3, 0x3, 0x0, {0xa, 0x4e22, 0x6, @loopback, 0xfffffffffffeffff}}}, 0x9d) fcntl$lock(r4, 0x7, &(0x7f0000000000)) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000080)='lp\x00', 0x3) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r3, &(0x7f0000a88f88), 0x2f0c, 0x20008001, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000140), &(0x7f00000002c0)=0xc) write$FUSE_POLL(r1, &(0x7f0000000100)={0x18, 0x0, 0x6, {0x9}}, 0x18) write$P9_RGETLOCK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="0f006d656d6f72792e63757272656e74000eaa8743b00902f74bcf082d9d940ba68b8c467878d5d56267f1c30010f8438f52"], 0x32) keyctl$link(0x8, 0x0, 0x0) 03:33:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="046304400000630cf8461a92e2"], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:47 executing program 5: inotify_init() pipe2$9p(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f00000002c0)={0xfffffffffffffe67}, 0x7) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000600)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000004c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@noextend='noextend'}]}}) write$P9_RREADDIR(r1, &(0x7f0000000480)={0x2a, 0x29, 0x1, {0x0, [{{}, 0x0, 0x0, 0x7, './file0'}]}}, 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RWALK(r1, &(0x7f0000000080)={0x16, 0x6f, 0x1, {0x1, [{}]}}, 0x16) write$P9_RGETATTR(r1, &(0x7f0000000540)={0x2ab, 0x19, 0x1, {0x0, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x400000400000000}}, 0xa0) write$P9_RGETATTR(r1, &(0x7f0000000640)={0xa0, 0x19, 0x1}, 0xa0) write$P9_RLERROR(r1, &(0x7f0000000780)=ANY=[@ANYBLOB="b5000000070100ac0065746830e87ddc08962917937426f980b73b7573656df0e81475151e81b825e976ff48f6ea6e2ff178a259fdbc2912411deb78a48a542a591d594e7025f0e5504ffa591de6a5b0"], 0x50) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000900)='9p\x00', 0x0, &(0x7f0000000840)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) pipe2$9p(&(0x7f0000000100), 0x80800) utimes(&(0x7f0000000180)='./file0/file0\x00', &(0x7f00000001c0)={{0x0, 0x7530}, {0x0, 0x7530}}) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$IP6T_SO_GET_INFO(r2, 0x29, 0x40, &(0x7f00000004c0)={'raw\x00'}, &(0x7f0000000540)=0x54) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f00000000c0)={'sit0\x00', 0x9}) openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x8000, 0x0) [ 513.940253] binder: 11298:11303 tried to acquire reference to desc 0, got 1 instead [ 513.941927] binder: BINDER_SET_CONTEXT_MGR already set [ 513.941935] binder: 11298:11303 ioctl 40046207 0 returned -16 [ 513.954605] binder: BINDER_SET_CONTEXT_MGR already set [ 513.954613] binder: 11298:11303 ioctl 40046207 0 returned -16 [ 513.954696] binder: 11298:11307 ioctl 8919 20000000 returned -22 03:33:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/checkreqprot\x00', 0x8300, 0x0) ioctl$TIOCSBRK(r1, 0x5427) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630e40"], 0x0, 0x0, &(0x7f0000002000)}) r3 = dup2(r2, r0) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000340)={{{@in=@multicast1, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000100)=0xe8) sendmsg$nl_netfilter(r3, &(0x7f0000000440)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x1c, 0x1, 0x0, 0x300, 0x70bd2c, 0x25dfdbfd, {0x1, 0x0, 0x7}, [@typed={0x8, 0x13, @uid=r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000680)={0x1d8, 0x0, &(0x7f0000000940)=ANY=[@ANYBLOB="12634840000000000000000002000000010100000000000011000000000000000000000018000000000000003000000000000000362f308eefe6a09b8159b0a7f9c8d6f03ae0f3f863bc7925c6a4173cab7e6bab77d7ca4991bec177e20c81829972b16ee62261bf63ef36bacedc43803e6a1ba98cf7e341077dd4478f834c023283746d7c0e38f0fc91551471be2458f022633ca96af12484cc886386aad48bfe48958ecf711553ebd7090b83f17db267e388f52f4b2c3037050481545c84e32e395dc389963ad8af5a4a80fff396731a52a91c9c65c642341d0ff867ea2977d4bf6ae156ca7ab63182e3401ef0", @ANYBLOB="5923e5f1cd3c836ad030ba5b47ba8bdbc3961907cc36dc5a57ae3bf29bc0382e05151c4a54d6ea9ffae2ec751b5ef4c7574f7ece4edd9211612b85fa98e30dba63d141d6f5c5317edae3af190d2f6fcea9fa6c5faf1d4343b7b917d48d1c34ba1d80a610c4bfa2c896c6d369a9bbbe3cd504ad4888bac5710dc840cbd25143182f4c5b8945f6181f4d8c41dc6decc0a84c46da62361fdc20475021e0f8d2c0a0666b552d42b8624ea06b38f67d26f9ba0ccc62bf437fc923397d28394cb9bed182b0e636eb25a752d6104f6b53922760", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00\x00\x00\x00\x00H\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x000\x00\x00\x00\x00\x00\x00\x00'], @ANYRESHEX=0x0], 0x0, 0x0, &(0x7f0000000900)}) 03:33:47 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x37e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0x0, 0x2000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f0000000ac0)=ANY=[@ANYBLOB="7472616e733d72646d612c706f3030303030304f18a333f790863c1e67da3030303030743d30783030a6d3c5c89890991471cf0008000030303030303030303030312c73713d30784e66666631b47c35447b6443bf0ca7bd32a0303030301a6f573a21227f624b903859dac0541bc477a77b0c27f9fe16890ac5ca7e1c97dd5d701119c4d6a1db3c60284f4c4769b307df26057e90d4a526cbeab4bb1692a8a82b4af27cc4bd52a50b60e7a1a070cf4c4387115128b36e46c94da7a6367aa070194ec1b2a35fca28bc15e01471910eec8faf6c4f791de3b2eb2eda4d3044c4c892013ab425b3dde1aaf480bcf24f4741808654f4be7b34c7477bc4ba77f95b6264d9c6b11203ac56eecb0fd5a9b2958a727fbe70caf64441907f1b783c81dac73c62631bd8b6447975c8c04366621c92acbe666aeff0b254943ff56d8c5c73e3af44b336a4f908893e6f9018931690f4e68f5b481d18ada317e22cf4f3d9d16cdb24fdab052af4cbff85abde6d8c6ad0b3fcb2e1ae722526a124edab584c7faa69552a5e86dfd7faf407da8c73401055142e1474c069d8eeb8fc67b95625f3271d42c5012300324a5873a49256cab58f14372a1ac7983ca7e07de332db8d56cb6abc9ffab3192257a8f60e668cf18492ff41a14e6b2f41e3cbdcb347b9"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) times(&(0x7f0000000240)) r1 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000000000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="ac61286c1d0737b4234e65722c00"]) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 514.008620] selinux_nlmsg_perm: 13 callbacks suppressed [ 514.008652] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11304 comm=syz-executor4 [ 514.041235] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11304 comm=syz-executor4 [ 514.063212] netlink: 3 bytes leftover after parsing attributes in process `syz-executor1'. 03:33:47 executing program 6: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) mount(&(0x7f000000a000)='./file0\x00', &(0x7f000000aff8)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f0000000000)) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f00000000c0)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') r0 = accept$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000040)=0x1c) getsockname(r0, &(0x7f0000000180)=@in={0x2, 0x0, @local}, &(0x7f0000000200)=0x80) r1 = creat(&(0x7f0000000340)='./file0/../file0\x00', 0x0) write$binfmt_aout(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="0b01200906010000840000000800000080020000090000000000000000000000f71428e15cb0b7e3a393f449d7aabeb9e72b4514b50c74ad68ad0b196d3aa327b0efd2db7d6406c257a1acfd88c6cb6d41b7679bb21f70623ae4ded4766f5e39d63dca9439bc267f34bcb8c85d3adcc7b7a4deb07cd025f419251a59829ec100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001d0d9648000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x37f) ioctl$PIO_UNIMAPCLR(r1, 0x4b68, &(0x7f0000000240)={0x6, 0x5, 0x8}) 03:33:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="d3fcc76ca27090ef3bf051436d1ece51627a7c7d8415411b118a8a051a2de9c98d109cb7a56e511855bf88be8509c5e8fe1f5e8825f70f50"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) setsockopt$sock_int(r2, 0x1, 0x3e, &(0x7f0000000040)=0x10000, 0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 514.186658] binder: 11318:11324 IncRefs 0 refcount change on invalid ref 207814656 ret -22 [ 514.196332] binder: 11316:11325 tried to acquire reference to desc 0, got 1 instead [ 514.204705] binder: BINDER_SET_CONTEXT_MGR already set [ 514.204714] binder: 11318:11324 ioctl 40046207 0 returned -16 [ 514.211839] binder: 11321:11329 unknown command 1074684677 [ 514.211848] binder: 11321:11329 ioctl c0306201 20007000 returned -22 [ 514.212538] binder: BINDER_SET_CONTEXT_MGR already set [ 514.212547] binder: 11318:11324 ioctl 40046207 0 returned -16 [ 514.212594] binder: 11318:11326 IncRefs 0 refcount change on invalid ref 207814656 ret -22 [ 514.212682] binder: 11321:11329 got reply transaction with no transaction stack [ 514.212690] binder: 11321:11329 transaction failed 29201/-71, size 24-48 line 2921 [ 514.220865] binder: undelivered TRANSACTION_ERROR: 29201 [ 514.284666] binder: 11316:11325 got transaction to context manager from process owning it [ 514.293411] binder: 11316:11325 transaction failed 29201/-22, size 0-0 line 3004 03:33:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x4058534c, &(0x7f0000000080)={0x0, 0x0, 0x7, 0xfffffffffffffffe, 0x81, 0x9}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) 03:33:47 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = accept4$packet(0xffffffffffffffff, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000180)=0x14, 0x80000) setsockopt$packet_buf(r0, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="7472616eff3d72646d612c706f72743d3078303030303030303030303030303030302c74696d656f75743d3078303030303030303030303030303030312c73713d3078666666666666666638366162646531642c74696d656f75743d3078303030303030303030303030303030302c0051b6605aa2d0e634f7bcbf886ba4c5d93e36b7a4fe20457202e5c373f7af08ace3946ef26c34407853316cd63e81e3540e5112b6f286460f3275453e68d34cb9afaec6b4d52c001f4c9005da1cb4011e88f9f05ad48b6d5575826a79d0b1ffb51808272b629260cf606a099ab398f5eaaa03b9c549bc81b00b244bc0ca1467474cdd7cb413813f87cb80c1aa232b68d5bd4eb788cd"]) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r1 = socket(0x10, 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000280)='net/ip_tables_matches\x00') sendfile(r1, r2, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB="6f64303030303030303030303030303079a34d3f3630302c757365720900000000000000d5967496a03f96f119b7e97b17feb5d3b9f9aeae2ba956087e176dd8e0d1cd2c83c0becc15361c95a3", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) [ 514.344537] binder: undelivered TRANSACTION_ERROR: 29201 [ 514.360248] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11337 comm=syz-executor4 [ 514.381763] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11341 comm=syz-executor4 03:33:47 executing program 6: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCGVERSION(r1, 0x80044501, &(0x7f0000000240)=""/70) recvmsg(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000080)=""/110, 0x6e}, {&(0x7f0000001440)=""/4096, 0x1000}], 0x2, &(0x7f0000002440)=""/4096, 0x1000}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000500)={&(0x7f0000000000), 0xc, &(0x7f0000000180)={&(0x7f0000000440)=@ipv6_getaddr={0x18, 0x16, 0x206}, 0x18}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000001400)={&(0x7f00000001c0), 0xc, &(0x7f00000013c0)={&(0x7f0000000200)=@ipv6_getanyicast={0x14, 0x12, 0x105}, 0x14}}, 0x0) 03:33:47 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x10000000800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r1, r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f0000000080)=""/238) [ 514.472281] binder: 11345:11349 unknown command 1825045715 [ 514.478508] binder: 11345:11349 ioctl c0306201 20007000 returned -22 [ 514.486925] binder: 11345:11349 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 514.496707] binder: 11344:11350 tried to acquire reference to desc 0, got 1 instead [ 514.496873] binder: 11345:11349 unknown command 1825045715 [ 514.496882] binder: 11345:11349 ioctl c0306201 20007000 returned -22 03:33:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r2 = dup2(r0, r1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=[@increfs], 0x0, 0x0, &(0x7f00000006c0)}) [ 514.497146] binder: 11345:11352 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 514.530157] binder: BINDER_SET_CONTEXT_MGR already set [ 514.535930] binder: 11344:11350 ioctl 40046207 0 returned -16 03:33:48 executing program 1: r0 = creat(&(0x7f00000003c0)='./file0\x00', 0x40) ioctl$fiemap(r0, 0x40086602, &(0x7f0000000440)=ANY=[]) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) ptrace$setregs(0xd, r1, 0xffffffff, &(0x7f0000000240)="cb69a7da32c67f2112ed19f06151840dd36f630f06bd1d2f98c64437e79cce240b52f2dd8de233e3b933fa6e912e84331a48d3cd93b56b16414f10fcbc0db6fb87bfd1996ea3a0649cb57866fc7c7f32c8057a1efcb165a0e485af50337c8e5c2d4ef010d1e27ad3398e6e676288f7727380b74666e17dbd23b46379b61e8b9d2bd902093145f8bed16eb33f5f8cf1ce447b1a98306c6957f7abb035b68ada28d79fdbe4549b6f26d89a957630bab06b728d0d5bd4a046911f") write$P9_RRENAME(r0, &(0x7f0000000000)={0x7}, 0xfffffd37) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket(0x10, 0x2, 0xc) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000100)) write(r3, &(0x7f0000000040)="1f0000000104ff00fd4354c007110000f305010008000100010423dcffdf00", 0x1f) write(r3, &(0x7f0000000000)="1f", 0x1) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000200)=0x38000, 0xffec) write$sndseq(0xffffffffffffffff, &(0x7f0000000340)=[{0xffffffffffffffff, 0x1, 0x0, 0x0, @tick, {}, {}, @time=@time={0x0, 0x989680}}], 0x30) ioctl$FS_IOC_FSSETXATTR(r0, 0x6609, &(0x7f00000004c0)) r4 = geteuid() ioctl$TUNSETOWNER(r0, 0x400454cc, r4) ioctl$TUNGETVNETHDRSZ(r0, 0x800454d7, &(0x7f0000000380)) write(r2, &(0x7f0000000400)="1c4b5a531506e5bd520d304ff4fc9864c980720ab5a629a6ae49fd36959169d03ff4a7b844b4e031b0a8c83cd096add401798aa03adcf264f7f9528afc652f65340aaab87a27537c8580e5f2ca42e88eacfb5a95e41e6ae5c9bb0462456c55de65dba5b0338bd12615e8b48ebd4be295fea2b41e5a546553dfeba448f8f1ae8547ec9c13d71d43e6dd353da762138826928fb1f6599e0d997bdb35c859b081fd5afa9629d600c855c9fb7782e1f29f028fb03bc921cde43348d6767520dc6466", 0xc0) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f00000001c0)={'icmp6\x00'}, &(0x7f0000000300)=0x1e) fsync(r0) accept4$inet6(r3, 0x0, &(0x7f00000000c0), 0x800) [ 514.682250] binder: 11351:11356 ioctl 4058534c 20000080 returned -22 [ 514.690168] binder: 11351:11356 tried to acquire reference to desc 0, got 1 instead [ 514.699783] binder: 11351:11356 got transaction to context manager from process owning it [ 514.708431] binder: 11351:11356 transaction failed 29201/-22, size 0-0 line 3004 03:33:48 executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000000c0)=0x0) ioprio_set$pid(0x2, r0, 0x4f) r1 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0x0, 0x0) r3 = mmap$binder(&(0x7f0000bfe000/0x400000)=nil, 0x400000, 0x2, 0x20810, r2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000240)={0x28, 0x0, &(0x7f00000001c0)=[@acquire_done={0x40106309, r3, 0x1}, @exit_looper, @acquire, @release], 0xd, 0x0, &(0x7f0000000200)="57234a1e89b70842968a65f576"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000007000)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05630440"], 0x0, 0x0, &(0x7f0000002000)}) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$selinux_access(r4, &(0x7f0000000140)={'system_u:object_r:syslogd_var_lib_t:s0', 0x20, 'system_u:system_r:kernel_t:s0', 0x20, 0x20}, 0x5a) r5 = dup2(r2, r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r6, 0x8912, 0x400200) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000680)={0x54, 0x0, &(0x7f0000000900)=[@increfs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000240)}}}], 0x0, 0x0, &(0x7f00000006c0)}) unlinkat(r5, &(0x7f0000000080)='./file0\x00', 0x200) [ 514.765415] binder: undelivered TRANSACTION_ERROR: 29201 [ 514.787202] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11358 comm=syz-executor4 03:33:48 executing program 4: perf_event_open(&(0x7f000001d000)={0x0, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@timeout={'timeout'}}]}}) mq_getsetattr(0xffffffffffffffff, &(0x7f0000000100), &(0x7f0000000140)) r0 = socket(0x10, 0x2, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ip_tables_matches\x00') sendfile(r0, r1, &(0x7f0000000000), 0x80000002) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode'}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000000c0)=0x83f) [ 514.815643] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11359 comm=syz-executor4 [ 514.897456] binder: 11360:11364 ioctl 80404519 20000080 returned -22 [ 514.905502] binder: 11360:11365 ioctl 80404519 20000080 returned -22 [ 514.922242] binder: BINDER_SET_CONTEXT_MGR already set [ 514.927933] binder: 11362:11366 ioctl 40046207 0 returned -16 [ 514.935816] binder: BINDER_SET_CONTEXT_MGR already set [ 514.941628] binder: 11362:11366 ioctl 40046207 0 returned -16 03:33:48 executing program 7: ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000080)) r0 = dup(0xffffffffffffff9c) r1 = openat$cgroup_ro(r0, &(0x7f0000000680)='memory.current\x00', 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) socket$inet(0x10, 0x3, 0xc) setpriority(0x0, 0x0, 0x0) mq_timedreceive(0xffffffffffffffff, &(0x7f0000001380)=""/164, 0xa4, 0x0, 0x0) r2 = fcntl$getown(0xffffffffffffffff, 0x9) mq_timedreceive(0xffffffffffffffff, &(0x7f0000000200)=""/181, 0xfe73, 0x0, &(0x7f0000000000)) sysfs$3(0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f0000000180)=0x40000000000074, 0x315) r4 = epoll_create1(0x0) fcntl$lock(r4, 0x25, &(0x7f00000000c0)) ptrace$cont(0x1f, r2, 0x4, 0xffffffff80000000) connect$l2tp(r1, &(0x7f0000000780)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x0, 0x3, 0x3, 0x0, {0xa, 0x4e22, 0x6, @loopback, 0xfffffffffffeffff}}}, 0x9d) fcntl$lock(r4, 0x7, &(0x7f0000000000)) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000080)='lp\x00', 0x3) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r3, &(0x7f0000a88f88), 0x2f0c, 0x20008001, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000140), &(0x7f00000002c0)=0xc) write$FUSE_POLL(r1, &(0x7f0000000100)={0x18, 0x0, 0x6, {0x9}}, 0x18) write$P9_RGETLOCK(r1, &(0x7f00000006c0)=ANY=[@ANYBLOB="0f006d656d6f72792e63757272656e74000eaa8743b00902f74bcf082d9d940ba68b8c467878d5d56267f1c30010f8438f52"], 0x32) keyctl$link(0x8, 0x0, 0x0) 03:33:48 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000008ff3)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0xa002, 0x0) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000140)) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000180)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@remote}}, &(0x7f0000000280)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000002c0)={0x0, 0x0, 0x0}, &(0x7f0000000300)=0xc) fgetxattr(r0, &(0x7f0000000400)=@random={'os2.', '^/-\x00'}, &(0x7f0000000440)=""/84, 0x54) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000340)={r3, r2, r4}, 0xc) ioctl$EVIOCGRAB(r1, 0x40044590, &(0x7f0000000080)=0xb4bf) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) r5 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$binfmt_script(r5, &(0x7f00000004c0)={'#! ', './file0', [{0x20, "2624776c616e31707070305d47504c401e73656375726974792b626465765e"}, {0x20, '/dev/binder#\x00'}, {0x20, '/dev/null\x00'}, {0x20, 'cgroupprocvmnet1'}, {0x20, '!proc$trusted'}, {0x20, '^/-\x00'}, {0x20, '(+'}, {0x20, '$'}, {0x20, "656d312c76626f786e65743065746830c062646576276367726f757076626f786e65743021747275737465643a73797374656d74727573746564707070312e766d6e65743129637075736574"}], 0xa, "c5ac543547083443dee98aa80ee151bdb0ce512fb08b23f55011b27ee304867bfcb89d756698bc2c776d31e687bc05baa259c58016ad84964c9fa3e2c7f4f13ecef953e5282d81c616c1fa2d3ed96aa5a088c18b4b9f3fa96a30ca9ebe1e9b328324fbbe4b6ee87313965ebece9607e57236f89cfc161a797945d417a8aea0dbe9617bd0c059628bba2560c249c488cf541c4e8a79c654388d23ff7ebef77661f9077a64f6fe0908df6755e185dc06571e64eefa834920fce079f5aabe27d5ce96787df48448e58008e741d6a370a0b8"}, 0x18a) ioctl$TIOCSBRK(r1, 0x5427) write$P9_RLOCK(r1, &(0x7f00000003c0)={0x8, 0x35, 0x2}, 0x8) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000007000)={0x2, 0x0, &(0x7f0000000000)=ANY=[@ANYRES16=r5], 0x0, 0x0, &(0x7f0000000040)}) r6 = dup2(r5, r0) gettid() creat(&(0x7f00000000c0)='./file0\x00', 0x80) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000680)={0x8, 0x0, &(0x7f0000000900)=ANY=[@ANYBLOB="0063044000ea0000"], 0x0, 0x0, &(0x7f00000006c0)}) truncate(&(0x7f0000000380)='./file0\x00', 0x2) [ 514.969502] binder: 11368:11374 BC_ACQUIRE_DONE u0000000000000000 no match [ 514.979332] binder: 11368:11374 tried to acquire reference to desc 0, got 1 instead [ 514.988136] binder: 11368:11374 got transaction to context manager from process owning it [ 514.996612] binder: 11368:11374 transaction failed 29201/-22, size 0-0 line 3004 [ 515.048748] binder: undelivered TRANSACTION_ERROR: 29201 [ 515.084282] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11386 comm=syz-executor4 [ 515.106740] binder: 11387:11389 unknown command 6 [ 515.113267] binder: 11387:11389 ioctl c0306201 20007000 returned -22 [ 515.126709] netlink: 3 bytes leftover after parsing attributes in process `syz-executor1'. [ 515.143159] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26996 sclass=netlink_route_socket pig=11386 comm=syz-executor4 [ 515.157595] binder: 11387:11389 unknown command 1074029312 [ 515.163563] binder: 11387:11389 ioctl c0306201 20000680 returned -22 [ 515.182969] binder: 11387:11398 unknown command 11 [ 515.188107] binder: 11387:11398 ioctl c0306201 20007000 returned -22 [ 515.195437] binder: 11387:11398 unknown command 1074029312 [ 515.201352] binder: 11387:11398 ioctl c0306201 20000680 returned -22 [ 716.102226] INFO: task syz-executor5:11379 blocked for more than 140 seconds. [ 716.109524] Not tainted 4.9.124-g09eb2ba #31 [ 716.114780] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 716.122842] syz-executor5 D28568 11379 3627 0x00000004 [ 716.128581] ffff8801cca98000 ffff8801ced2b9c0 ffff880186206f40 ffff8801cca9b000 [ 716.136720] ffff8801db321c18 ffff8801aa9d7660 ffffffff839f0afd dffffc0000000000 [ 716.145030] ffff8801baab5f50 ffff8801aa9d7620 00ff8801cca988c0 ffff8801db3224e8 [ 716.153392] Call Trace: [ 716.155997] [] ? __schedule+0x64d/0x1bd0 [ 716.161702] [] schedule+0x7f/0x1b0 [ 716.166961] [] d_alloc_parallel+0xeb2/0x17c0 [ 716.173071] [] ? lookup_slow+0x19c/0x470 [ 716.178813] [] ? __d_lookup_rcu+0x730/0x730 [ 716.184873] [] ? wake_up_q+0xe0/0xe0 [ 716.190263] [] lookup_slow+0x19c/0x470 [ 716.195850] [] ? page_put_link+0xd0/0xd0 [ 716.201610] [] walk_component+0x716/0x1bb0 [ 716.207517] [] ? __inode_permission2+0x9b/0x2d0 [ 716.214296] [] ? path_init+0x1580/0x1580 [ 716.220035] [] ? link_path_walk+0x8a7/0x1200 [ 716.226131] [] ? walk_component+0x1bb0/0x1bb0 [ 716.232337] [] path_lookupat.isra.41+0x186/0x410 [ 716.238775] [] filename_lookup.part.55+0x177/0x370 [ 716.245422] [] ? filename_parentat.isra.53.part.54+0x3d0/0x3d0 [ 716.253312] [] ? strncpy_from_user+0x20d/0x2d0 [ 716.259571] [] ? getname_flags+0x23a/0x580 [ 716.265517] [] user_path_at_empty+0x53/0x70 [ 716.271526] [] do_utimes+0x17f/0x2c0 [ 716.276955] [] ? utimes_common.isra.1+0x5e0/0x5e0 [ 716.283497] [] ? __might_fault+0x114/0x1d0 [ 716.289483] [] SyS_utimes+0x13d/0x1b0 [ 716.294989] [] ? SyS_futimesat+0x1b0/0x1b0 [ 716.300977] [] ? do_syscall_64+0x48/0x490 [ 716.306835] [] ? SyS_futimesat+0x1b0/0x1b0 [ 716.312881] [] do_syscall_64+0x1a6/0x490 [ 716.318625] [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb [ 716.325604] [ 716.325604] Showing all locks held in the system: [ 716.331962] 2 locks held by khungtaskd/519: [ 716.336711] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 [ 716.345625] #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 [ 716.355338] 2 locks held by rs:main Q:Reg/3675: [ 716.359992] #0: (&f->f_pos_lock){+.+.+.}, at: [] __fdget_pos+0xac/0xd0 [ 716.368929] #1: (sb_writers#3){.+.+.+}, at: [] vfs_write+0x3ae/0x530 [ 716.377790] 1 lock held by rsyslogd/3677: [ 716.381904] #0: (&f->f_pos_lock){+.+.+.}, at: [] __fdget_pos+0xac/0xd0 [ 716.390811] 2 locks held by getty/3773: [ 716.394828] #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 [ 716.404169] #1: (&ldata->atomic_read_lock){+.+.+.}, at: [] n_tty_read+0x202/0x16e0 [ 716.414124] 1 lock held by syz-executor5/11331: [ 716.418775] #0: (&sb->s_type->i_mutex_key#23){++++++}, at: [] lookup_slow+0x141/0x470 [ 716.429182] 1 lock held by syz-executor5/11379: [ 716.433858] #0: (&sb->s_type->i_mutex_key#23){++++++}, at: [] lookup_slow+0x141/0x470 [ 716.444172] [ 716.445785] ============================================= [ 716.445785] [ 716.452925] NMI backtrace for cpu 1 [ 716.456574] CPU: 1 PID: 519 Comm: khungtaskd Not tainted 4.9.124-g09eb2ba #31 [ 716.463828] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 716.473154] ffff8801d8607d08 ffffffff81eb95e9 0000000000000000 0000000000000001 [ 716.481134] 0000000000000001 0000000000000001 ffffffff810b9fa0 ffff8801d8607d40 [ 716.489112] ffffffff81ec4927 0000000000000001 0000000000000000 0000000000000003 [ 716.497092] Call Trace: [ 716.499656] [] dump_stack+0xc1/0x128 [ 716.505100] [] ? irq_force_complete_move+0x320/0x320 [ 716.511835] [] nmi_cpu_backtrace.cold.2+0x48/0x87 [ 716.518305] [] ? irq_force_complete_move+0x320/0x320 [ 716.525077] [] nmi_trigger_cpumask_backtrace+0x12a/0x14f [ 716.532158] [] arch_trigger_cpumask_backtrace+0x14/0x20 [ 716.539146] [] watchdog+0x6b4/0xa20 [ 716.544397] [] ? watchdog+0x11c/0xa20 [ 716.549819] [] kthread+0x26d/0x300 [ 716.554984] [] ? reset_hung_task_detector+0x20/0x20 [ 716.561622] [] ? kthread_park+0xa0/0xa0 [ 716.567320] [] ? __switch_to_asm+0x34/0x70 [ 716.573230] [] ? kthread_park+0xa0/0xa0 [ 716.578834] [] ? kthread_park+0xa0/0xa0 [ 716.584433] [] ret_from_fork+0x5c/0x70 [ 716.590160] Sending NMI from CPU 1 to CPUs 0: [ 716.594699] NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff83a00606 [ 716.601985] Kernel panic - not syncing: hung_task: blocked tasks [ 716.608128] CPU: 0 PID: 519 Comm: khungtaskd Not tainted 4.9.124-g09eb2ba #31 [ 716.615370] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 716.624698] ffff8801d8607cc8 ffffffff81eb95e9 ffffffff83c8c0a0 00000000ffffffff [ 716.632814] 0000000000000000 0000000000000000 dffffc0000000000 ffff8801d8607d88 [ 716.640792] ffffffff81423eb5 0000000041b58ab3 ffffffff843bb8e8 ffffffff81423cf6 [ 716.648775] Call Trace: [ 716.651338] [] dump_stack+0xc1/0x128 [ 716.656684] [] panic+0x1bf/0x3bc [ 716.661675] [] ? add_taint.cold.6+0x16/0x16 [ 716.667622] [] ? ___preempt_schedule+0x16/0x18 [ 716.673832] [] ? nmi_trigger_cpumask_backtrace+0x100/0x14f [ 716.681079] [] watchdog+0x6c5/0xa20 [ 716.686329] [] ? watchdog+0x11c/0xa20 [ 716.691758] [] kthread+0x26d/0x300 [ 716.696928] [] ? reset_hung_task_detector+0x20/0x20 [ 716.703573] [] ? kthread_park+0xa0/0xa0 [ 716.709188] [] ? __switch_to_asm+0x34/0x70 [ 716.715055] [] ? kthread_park+0xa0/0xa0 [ 716.720656] [] ? kthread_park+0xa0/0xa0 [ 716.726324] [] ret_from_fork+0x5c/0x70 [ 716.732228] Dumping ftrace buffer: [ 716.735858] (ftrace buffer empty) [ 716.739550] Kernel Offset: disabled [ 716.743156] Rebooting in 86400 seconds..