7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$int_in(r1, 0x5452, &(0x7f0000e35ff8)=0x45) r2 = getpgrp(0x0) fcntl$setown(r1, 0x8, r2) fcntl$setsig(r0, 0xa, 0x15) r3 = gettid() tkill(r3, 0x102080000000015) 14:17:29 executing program 5: socket$pppoe(0x18, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x41, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x8, 0x442) write$FUSE_WRITE(r0, &(0x7f0000000000)={0x18, 0x0, 0x1, {0x9}}, 0x18) ftruncate(r0, 0x3) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = getpid() rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f00000000c0)) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000200)="37bf714a03a40959c32786a153def83556fa50cd07a17e57dec67c6416a295c095eb32a4f530f4c9d5a1097ec9cb7ae16740e3757f15b6dcf57990782d6184c5e4008d0a13c88dde2489844d5ac77297e284a19202b19948d27e47580f8ba3d97f4b9c4002ed0be3a4772706db21e6218c26e76063cb18300682ff759367394a3dd6a021fbb7b9fbcf") ptrace$setregs(0xf, r2, 0x7ffa, &(0x7f00000004c0)="4a051d7f06dc795032df56a73e26cfe541ed36e27b9be01282dc0a5c8564ff14fa6ae94add0fb0534109fd07b56d0db33bdbf964fdc2a49c81a0f7837c4b6e4e0b6d77609e30df8b87b8e8a438d0778dad213d") r3 = memfd_create(&(0x7f0000000100)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) write(r3, &(0x7f0000000380)='`', 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ptrace$setregset(0x4204, r2, 0x0, &(0x7f00000001c0)={0x0, 0xffffffffffffffc5}) 14:17:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:17:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:30 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:17:30 executing program 5: socket$pppoe(0x18, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x41, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x8, 0x442) write$FUSE_WRITE(r0, &(0x7f0000000000)={0x18, 0x0, 0x1, {0x9}}, 0x18) ftruncate(r0, 0x3) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = getpid() rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f00000000c0)) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000200)="37bf714a03a40959c32786a153def83556fa50cd07a17e57dec67c6416a295c095eb32a4f530f4c9d5a1097ec9cb7ae16740e3757f15b6dcf57990782d6184c5e4008d0a13c88dde2489844d5ac77297e284a19202b19948d27e47580f8ba3d97f4b9c4002ed0be3a4772706db21e6218c26e76063cb18300682ff759367394a3dd6a021fbb7b9fbcf") ptrace$setregs(0xf, r2, 0x7ffa, &(0x7f00000004c0)="4a051d7f06dc795032df56a73e26cfe541ed36e27b9be01282dc0a5c8564ff14fa6ae94add0fb0534109fd07b56d0db33bdbf964fdc2a49c81a0f7837c4b6e4e0b6d77609e30df8b87b8e8a438d0778dad213d") r3 = memfd_create(&(0x7f0000000100)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) write(r3, &(0x7f0000000380)='`', 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ptrace$setregset(0x4204, r2, 0x2, 0x0) 14:17:30 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:30 executing program 5: socket$pppoe(0x18, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x41, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x8, 0x442) write$FUSE_WRITE(r0, &(0x7f0000000000)={0x18, 0x0, 0x1, {0x9}}, 0x18) ftruncate(r0, 0x3) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = getpid() rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f00000000c0)) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000200)="37bf714a03a40959c32786a153def83556fa50cd07a17e57dec67c6416a295c095eb32a4f530f4c9d5a1097ec9cb7ae16740e3757f15b6dcf57990782d6184c5e4008d0a13c88dde2489844d5ac77297e284a19202b19948d27e47580f8ba3d97f4b9c4002ed0be3a4772706db21e6218c26e76063cb18300682ff759367394a3dd6a021fbb7b9fbcf") ptrace$setregs(0xf, r2, 0x7ffa, &(0x7f00000004c0)="4a051d7f06dc795032df56a73e26cfe541ed36e27b9be01282dc0a5c8564ff14fa6ae94add0fb0534109fd07b56d0db33bdbf964fdc2a49c81a0f7837c4b6e4e0b6d77609e30df8b87b8e8a438d0778dad213d") r3 = memfd_create(&(0x7f0000000100)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) write(r3, &(0x7f0000000380)='`', 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ptrace$setregset(0x4204, r2, 0x2, 0x0) 14:17:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) [ 310.584877][T15234] binder: 15225:15234 ioctl c0306201 0 returned -14 [ 310.603580][T15236] binder_thread_write: 14 callbacks suppressed [ 310.603595][T15236] binder: 15233:15236 Acquire 1 refcount change on invalid ref 0 ret -22 [ 310.613684][T15237] binder: 15235:15237 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:30 executing program 5: socket$pppoe(0x18, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x41, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x8, 0x442) write$FUSE_WRITE(r0, &(0x7f0000000000)={0x18, 0x0, 0x1, {0x9}}, 0x18) ftruncate(r0, 0x3) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r2 = getpid() rt_tgsigqueueinfo(r2, r2, 0x16, &(0x7f00000000c0)) ptrace(0x10, r2) ptrace$setregs(0xd, r2, 0x0, &(0x7f0000000200)="37bf714a03a40959c32786a153def83556fa50cd07a17e57dec67c6416a295c095eb32a4f530f4c9d5a1097ec9cb7ae16740e3757f15b6dcf57990782d6184c5e4008d0a13c88dde2489844d5ac77297e284a19202b19948d27e47580f8ba3d97f4b9c4002ed0be3a4772706db21e6218c26e76063cb18300682ff759367394a3dd6a021fbb7b9fbcf") ptrace$setregs(0xf, r2, 0x7ffa, &(0x7f00000004c0)="4a051d7f06dc795032df56a73e26cfe541ed36e27b9be01282dc0a5c8564ff14fa6ae94add0fb0534109fd07b56d0db33bdbf964fdc2a49c81a0f7837c4b6e4e0b6d77609e30df8b87b8e8a438d0778dad213d") r3 = memfd_create(&(0x7f0000000100)='-B\xd5NI\xc5j\xbappp\xf0\b\x84\xa2m\x00:)\x00\xbb\x8d\xac\xacva}knh#\xcb)\x0f\xc8\xc0:\x9cc\x10d\xee\xa9\x8bCc\xad\x89\x9ck\xde\xc5\xe96\xddU\xa9=\xcdJx\xaa\x8f~\xb90a\xa9\xb2\x04K\x98\x93?\x88Q\xf7\xd6\x1d\xa1\xce\x8b\x19\xea\xef\xe3\xab\xb6\xa5$4\xd6\xfe7\x0f\xe7\xd9$\xce \xabN\xae\xc9\xbd\xd3g@\xe1\'s\x0e\x90\xf2\xcdr\xb8(', 0x0) write(r3, &(0x7f0000000380)='`', 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r3, 0x0) ptrace$setregset(0x4204, r2, 0x2, 0x0) 14:17:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) [ 310.648979][T15234] binder: 15225:15234 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 310.679507][T15245] binder: 15244:15245 Acquire 1 refcount change on invalid ref 0 ret -22 [ 310.735434][T15254] binder: 15252:15254 Acquire 1 refcount change on invalid ref 0 ret -22 [ 310.744042][T15234] binder: 15225:15234 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 310.770568][T15256] binder: 15233:15256 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:30 executing program 5: 14:17:30 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r0}], 0x1, 0x0, 0x0, 0x0) r1 = dup2(0xffffffffffffffff, r0) ioctl$int_in(r1, 0x5452, &(0x7f0000e35ff8)=0x45) r2 = getpgrp(0x0) fcntl$setown(r1, 0x8, r2) fcntl$setsig(r0, 0xa, 0x15) r3 = gettid() tkill(r3, 0x102080000000015) 14:17:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) [ 311.101704][T15261] binder: 15257:15261 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:31 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:31 executing program 5: 14:17:31 executing program 2: 14:17:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:31 executing program 5: 14:17:31 executing program 2: [ 311.428195][T15268] binder: 15267:15268 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:31 executing program 2: 14:17:31 executing program 5: r0 = socket(0x10, 0x803, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000000300)=[{0x0}, {0x0}], 0x2, &(0x7f0000000600)=""/148, 0x94}}, {{0x0, 0x0, &(0x7f00000009c0)=[{0x0}], 0x1}}, {{0x0, 0x0, 0x0, 0x0, &(0x7f0000000d00)=""/54, 0x36}, 0xfffffffffffff9b6}, {{0x0, 0x0, &(0x7f00000020c0)=[{0x0}], 0x1}, 0x9}], 0x4, 0x40000000, 0x0) sendto(r0, &(0x7f0000cfefee)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000040)=""/95, 0x5f}, {&(0x7f00000000c0)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {0x0}, {&(0x7f0000000480)=""/60, 0x3c}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f0000000540)=""/154, 0x9a}, {&(0x7f0000000340)=""/22, 0x16}], 0x8, &(0x7f0000002400)=""/191, 0xbf}, 0xe80f}], 0x1, 0x0, &(0x7f0000003700)={0x77359400}) [ 311.506509][T15277] binder: 15276:15277 Acquire 1 refcount change on invalid ref 0 ret -22 [ 311.516791][T15281] binder: 15271:15281 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:17:31 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x200408d4, &(0x7f0000000380)={0xa, 0x0, 0x0, @loopback}, 0x1c) 14:17:31 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, 0xffffffffffffffff) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:31 executing program 2: clone(0x100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) futex(&(0x7f0000000040)=0x1, 0x8b, 0x1, 0x0, &(0x7f0000000000), 0x0) wait4(0x0, 0x0, 0x0, 0x0) 14:17:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:31 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:31 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x315, &(0x7f0000000240)={&(0x7f0000000000)=@ipv4_delrule={0x2c, 0x21, 0x93403a352db30171, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10004}, [@FRA_GENERIC_POLICY=@FRA_UID_RANGE={0xc}]}, 0x2c}}, 0x0) 14:17:31 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 312.243630][T15405] binder: 15404:15405 Acquire 1 refcount change on invalid ref 0 ret -22 [ 312.254044][T15405] binder_thread_write: 18 callbacks suppressed [ 312.254054][T15405] binder: 15404:15405 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 312.269020][T15405] binder: 15404:15405 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 312.323200][T15410] binder_thread_write: 2 callbacks suppressed [ 312.323212][T15410] binder: 15404:15410 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 312.348928][T15414] binder: 15408 invalid dec weak, ref 192 desc 0 s 1 w 0 [ 312.351259][T15415] binder: BINDER_SET_CONTEXT_MGR already set 14:17:32 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:32 executing program 2: [ 312.369142][T15415] binder: 15412:15415 ioctl 40046207 0 returned -16 14:17:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x1f, &(0x7f0000000040), 0x4) 14:17:32 executing program 4: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 312.465887][T15527] binder: 15412:15527 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 312.484958][T15529] binder: 15524 invalid dec weak, ref 196 desc 0 s 1 w 0 [ 312.539065][T15535] binder: 15412:15535 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:32 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, 0xffffffffffffffff) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 312.738422][T15539] binder: 15537 invalid dec weak, ref 198 desc 0 s 1 w 0 14:17:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:32 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000100)=0x1, 0xfb) connect$inet(r0, &(0x7f0000000180), 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000700)={0x0, 0x40000007fff, 0x80000001}, 0x14) shutdown(r0, 0x1) 14:17:32 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 313.062239][T15545] binder: 15543 invalid dec weak, ref 200 desc 0 s 1 w 0 [ 313.101039][T15552] binder: 15544:15552 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:32 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:32 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:32 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = pkey_alloc(0x0, 0x1) pkey_free(r0) [ 313.117794][T15552] binder: 15544:15552 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 313.138294][T15552] binder: 15544:15552 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:17:32 executing program 4: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 313.186474][T15561] binder: 15558:15561 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 313.198582][T15562] binder: 15544:15562 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 313.263744][T15572] binder: 15563:15572 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 313.328889][T15576] binder: 15563:15576 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:33 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, 0xffffffffffffffff) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:33 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 313.560134][T15579] binder: 15578:15579 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:33 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = pkey_alloc(0x0, 0x1) pkey_free(r0) 14:17:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 313.937650][T15589] binder: 15588:15589 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 313.951339][T15589] binder: 15588:15589 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:17:33 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:33 executing program 2: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = pkey_alloc(0x0, 0x1) pkey_free(r0) 14:17:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 314.005616][T15595] binder: 15588:15595 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:33 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:33 executing program 2: socketpair(0x22, 0x3, 0x0, &(0x7f00000001c0)={0x0, 0x0}) [ 314.103691][T15608] binder: 15601:15608 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 314.168294][T15614] binder: 15601:15614 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:34 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:34 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:34 executing program 2: socketpair(0x22, 0x3, 0x0, &(0x7f00000001c0)={0x0, 0x0}) 14:17:34 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:34 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 314.762785][T15627] binder: 15626:15627 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 314.783349][T15631] binder: 15630:15631 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 314.794643][T15631] binder: 15630:15631 ioctl c0306201 0 returned -14 [ 314.806132][T15631] binder: 15630:15631 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:17:34 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:34 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:34 executing program 2: socketpair(0x22, 0x3, 0x0, &(0x7f00000001c0)={0x0, 0x0}) 14:17:34 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:34 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 314.861297][T15634] binder: 15630:15634 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:34 executing program 2: socketpair(0x22, 0x3, 0x0, &(0x7f00000001c0)={0x0, 0x0}) 14:17:34 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:34 executing program 2: socketpair(0x0, 0x3, 0x0, &(0x7f00000001c0)={0x0, 0x0}) [ 314.957806][T15651] binder: 15640:15651 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 315.019608][T15659] binder: 15640:15659 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:35 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:35 executing program 2: socketpair(0x0, 0x3, 0x0, &(0x7f00000001c0)={0x0, 0x0}) 14:17:35 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 315.621393][T15672] binder_thread_write: 12 callbacks suppressed [ 315.621407][T15672] binder: 15671:15672 Acquire 1 refcount change on invalid ref 0 ret -22 [ 315.641052][T15672] binder: 15671:15672 ioctl c0306201 0 returned -14 14:17:35 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:35 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:35 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:35 executing program 2: socketpair(0x0, 0x3, 0x0, &(0x7f00000001c0)={0x0, 0x0}) 14:17:35 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x0, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) [ 315.706228][T15676] binder: 15671:15676 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:35 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:35 executing program 2: socketpair(0x22, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0}) [ 315.755512][T15686] binder: 15677:15686 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:35 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 315.815660][T15695] binder: 15684:15695 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 315.844981][T15699] binder: 15698:15699 Acquire 1 refcount change on invalid ref 0 ret -22 [ 315.865216][T15699] binder: 15698:15699 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 315.875392][T15701] binder: 15684:15701 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:36 executing program 2: socketpair(0x22, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0}) 14:17:36 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x0, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:36 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 316.453604][T15707] binder: 15705:15707 Acquire 1 refcount change on invalid ref 0 ret -22 [ 316.471851][T15711] binder: 15709:15711 Acquire 1 refcount change on invalid ref 0 ret -22 [ 316.485483][T15707] binder: 15705:15707 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 316.495270][T15711] binder: 15709:15711 ioctl c0306201 0 returned -14 14:17:36 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:36 executing program 2: socketpair(0x22, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x0}) 14:17:36 executing program 5: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:36 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x0, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:36 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:36 executing program 2: socketpair(0x22, 0x3, 0x0, 0x0) 14:17:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 316.624437][T15725] binder: 15718:15725 Acquire 1 refcount change on invalid ref 0 ret -22 [ 316.641078][T15725] binder: 15718:15725 DecRefs 0 refcount change on invalid ref 0 ret -22 14:17:36 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, 0x0) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) [ 316.711196][T15733] binder: 15729:15733 DecRefs 0 refcount change on invalid ref 0 ret -22 14:17:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:36 executing program 2: socketpair(0x22, 0x3, 0x0, 0x0) 14:17:36 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, 0x0) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) [ 317.320302][T15749] binder_thread_write: 6 callbacks suppressed [ 317.320314][T15749] binder: 15748:15749 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 317.346977][T15749] binder: 15748:15749 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 317.400755][T15753] binder_thread_write: 2 callbacks suppressed [ 317.400767][T15753] binder: 15748:15753 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:37 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:37 executing program 2: socketpair(0x22, 0x3, 0x0, 0x0) 14:17:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:37 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, 0x0) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:37 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 317.524987][ T23] binder: undelivered death notification, 0000000000000000 [ 317.562792][T15765] binder: BINDER_SET_CONTEXT_MGR already set 14:17:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:37 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) [ 317.569455][T15764] binder: 15763:15764 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 317.582241][T15765] binder: 15759:15765 ioctl 40046207 0 returned -16 [ 317.602554][T15765] binder: 15759:15765 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 317.616674][T15765] binder: 15759:15765 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:17:37 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) [ 317.638229][T15770] binder: 15769:15770 ioctl c0306201 0 returned -14 [ 317.702627][T15778] binder: 15759:15778 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:37 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:37 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) [ 318.148448][T15781] binder: 15780:15781 ioctl c0306201 0 returned -14 [ 318.171175][T15788] binder: 15782:15788 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 318.193549][T15788] binder: 15782:15788 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 318.252539][T15792] binder: 15782:15792 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:38 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:38 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:38 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) [ 318.377858][T15796] binder: 15795:15796 ioctl c0306201 0 returned -14 [ 318.405805][T15802] binder: BINDER_SET_CONTEXT_MGR already set 14:17:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 318.436684][T15802] binder: 15801:15802 ioctl 40046207 0 returned -16 [ 318.457104][T15804] binder: 15803:15804 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:38 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(0xffffffffffffffff, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) [ 319.000379][T15827] binder: BINDER_SET_CONTEXT_MGR already set [ 319.023601][T15827] binder: 15825:15827 ioctl 40046207 0 returned -16 [ 319.038510][T15829] binder: 15828:15829 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:38 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 319.065375][T15829] binder: 15828:15829 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 319.125774][T15842] binder: 15841:15842 ioctl c0306201 0 returned -14 [ 319.135576][T15843] binder: 15828:15843 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:38 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:38 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:38 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(0xffffffffffffffff, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 319.185590][T15844] binder: 15841:15844 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 319.280255][T15854] binder: 15853:15854 ioctl c0306201 0 returned -14 14:17:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:39 executing program 2: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:39 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(0xffffffffffffffff, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:39 executing program 2: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 319.885698][T15868] binder: 15857:15868 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) 14:17:39 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 319.931240][ T23] binder: undelivered death notification, 0000000000000000 [ 319.973251][T15878] binder: 15877:15878 ioctl c0306201 0 returned -14 14:17:39 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:39 executing program 2: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:39 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) getpgrp(0x0) fcntl$setown(r2, 0x8, 0x0) fcntl$setsig(r1, 0xa, 0x15) r3 = gettid() tkill(r3, 0x102080000000015) 14:17:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046307}], 0x0, 0x0, 0x0}) [ 320.043025][T15882] binder: 15877:15882 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 320.131708][T15891] binder: 15890:15891 ioctl c0306201 0 returned -14 14:17:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:17:40 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:40 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) getpgrp(0x0) fcntl$setown(r2, 0x8, 0x0) fcntl$setsig(r1, 0xa, 0x15) r3 = gettid() tkill(r3, 0x102080000000015) 14:17:40 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:17:40 executing program 2: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) [ 320.669421][T15900] binder: 15895:15900 ioctl c0306201 0 returned -14 [ 320.691386][T15903] binder_thread_write: 16 callbacks suppressed [ 320.691542][T15903] binder: 15902:15903 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:40 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 320.756996][T15910] binder: 15909:15910 ioctl c0306201 0 returned -14 [ 320.772608][T15913] binder: 15902:15913 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 320.780842][ T23] binder: undelivered death notification, 0000000000000000 [ 320.864641][T15919] binder: 15917:15919 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:40 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:40 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) getpgrp(0x0) fcntl$setown(r2, 0x8, 0x0) fcntl$setsig(r1, 0xa, 0x15) r3 = gettid() tkill(r3, 0x102080000000015) 14:17:40 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 320.955581][T15925] binder: 15924:15925 ioctl c0306201 0 returned -14 [ 320.972426][T15928] binder: BINDER_SET_CONTEXT_MGR already set [ 320.979161][T15928] binder: 15926:15928 ioctl 40046207 0 returned -16 [ 320.991726][T15928] binder: 15926:15928 ioctl c0306201 0 returned -14 14:17:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:41 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:17:41 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(0xffffffffffffffff, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:17:41 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) [ 321.537310][T15940] binder: 15934:15940 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:41 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:41 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 321.595699][T15948] binder: 15934:15948 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 321.616664][ T9063] binder: undelivered death notification, 0000000000000000 14:17:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:17:41 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(0xffffffffffffffff, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:41 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:41 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) 14:17:41 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(0xffffffffffffffff, 0xa, 0x15) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:42 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) [ 322.395824][T15979] binder: 15977:15979 Acquire 1 refcount change on invalid ref 0 ret -22 [ 322.433257][T15979] binder_thread_write: 10 callbacks suppressed 14:17:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) [ 322.433269][T15979] binder: 15977:15979 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:42 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 322.476632][ T23] binder: undelivered death notification, 0000000000000000 [ 322.477594][T15979] binder: 15977:15979 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:17:42 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:42 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x0) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:42 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 322.549524][T15994] binder_thread_write: 1 callbacks suppressed [ 322.549535][T15994] binder: 15977:15994 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 322.579370][T15995] binder: 15992:15995 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 322.651716][T16004] binder: 15997:16004 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 322.661232][ T23] binder: undelivered death notification, 0000000000000000 14:17:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:42 executing program 5: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001240)={0x0, 0x0}, 0x20) stat(0x0, 0x0) lchown(0x0, 0x0, 0x0) gettid() stat(&(0x7f0000001580)='./file0\x00', &(0x7f00000015c0)) r0 = memfd_create(&(0x7f0000000140)='proc}GXLeth0^wlan0#:\x00', 0x4) msgget$private(0x0, 0x3c8) clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() socket$netlink(0x10, 0x3, 0xe) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x400, 0x0) fcntl$setown(0xffffffffffffffff, 0x8, r1) ptrace$setopts(0x4206, r1, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000001540)='/dev/udmabuf\x00', 0x2) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) tkill(r1, 0x20) fsetxattr(0xffffffffffffffff, &(0x7f0000000240)=@random={'os2.', 'vboxnet0{cgroup\x00'}, &(0x7f0000000280)='/\x00', 0x2, 0x3) ioctl$VT_WAITACTIVE(0xffffffffffffffff, 0x5607) getsockopt$inet_sctp6_SCTP_PR_STREAM_STATUS(0xffffffffffffffff, 0x84, 0x74, &(0x7f00000012c0)=""/106, &(0x7f0000001340)=0x6a) 14:17:42 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x0) r4 = gettid() tkill(r4, 0x102080000000015) 14:17:42 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x3f00, 0x0) 14:17:42 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x0) r4 = gettid() tkill(r4, 0x102080000000015) [ 323.237042][T16118] binder: 16112:16118 Acquire 1 refcount change on invalid ref 0 ret -22 [ 323.248006][T16118] binder: 16112:16118 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 323.260325][T16118] binder: 16112:16118 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:17:42 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:17:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 323.316555][T16127] binder: 16112:16127 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 323.334014][ T9063] binder: undelivered death notification, 0000000000000000 14:17:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:43 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:17:43 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) gettid() tkill(0x0, 0x102080000000015) 14:17:43 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000080)={'security\x00'}, &(0x7f0000000000)=0x54) [ 323.441636][T16213] binder: 16208:16213 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 323.509982][T16223] binder: 16221:16223 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:43 executing program 5: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x10006, 0x80011, r0, 0x0) poll(&(0x7f0000000000)=[{r0}], 0x1, 0x0) 14:17:43 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:17:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 324.079008][T16252] binder: 16233:16252 Acquire 1 refcount change on invalid ref 0 ret -22 [ 324.089852][T16252] binder: 16233:16252 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 324.099263][T16252] binder: 16233:16252 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:17:43 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x0, @multicast2}, 0x10) 14:17:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:43 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 324.153965][T16338] binder: 16233:16338 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 324.191176][ T23] binder: undelivered death notification, 0000000000000000 14:17:43 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:43 executing program 5: syz_emit_ethernet(0x66, &(0x7f00000f8000)={@random="cd390b081bf2", @local, [], {@ipv6={0x86dd, {0x0, 0x6, "a2fbe8", 0x30, 0x2b, 0x0, @ipv4={[], [], @multicast2}, @mcast2, {[], @icmpv6=@pkt_toobig={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "9433df", 0x0, 0x0, 0x0, @mcast2, @loopback}}}}}}}, 0x0) 14:17:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:43 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) gettid() tkill(0x0, 0x102080000000015) [ 324.320121][T16355] binder: 16350:16355 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 324.371426][T16362] binder: 16360:16362 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:44 executing program 5: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mount(&(0x7f0000000240)=@nullb='/dev/nullb0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000140)='btrfs\x00', 0x0, 0x0) dup(0xffffffffffffffff) 14:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:44 executing program 5: mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount(&(0x7f0000000240)=@nullb='/dev/nullb0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000140)='btrfs\x00', 0x0, 0x0) dup(0xffffffffffffffff) [ 324.925647][T16372] binder: 16370:16372 Acquire 1 refcount change on invalid ref 0 ret -22 [ 324.941681][T16372] binder: 16370:16372 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:44 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 325.061327][ T9063] binder: undelivered death notification, 0000000000000000 [ 325.091557][T16586] binder: 16584:16586 IncRefs 0 refcount change on invalid ref 0 ret -22 14:17:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:44 executing program 5: openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f00000000c0)) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x140100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000240)=@nullb='/dev/nullb0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000140)='btrfs\x00', 0x0, 0x0) dup(r0) fcntl$setstatus(r0, 0x4, 0x4000) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0) 14:17:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:44 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) gettid() tkill(0x0, 0x102080000000015) [ 325.157576][T16591] binder: 16588:16591 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:45 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}, &(0x7f0000000040)=0x10) 14:17:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 325.781333][T16712] binder: 16710:16712 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:45 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 325.916826][ T9063] binder: undelivered death notification, 0000000000000000 [ 325.940565][ T23] binder: undelivered death notification, 0000000000000000 14:17:45 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:45 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:45 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:45 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x0) [ 326.036708][T16835] binder: 16833:16835 Acquire 1 refcount change on invalid ref 0 ret -22 [ 326.046567][T16835] binder: 16833:16835 IncRefs 0 refcount change on invalid ref 0 ret -22 14:17:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) [ 326.616378][ T9063] binder: undelivered death notification, 0000000000000000 [ 326.623850][T16848] binder: 16844:16848 Acquire 1 refcount change on invalid ref 0 ret -22 [ 326.645459][T16852] binder: 16850:16852 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) ioctl$TCSETSF(0xffffffffffffffff, 0x5441, 0x0) 14:17:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 326.665819][T16848] binder: 16844:16848 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 326.735984][ T23] binder: undelivered death notification, 0000000000000000 [ 326.748949][T16863] binder: 16861:16863 Acquire 1 refcount change on invalid ref 0 ret -22 [ 326.766311][T16863] binder: 16861:16863 IncRefs 0 refcount change on invalid ref 0 ret -22 14:17:46 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:46 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:46 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) ioctl$TCSETSF(0xffffffffffffffff, 0x5441, 0x0) 14:17:46 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x0) 14:17:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:47 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) ioctl$TCSETSF(0xffffffffffffffff, 0x5441, 0x0) 14:17:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:47 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 327.463312][T16884] binder: BINDER_SET_CONTEXT_MGR already set [ 327.485050][T16884] binder: 16881:16884 ioctl 40046207 0 returned -16 14:17:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:47 executing program 2: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 327.555497][T16896] binder: 16888:16896 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:47 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:47 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:47 executing program 0: timer_create(0x0, &(0x7f0000000100)={0x0, 0x12}, &(0x7f00009b1ffc)) timer_settime(0x0, 0x0, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000040)=[{r1}], 0x1, 0x0, 0x0, 0x0) r2 = dup2(r0, r1) ioctl$int_in(r2, 0x5452, &(0x7f0000e35ff8)=0x45) r3 = getpgrp(0x0) fcntl$setown(r2, 0x8, r3) fcntl$setsig(r1, 0xa, 0x15) r4 = gettid() tkill(r4, 0x0) 14:17:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:47 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 327.815008][T16915] binder: 16914:16915 Acquire 1 refcount change on invalid ref 0 ret -22 [ 327.841950][T16916] binder: BINDER_SET_CONTEXT_MGR already set 14:17:47 executing program 5: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000140)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETSF(r0, 0x5441, 0x0) 14:17:47 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:47 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 327.859014][T16916] binder: 16913:16916 ioctl 40046207 0 returned -16 [ 327.874356][T16915] binder_thread_write: 4 callbacks suppressed [ 327.874366][T16915] binder: 16914:16915 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:47 executing program 5: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000140)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETSF(r0, 0x5441, 0x0) 14:17:47 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 327.950135][T16924] binder: 16914:16924 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:47 executing program 5: ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000140)) r0 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETSF(r0, 0x5441, 0x0) 14:17:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:48 executing program 0: syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:48 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:48 executing program 0: [ 328.733817][T17065] binder: 17055:17065 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:48 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:48 executing program 0: 14:17:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 328.777649][T17070] binder: BINDER_SET_CONTEXT_MGR already set [ 328.791445][T17070] binder: 17069:17070 ioctl 40046207 0 returned -16 [ 328.804262][T17070] binder: 17069:17070 IncRefs 0 refcount change on invalid ref 0 ret -22 14:17:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:48 executing program 0: [ 328.898670][T17086] binder: 17082:17086 ioctl c0306201 0 returned -14 14:17:48 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:49 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 329.624146][T17103] binder: 17100:17103 ioctl c0306201 0 returned -14 14:17:49 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:49 executing program 0: 14:17:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:49 executing program 0: [ 329.731259][T17115] binder: 17110:17115 ioctl c0306201 0 returned -14 [ 329.747002][T17118] binder: BINDER_SET_CONTEXT_MGR already set 14:17:49 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:49 executing program 0: [ 329.774461][T17118] binder: 17116:17118 ioctl 40046207 0 returned -16 [ 329.779170][T17120] binder: 17119:17120 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 329.848438][T17128] binder: 17127:17128 ioctl c0306201 0 returned -14 [ 329.858027][T17129] binder: 17119:17129 ioctl c0306201 0 returned -14 [ 329.911702][T17132] binder: 17119:17132 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:50 executing program 0: 14:17:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) [ 330.483388][T17137] binder: 17134:17137 ioctl c0306201 0 returned -14 14:17:50 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:50 executing program 0: 14:17:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) 14:17:50 executing program 0: 14:17:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 330.646533][T17154] binder: 17148:17154 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 330.720147][T17163] binder: 17148:17163 ioctl c0306201 0 returned -14 [ 330.776301][T17165] binder: 17148:17165 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:50 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:50 executing program 0: 14:17:50 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) r1 = syz_open_pts(0xffffffffffffffff, 0x0) ioctl$TCSETSF(r1, 0x5441, 0x0) [ 331.322506][T17171] binder: 17170:17171 ioctl c0306201 0 returned -14 14:17:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:51 executing program 0: 14:17:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) syz_open_pts(r0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5441, 0x0) 14:17:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) syz_open_pts(r0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5441, 0x0) 14:17:51 executing program 0: [ 331.457741][T17181] binder: BINDER_SET_CONTEXT_MGR already set [ 331.465446][T17181] binder: 17175:17181 ioctl 40046207 0 returned -16 [ 331.481474][T17179] binder: 17177:17179 ioctl c0306201 0 returned -14 14:17:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 331.519503][T17186] binder_thread_write: 10 callbacks suppressed [ 331.519517][T17186] binder: 17183:17186 Acquire 1 refcount change on invalid ref 0 ret -22 14:17:51 executing program 0: [ 331.560181][T17186] binder: 17183:17186 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 331.576189][T17192] binder: 17190:17192 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 331.664524][T17197] binder: 17183:17197 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:51 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:51 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000140)) syz_open_pts(r0, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5441, 0x0) 14:17:51 executing program 0: 14:17:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f00000001c0), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:51 executing program 0: [ 332.143166][T17204] binder: 17201:17204 IncRefs 0 refcount change on invalid ref 0 ret -22 [ 332.155890][T17205] binder: 17203:17205 ioctl c0306201 0 returned -14 14:17:51 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:51 executing program 5: 14:17:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:51 executing program 0: 14:17:51 executing program 5: [ 332.295734][T17213] binder: 17212:17213 ioctl c0306201 0 returned -14 14:17:52 executing program 0: [ 332.351122][T17221] binder: 17216:17221 Acquire 1 refcount change on invalid ref 0 ret -22 [ 332.366994][T17221] binder: 17216:17221 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 332.469564][T17226] binder: 17216:17226 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:52 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:52 executing program 5: 14:17:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:52 executing program 0: 14:17:52 executing program 5: 14:17:52 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:52 executing program 0: 14:17:52 executing program 5: 14:17:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) [ 333.123291][T17243] binder: 17242:17243 ioctl c0306201 0 returned -14 14:17:52 executing program 5: 14:17:53 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:53 executing program 0: 14:17:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:53 executing program 5: 14:17:53 executing program 0: 14:17:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:53 executing program 5: 14:17:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:17:53 executing program 0: 14:17:53 executing program 5: 14:17:53 executing program 5: [ 334.066585][T17281] binder: 17278:17281 Acquire 1 refcount change on invalid ref 0 ret -22 [ 334.088944][T17281] binder: 17278:17281 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 334.196576][T17285] binder: 17278:17285 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:54 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:54 executing program 0: 14:17:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:17:54 executing program 5: 14:17:54 executing program 0: [ 334.686780][T17290] binder: 17287:17290 ioctl c0306201 0 returned -14 14:17:54 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:54 executing program 5: 14:17:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:17:54 executing program 0: 14:17:54 executing program 5: 14:17:54 executing program 0: [ 334.897102][T17305] binder: 17302:17305 ioctl c0306201 0 returned -14 [ 334.917423][T17308] binder: 17307:17308 Acquire 1 refcount change on invalid ref 0 ret -22 [ 334.928436][T17308] binder: 17307:17308 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 335.040499][T17313] binder: 17307:17313 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:55 executing program 5: 14:17:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:17:55 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:55 executing program 0: 14:17:55 executing program 0: 14:17:55 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:55 executing program 5: [ 335.556941][T17318] binder: 17317:17318 ioctl c0306201 0 returned -14 14:17:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:55 executing program 0: 14:17:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:17:55 executing program 5: 14:17:55 executing program 0: 14:17:55 executing program 5: 14:17:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 335.763801][T17336] binder: 17334:17336 Acquire 1 refcount change on invalid ref 0 ret -22 [ 335.780401][T17336] binder: 17334:17336 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 335.884532][T17346] binder: 17334:17346 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:56 executing program 0: 14:17:56 executing program 5: 14:17:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:17:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:56 executing program 0: 14:17:56 executing program 5: 14:17:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) 14:17:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) 14:17:56 executing program 5: 14:17:56 executing program 0: [ 336.612787][T17366] binder: 17365:17366 Acquire 1 refcount change on invalid ref 0 ret -22 [ 336.652795][T17366] binder: 17365:17366 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 336.719596][T17375] binder: 17365:17375 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 336.728058][T17375] binder: 17365:17375 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:56 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) 14:17:56 executing program 0: 14:17:56 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:56 executing program 5: openat$pfkey(0xffffffffffffff9c, &(0x7f0000001d80)='/proc/self/net/pfkey\x00', 0x0, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000002340)='/proc/self/net/pfkey\x00', 0x0, 0x0) 14:17:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:57 executing program 0: bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0xa, 0xa, 0x100000000000910, 0x1}, 0x2f) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x2}, 0x2c) 14:17:57 executing program 2: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, &(0x7f00000008c0)={0x1f, 0x6000000000}, 0x8, 0x10, &(0x7f0000000900)={0xacd3, 0x3, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(0xffffffffffffffff, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040), 0x84800) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000640)=0x7, 0x4) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') 14:17:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:57 executing program 0: setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, &(0x7f0000000100)='westwood\x00', 0x9) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffebc) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000000c0)={0x0, 0x80000018000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0xfde5, 0x0, 0x0, 0x2b7) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) 14:17:57 executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000240)=ANY=[], 0xeb) recvmmsg(r1, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000140)=""/84, 0x54}, {&(0x7f0000000780)=""/98, 0x62}], 0x2}}], 0x1, 0x0, 0x0) 14:17:57 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000000)={&(0x7f0000ffd000/0x3000)=nil, 0x3000}, &(0x7f0000000040)=0x10) [ 337.494843][T17400] binder: 17394:17400 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 337.562619][T17503] kvm: emulating exchange as write 14:17:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:57 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)={0x1, 0x9, 0x6, 0x8000000001}, 0x3c) bpf$MAP_LOOKUP_ELEM(0x3, &(0x7f0000000080)={r0, &(0x7f0000000000), 0x0}, 0x18) [ 338.049992][T17513] binder: 17511:17513 Acquire 1 refcount change on invalid ref 0 ret -22 [ 338.069144][T17513] binder: 17511:17513 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:17:57 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, &(0x7f000000dff8), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:57 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r0, &(0x7f00000000c0)=ANY=[], 0xff2e) r1 = dup2(r0, r0) ioctl$TCSETSF(r1, 0x5404, &(0x7f0000000000)) 14:17:57 executing program 2: r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="b80000000000000029000000390000008103020100ff3a06fe80000000000000b87f25f8fba8cac171df2a488c992ef8b0264f3701c721001000000000000096630f5e4fccdc511f0000002572a00000000000009926e81e5458c4239a93f53fcd7d000004009f61a8c59c68a22fd8b1ae111552f05ddb342e4c775364519853793d149465c80010000000000000c2f5da37c4b77f00000000000000bfb87d7eb09576071f648001b85461e6ea94f5000000000000000000"], 0xb8}, 0x0) 14:17:57 executing program 5: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='fdinfo/4\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000241, 0x0) [ 338.096933][ T23] binder: undelivered death notification, 0000000000000000 14:17:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 338.126625][T17521] binder: 17511:17521 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 338.164209][T17521] binder: 17511:17521 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:17:57 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 338.261239][ T2966] binder: undelivered death notification, 0000000000000000 14:17:58 executing program 5: perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc00000, 0x400000000000000c) 14:17:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 338.379855][ T2966] binder: undelivered death notification, 0000000000000000 14:17:58 executing program 5: r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="b800000000000000290000000b0000008102020100ff3a06fe80000000000000b87f25f8fba8cac171df2a488c992ef8b0264f3701c721001000000000000096630f5e4fccdc511f0000002572a00000000000009926e81e5458c4239a93f53fcd7d000004009f61a8c59c68a22fd8b1ae111552f05ddb342e4c775364519853793d149465c80010000000000000c2f5da37c4b77f00000000000000bfb87d7eb09576071f648001b85461e6ea94f5000000000000000000"], 0xb8}, 0x0) [ 338.489098][T17639] binder: 17638:17639 ioctl c0306201 0 returned -14 14:17:58 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 338.529543][ T2966] binder: undelivered death notification, 0000000000000000 14:17:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:17:58 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 338.870339][ T2557] device bridge_slave_1 left promiscuous mode [ 338.884375][ T2557] bridge0: port 2(bridge_slave_1) entered disabled state [ 338.893579][T17650] binder: 17649:17650 ioctl c0306201 0 returned -14 [ 338.905319][T17652] binder: 17651:17652 Acquire 1 refcount change on invalid ref 0 ret -22 [ 338.905474][ T9066] binder: undelivered death notification, 0000000000000000 [ 338.914673][T17652] binder: 17651:17652 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 338.952061][ T2557] device bridge_slave_0 left promiscuous mode [ 338.958376][ T2557] bridge0: port 1(bridge_slave_0) entered disabled state 14:17:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:17:58 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 338.979624][T17655] binder: 17651:17655 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 338.987835][T17655] binder: 17651:17655 ioctl c0306201 0 returned -14 [ 338.994989][T17655] binder: 17651:17655 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 339.733618][ T2557] device hsr_slave_1 left promiscuous mode [ 339.784160][ T2557] device hsr_slave_0 left promiscuous mode [ 339.823347][ T2557] team0 (unregistering): Port device team_slave_1 removed [ 339.833878][ T2557] team0 (unregistering): Port device team_slave_0 removed [ 339.843461][ T2557] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 339.875286][ T2557] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 339.951475][ T2557] bond0 (unregistering): Released all slaves [ 340.078504][T17664] IPVS: ftp: loaded support on port[0] = 21 [ 340.137541][T17664] chnl_net:caif_netlink_parms(): no params data found [ 340.165131][T17664] bridge0: port 1(bridge_slave_0) entered blocking state [ 340.174400][T17664] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.182039][T17664] device bridge_slave_0 entered promiscuous mode [ 340.189190][T17664] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.196323][T17664] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.204268][T17664] device bridge_slave_1 entered promiscuous mode [ 340.219334][T17664] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 340.228898][T17664] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 340.292255][T17664] team0: Port device team_slave_0 added [ 340.298879][T17664] team0: Port device team_slave_1 added [ 340.353509][T17664] device hsr_slave_0 entered promiscuous mode [ 340.391260][T17664] device hsr_slave_1 entered promiscuous mode [ 340.452845][T17664] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.459978][T17664] bridge0: port 2(bridge_slave_1) entered forwarding state [ 340.467361][T17664] bridge0: port 1(bridge_slave_0) entered blocking state [ 340.474459][T17664] bridge0: port 1(bridge_slave_0) entered forwarding state [ 340.513149][T17664] 8021q: adding VLAN 0 to HW filter on device bond0 [ 340.529157][ T2966] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 340.538160][ T2966] bridge0: port 1(bridge_slave_0) entered disabled state [ 340.545971][ T2966] bridge0: port 2(bridge_slave_1) entered disabled state [ 340.556799][T17664] 8021q: adding VLAN 0 to HW filter on device team0 [ 340.566969][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 340.575608][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 340.582721][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 340.601592][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 340.609900][ T9066] bridge0: port 2(bridge_slave_1) entered blocking state [ 340.617033][ T9066] bridge0: port 2(bridge_slave_1) entered forwarding state [ 340.624986][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 340.633588][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 340.641851][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 340.650388][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 340.659891][T17664] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 340.681227][T17664] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 340.689473][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 340.709651][T17664] 8021q: adding VLAN 0 to HW filter on device batadv0 14:18:00 executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000001ff0), 0x10) sendmsg$can_raw(r0, &(0x7f0000001fc8)={0x0, 0x0, &(0x7f0000000ff0)={&(0x7f000000a000)=@canfd={{0x5}, 0x0, 0x0, 0x0, 0x0, "0327e1b22b5fcef7739c699f5ff986ca08990039576a7d5cb2bdac3fa80acf584ecb5fee496e6866856b76b5f702000000000000004e2f9663a918fa1efd9b0b"}, 0x48}}, 0x0) 14:18:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:00 executing program 0: mknod$loop(&(0x7f0000000100)='./file0\x00', 0x400002200006005, 0x1) r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000040)) 14:18:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:18:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:00 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 340.812095][T17678] binder: 17670:17678 Acquire 1 refcount change on invalid ref 0 ret -22 [ 340.818060][T17680] binder: BINDER_SET_CONTEXT_MGR already set [ 340.838133][T17678] binder: 17670:17678 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:00 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 14:18:00 executing program 0: openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='/group.stat\x00', 0x2761, 0x0) perf_event_open(&(0x7f0000000200)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x100000000}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) [ 340.858521][T17679] binder: 17671:17679 ioctl c0306201 0 returned -14 [ 340.866753][T17680] binder: 17673:17680 ioctl 40046207 0 returned -16 [ 340.882889][ T9063] binder: undelivered death notification, 0000000000000000 14:18:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:00 executing program 2: clone(0x41ff, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x32, &(0x7f0000000140)) setpgid(r0, 0x0) [ 340.908440][T17689] binder: 17670:17689 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 340.923991][T17689] binder: 17670:17689 ioctl c0306201 0 returned -14 14:18:00 executing program 0: r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="b80000000000000029000000030000008102020100ff3a06fe80000000000000b87f25f8fba8cac171df2a488c992ef8b0264f3701c721001000000000000096630f5e4fccdc511f0000002572a00000000000009926e81e5458c4239a93f53fcd7d000004009f61a8c59c68a22fd8b1ae111552f05ddb342e4c775364519853793d149465c80010000000000000c2f5da37c4b77f00000000000000bfb87d7eb09576071f648001b85461e6ea94f5000000000000000000"], 0xb8}, 0x0) 14:18:00 executing program 5: sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 14:18:00 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 14:18:00 executing program 2: ioctl$TIOCGETD(0xffffffffffffffff, 0x5424, &(0x7f0000000340)) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000009a00)=ANY=[@ANYBLOB], 0x1) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0x7, 0x0, 0x0) ioctl$DRM_IOCTL_SWITCH_CTX(0xffffffffffffffff, 0x40086424, &(0x7f0000000140)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000380)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='cgroup\x00', 0x0, 0x0) ioctl$LOOP_SET_DIRECT_IO(0xffffffffffffffff, 0x4c08, 0x0) ioctl$sock_inet_udp_SIOCINQ(0xffffffffffffffff, 0x541b, &(0x7f0000000280)) chdir(&(0x7f0000000200)='./file0\x00') syz_open_dev$usbmon(&(0x7f0000009b40)='/dev/usbmon#\x00', 0xa1, 0x600) rename(0x0, &(0x7f0000000180)='./file0\x00') r0 = openat$cgroup_procs(0xffffffffffffff9c, &(0x7f0000000000)='cgroup.procs\x00', 0x2, 0x0) membarrier(0x6, 0x0) socket$inet6(0xa, 0xa, 0x8001) read$eventfd(r0, 0x0, 0x0) [ 340.969409][T17689] binder: 17670:17689 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 340.996896][ T9063] binder: undelivered death notification, 0000000000000000 14:18:00 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:00 executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid\x00', 0x400000002, 0x0) write$UHID_DESTROY(r0, &(0x7f0000000200), 0x1a7) [ 341.166208][ T5] binder: undelivered death notification, 0000000000000000 14:18:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:01 executing program 5: sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 14:18:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:18:01 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$VIDIOC_ENUMAUDOUT(0xffffffffffffffff, 0xc0345642, &(0x7f00000001c0)={0x0, "92b4a466fecc8dd65f0cfc6abbe69eec91422bbd8ab013548146cfbaf9ad6252"}) ioctl$KVM_SET_VAPIC_ADDR(r2, 0x4138ae84, &(0x7f00000000c0)) 14:18:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:01 executing program 2: r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="b80000000000000029000000430000008102020100ff3a06fe80000000000000b87f25f8fba8cac171df2a488c992ef8b0264f3701c721001000000000000096630f5e4fccdc511f0000002572a00000000000009926e81e5458c4239a93f53fcd7d000004009f61a8c59c68a22fd8b1ae111552f05ddb342e4c775364519853793d149465c80010000000000000c2f5da37c4b77f00000000000000bfb87d7eb09576071f648001b85461e6ea94f5000000000000000000"], 0xb8}, 0x0) 14:18:01 executing program 5: sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 14:18:01 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 341.650128][T17829] binder: 17823:17829 ioctl c0306201 0 returned -14 [ 341.670686][ T5] binder: undelivered death notification, 0000000000000000 [ 341.675993][T17834] binder: 17832:17834 Acquire 1 refcount change on invalid ref 0 ret -22 14:18:01 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) 14:18:01 executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)={0x24, r1, 0x101, 0x0, 0x0, {{}, 0x0, 0xffff8001, 0x0, {0x8}}}, 0x24}}, 0x0) 14:18:01 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:18:01 executing program 5: r0 = socket$inet(0x10, 0x0, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 341.762728][T17834] binder: 17832:17834 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 341.802754][ T9066] binder: undelivered death notification, 0000000000000000 [ 341.828520][T17840] binder: 17832:17840 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 341.869727][T17840] binder: 17832:17840 ioctl c0306201 0 returned -14 [ 341.881840][T17852] binder: 17849:17852 ioctl c0306201 0 returned -14 [ 341.889999][T17840] binder: 17832:17840 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:18:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:02 executing program 0: socket$pppoe(0x18, 0x1, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x41, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_open_dev$vcsn(&(0x7f0000000180)='/dev/vcs#\x00', 0x8, 0x442) write$FUSE_WRITE(r0, &(0x7f0000000000)={0x18, 0x0, 0x1, {0x9}}, 0x18) clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = getpid() rt_tgsigqueueinfo(r1, r1, 0x16, &(0x7f00000000c0)) ptrace(0x10, r1) ptrace$setregset(0x4204, r1, 0x2, &(0x7f00000001c0)={0x0, 0xffffffffffffffc5}) 14:18:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 14:18:02 executing program 5: r0 = socket$inet(0x10, 0x0, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 14:18:02 executing program 5: r0 = socket$inet(0x10, 0x0, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 14:18:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) [ 342.513673][T17866] binder: 17863:17866 ioctl c0306201 0 returned -14 [ 342.523474][T17870] binder: 17861:17870 Acquire 1 refcount change on invalid ref 0 ret -22 [ 342.535228][T17870] binder: 17861:17870 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:02 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) 14:18:02 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:02 executing program 5: socket$inet(0x10, 0x2000000003, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 14:18:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) [ 342.603754][T17881] binder: 17861:17881 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 342.623433][T17881] binder: 17861:17881 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:18:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:02 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)}) 14:18:02 executing program 5: socket$inet(0x10, 0x2000000003, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) 14:18:02 executing program 0: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/unix\x00') preadv(r0, &(0x7f0000000100), 0x280, 0x0) 14:18:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) 14:18:03 executing program 5: socket$inet(0x10, 0x2000000003, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000005e00ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) [ 343.357539][T17910] binder: 17908:17910 Acquire 1 refcount change on invalid ref 0 ret -22 14:18:03 executing program 0: socketpair$unix(0x1, 0x20000000001, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = perf_event_open(&(0x7f00000002c0)={0x1, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = gettid() clone(0x7ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) clone(0x2102001fec, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) exit_group(0x0) r3 = perf_event_open(&(0x7f0000000040)={0x200000002, 0x70, 0x6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, r1, 0x0) dup2(r3, r1) ptrace(0x10, r2) wait4(0x0, 0x0, 0x0, 0x0) 14:18:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) [ 343.398700][T17910] binder: 17908:17910 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:03 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) 14:18:03 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, 0x0, 0x0) 14:18:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000680)}) 14:18:03 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 343.471281][T17925] binder: 17908:17925 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 343.482659][ T5] binder_release_work: 2 callbacks suppressed [ 343.482667][ T5] binder: undelivered death notification, 0000000000000000 [ 343.509399][T17925] binder: 17908:17925 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 343.593542][T17939] cgroup: fork rejected by pids controller in /syz0 14:18:03 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, 0x0, 0x0) 14:18:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) 14:18:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:03 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040)) 14:18:03 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, 0x0, 0x0) 14:18:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) [ 344.218476][T17956] binder: 17954:17956 Acquire 1 refcount change on invalid ref 0 ret -22 [ 344.252179][T17956] binder: 17954:17956 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 344.310553][T17965] binder: 17954:17965 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 344.319028][T17965] binder: 17954:17965 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 344.378612][ T5] binder: undelivered death notification, 0000000000000000 14:18:06 executing program 0: perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f00001a2000/0xc00000)=nil, 0xc04000, 0x400000000000000c) 14:18:06 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) 14:18:06 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) 14:18:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:06 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:06 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:06 executing program 4: 14:18:06 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) [ 346.474779][T17977] binder: 17971:17977 Acquire 1 refcount change on invalid ref 0 ret -22 [ 346.498347][T17977] binder: 17971:17977 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:06 executing program 4: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) lseek(r0, 0x0, 0x0) 14:18:06 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) [ 346.558859][T17991] binder: 17971:17991 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 346.571344][T17991] binder: 17971:17991 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:18:06 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:06 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)}, 0x0) 14:18:06 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:06 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:06 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 14:18:06 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:06 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:06 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)}, 0x0) 14:18:06 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 347.263602][ T23] binder: undelivered death notification, 0000000000000000 14:18:07 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)}, 0x0) 14:18:07 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) [ 347.354355][T18123] binder: 18121:18123 Acquire 1 refcount change on invalid ref 0 ret -22 [ 347.386897][T18123] binder: 18121:18123 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:07 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{0x0}], 0x1}, 0x0) 14:18:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 347.417316][T18131] binder: 18113:18131 ioctl c0306201 0 returned -14 14:18:07 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:07 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{0x0}], 0x1}, 0x0) [ 347.463888][T18137] binder: 18121:18137 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 347.486409][T18137] binder: 18121:18137 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:18:07 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{0x0}], 0x1}, 0x0) 14:18:07 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) 14:18:07 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:07 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 14:18:07 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)}], 0x1}, 0x0) [ 348.151212][ T23] binder: undelivered death notification, 0000000000000000 14:18:07 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)}], 0x1}, 0x0) [ 348.221764][T18257] binder: 18256:18257 Acquire 1 refcount change on invalid ref 0 ret -22 14:18:07 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:07 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)}], 0x1}, 0x0) 14:18:07 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 348.270139][T18257] binder: 18256:18257 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 348.291330][T18266] binder: 18258:18266 ioctl c0306201 0 returned -14 14:18:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:08 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e2800", 0x26}], 0x1}, 0x0) [ 348.357354][T18276] binder: 18256:18276 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 348.389923][T18276] binder: 18256:18276 BC_DEAD_BINDER_DONE 0000000000000000 not found 14:18:08 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)}], 0x1}, 0x0) 14:18:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:08 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:08 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) 14:18:08 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 349.045458][ T23] binder: undelivered death notification, 0000000000000000 14:18:08 executing program 0: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:08 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)}], 0x1}, 0x0) [ 349.096980][T18293] binder: 18291:18293 Acquire 1 refcount change on invalid ref 0 ret -22 [ 349.133674][T18293] binder: 18291:18293 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 349.152564][T18303] binder: 18294:18303 ioctl c0306201 0 returned -14 14:18:08 executing program 0: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:08 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)}], 0x1}, 0x0) [ 349.202670][T18311] binder: 18291:18311 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:18:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:08 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a", 0x13}], 0x1}, 0x0) 14:18:08 executing program 0: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:08 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) [ 349.897581][ T23] binder: undelivered death notification, 0000000000000000 14:18:09 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x4000, 0x0) 14:18:09 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a", 0x13}], 0x1}, 0x0) 14:18:09 executing program 0: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:09 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0}) [ 349.938119][T18336] binder: 18334:18336 Acquire 1 refcount change on invalid ref 0 ret -22 14:18:09 executing program 0: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:09 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a", 0x13}], 0x1}, 0x0) 14:18:09 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 349.989926][T18336] binder: 18334:18336 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:09 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c", 0x1d}], 0x1}, 0x0) 14:18:09 executing program 0: r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) [ 350.045728][T18355] binder: 18334:18355 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:18:09 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c", 0x1d}], 0x1}, 0x0) 14:18:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:10 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c", 0x1d}], 0x1}, 0x0) 14:18:10 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:10 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0}) [ 350.760237][T18373] binder: 18372:18373 Acquire 1 refcount change on invalid ref 0 ret -22 [ 350.781009][ T23] binder: undelivered death notification, 0000000000000000 14:18:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:10 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400", 0x22}], 0x1}, 0x0) 14:18:10 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:10 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400", 0x22}], 0x1}, 0x0) 14:18:10 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:10 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400", 0x22}], 0x1}, 0x0) 14:18:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 14:18:11 executing program 4: bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:11 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:11 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e", 0x24}], 0x1}, 0x0) [ 351.603267][T18417] binder: 18415:18417 Acquire 1 refcount change on invalid ref 0 ret -22 [ 351.628660][T18417] binder_thread_write: 2 callbacks suppressed [ 351.628672][T18417] binder: 18415:18417 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:11 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:11 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0}) 14:18:11 executing program 4: bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:11 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400", 0x22}], 0x1}, 0x0) 14:18:11 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 351.651028][ T23] binder: undelivered death notification, 0000000000000000 14:18:11 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400", 0x22}], 0x1}, 0x0) 14:18:11 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x10, r0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:11 executing program 4: bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 351.715671][T18431] binder: 18415:18431 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 351.780598][T18442] binder: 18415:18442 ioctl c0306201 0 returned -14 14:18:12 executing program 4: bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:12 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400", 0x22}], 0x1}, 0x0) 14:18:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 14:18:12 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:12 executing program 4: bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 352.461839][T18455] binder: 18454:18455 Acquire 1 refcount change on invalid ref 0 ret -22 [ 352.480219][T18455] binder: 18454:18455 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:12 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:12 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff", 0x23}], 0x1}, 0x0) 14:18:12 executing program 4: bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:12 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:12 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffdfd, 0x0}) [ 352.517708][ T23] binder: undelivered death notification, 0000000000000000 [ 352.552652][T18465] binder: 18454:18465 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:18:12 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff", 0x23}], 0x1}, 0x0) 14:18:12 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, 0xffffffffffffffff, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:12 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:12 executing program 5: r0 = socket$inet(0x10, 0x2000000003, 0x0) sendmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f00000000c0)="24000000110007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff", 0x23}], 0x1}, 0x0) [ 352.639280][T18480] binder: 18454:18480 ioctl c0306201 0 returned -14 14:18:12 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:12 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 14:18:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:18:12 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x0, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 353.277506][T18492] binder: 18490:18492 Acquire 1 refcount change on invalid ref 0 ret -22 [ 353.307369][T18492] binder: 18490:18492 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:12 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) [ 353.321143][T18499] binder: 18498:18499 Acquire 1 refcount change on invalid ref 0 ret -22 [ 353.339515][T18499] binder: 18498:18499 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:13 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:13 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffdfd, 0x0}) 14:18:13 executing program 0: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) openat$snapshot(0xffffffffffffff9c, 0x0, 0x0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0) 14:18:13 executing program 5: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(aes)\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="0a0775b0d5e383e5b3c06639d476a0bf", 0x10) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") sendmsg$unix(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000280)='!', 0x1}], 0x1, 0x0, 0x0, 0x10}, 0x4) [ 353.374354][ T5] binder: undelivered death notification, 0000000000000000 [ 353.402902][T18579] binder: 18498:18579 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:18:13 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 353.457583][T18614] binder: 18498:18614 ioctl c0306201 0 returned -14 14:18:13 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x0, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:13 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r1, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="b80000000000000029000000370000008102020100ff3a06fe80000000000000b87f25f8fba8cac171df2a488c992ef8b0264f3701c721001000000000000096630f5e4fccdc511f0000002572a00000000000009926e81e5458c4239a93f53fcd7d000004009f61a8c59c68a22fd8b1ae111552f05ddb342e4c775364519853793d149465c80010000000000000c2f5da37c4b77f00000000000000bfb87d7eb09576071f648001b85461e6ea94f5000000000000000000"], 0xb8}, 0x0) 14:18:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0}) 14:18:13 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:13 executing program 5: syz_emit_ethernet(0x66, &(0x7f00000f8000)={@random="cd390b081bf2", @local, [], {@ipv6={0x86dd, {0x0, 0x6, "a2fbe8", 0x3, 0x2b, 0x0, @ipv4={[], [], @multicast2}, @mcast2, {[], @icmpv6=@pkt_toobig={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "9433df", 0x0, 0x0, 0x0, @mcast2, @loopback}}}}}}}, 0x0) 14:18:13 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 354.169077][T18747] binder: 18744:18747 Acquire 1 refcount change on invalid ref 0 ret -22 [ 354.189673][T18747] binder: 18744:18747 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:13 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) sendmsg$netlink(r0, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:13 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:13 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:13 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:13 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffdfd, 0x0}) [ 354.246742][T18751] binder: 18744:18751 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 354.260798][ T23] binder: undelivered death notification, 0000000000000000 14:18:13 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x0, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:14 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:14 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0}) 14:18:14 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:14 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:14 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) [ 355.005337][T18887] binder: 18880:18887 Acquire 1 refcount change on invalid ref 0 ret -22 [ 355.043628][T18887] binder: 18880:18887 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:14 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) ioctl$ION_IOC_ALLOC(0xffffffffffffffff, 0xc0184900, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:14 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:14 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:14 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:14 executing program 3: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) [ 355.115753][ T23] binder: undelivered death notification, 0000000000000000 14:18:14 executing program 3: ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(0xffffffffffffffff, 0x40106614, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00\x9f\xc5r\x0e8J\xdb@\xf8\xbfj1\xe8\xce\x88\x02^\xb2\xf4hTR2\xf1\x89\x1e~m\x19\xc9lG^l\x13c7\xf7$\x7f?9>b\xe8/<\xdbj>:\xd9\x10\x04r\x18\x15\xdc)\x10I<\xd0:\x0f\x18\xec\x00\xc2w\x8a0C\xf8\xa9\xeaa\x16\x8c\xe6C\xf5\xcb\xdc\x1c\xea`\x9c\xe1\x8e\xdd\x8e\xaa\x1f\xf4\xaf\xa3Z\xbf\x17M\x1a\xff\xb1\x8dP]<\x9e\xe1B[y\xe6\xae\xe9I\xdb)\x9b\xcb\xa3Wlt\xe9\xa9\xfc\xf8\xde\xf0]\n\xa5S\x16\x1dh\x88\xc5\xea\xcf\xca5\xd2.\x93\xfd\t\x90#hq\r\x9b;\x83\xdd\x0fs\x80\x12\xc6\x8e~\xd4\xef\xc7:\xee4cu\xb2\x03\xd5\xd5)\xc9\xf1/\xea\x95_\'\xfb\xb9\xa94\xca\x9e\xf3\xfb\xc9\xd6~\xd5\xb7}B\xe5.\x86\xbf\xbb#\xb9\xf7N\xb3\xfe?x\xccX^\x16bz\"\x8a\xa45\x10t\xbb\xb7\xca\xa7\xcc\xde_\xdc\xab\xf2\xb8\xc7\xb3\xd3&$\xbb4\x81\t\xbb\xe3\xbfB(ln\xbc\xe9E<6$\x8f)\xb0\x1a\xc9\xe3\x18\xa6\xd9zk\x94Z\xed\x96\xad\xe2\\\xcb,!\x13\rv)r\xf1\x00E\xcccgr\xbf\xd4uB\x9f\xa5\x8c8\xe4D\x0f\xd3Vtd\x89\xc8V\x14\x17=\xd9\xcf*\xc8\xc7\xb7\xcc\x182/Jm\x8c5\x93\x14\xfd\x02\'\xe3\xc9\x12~\xc3\x10\xb7\xc7\xae\xcfA\x823|\xfd\xba2\xbd\xc6-\xe0E_x\xc7i\x8dV\xd9\\_l\xfb\xd8xX.N\x9bd\x91\xd5\xc1\xa1\xbahL\x95wF\x13{\xfd\xc8T\x1f\xe1)h\a\xe8Wn]\xe4') sendfile(r0, r0, 0x0, 0x400000000000004) 14:18:14 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:14 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xfffffdfd, 0x0}) 14:18:15 executing program 5: socket$kcm(0x2, 0x2, 0x73) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:15 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:15 executing program 3: syz_open_procfs(0x0, &(0x7f0000000040)='oom_score_adj\x00\x9f\xc5r\x0e8J\xdb@\xf8\xbfj1\xe8\xce\x88\x02^\xb2\xf4hTR2\xf1\x89\x1e~m\x19\xc9lG^l\x13c7\xf7$\x7f?9>b\xe8/<\xdbj>:\xd9\x10\x04r\x18\x15\xdc)\x10I<\xd0:\x0f\x18\xec\x00\xc2w\x8a0C\xf8\xa9\xeaa\x16\x8c\xe6C\xf5\xcb\xdc\x1c\xea`\x9c\xe1\x8e\xdd\x8e\xaa\x1f\xf4\xaf\xa3Z\xbf\x17M\x1a\xff\xb1\x8dP]<\x9e\xe1B[y\xe6\xae\xe9I\xdb)\x9b\xcb\xa3Wlt\xe9\xa9\xfc\xf8\xde\xf0]\n\xa5S\x16\x1dh\x88\xc5\xea\xcf\xca5\xd2.\x93\xfd\t\x90#hq\r\x9b;\x83\xdd\x0fs\x80\x12\xc6\x8e~\xd4\xef\xc7:\xee4cu\xb2\x03\xd5\xd5)\xc9\xf1/\xea\x95_\'\xfb\xb9\xa94\xca\x9e\xf3\xfb\xc9\xd6~\xd5\xb7}B\xe5.\x86\xbf\xbb#\xb9\xf7N\xb3\xfe?x\xccX^\x16bz\"\x8a\xa45\x10t\xbb\xb7\xca\xa7\xcc\xde_\xdc\xab\xf2\xb8\xc7\xb3\xd3&$\xbb4\x81\t\xbb\xe3\xbfB(ln\xbc\xe9E<6$\x8f)\xb0\x1a\xc9\xe3\x18\xa6\xd9zk\x94Z\xed\x96\xad\xe2\\\xcb,!\x13\rv)r\xf1\x00E\xcccgr\xbf\xd4uB\x9f\xa5\x8c8\xe4D\x0f\xd3Vtd\x89\xc8V\x14\x17=\xd9\xcf*\xc8\xc7\xb7\xcc\x182/Jm\x8c5\x93\x14\xfd\x02\'\xe3\xc9\x12~\xc3\x10\xb7\xc7\xae\xcfA\x823|\xfd\xba2\xbd\xc6-\xe0E_x\xc7i\x8dV\xd9\\_l\xfb\xd8xX.N\x9bd\x91\xd5\xc1\xa1\xbahL\x95wF\x13{\xfd\xc8T\x1f\xe1)h\a\xe8Wn]\xe4') bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) [ 355.850298][T18928] binder: 18927:18928 Acquire 1 refcount change on invalid ref 0 ret -22 14:18:15 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:15 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:15 executing program 5: socket$kcm(0x2, 0x2, 0x73) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:15 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = epoll_create(0x0) ioctl$PIO_UNISCRNMAP(r0, 0x4b6a, 0x0) 14:18:15 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:15 executing program 5: socket$kcm(0x2, 0x2, 0x73) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:15 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:15 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000000000)) 14:18:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffdfd, 0x0}) 14:18:16 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:16 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000000000)) 14:18:16 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x0, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 356.695569][T18966] binder: 18960:18966 Acquire 1 refcount change on invalid ref 0 ret -22 [ 356.718610][T18966] binder_thread_write: 3 callbacks suppressed [ 356.718621][T18966] binder: 18960:18966 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 356.779627][T18969] binder: 18960:18969 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:18:16 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:16 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:16 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = accept4$inet(0xffffffffffffff9c, 0x0, 0x0, 0x0) pwritev(r0, 0x0, 0x0, 0x0) 14:18:16 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000000000)) 14:18:16 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x0, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:16 executing program 5: r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:16 executing program 0: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r0, 0x8070ae9f, &(0x7f0000000000)) 14:18:16 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x0, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffdfd, 0x0}) 14:18:17 executing program 5: socket$kcm(0x2, 0x0, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:17 executing program 0: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r0, 0x8070ae9f, &(0x7f0000000000)) 14:18:17 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x0, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 357.547013][T19005] binder: 19001:19005 Acquire 1 refcount change on invalid ref 0 ret -22 [ 357.559893][T19005] binder: 19001:19005 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 357.615577][T19009] binder: 19001:19009 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:18:17 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:17 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = syz_open_procfs(0x0, 0x0) ioctl$int_out(r0, 0x0, 0x0) 14:18:17 executing program 0: r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r0, 0x8070ae9f, &(0x7f0000000000)) 14:18:17 executing program 5: socket$kcm(0x2, 0x0, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:17 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x0, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:17 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x0, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:17 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:17 executing program 5: socket$kcm(0x2, 0x0, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100), 0x0, 0xfffffdfd, 0x0}) 14:18:17 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:17 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:17 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, 0x0, 0x0) 14:18:17 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:17 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x0, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:18 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:18 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:18 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x0, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:18 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) [ 358.446061][T19281] binder: 19246:19281 Acquire 1 refcount change on invalid ref 0 ret -22 [ 358.464447][T19281] binder: 19246:19281 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 14:18:18 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r0, 0x8070ae9f, &(0x7f0000000000)) 14:18:18 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = syz_open_procfs(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, 0x0, 0x0) [ 358.537706][T19364] binder: 19246:19364 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:18:18 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = socket(0x0, 0x0, 0x0) ioctl$sock_inet_SIOCDARP(r0, 0x8953, 0x0) 14:18:18 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r0, 0x8070ae9f, &(0x7f0000000000)) 14:18:18 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:18 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:18 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x0, 0x73) bind$inet(r0, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:18 executing program 1: pipe2(0x0, 0x0) geteuid() fstat(0xffffffffffffffff, 0x0) fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = openat$zero(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VT_GETSTATE(r0, 0x5603, 0x0) 14:18:18 executing program 0: openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r0, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r0, 0x8070ae9f, &(0x7f0000000000)) 14:18:18 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:19 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:19 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:19 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:19 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = creat(0x0, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, 0x0, 0x0) 14:18:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) dup3(0xffffffffffffffff, r0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:19 executing program 5: socket$kcm(0x2, 0x2, 0x73) socket$kcm(0x2, 0x2, 0x73) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @multicast1=0xac1414bb}, 0x10) 14:18:19 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) dup3(0xffffffffffffffff, r0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:19 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = socket(0x0, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0x0, 0x0) 14:18:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:19 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, 0x0, 0x0) 14:18:19 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x0, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) dup3(0xffffffffffffffff, r0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(0xffffffffffffffff, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:19 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, 0x0, 0x0) 14:18:19 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) 14:18:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:19 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:19 executing program 5: socket$kcm(0x2, 0x2, 0x73) r0 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r0, 0x0, 0x0) 14:18:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:19 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = dup(0xffffffffffffff9c) recvfrom$unix(r0, 0x0, 0x0, 0x0, 0x0, 0x0) 14:18:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:19 executing program 5: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = syz_open_procfs(0x0, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, 0x0) 14:18:19 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:19 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = syz_open_procfs(0x0, 0x0) ioctl$sock_SIOCGIFCONF(r0, 0x8912, 0x0) 14:18:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, 0x0) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, &(0x7f0000000000)) 14:18:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:19 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000000000)) 14:18:20 executing program 5: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080)={r1}, 0x8) 14:18:20 executing program 1: timer_gettime(0x0, 0x0) request_key(0x0, 0x0, 0x0, 0xfffffffffffffff8) keyctl$KEYCTL_PKEY_SIGN(0x1b, 0x0, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) ioctl$FS_IOC_MEASURE_VERITY(0xffffffffffffffff, 0xc0046686, 0x0) mmap$perf(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) timer_create(0x0, 0x0, 0x0) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000540), 0x4) 14:18:20 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:20 executing program 3: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = syz_open_procfs(0x0, 0x0) fcntl$setstatus(r0, 0x4, 0x0) 14:18:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000000000)) 14:18:20 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:20 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = syz_open_procfs(0x0, 0x0) ioctl$void(r0, 0x0) 14:18:20 executing program 5: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x10000050000}]}) r0 = accept$inet6(0xffffffffffffff9c, 0x0, 0x0) write$binfmt_aout(r0, 0x0, 0x0) 14:18:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(0xffffffffffffffff, 0x8070ae9f, &(0x7f0000000000)) 14:18:20 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:20 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:20 executing program 3: fstat(0xffffffffffffffff, 0x0) fchownat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = accept(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCDELDLCI(r0, 0x8981, 0x0) 14:18:20 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, 0x0) 14:18:20 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:20 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) socketpair(0x0, 0x0, 0x0, 0x0) ioctl$TCSETAF(0xffffffffffffffff, 0x5408, &(0x7f00000001c0)={0x5, 0x7, 0x1, 0x5, 0x0, 0x8, 0x1b, 0x2, 0x651, 0x20}) 14:18:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, 0x0) 14:18:20 executing program 5: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x80000, 0x0) fgetxattr(r0, &(0x7f0000000040)=@random={'osx.', 'usereth1cpuset\x00'}, &(0x7f0000000080)=""/214, 0xd6) r1 = openat(0xffffffffffffffff, &(0x7f0000000180)='./file0\x00', 0x1, 0x0) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000200)=@add_del={0x2, &(0x7f00000001c0)='erspan0\x00'}) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f0000000240)=@generic={0x0, 0x2, 0x8}) r2 = getegid() getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0, 0x0}, &(0x7f00000002c0)=0xc) setregid(r2, r4) write$P9_RGETLOCK(r1, &(0x7f0000000300)={0x26, 0x37, 0x1, {0x1, 0xefc8, 0x401, r3, 0x8, 'erspan0\x00'}}, 0x26) bind$unix(r1, &(0x7f0000000340)=@file={0x1, './file1\x00'}, 0x6e) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f00000003c0)=""/4096, &(0x7f00000013c0)=0x1000) fallocate(r1, 0x0, 0x401, 0x1d38982c) fcntl$addseals(r0, 0x409, 0x2) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000001440)={0x1, &(0x7f0000001400)=[{0x5, 0x0, 0x8001, 0x40}]}, 0x10) stat(&(0x7f0000001480)='./file0\x00', &(0x7f00000014c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r6 = semget(0x1, 0x3, 0xc0) write$P9_RATTACH(r1, &(0x7f0000001540)={0x14, 0x69, 0x2, {0x1, 0x0, 0x6}}, 0x14) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000001580), &(0x7f00000015c0)=0xc) write$P9_RAUTH(r1, &(0x7f0000001600)={0x14, 0x67, 0x2, {0x8, 0x1, 0x4}}, 0x14) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000001640)) r7 = shmget$private(0x0, 0x1000, 0x5, &(0x7f0000ffe000/0x1000)=nil) dup2(r0, r1) semctl$GETALL(r7, 0x0, 0xd, &(0x7f0000001680)=""/190) getsockopt$IP_VS_SO_GET_TIMEOUT(r1, 0x0, 0x486, &(0x7f0000001740), &(0x7f0000001780)=0xc) ioctl$KDGKBSENT(r1, 0x4b48, &(0x7f00000017c0)={0x6, 0x3, 0x72083c16}) write$P9_RXATTRCREATE(r1, &(0x7f0000001800)={0x7, 0x21, 0x2}, 0x7) lchown(&(0x7f0000001840)='./file0\x00', r5, r2) semctl$GETPID(r6, 0x2, 0xb, &(0x7f0000001880)=""/29) openat(r1, &(0x7f00000018c0)='./file0\x00', 0x800, 0x13) 14:18:20 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:20 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:20 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:20 executing program 3: r0 = open(&(0x7f0000000140)='.\x00', 0x143042, 0x0) write$P9_RREAD(0xffffffffffffffff, 0x0, 0x0) write$P9_RLINK(r0, 0x0, 0x0) 14:18:20 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000200)) ioctl$KVM_REINJECT_CONTROL(r1, 0x8070ae9f, 0x0) 14:18:20 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:20 executing program 5: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) setsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000000000)={r1}, 0x8) 14:18:21 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x400) fsync(r0) 14:18:21 executing program 1: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={r1}, 0x0) 14:18:21 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:21 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:21 executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000200)="ab553fec94248c32e27d04000000288a", 0x10) r1 = accept$alg(r0, 0x0, 0x0) sendmsg$alg(r1, &(0x7f0000001380)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, 0x0) write$binfmt_script(r1, &(0x7f0000000240)=ANY=[], 0xeb) recvmmsg(r1, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000140)=""/84, 0x54}], 0x1}}], 0x1, 0x0, 0x0) 14:18:21 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:21 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:21 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x400) fsync(r0) 14:18:21 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:21 executing program 0: syz_emit_ethernet(0x6e, &(0x7f00000f8000)={@random="cd390b081bf2", @local, [], {@ipv6={0x86dd, {0x0, 0x6, "a2fbe8", 0x38, 0x3a, 0x0, @ipv4={[], [], @multicast2}, @mcast2, {[], @icmpv6=@pkt_toobig={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "9433df", 0x0, 0x29, 0x0, @mcast2, @loopback, [], "fca967e17f791010"}}}}}}}, 0x0) 14:18:21 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, 0x0, 0x0) 14:18:21 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:21 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:21 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:21 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="140000001202236579f0426ecc7068f8191e7a08"], 0x14}}, 0x0) 14:18:21 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x400) fsync(r0) 14:18:21 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:21 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:21 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:21 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, 0x0, 0x0) 14:18:21 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x400) fsync(r0) 14:18:21 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:21 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:21 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:21 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:21 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:21 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) fsync(r0) 14:18:21 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:21 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, 0x0, 0x0) 14:18:21 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:21 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:21 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:21 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) fsync(r0) 14:18:21 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:21 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:21 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x0, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:21 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:21 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:21 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:21 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) fsync(r0) 14:18:21 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:21 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:21 executing program 3: unshare(0x400) fsync(0xffffffffffffffff) 14:18:22 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x0, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:22 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) sysinfo(&(0x7f0000000100)=""/90) 14:18:22 executing program 5: ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:22 executing program 3: unshare(0x400) fsync(0xffffffffffffffff) 14:18:22 executing program 1: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) sysinfo(&(0x7f0000000100)=""/90) 14:18:22 executing program 3: unshare(0x400) fsync(0xffffffffffffffff) 14:18:22 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:22 executing program 1: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:22 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) sysinfo(&(0x7f0000000100)=""/90) 14:18:22 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x0, 0x0, 0x77fffb, 0x0, 0x820000, 0x0}, 0x2c) 14:18:22 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:22 executing program 3: r0 = syz_open_dev$ndb(0x0, 0xffffffffffffffff, 0x0) unshare(0x400) fsync(r0) 14:18:22 executing program 1: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:22 executing program 3: r0 = syz_open_dev$ndb(0x0, 0xffffffffffffffff, 0x0) unshare(0x400) fsync(r0) 14:18:22 executing program 1: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 5: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:22 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:22 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:22 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x0, 0x0, 0x820000, 0x0}, 0x2c) 14:18:22 executing program 3: r0 = syz_open_dev$ndb(0x0, 0xffffffffffffffff, 0x0) unshare(0x400) fsync(r0) 14:18:22 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:22 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:22 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:22 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x0, 0x0, 0x820000, 0x0}, 0x2c) 14:18:22 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x0) fsync(r0) 14:18:22 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:22 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:22 executing program 5: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(0xffffffffffffffff, 0xc0505510, &(0x7f00000001c0)={{0x0, 0xfffffdfd, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:22 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0), 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x0) fsync(r0) 14:18:22 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:22 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:22 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, 0x0) 14:18:22 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x0, 0x0, 0x820000, 0x0}, 0x2c) 14:18:22 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{0x0}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:22 executing program 3: r0 = syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x0) fsync(r0) 14:18:23 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:23 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, 0x0) 14:18:23 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{0x0}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:23 executing program 0: socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sysinfo(&(0x7f0000000100)=""/90) 14:18:23 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x0, 0x0}, 0x2c) 14:18:23 executing program 3: syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x400) fsync(0xffffffffffffffff) 14:18:23 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, 0x0) 14:18:23 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{0x0}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:23 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) sysinfo(&(0x7f0000000100)=""/90) 14:18:23 executing program 3: syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x400) fsync(0xffffffffffffffff) 14:18:23 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:23 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, 0x0) preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:23 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:23 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x0, 0x0}, 0x2c) 14:18:23 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) sysinfo(&(0x7f0000000100)=""/90) 14:18:23 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:23 executing program 3: syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0xffffffffffffffff, 0x0) unshare(0x400) fsync(0xffffffffffffffff) 14:18:23 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, 0x0) preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:23 executing program 4: bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x1, 0x8, 0x209e20, 0x8000000001}, 0x3c) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0x0, [0x0, 0x0, 0x2000000000000000]}, 0x2c) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) bpf$MAP_CREATE(0x2, &(0x7f0000000100)={0x3, 0x0, 0x77fffb, 0x0, 0x0, 0x0}, 0x2c) 14:18:23 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) sysinfo(&(0x7f0000000100)=""/90) 14:18:23 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:23 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r0, 0xc0505510, &(0x7f00000001c0)={{0x0, 0x0, 0x0, 0x0, 'syz1\x00'}, 0x0, [], {0x77359400}}) 14:18:23 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc0045540, &(0x7f0000000100)) 14:18:23 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sysinfo(0x0) 14:18:23 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:23 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, 0x0) preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:23 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, &(0x7f0000000100)) 14:18:23 executing program 5: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0xc10c5541, &(0x7f0000000100)) 14:18:23 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sysinfo(0x0) 14:18:23 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000040)='\x00\xabtw/Z%B\xd2\xd6\x1e\xf0\xfc', 0x0) fcntl$setlease(r1, 0x400, 0x1) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_MRT6_ADD_MFC(r2, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e21, 0x0, @ipv4={[], [], @multicast1}, 0xf}, {0xa, 0x4e24, 0xe24, @empty, 0x9}, 0x7, [0x6, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7f, 0x2]}, 0x5c) fcntl$setown(r1, 0x8, 0x0) fcntl$setpipe(r0, 0x407, 0x0) execveat(r1, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) 14:18:23 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, &(0x7f0000000100)) 14:18:23 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:23 executing program 5: r0 = memfd_create(&(0x7f0000000140)='proc}GXLeth0^wlan0#:\x00', 0x4) openat$autofs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x400001000) 14:18:23 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:23 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) sysinfo(0x0) 14:18:23 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, &(0x7f0000000100)) 14:18:23 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x10000, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f00000000c0)) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x140100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2f6465762b6e756c6c6230005529ea9ec677588c9db846ef54ff9d3ef718a2cb83332c82ed926c03dee072f0be98d6f4b683141684d64c47c554a8ea6e0d6c345e6ae9f419d10c1f64c851596cce106cba9cabe81eeb36e6e4fc493d9d1177470e1b7e73a8fc08f5a9b1220c7ff19181fa5b5317cb3a0dee363d63002e5cf9bd929be44236f15b3d1a"], 0x0, &(0x7f0000000140)='btrfs\x00', 0x0, 0x0) r2 = dup(r1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/syz1\x00', 0x1ff) fcntl$setstatus(r1, 0x4, 0x4000) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000280)={0x0, @dev={0xac, 0x14, 0x14, 0x28}, @multicast1}, 0xc) 14:18:23 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:23 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, &(0x7f0000000100)) 14:18:24 executing program 3: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0x80dc5521, &(0x7f0000000100)) 14:18:24 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(0xffffffffffffffff, &(0x7f0000000480), 0x1000000000000038, 0x47) 14:18:24 executing program 5: 14:18:24 executing program 3: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0x80dc5521, &(0x7f0000000100)) 14:18:24 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:24 executing program 4: 14:18:24 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, 0x0, 0x0, 0x47) 14:18:24 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x10000, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f00000000c0)) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x140100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2f6465762b6e756c6c6230005529ea9ec677588c9db846ef54ff9d3ef718a2cb83332c82ed926c03dee072f0be98d6f4b683141684d64c47c554a8ea6e0d6c345e6ae9f419d10c1f64c851596cce106cba9cabe81eeb36e6e4fc493d9d1177470e1b7e73a8fc08f5a9b1220c7ff19181fa5b5317cb3a0dee363d63002e5cf9bd929be44236f15b3d1a"], 0x0, &(0x7f0000000140)='btrfs\x00', 0x0, 0x0) r2 = dup(r1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/syz1\x00', 0x1ff) fcntl$setstatus(r1, 0x4, 0x4000) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000280)={0x0, @dev={0xac, 0x14, 0x14, 0x28}, @multicast1}, 0xc) 14:18:24 executing program 5: ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x140100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000240)=@nullb='/dev/nullb0\x00', &(0x7f0000000400)='./file0\x00', &(0x7f0000000140)='btrfs\x00', 0x0, 0x0) 14:18:24 executing program 3: ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0x80dc5521, &(0x7f0000000100)) 14:18:24 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, 0x0, 0x0, 0x47) 14:18:24 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xda00) write$cgroup_int(r2, &(0x7f0000000200), 0x42400) 14:18:24 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:24 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, &(0x7f0000000100)) 14:18:24 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x10000, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f00000000c0)) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x140100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2f6465762b6e756c6c6230005529ea9ec677588c9db846ef54ff9d3ef718a2cb83332c82ed926c03dee072f0be98d6f4b683141684d64c47c554a8ea6e0d6c345e6ae9f419d10c1f64c851596cce106cba9cabe81eeb36e6e4fc493d9d1177470e1b7e73a8fc08f5a9b1220c7ff19181fa5b5317cb3a0dee363d63002e5cf9bd929be44236f15b3d1a"], 0x0, &(0x7f0000000140)='btrfs\x00', 0x0, 0x0) r2 = dup(r1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/syz1\x00', 0x1ff) fcntl$setstatus(r1, 0x4, 0x4000) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000280)={0x0, @dev={0xac, 0x14, 0x14, 0x28}, @multicast1}, 0xc) 14:18:24 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, 0x0, 0x0, 0x47) 14:18:24 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x10000, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_VAPIC_ADDR(0xffffffffffffffff, 0x4008ae93, &(0x7f00000000c0)) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x140100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) mount(&(0x7f0000000000)=ANY=[@ANYBLOB="2f6465762b6e756c6c6230005529ea9ec677588c9db846ef54ff9d3ef718a2cb83332c82ed926c03dee072f0be98d6f4b683141684d64c47c554a8ea6e0d6c345e6ae9f419d10c1f64c851596cce106cba9cabe81eeb36e6e4fc493d9d1177470e1b7e73a8fc08f5a9b1220c7ff19181fa5b5317cb3a0dee363d63002e5cf9bd929be44236f15b3d1a"], 0x0, &(0x7f0000000140)='btrfs\x00', 0x0, 0x0) r2 = dup(r1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup.cpu/syz1\x00', 0x1ff) fcntl$setstatus(r1, 0x4, 0x4000) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, 0x0) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000280)={0x0, @dev={0xac, 0x14, 0x14, 0x28}, @multicast1}, 0xc) 14:18:24 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:24 executing program 5: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) r1 = creat(&(0x7f0000000700)='./bus\x00', 0x0) r2 = creat(&(0x7f0000000380)='./bus\x00', 0x0) syz_genetlink_get_family_id$nbd(&(0x7f0000000180)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(0xffffffffffffffff, 0x0, 0x0) io_setup(0xf0, &(0x7f0000000040)=0x0) io_submit(r3, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f0000000000), 0x377140be6b5ef4c7}]) fallocate(r1, 0x20, 0x2, 0xab18) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, 0xffffffffffffffff, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x65, &(0x7f00000002c0)=0x1, 0x4) dup2(r2, r1) ioctl$EXT4_IOC_MOVE_EXT(r2, 0xc028660f, &(0x7f0000000080)={0x0, r2, 0x0, 0x3f, 0xffffffffffffffff, 0x1ba}) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f00000003c0)=ANY=[]) 14:18:24 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, &(0x7f0000000100)) 14:18:25 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x0) 14:18:25 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:25 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40086602, 0x400007) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000001c00)='memory.events\x00', 0x7a05, 0x1700) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[@ANYBLOB], 0xda00) write$cgroup_int(r2, &(0x7f0000000200), 0x42400) 14:18:25 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) 14:18:25 executing program 3: r0 = syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, &(0x7f0000000100)) 14:18:25 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x0) 14:18:25 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:25 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000040)=0x400100000001, 0x102f9) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) r2 = dup2(r1, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @local}}, {{0xa, 0x0, 0x0, @mcast1}}}, 0x108) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x3c) fcntl$setstatus(r2, 0x4, 0x42803) 14:18:25 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0x80dc5521, &(0x7f0000000100)) 14:18:25 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = getpid() sched_setattr(r1, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x100000000007}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000004c0)=[{r3, 0x400}], 0x1, 0x0, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r3) syz_open_pts(r0, 0x0) 14:18:25 executing program 1: preadv(0xffffffffffffffff, &(0x7f00000006c0)=[{&(0x7f00000005c0)=""/148, 0x386}], 0xed, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/ip_mr_vif\x00') preadv(r0, &(0x7f0000000480), 0x1000000000000038, 0x0) 14:18:25 executing program 4: r0 = perf_event_open(&(0x7f0000000280)={0x2, 0x70, 0xee6d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000200)={0x7, 0x70, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0xffffffffffffffff, 0x0, r0, 0x0) 14:18:25 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:25 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0x80dc5521, &(0x7f0000000100)) 14:18:25 executing program 1: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4, 0x61133, 0xffffffffffffffff, 0x0) 14:18:25 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:25 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(0xffffffffffffffff, 0x80dc5521, &(0x7f0000000100)) 14:18:25 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:25 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, 0x0) 14:18:25 executing program 5: 14:18:25 executing program 1: mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x4, 0x61133, 0xffffffffffffffff, 0x0) 14:18:26 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = getpid() sched_setattr(r1, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x100000000007}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000004c0)=[{r3, 0x400}], 0x1, 0x0, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r3) syz_open_pts(r0, 0x0) 14:18:26 executing program 4: 14:18:26 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, 0x0) 14:18:26 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @ipv4}}}, 0x108) dup2(r0, r1) 14:18:26 executing program 2: mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:26 executing program 1: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @ipv4}}}, 0x108) dup2(r0, r1) 14:18:26 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = getpid() sched_setattr(r1, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x100000000007}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000004c0)=[{r3, 0x400}], 0x1, 0x0, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r3) syz_open_pts(r0, 0x0) 14:18:26 executing program 3: r0 = syz_open_dev$sndctrl(&(0x7f0000000080)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_NEXT_DEVICE(r0, 0x80dc5521, 0x0) 14:18:26 executing program 1: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2e, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @ipv4}}}, 0x108) dup2(r0, r1) 14:18:26 executing program 2: mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x40046304}], 0x0, 0x0, 0x0}) 14:18:26 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00'}, &(0x7f0000000080)=0x44) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, 0x0, 0x0) ioctl$KVM_S390_UCAS_UNMAP(0xffffffffffffffff, 0x4018ae51, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0x14, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) fsetxattr$trusted_overlay_upper(r2, 0x0, 0x0, 0x0, 0x2) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) lsetxattr$trusted_overlay_origin(0x0, 0x0, &(0x7f00000002c0)='y\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) inotify_init() bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e23}, 0x10) getrlimit(0x0, &(0x7f00000001c0)) sendto$inet(r3, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0x2, 0x1000004e23, @local}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = memfd_create(&(0x7f0000000200)='Pev ', 0x0) ftruncate(r4, 0x200739) sendfile(r3, r4, &(0x7f0000000240)=0xfa0, 0xa00404000000004) getsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000100), &(0x7f0000000180)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) setsockopt$inet_msfilter(r3, 0x0, 0x29, 0x0, 0xfeef) socketpair(0x4, 0x3, 0x7, 0x0) fchdir(0xffffffffffffffff) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffb000/0x4000)=nil) [ 366.968834][T21904] device lo entered promiscuous mode [ 367.037535][T21999] device lo left promiscuous mode [ 367.173871][T21904] device lo entered promiscuous mode [ 367.189913][T22001] device lo left promiscuous mode 14:18:27 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = getpid() sched_setattr(r1, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x100000000007}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000004c0)=[{r3, 0x400}], 0x1, 0x0, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r3) syz_open_pts(r0, 0x0) 14:18:27 executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = getpid() sched_setattr(r1, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x100000000007}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000004c0)=[{r3}], 0x1, 0x0, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r3) syz_open_pts(r0, 0x0) 14:18:27 executing program 2: mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:27 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = getpid() sched_setattr(r1, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x100000000007}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000004c0)=[{r3, 0x400}], 0x1, 0x0, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r3) syz_open_pts(r0, 0x0) 14:18:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00'}, &(0x7f0000000080)=0x44) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, 0x0, 0x0) ioctl$KVM_S390_UCAS_UNMAP(0xffffffffffffffff, 0x4018ae51, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0x14, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) fsetxattr$trusted_overlay_upper(r2, 0x0, 0x0, 0x0, 0x2) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) lsetxattr$trusted_overlay_origin(0x0, 0x0, &(0x7f00000002c0)='y\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) inotify_init() bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e23}, 0x10) getrlimit(0x0, &(0x7f00000001c0)) sendto$inet(r3, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0x2, 0x1000004e23, @local}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = memfd_create(&(0x7f0000000200)='Pev ', 0x0) ftruncate(r4, 0x200739) sendfile(r3, r4, &(0x7f0000000240)=0xfa0, 0xa00404000000004) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) setsockopt$inet_msfilter(r3, 0x0, 0x29, 0x0, 0xfeef) socketpair(0x4, 0x3, 0x7, 0x0) fchdir(0xffffffffffffffff) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffb000/0x4000)=nil) 14:18:27 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00'}, &(0x7f0000000080)=0x44) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, 0x0, 0x0) ioctl$KVM_S390_UCAS_UNMAP(0xffffffffffffffff, 0x4018ae51, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0x14, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) fsetxattr$trusted_overlay_upper(r2, 0x0, 0x0, 0x0, 0x2) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) lsetxattr$trusted_overlay_origin(0x0, 0x0, &(0x7f00000002c0)='y\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) inotify_init() bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e23}, 0x10) getrlimit(0x0, &(0x7f00000001c0)) sendto$inet(r3, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0x2, 0x1000004e23, @local}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = memfd_create(&(0x7f0000000200)='Pev ', 0x0) ftruncate(r4, 0x200739) sendfile(r3, r4, &(0x7f0000000240)=0xfa0, 0xa00404000000004) getsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000100), &(0x7f0000000180)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) setsockopt$inet_msfilter(r3, 0x0, 0x29, 0x0, 0xfeef) socketpair(0x4, 0x3, 0x7, 0x0) fchdir(0xffffffffffffffff) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffb000/0x4000)=nil) [ 367.462003][T22005] device lo entered promiscuous mode [ 367.477633][T22015] device lo entered promiscuous mode [ 367.563487][T22118] device lo left promiscuous mode 14:18:27 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000000)) r1 = getpid() sched_setattr(r1, &(0x7f00000002c0)={0x0, 0x2, 0x0, 0x0, 0x100000000007}, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000004c0)=[{r3, 0x400}], 0x1, 0x0, 0x0, 0x0) fcntl$setpipe(r3, 0x407, 0x0) write(r3, &(0x7f00000001c0), 0xfffffef3) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) close(r3) syz_open_pts(r0, 0x0) 14:18:27 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:27 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00'}, &(0x7f0000000080)=0x44) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, 0x0, 0x0) ioctl$KVM_S390_UCAS_UNMAP(0xffffffffffffffff, 0x4018ae51, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0x14, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) fsetxattr$trusted_overlay_upper(r2, 0x0, 0x0, 0x0, 0x2) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) lsetxattr$trusted_overlay_origin(0x0, 0x0, &(0x7f00000002c0)='y\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) inotify_init() bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e23}, 0x10) getrlimit(0x0, &(0x7f00000001c0)) sendto$inet(r3, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0x2, 0x1000004e23, @local}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = memfd_create(&(0x7f0000000200)='Pev ', 0x0) ftruncate(r4, 0x200739) sendfile(r3, r4, &(0x7f0000000240)=0xfa0, 0xa00404000000004) getsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000100), &(0x7f0000000180)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) setsockopt$inet_msfilter(r3, 0x0, 0x29, 0x0, 0xfeef) socketpair(0x4, 0x3, 0x7, 0x0) fchdir(0xffffffffffffffff) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffb000/0x4000)=nil) [ 368.032072][T22333] device lo entered promiscuous mode 14:18:27 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:27 executing program 5: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00'}, &(0x7f0000000080)=0x44) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, 0x0, 0x0) ioctl$KVM_S390_UCAS_UNMAP(0xffffffffffffffff, 0x4018ae51, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0x14, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) fsetxattr$trusted_overlay_upper(r2, 0x0, 0x0, 0x0, 0x2) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) lsetxattr$trusted_overlay_origin(0x0, 0x0, &(0x7f00000002c0)='y\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) inotify_init() bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e23}, 0x10) getrlimit(0x0, &(0x7f00000001c0)) sendto$inet(r3, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0x2, 0x1000004e23, @local}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = memfd_create(&(0x7f0000000200)='Pev ', 0x0) ftruncate(r4, 0x200739) sendfile(r3, r4, &(0x7f0000000240)=0xfa0, 0xa00404000000004) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) setsockopt$inet_msfilter(r3, 0x0, 0x29, 0x0, 0xfeef) socketpair(0x4, 0x3, 0x7, 0x0) fchdir(0xffffffffffffffff) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffb000/0x4000)=nil) 14:18:27 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000340)={'filter\x00'}, &(0x7f0000000080)=0x44) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) setsockopt$inet_mreqsrc(r1, 0x0, 0x27, 0x0, 0x0) ioctl$KVM_S390_UCAS_UNMAP(0xffffffffffffffff, 0x4018ae51, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0x14, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, 0x0, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) fsetxattr$trusted_overlay_upper(r2, 0x0, 0x0, 0x0, 0x2) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) lsetxattr$trusted_overlay_origin(0x0, 0x0, &(0x7f00000002c0)='y\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_CTL_REMOVE(0xffffffffffffffff, 0x4c81, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) inotify_init() bind$inet(r3, &(0x7f0000000140)={0x2, 0x4e23}, 0x10) getrlimit(0x0, &(0x7f00000001c0)) sendto$inet(r3, 0x0, 0x0, 0x20000003, &(0x7f0000000040)={0x2, 0x1000004e23, @local}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r4 = memfd_create(&(0x7f0000000200)='Pev ', 0x0) ftruncate(r4, 0x200739) sendfile(r3, r4, &(0x7f0000000240)=0xfa0, 0xa00404000000004) getsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000100), &(0x7f0000000180)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00'}) setsockopt$inet_msfilter(r3, 0x0, 0x29, 0x0, 0xfeef) socketpair(0x4, 0x3, 0x7, 0x0) fchdir(0xffffffffffffffff) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffb000/0x4000)=nil) [ 368.213932][T22375] device lo entered promiscuous mode 14:18:27 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$tipc(r0, 0x0, &(0x7f0000000600)) 14:18:28 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0x308) socketpair(0x0, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x841, 0x0) renameat(r0, &(0x7f00000002c0)='./file0\x00', r1, &(0x7f0000000300)='./file0\x00') ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000280)={0x2, &(0x7f0000000100)=[{0x0}, {}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000400)={r2, &(0x7f0000000340)=""/139}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x5) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40086602, 0x400007) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x20032600) 14:18:28 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:28 executing program 0: setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x6, 0x8, &(0x7f0000000140), 0x4) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, 0x0, 0x0) r1 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu\x00', 0x200002, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x2, 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000240)={&(0x7f0000000040)='./file0\x00', r0}, 0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, &(0x7f00000002c0)=0x7, 0x4) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) openat$cgroup_int(r2, &(0x7f0000000280)='notify_on_release\x00', 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)='.\x00\x00\x00>\x00', 0x6}], 0x1}, 0x0) r4 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r3, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) write$cgroup_subtree(r3, &(0x7f00000000c0)={[{0x33, 'c\x86\xdd'}]}, 0xfdef) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/mixer\x00', 0x80000, 0x0) ioctl$PPPIOCGIDLE(r5, 0x8010743f, &(0x7f0000000380)) [ 368.443482][T22522] device lo left promiscuous mode 14:18:28 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:28 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:28 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) 14:18:28 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:28 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:28 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 368.923229][T22571] netlink: 'syz-executor.4': attribute type 20 has an invalid length. [ 368.946678][T22571] netlink: 'syz-executor.4': attribute type 21 has an invalid length. 14:18:28 executing program 3: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) syz_mount_image$jfs(&(0x7f00000003c0)='jfs\x00', &(0x7f0000000400)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 368.981984][T22571] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 368.989263][T22571] IPv6: NLM_F_CREATE should be set when creating new route [ 368.996528][T22571] IPv6: NLM_F_CREATE should be set when creating new route 14:18:28 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:28 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) [ 369.034006][T22565] device nr0 entered promiscuous mode [ 369.119333][T22792] netlink: 'syz-executor.4': attribute type 20 has an invalid length. [ 369.173314][T22792] netlink: 'syz-executor.4': attribute type 21 has an invalid length. [ 369.202226][T22792] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 14:18:28 executing program 1: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x82a}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000200), 0x308) socketpair(0x0, 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/btrfs-control\x00', 0x0, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000240)='/dev/snapshot\x00', 0x841, 0x0) renameat(r0, &(0x7f00000002c0)='./file0\x00', r1, &(0x7f0000000300)='./file0\x00') ioctl$DRM_IOCTL_RES_CTX(r0, 0xc0106426, &(0x7f0000000280)={0x2, &(0x7f0000000100)=[{0x0}, {}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r0, 0x4010641c, &(0x7f0000000400)={r2, &(0x7f0000000340)=""/139}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_RESET(0xffffffffffffffff, 0x2403, 0x5) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40086602, 0x400007) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x20032600) 14:18:28 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:29 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) sendmsg$kcm(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)='&', 0x1}], 0x1, 0x0, 0x0, 0x4}, 0x0) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:29 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) 14:18:29 executing program 3: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=[@clear_death], 0x0, 0x0, 0x0}) 14:18:29 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:29 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:29 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 369.447364][T22810] netlink: 'syz-executor.4': attribute type 20 has an invalid length. [ 369.477119][T22810] netlink: 'syz-executor.4': attribute type 21 has an invalid length. 14:18:29 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) pkey_free(0xffffffffffffffff) [ 369.507983][T22810] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE 14:18:29 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:29 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:29 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(0xffffffffffffffff, 0x2, 0xffffffffffffffff) [ 369.633686][T22829] netlink: 'syz-executor.4': attribute type 20 has an invalid length. [ 369.662323][T22829] netlink: 'syz-executor.4': attribute type 21 has an invalid length. [ 369.670775][T22829] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 369.730175][T22817] binder: 22808:22817 Acquire 1 refcount change on invalid ref 0 ret -22 [ 369.746141][T22836] binder: 22808:22836 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 14:18:29 executing program 1: r0 = socket(0x10, 0x3, 0x0) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, 0x0, 0x0) connect$rxrpc(0xffffffffffffffff, 0x0, 0x0) 14:18:29 executing program 4: sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) [ 369.847966][T22845] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. [ 369.864399][T22847] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:18:29 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) sendmsg$kcm(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)='&', 0x1}], 0x1, 0x0, 0x0, 0x4}, 0x0) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:29 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:29 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) 14:18:29 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:29 executing program 4: sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:29 executing program 1: r0 = socket(0x10, 0x3, 0x0) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, 0x0, 0x0) connect$rxrpc(0xffffffffffffffff, 0x0, 0x0) 14:18:29 executing program 4: sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:29 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 370.298431][T22854] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:18:30 executing program 1: r0 = socket(0x10, 0x3, 0x0) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, 0x0, 0x0) connect$rxrpc(0xffffffffffffffff, 0x0, 0x0) 14:18:30 executing program 4: r0 = socket$inet6(0x10, 0x0, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:30 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) [ 370.419102][T22870] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:18:30 executing program 1: r0 = socket(0x10, 0x3, 0x0) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, 0x0, 0x0) connect$rxrpc(0xffffffffffffffff, 0x0, 0x0) [ 370.555579][T22888] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:18:30 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) sendmsg$kcm(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)='&', 0x1}], 0x1, 0x0, 0x0, 0x4}, 0x0) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:30 executing program 4: r0 = socket$inet6(0x10, 0x0, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:30 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:30 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:30 executing program 1: r0 = socket(0x10, 0x3, 0x0) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_NOTIFY(0xffffffffffffffff, 0x0, 0x0) 14:18:30 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:30 executing program 4: r0 = socket$inet6(0x10, 0x0, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:30 executing program 1: r0 = socket(0x10, 0x3, 0x0) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) [ 371.171055][T22900] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:18:30 executing program 4: socket$inet6(0x10, 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:30 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:30 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 371.268495][T22914] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:18:30 executing program 1: r0 = socket(0x10, 0x3, 0x0) ioctl$VIDIOC_S_FREQUENCY(0xffffffffffffffff, 0x402c5639, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) [ 371.403812][T22929] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:18:31 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) sendmsg$kcm(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f00000009c0)='&', 0x1}], 0x1, 0x0, 0x0, 0x4}, 0x0) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:31 executing program 4: socket$inet6(0x10, 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:31 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:31 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:31 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:31 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:31 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:31 executing program 4: socket$inet6(0x10, 0x3, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7d4", 0x55}], 0x1}, 0x0) 14:18:31 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 372.028796][T22943] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.1'. 14:18:31 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:31 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:31 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:32 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:32 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:32 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, 0x0, 0x0) 14:18:32 executing program 1: write(0xffffffffffffffff, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:32 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:32 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:32 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:32 executing program 1: r0 = socket(0x0, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:32 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, 0x0, 0x0) 14:18:32 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:32 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:32 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, 0x0, 0x0) 14:18:33 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:33 executing program 1: r0 = socket(0x0, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:33 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:33 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:33 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) 14:18:33 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:33 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:33 executing program 1: r0 = socket(0x0, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:33 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:33 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) 14:18:33 executing program 5: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:33 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) 14:18:34 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:34 executing program 1: r0 = socket(0x10, 0x0, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:34 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, 0x0, 0x0) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:34 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:34 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) 14:18:34 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:34 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:34 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) 14:18:34 executing program 1: r0 = socket(0x10, 0x0, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:34 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180), 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:34 executing program 1: r0 = socket(0x10, 0x0, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:34 executing program 5: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:35 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:35 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)}, 0x0) 14:18:35 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180), 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:35 executing program 1: socket(0x10, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:35 executing program 5: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:35 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:35 executing program 5: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:35 executing program 1: socket(0x10, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:35 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180), 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:35 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) 14:18:35 executing program 1: socket(0x10, 0x3, 0x0) write(0xffffffffffffffff, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb00028005000000", 0x24) 14:18:35 executing program 5: perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:35 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:35 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) 14:18:35 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, 0x0, 0x0) 14:18:35 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:35 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:35 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x2000000000a, 0x0) 14:18:36 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, 0x0, 0x0) 14:18:36 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) 14:18:36 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:36 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:36 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:36 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)}], 0x1}, 0x0) 14:18:36 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:36 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, 0x0, 0x0) 14:18:36 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:36 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:36 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0), 0x0) 14:18:36 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x2000000000a, 0x0) 14:18:36 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)}], 0x1}, 0x0) 14:18:36 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:36 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:36 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:36 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0), 0x0) 14:18:36 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)}], 0x1}, 0x0) 14:18:36 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:36 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0), 0x0) 14:18:36 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:36 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c0006000000190015", 0x2b}], 0x1}, 0x0) 14:18:37 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1c", 0x12) 14:18:37 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x2000000000a, 0x0) 14:18:37 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c0006000000190015", 0x2b}], 0x1}, 0x0) 14:18:37 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:37 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1c", 0x12) 14:18:37 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, 0x0, 0x0) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:37 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:37 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c0006000000190015", 0x2b}], 0x1}, 0x0) 14:18:37 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1c", 0x12) 14:18:37 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:37 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:37 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75a", 0x40}], 0x1}, 0x0) 14:18:37 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf51108000100020100", 0x1b) 14:18:38 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:38 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf51108000100020100", 0x1b) 14:18:38 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75a", 0x40}], 0x1}, 0x0) 14:18:38 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:38 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:38 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:38 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x0, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:38 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75a", 0x40}], 0x1}, 0x0) 14:18:38 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf51108000100020100", 0x1b) 14:18:38 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:38 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb000280", 0x20) 14:18:38 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8", 0x4b}], 0x1}, 0x0) 14:18:39 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:39 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:39 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8", 0x4b}], 0x1}, 0x0) 14:18:39 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb000280", 0x20) 14:18:39 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:39 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:39 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb000280", 0x20) 14:18:39 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8", 0x4b}], 0x1}, 0x0) 14:18:39 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:39 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:39 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb0002800500", 0x22) 14:18:39 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060c", 0x50}], 0x1}, 0x0) 14:18:40 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:40 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb0002800500", 0x22) 14:18:40 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:40 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, &(0x7f0000000040)) 14:18:40 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060c", 0x50}], 0x1}, 0x0) 14:18:40 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:40 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060c", 0x50}], 0x1}, 0x0) 14:18:40 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb0002800500", 0x22) 14:18:40 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:40 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x0, 0x0, &(0x7f0000000040)) 14:18:40 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab", 0x53}], 0x1}, 0x0) 14:18:40 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb000280050000", 0x23) 14:18:41 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:41 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:41 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab", 0x53}], 0x1}, 0x0) 14:18:41 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb000280050000", 0x23) 14:18:41 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x0, 0x0, &(0x7f0000000040)) 14:18:41 executing program 0: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:41 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4fab", 0x53}], 0x1}, 0x0) 14:18:41 executing program 1: r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="2400000058001f00ff07f4f9002304040a1cf5110800010002010001fb000280050000", 0x23) 14:18:41 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7", 0x54}], 0x1}, 0x0) 14:18:41 executing program 1: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:41 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x0, 0x0, &(0x7f0000000040)) 14:18:41 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7", 0x54}], 0x1}, 0x0) 14:18:42 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:42 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:42 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000000c0)="5500000018007f4812fe01b2a4a280930a06000000a84306910000000b00140003000c00060000001900154007000000000000dc1338d54400009b84136ef75afb83de4411001600c43ab8220000060cec4faba7", 0x54}], 0x1}, 0x0) 14:18:42 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, 0x0) 14:18:42 executing program 1: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:42 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:42 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:42 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, 0x0) 14:18:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:42 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:42 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:42 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @ipv4={[], [], @remote}}, 0x1c) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, 0x0) 14:18:42 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:42 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:42 executing program 1: perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)="2e0000002700050ad25a80648c63940d0300fc00100003400a000000053582c137153e370900018004001700d1bd", 0x2e}], 0x1}, 0x0) 14:18:42 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) [ 383.267092][T23432] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 383.300579][T23432] netlink: 'syz-executor.1': attribute type 1 has an invalid length. 14:18:42 executing program 4: ioctl(0xffffffffffffffff, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:42 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 383.311681][T23437] netlink: 'syz-executor.1': attribute type 3 has an invalid length. [ 383.320235][T23437] netlink: 'syz-executor.1': attribute type 1 has an invalid length. 14:18:43 executing program 5: sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000680)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001e000901001700"/20], 0x1}}, 0x0) r0 = socket(0x10, 0x80002, 0x0) sendmmsg$alg(r0, &(0x7f0000000140)=[{0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000100)}], 0x492492492492805, 0x0) 14:18:43 executing program 1: r0 = socket$inet(0x2, 0x3, 0x8) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc5f123c123f319bd070") r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet_MCAST_LEAVE_GROUP(r0, 0x0, 0x2d, &(0x7f0000000180)={0x9, {{0x2, 0x4e23, @rand_addr=0xb65}}}, 0x88) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20}, 0x1b) syz_emit_ethernet(0x74, &(0x7f0000000100)={@local, @link_local, [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x6, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, @local, {[], @tcp={{0x0, 0x4e20, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 14:18:43 executing program 4: ioctl(0xffffffffffffffff, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:43 executing program 5: [ 383.445512][T23456] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 383.475061][T23456] syz-executor.1 (23456) used greatest stack depth: 24008 bytes left 14:18:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x2000000000a, 0x0) 14:18:43 executing program 1: 14:18:43 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:43 executing program 4: ioctl(0xffffffffffffffff, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:43 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f023c1f3f3188b070") r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000400)="de75e1fe7d087634b214a3765ba0017995103a08917fc2a1", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)={0x14}, 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) 14:18:43 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:43 executing program 1: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000100)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = inotify_init1(0x0) getsockopt$inet_mtu(r0, 0x0, 0xa, 0x0, 0x0) 14:18:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x2000000000a, 0x0) 14:18:43 executing program 4: r0 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:43 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x0, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:43 executing program 5: inotify_init1(0x0) r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffb7, &(0x7f0000000080)) 14:18:43 executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x2000000000a, 0x0) 14:18:43 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:43 executing program 4: r0 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:44 executing program 3: pipe(0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x2000000000a, 0x0) 14:18:44 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:44 executing program 4: r0 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:44 executing program 0: socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:44 executing program 5: r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/mixer\x00', 0x0, 0x0) ioctl$ION_IOC_HEAP_QUERY(r0, 0xc0184908, &(0x7f00000002c0)={0x0, 0x0, 0x0}) 14:18:44 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) 14:18:44 executing program 3: pipe(0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x2000000000a, 0x0) 14:18:44 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:44 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:44 executing program 5: r0 = add_key(&(0x7f00000002c0)='big_key\x00', &(0x7f0000000300)={'syz'}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$revoke(0x3, r0) 14:18:44 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:44 executing program 3: pipe(0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r1 = accept4$alg(r0, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r1, 0x0, 0x2000000000a, 0x0) 14:18:44 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:44 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:44 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) 14:18:45 executing program 0: socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:45 executing program 5: 14:18:45 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:45 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:45 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(0xffffffffffffffff, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:45 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) 14:18:45 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(0xffffffffffffffff, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:45 executing program 5: 14:18:45 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:45 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) 14:18:45 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280), 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:45 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(0xffffffffffffffff, 0xffffffffffffffb9, &(0x7f0000000040)) 14:18:46 executing program 0: socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:46 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:46 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280), 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:46 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000040)) 14:18:46 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:46 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:46 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000040)) 14:18:46 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:46 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0x0, &(0x7f0000000040)) 14:18:46 executing program 1: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:46 executing program 5: r0 = open(&(0x7f0000000000)='./file0\x00', 0x40c2, 0x0) fadvise64(r0, 0x0, 0x0, 0x2) 14:18:46 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280), 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 387.041058][ T26] kauditd_printk_skb: 8 callbacks suppressed [ 387.041071][ T26] audit: type=1800 audit(1554992326.664:31): pid=23920 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=collect_data cause=failed(directio) comm="syz-executor.5" name="file0" dev="sda1" ino=17789 res=0 14:18:47 executing program 1: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:47 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, 0x0) 14:18:47 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:47 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:47 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(0x0, 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:47 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:47 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, 0x0) 14:18:47 executing program 1: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:47 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:47 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x1, 0x0) ioctl(r0, 0xffffffffffffffb9, 0x0) 14:18:47 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:47 executing program 4: r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="240000000000000029000000020000008102020100ff3a06fe80000000000000b87f25f8"], 0x24}, 0x0) 14:18:47 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:47 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(0x0, 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:47 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:48 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:48 executing program 5: getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:48 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, 0x0, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:48 executing program 4: 14:18:48 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(0x0, 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:48 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:48 executing program 5: getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:48 executing program 5: getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:48 executing program 4: prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x50000}]}) r0 = perf_event_open(0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffff9c, 0x0) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, 0x0, 0x0) 14:18:48 executing program 1: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:48 executing program 5: r0 = socket(0x0, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:48 executing program 1: r0 = socket(0x0, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:48 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:48 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0, 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:49 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, 0x0, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:49 executing program 5: r0 = socket(0x0, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:49 executing program 1: r0 = socket(0x0, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:49 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0x5b4, 0x0) 14:18:49 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0, 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:49 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0x5b4, 0x0) 14:18:49 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, 0x0, 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:49 executing program 5: r0 = socket(0x0, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:49 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0x5b4, 0x0) 14:18:49 executing program 1: r0 = socket(0x0, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:49 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:49 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:49 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, 0x0, 0x0) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:49 executing program 5: r0 = socket(0xa, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:49 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0x5b4, 0x0) 14:18:49 executing program 1: r0 = socket(0xa, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:49 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:49 executing program 4: ioctl(0xffffffffffffffff, 0x5b4, 0x0) 14:18:50 executing program 5: r0 = socket(0xa, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:50 executing program 1: r0 = socket(0xa, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:50 executing program 4: ioctl(0xffffffffffffffff, 0x5b4, 0x0) 14:18:50 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:50 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:50 executing program 4: ioctl(0xffffffffffffffff, 0x5b4, 0x0) 14:18:50 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:50 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:50 executing program 5: r0 = socket(0xa, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:50 executing program 1: r0 = socket(0xa, 0x0, 0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:50 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl(r0, 0x5b4, 0x0) 14:18:50 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:50 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl(r0, 0x5b4, 0x0) 14:18:50 executing program 5: socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:50 executing program 4: r0 = syz_open_dev$dri(0x0, 0x0, 0x0) ioctl(r0, 0x5b4, 0x0) 14:18:50 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:51 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x0) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:51 executing program 5: socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:51 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:51 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x5b4, 0x0) 14:18:51 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:51 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:51 executing program 5: socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, &(0x7f0000000040)=0x10) 14:18:51 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x5b4, 0x0) 14:18:51 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:51 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, 0x0) 14:18:51 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:51 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, 0x0) 14:18:52 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x0, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:52 executing program 5: r0 = socket(0xa, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, 0x0, 0x0) 14:18:52 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:52 executing program 4: syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(0xffffffffffffffff, 0x5b4, 0x0) 14:18:52 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:52 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:52 executing program 5: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setitimer(0x1, &(0x7f0000008440)={{0x0, 0x7530}, {0x77359400}}, 0x0) getitimer(0x1, &(0x7f0000005580)) syz_open_procfs(0x0, 0x0) 14:18:52 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x0, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:52 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0x0, 0x0) 14:18:52 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:52 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:52 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x0, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:52 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0x0, 0x0) 14:18:52 executing program 1: socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:53 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:53 executing program 1: socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:53 executing program 4: r0 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0x0, 0x0) 14:18:53 executing program 5: r0 = socket$kcm(0xa, 0x122000000003, 0x11) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000003840)=@nl=@unspec={0x0, 0x0, 0x0, 0x80fe}, 0x80, 0x0}, 0x0) dup2(r1, r0) 14:18:53 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:53 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:53 executing program 4: r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="240000000000000029000000320000008102020100ff3a06fe80000000000000b87f25f8"], 0x24}, 0x0) 14:18:53 executing program 1: socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x21, 0x0, &(0x7f0000000040)) 14:18:53 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:53 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:53 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0, 0x11, r0, 0x0) remap_file_pages(&(0x7f0000fff000/0x1000)=nil, 0x20fff000, 0x0, 0x0, 0x0) 14:18:53 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x0, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:54 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:54 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = socket(0x10, 0x3, 0x0) write(r1, 0x0, 0x0) write(r1, &(0x7f00000000c0)="2400000067001f00ff07f4f9002304040a04f51108000100020100020800028005000000", 0x24) 14:18:54 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, 0x0) 14:18:54 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:54 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:54 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000380)={0xaa, 0x74}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000909000/0x4000)=nil, 0x4000}, 0x1}) mremap(&(0x7f000090a000/0x3000)=nil, 0x3000, 0x2000, 0x0, &(0x7f0000ffc000/0x2000)=nil) clone(0x0, 0x0, 0x0, 0x0, 0x0) read(r1, &(0x7f0000009f9c)=""/100, 0x64) 14:18:54 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:54 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, 0x0) 14:18:54 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:54 executing program 1: r0 = socket(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000140)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x21, 0x0, 0x0) 14:18:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) 14:18:54 executing program 5: mkdir(&(0x7f0000fd5ff8)='./file0\x00', 0x0) r0 = creat(&(0x7f0000000240)='./file0/file0\x00', 0x0) syncfs(r0) 14:18:55 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:18:55 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:55 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:55 executing program 4: r0 = socket$kcm(0x2, 0x5, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0x343, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) sendmsg(0xffffffffffffffff, &(0x7f0000000800)={&(0x7f0000000000)=@nfc={0x27, 0x0, 0x2}, 0x80, 0x0}, 0x0) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x890b, &(0x7f0000000000)) 14:18:55 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:55 executing program 5: setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x10) r0 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000100), 0x4) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x2000000000002, @dev, 'bridge0\x00'}}, 0x1e) sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x0) bind$packet(r0, &(0x7f0000000480)={0x11, 0x3, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5) 14:18:55 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:55 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:18:55 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:55 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:55 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:55 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, 0x0, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:55 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x0) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:55 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:18:55 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:55 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, 0x0, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:55 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, &(0x7f00000008c0)={0x1f, 0x6000000000}, 0x8, 0x10, &(0x7f0000000900)={0xacd3, 0x3, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@dev, @in=@local, 0x4e22, 0x0, 0x4e22, 0x8, 0x57b98bd6d522e0be, 0x80, 0xa0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x78, 0x9, 0x1bea, 0x40}, {0x0, 0xffffffffffffffe1, 0x101, 0xfffffffffffff800}, 0x800, 0x6e6bb9, 0x3, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d6, 0x32}, 0x0, @in6=@mcast1, 0x34ff, 0x81f62f3b158e3be3, 0x2, 0x8, 0x0, 0xac5, 0x8}}, 0xe8) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000640)=0x7, 0x4) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000009c0)={@in6={{0xa, 0x4e23, 0x4, @empty, 0x3}}, 0x0, 0x88, 0x0, "9c77cc6fd1d2645acc8d8241ef0f069348e92baaab61974a9bdea9afac565038e41c4d662498044872af46037b0c9d67f990068de127bc5abed6b7eb95ffbb7e6198dd892e95578b184dc74ca386e961"}, 0xd8) 14:18:55 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:18:55 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:55 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:56 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, 0x0, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:18:56 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:56 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:56 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x0) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:18:56 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, &(0x7f00000008c0)={0x1f, 0x6000000000}, 0x8, 0x10, &(0x7f0000000900)={0xacd3, 0x3, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@dev, @in=@local, 0x4e22, 0x0, 0x4e22, 0x8, 0x57b98bd6d522e0be, 0x80, 0xa0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x78, 0x9, 0x1bea, 0x40}, {0x0, 0xffffffffffffffe1, 0x101, 0xfffffffffffff800}, 0x800, 0x6e6bb9, 0x3, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d6, 0x32}, 0x0, @in6=@mcast1, 0x34ff, 0x81f62f3b158e3be3, 0x2, 0x8, 0x0, 0xac5, 0x8}}, 0xe8) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000640)=0x7, 0x4) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000009c0)={@in6={{0xa, 0x4e23, 0x4, @empty, 0x3}}, 0x0, 0x88, 0x0, "9c77cc6fd1d2645acc8d8241ef0f069348e92baaab61974a9bdea9afac565038e41c4d662498044872af46037b0c9d67f990068de127bc5abed6b7eb95ffbb7e6198dd892e95578b184dc74ca386e961"}, 0xd8) 14:18:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:18:56 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:56 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:56 executing program 1: bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:56 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:18:56 executing program 1: bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:56 executing program 1: bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:56 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:18:56 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:56 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:18:57 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x0) splice(r0, 0x0, r3, 0x0, 0x2000000000a, 0x0) 14:19:56 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:19:56 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, &(0x7f00000008c0)={0x1f, 0x6000000000}, 0x8, 0x10, &(0x7f0000000900)={0xacd3, 0x3, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@dev, @in=@local, 0x4e22, 0x0, 0x4e22, 0x8, 0x57b98bd6d522e0be, 0x80, 0xa0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x78, 0x9, 0x1bea, 0x40}, {0x0, 0xffffffffffffffe1, 0x101, 0xfffffffffffff800}, 0x800, 0x6e6bb9, 0x3, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d6, 0x32}, 0x0, @in6=@mcast1, 0x34ff, 0x81f62f3b158e3be3, 0x2, 0x8, 0x0, 0xac5, 0x8}}, 0xe8) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000640)=0x7, 0x4) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000009c0)={@in6={{0xa, 0x4e23, 0x4, @empty, 0x3}}, 0x0, 0x88, 0x0, "9c77cc6fd1d2645acc8d8241ef0f069348e92baaab61974a9bdea9afac565038e41c4d662498044872af46037b0c9d67f990068de127bc5abed6b7eb95ffbb7e6198dd892e95578b184dc74ca386e961"}, 0xd8) 14:19:56 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, 0x0, 0x0, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:56 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:19:56 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, 0x0, 0x0) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:19:56 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:19:56 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:19:56 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, 0x0, 0x0, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:56 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:19:56 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, 0x0, 0x0, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:56 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:19:56 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740), 0x0, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 458.480388][T25826] IPVS: ftp: loaded support on port[0] = 21 [ 458.526005][T25826] chnl_net:caif_netlink_parms(): no params data found [ 458.547854][T25826] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.555131][T25826] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.562690][T25826] device bridge_slave_0 entered promiscuous mode [ 458.569855][T25826] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.577011][T25826] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.584728][T25826] device bridge_slave_1 entered promiscuous mode [ 458.598651][T25826] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 458.609183][T25826] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 458.625089][T25826] team0: Port device team_slave_0 added [ 458.631784][T25826] team0: Port device team_slave_1 added [ 458.712238][T25826] device hsr_slave_0 entered promiscuous mode [ 458.771145][T25826] device hsr_slave_1 entered promiscuous mode [ 458.826700][T25826] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.833816][T25826] bridge0: port 2(bridge_slave_1) entered forwarding state [ 458.841651][T25826] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.849078][T25826] bridge0: port 1(bridge_slave_0) entered forwarding state [ 458.873058][T25826] 8021q: adding VLAN 0 to HW filter on device bond0 [ 458.884258][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 458.893431][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 458.900761][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 458.909334][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 458.920315][T25826] 8021q: adding VLAN 0 to HW filter on device team0 [ 458.930217][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 458.938636][ T23] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.945732][ T23] bridge0: port 1(bridge_slave_0) entered forwarding state [ 458.961561][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 458.969837][ T23] bridge0: port 2(bridge_slave_1) entered blocking state [ 458.976914][ T23] bridge0: port 2(bridge_slave_1) entered forwarding state [ 458.985445][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 458.993974][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 459.002722][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 459.014120][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 459.024687][T25826] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 459.036673][T25826] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 459.045023][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 459.058281][T25826] 8021q: adding VLAN 0 to HW filter on device batadv0 14:19:58 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, &(0x7f00000008c0)={0x1f, 0x6000000000}, 0x8, 0x10, &(0x7f0000000900)={0xacd3, 0x3, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@dev, @in=@local, 0x4e22, 0x0, 0x4e22, 0x8, 0x57b98bd6d522e0be, 0x80, 0xa0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x78, 0x9, 0x1bea, 0x40}, {0x0, 0xffffffffffffffe1, 0x101, 0xfffffffffffff800}, 0x800, 0x6e6bb9, 0x3, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d6, 0x32}, 0x0, @in6=@mcast1, 0x34ff, 0x81f62f3b158e3be3, 0x2, 0x8, 0x0, 0xac5, 0x8}}, 0xe8) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000640)=0x7, 0x4) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000009c0)={@in6={{0xa, 0x4e23, 0x4, @empty, 0x3}}, 0x0, 0x88, 0x0, "9c77cc6fd1d2645acc8d8241ef0f069348e92baaab61974a9bdea9afac565038e41c4d662498044872af46037b0c9d67f990068de127bc5abed6b7eb95ffbb7e6198dd892e95578b184dc74ca386e961"}, 0xd8) 14:19:58 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:19:58 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740), 0x0, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:58 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:19:58 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:19:58 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, 0x0, 0x0) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:19:58 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:19:58 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740), 0x0, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:58 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) 14:19:58 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{0x0}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:58 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, 0x0, 0x0) 14:19:58 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{0x0}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:59 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, &(0x7f00000008c0)={0x1f, 0x6000000000}, 0x8, 0x10, &(0x7f0000000900)={0xacd3, 0x3, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@dev, @in=@local, 0x4e22, 0x0, 0x4e22, 0x8, 0x57b98bd6d522e0be, 0x80, 0xa0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x78, 0x9, 0x1bea, 0x40}, {0x0, 0xffffffffffffffe1, 0x101, 0xfffffffffffff800}, 0x800, 0x6e6bb9, 0x3, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d6, 0x32}, 0x0, @in6=@mcast1, 0x34ff, 0x81f62f3b158e3be3, 0x2, 0x8, 0x0, 0xac5, 0x8}}, 0xe8) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000640)=0x7, 0x4) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000009c0)={@in6={{0xa, 0x4e23, 0x4, @empty, 0x3}}, 0x0, 0x88, 0x0, "9c77cc6fd1d2645acc8d8241ef0f069348e92baaab61974a9bdea9afac565038e41c4d662498044872af46037b0c9d67f990068de127bc5abed6b7eb95ffbb7e6198dd892e95578b184dc74ca386e961"}, 0xd8) 14:19:59 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, 0x0, 0x0) 14:19:59 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{0x0}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:59 executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000000c0)={0x26, 'aead\x00', 0x0, 0x0, 'morus1280\x00'}, 0x58) bind$alg(r0, 0x0, 0x0) 14:19:59 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0x1b) readv(0xffffffffffffffff, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:19:59 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, 0x0, 0x0) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:19:59 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r2 = accept4$alg(r1, 0x0, 0x0, 0x0) write$binfmt_elf64(r0, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(0xffffffffffffffff, 0x0, r2, 0x0, 0x2000000000a, 0x0) 14:19:59 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:59 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, &(0x7f00000008c0)={0x1f, 0x6000000000}, 0x8, 0x10, &(0x7f0000000900)={0xacd3, 0x3, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@dev, @in=@local, 0x4e22, 0x0, 0x4e22, 0x8, 0x57b98bd6d522e0be, 0x80, 0xa0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x78, 0x9, 0x1bea, 0x40}, {0x0, 0xffffffffffffffe1, 0x101, 0xfffffffffffff800}, 0x800, 0x6e6bb9, 0x3, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d6, 0x32}, 0x0, @in6=@mcast1, 0x34ff, 0x81f62f3b158e3be3, 0x2, 0x8, 0x0, 0xac5, 0x8}}, 0xe8) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000640)=0x7, 0x4) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000009c0)={@in6={{0xa, 0x4e23, 0x4, @empty, 0x3}}, 0x0, 0x88, 0x0, "9c77cc6fd1d2645acc8d8241ef0f069348e92baaab61974a9bdea9afac565038e41c4d662498044872af46037b0c9d67f990068de127bc5abed6b7eb95ffbb7e6198dd892e95578b184dc74ca386e961"}, 0xd8) 14:19:59 executing program 1: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, &(0x7f00000008c0)={0x1f, 0x6000000000}, 0x8, 0x10, &(0x7f0000000900)={0xacd3, 0x3, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@dev, @in=@local, 0x4e22, 0x0, 0x4e22, 0x8, 0x57b98bd6d522e0be, 0x80, 0xa0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x78, 0x9, 0x1bea, 0x40}, {0x0, 0xffffffffffffffe1, 0x101, 0xfffffffffffff800}, 0x800, 0x6e6bb9, 0x3, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d6, 0x32}, 0x0, @in6=@mcast1, 0x34ff, 0x81f62f3b158e3be3, 0x2, 0x8, 0x0, 0xac5, 0x8}}, 0xe8) setsockopt$bt_BT_CHANNEL_POLICY(0xffffffffffffffff, 0x112, 0xa, &(0x7f0000000640)=0x7, 0x4) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') setsockopt$inet_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000009c0)={@in6={{0xa, 0x4e23, 0x4, @empty, 0x3}}, 0x0, 0x88, 0x0, "9c77cc6fd1d2645acc8d8241ef0f069348e92baaab61974a9bdea9afac565038e41c4d662498044872af46037b0c9d67f990068de127bc5abed6b7eb95ffbb7e6198dd892e95578b184dc74ca386e961"}, 0xd8) 14:19:59 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:19:59 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0x1b) readv(0xffffffffffffffff, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:19:59 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:19:59 executing program 4: ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0x1b) readv(0xffffffffffffffff, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:19:59 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 460.091551][ T2557] device bridge_slave_1 left promiscuous mode [ 460.100429][ T2557] bridge0: port 2(bridge_slave_1) entered disabled state 14:19:59 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:19:59 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x0) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 460.161758][ T2557] device bridge_slave_0 left promiscuous mode [ 460.177203][ T2557] bridge0: port 1(bridge_slave_0) entered disabled state 14:20:00 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:20:00 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:00 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x0) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 461.123066][ T2557] device hsr_slave_1 left promiscuous mode [ 461.173724][ T2557] device hsr_slave_0 left promiscuous mode [ 461.233129][ T2557] team0 (unregistering): Port device team_slave_1 removed [ 461.243596][ T2557] team0 (unregistering): Port device team_slave_0 removed [ 461.253378][ T2557] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 461.303735][ T2557] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 461.361103][ T2557] bond0 (unregistering): Released all slaves [ 461.564416][T25921] IPVS: ftp: loaded support on port[0] = 21 [ 461.627979][T25921] chnl_net:caif_netlink_parms(): no params data found [ 461.711432][T25921] bridge0: port 1(bridge_slave_0) entered blocking state [ 461.718551][T25921] bridge0: port 1(bridge_slave_0) entered disabled state [ 461.726297][T25921] device bridge_slave_0 entered promiscuous mode [ 461.733925][T25921] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.741045][T25921] bridge0: port 2(bridge_slave_1) entered disabled state [ 461.748496][T25921] device bridge_slave_1 entered promiscuous mode [ 461.773763][T25921] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 461.783705][T25921] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 461.803963][T25921] team0: Port device team_slave_0 added [ 461.810749][T25921] team0: Port device team_slave_1 added [ 461.885938][T25921] device hsr_slave_0 entered promiscuous mode [ 461.931180][T25921] device hsr_slave_1 entered promiscuous mode [ 461.988191][T25921] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.995320][T25921] bridge0: port 2(bridge_slave_1) entered forwarding state [ 462.002686][T25921] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.009786][T25921] bridge0: port 1(bridge_slave_0) entered forwarding state [ 462.043403][T25921] 8021q: adding VLAN 0 to HW filter on device bond0 [ 462.055593][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 462.064057][ T5] bridge0: port 1(bridge_slave_0) entered disabled state [ 462.081246][ T5] bridge0: port 2(bridge_slave_1) entered disabled state [ 462.103799][T25921] 8021q: adding VLAN 0 to HW filter on device team0 [ 462.113865][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 462.122231][ T5] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.129676][ T5] bridge0: port 1(bridge_slave_0) entered forwarding state [ 462.139335][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 462.147802][ T3481] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.154909][ T3481] bridge0: port 2(bridge_slave_1) entered forwarding state [ 462.180059][T25921] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 462.193713][T25921] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 462.206105][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 462.215214][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 462.223599][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 462.232347][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 462.240482][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 462.248218][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 462.263679][T25921] 8021q: adding VLAN 0 to HW filter on device batadv0 14:20:01 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000780)={{{@in=@multicast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @local}}, 0x0, @in6=@remote}}, &(0x7f0000000880)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x11, 0x0, &(0x7f0000000ac0)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x4, 0xb6, &(0x7f00000006c0)=""/182, 0x41100, 0x0, [], r1, 0x0, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000900)={0xacd3, 0x0, 0x9, 0x2c2}, 0x10}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(&(0x7f0000000680)='./file0\x00', 0x0, 0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r2) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000480)={{{@in6=@dev, @in=@local, 0x4e22, 0x0, 0x4e22, 0x8, 0x57b98bd6d522e0be, 0x80, 0xa0, 0x2}, {0x0, 0x0, 0x0, 0x0, 0x78, 0x9, 0x1bea, 0x40}, {0x0, 0xffffffffffffffe1, 0x101, 0xfffffffffffff800}, 0x800, 0x6e6bb9, 0x3, 0x0, 0x2, 0x3}, {{@in6=@remote, 0x4d6, 0x32}, 0xa, @in6=@mcast1, 0x34ff, 0x81f62f3b158e3be3, 0x0, 0x8, 0x0, 0xac5, 0x8}}, 0xe8) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') 14:20:01 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x2000000000a, 0x0) 14:20:01 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:01 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x0) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:01 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:02 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:20:02 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:02 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:02 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:02 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r0, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r1 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r0, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r0, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:02 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:02 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000001c0)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, 0x0}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="f3"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0xc, 0x0, &(0x7f0000000100)=[@dead_binder_done], 0x0, 0xfffffdfd, 0x0}) 14:20:02 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x2000000000a, 0x0) 14:20:02 executing program 5: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x400000, 0x0) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f00000001c0)) r1 = socket$rds(0x15, 0x5, 0x0) bind$rds(r1, &(0x7f0000000080)={0x2, 0x0, @local}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) sendmsg$rds(r1, &(0x7f00000001c0)={&(0x7f0000000000)={0x2, 0x0, @local}, 0x10, 0x0, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="000000000000000000000100"/56], 0x38}, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x6e96}, &(0x7f0000000140)=0x8) finit_module(r0, &(0x7f0000000380)=')&\x00', 0x2) 14:20:02 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(0xffffffffffffffff, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 463.681574][ T2557] device bridge_slave_1 left promiscuous mode [ 463.687801][ T2557] bridge0: port 2(bridge_slave_1) entered disabled state [ 463.761402][ T2557] device bridge_slave_0 left promiscuous mode [ 463.767606][ T2557] bridge0: port 1(bridge_slave_0) entered disabled state [ 464.522823][ T2557] device hsr_slave_1 left promiscuous mode [ 464.593129][ T2557] device hsr_slave_0 left promiscuous mode [ 464.644225][ T2557] team0 (unregistering): Port device team_slave_1 removed [ 464.654336][ T2557] team0 (unregistering): Port device team_slave_0 removed [ 464.664778][ T2557] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 464.724471][ T2557] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 464.791337][ T2557] bond0 (unregistering): Released all slaves [ 464.924109][T25969] IPVS: ftp: loaded support on port[0] = 21 [ 464.924162][T25972] IPVS: ftp: loaded support on port[0] = 21 [ 465.020102][T25969] chnl_net:caif_netlink_parms(): no params data found [ 465.060396][T25969] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.068239][T25969] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.075762][T25969] device bridge_slave_0 entered promiscuous mode [ 465.088540][T25969] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.097696][T25969] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.105984][T25969] device bridge_slave_1 entered promiscuous mode [ 465.135942][T25969] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 465.146192][T25969] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 465.154862][T25972] chnl_net:caif_netlink_parms(): no params data found [ 465.195311][T25969] team0: Port device team_slave_0 added [ 465.202097][T25972] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.209196][T25972] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.217244][T25972] device bridge_slave_0 entered promiscuous mode [ 465.225482][T25969] team0: Port device team_slave_1 added [ 465.231625][T25972] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.238723][T25972] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.246775][T25972] device bridge_slave_1 entered promiscuous mode [ 465.314851][T25972] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 465.373144][T25969] device hsr_slave_0 entered promiscuous mode [ 465.412421][T25969] device hsr_slave_1 entered promiscuous mode [ 465.453522][T25972] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 465.478426][T25969] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.485572][T25969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.492922][T25969] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.499986][T25969] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.526568][T25972] team0: Port device team_slave_0 added [ 465.544377][T25972] team0: Port device team_slave_1 added [ 465.557747][T25969] 8021q: adding VLAN 0 to HW filter on device bond0 [ 465.623178][T25972] device hsr_slave_0 entered promiscuous mode [ 465.661360][T25972] device hsr_slave_1 entered promiscuous mode [ 465.716794][T25969] 8021q: adding VLAN 0 to HW filter on device team0 [ 465.727475][ T2966] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 465.735554][ T2966] bridge0: port 1(bridge_slave_0) entered disabled state [ 465.743340][ T2966] bridge0: port 2(bridge_slave_1) entered disabled state [ 465.764097][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 465.772701][ T23] bridge0: port 1(bridge_slave_0) entered blocking state [ 465.779773][ T23] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.787324][ T23] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 465.795683][ T23] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.802738][ T23] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.823207][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 465.832889][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 465.847839][T25969] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 465.859120][T25969] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 465.870628][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 465.879124][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 465.887593][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 465.896389][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 465.960055][T25969] 8021q: adding VLAN 0 to HW filter on device batadv0 14:20:05 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:05 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r1, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x2, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0xffffff77}], 0x1, &(0x7f00000001c0)=""/17, 0xffda}, 0x0) 14:20:05 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:05 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:05 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, 0xffffffffffffffff, 0x0, 0x2000000000a, 0x0) [ 466.045668][T25972] 8021q: adding VLAN 0 to HW filter on device bond0 [ 466.057407][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 466.065996][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 466.152572][T25972] 8021q: adding VLAN 0 to HW filter on device team0 [ 466.171601][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 466.193661][ T9063] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready 14:20:05 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 466.215332][ T9063] bridge0: port 1(bridge_slave_0) entered blocking state [ 466.222476][ T9063] bridge0: port 1(bridge_slave_0) entered forwarding state 14:20:05 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:05 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 466.348730][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 466.360721][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 466.383963][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready 14:20:06 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 466.395082][ T5] bridge0: port 2(bridge_slave_1) entered blocking state [ 466.402210][ T5] bridge0: port 2(bridge_slave_1) entered forwarding state [ 466.414484][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 466.429731][ T5] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready 14:20:06 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 466.535909][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 466.547066][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 466.556882][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 466.576164][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 466.585227][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 466.601440][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 466.609650][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 466.618346][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 466.626925][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 466.636119][T25972] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 466.721208][T25972] 8021q: adding VLAN 0 to HW filter on device batadv0 14:20:06 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:06 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:06 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:06 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, 0x0, 0x0) 14:20:06 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:06 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:06 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:06 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x0, 0x0) 14:20:06 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:06 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, &(0x7f00000004c0)) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:06 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:06 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:06 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, &(0x7f00000004c0)) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:06 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 467.151907][ T2557] device bridge_slave_1 left promiscuous mode [ 467.162986][ T2557] bridge0: port 2(bridge_slave_1) entered disabled state 14:20:06 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) [ 467.220678][ T2557] device bridge_slave_0 left promiscuous mode [ 467.235994][ T2557] bridge0: port 1(bridge_slave_0) entered disabled state 14:20:07 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, 0x0, 0x0) 14:20:07 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:07 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:07 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:07 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, 0x0, &(0x7f00000004c0)) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:07 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x0, 0x0) 14:20:07 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:07 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), 0x0) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:07 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:07 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:07 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:07 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) [ 468.472364][ T2557] device hsr_slave_1 left promiscuous mode [ 468.513649][ T2557] device hsr_slave_0 left promiscuous mode [ 468.573925][ T2557] team0 (unregistering): Port device team_slave_1 removed [ 468.584254][ T2557] team0 (unregistering): Port device team_slave_0 removed [ 468.595150][ T2557] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 468.636322][ T2557] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 468.704158][ T2557] bond0 (unregistering): Released all slaves 14:20:08 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, 0x0, 0x0) 14:20:08 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), 0x0) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:08 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:08 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:08 executing program 3: pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) r3 = accept4$alg(r2, 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000000040)=ANY=[], 0xfffffdea) splice(r0, 0x0, r3, 0x0, 0x0, 0x0) 14:20:08 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:08 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:08 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), 0x0) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:08 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:08 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, 0x0, 0x0) 14:20:08 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, 0x0, 0x0) 14:20:08 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, 0x0, 0x0) 14:20:09 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:09 executing program 1: open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:09 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:09 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 14:20:09 executing program 3: pipe(0x0) r0 = syz_open_dev$vbi(&(0x7f00000003c0)='/dev/vbi#\x00', 0x2, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000000)='\x00', 0x0) ioctl$FICLONE(r2, 0x40049409, 0xffffffffffffffff) clone(0x12102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fcntl$setlease(r2, 0x400, 0x1) fcntl$setown(r2, 0x8, 0x0) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x38) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) unshare(0x40000000) fcntl$getown(r1, 0x9) 14:20:09 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, 0x0) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:09 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 14:20:09 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:09 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 14:20:09 executing program 1: open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:09 executing program 3: pipe(0x0) r0 = syz_open_dev$vbi(&(0x7f00000003c0)='/dev/vbi#\x00', 0x2, 0x2) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000000)='\x00', 0x0) ioctl$FICLONE(r2, 0x40049409, 0xffffffffffffffff) clone(0x12102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) fcntl$setlease(r2, 0x400, 0x1) fcntl$setown(r2, 0x8, 0x0) ioctl$KDSIGACCEPT(r0, 0x4b4e, 0x38) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) unshare(0x40000000) fcntl$getown(r1, 0x9) 14:20:09 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 14:20:10 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:10 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 14:20:10 executing program 1: open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:10 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:10 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x111100, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x28, 0x0, 0x20, 0x0, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8}]}]}, 0x28}}, 0x0) sendmmsg(r1, &(0x7f0000005fc0), 0x800000000000059, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x8441, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x1c, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000000140)) timer_settime(0x0, 0x0, 0x0, 0x0) 14:20:10 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:10 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 14:20:10 executing program 1: fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:10 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x0, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:10 executing program 1: fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:10 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x111100, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x28, 0x0, 0x20, 0x0, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8}]}]}, 0x28}}, 0x0) sendmmsg(r1, &(0x7f0000005fc0), 0x800000000000059, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x8441, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x1c, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000000140)) timer_settime(0x0, 0x0, 0x0, 0x0) 14:20:10 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x0, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:11 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:11 executing program 1: fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:11 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x0, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:11 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:11 executing program 3: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) arch_prctl$ARCH_GET_GS(0x1004, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x111100, 0x0) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) sendmsg$TIPC_NL_MON_GET(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000001c0)={&(0x7f0000000240)={0x28, 0x0, 0x20, 0x0, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x8, 0x6, [@TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8}]}]}, 0x28}}, 0x0) sendmmsg(r1, &(0x7f0000005fc0), 0x800000000000059, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x8441, 0x0) timer_create(0x7, &(0x7f00000000c0)={0x0, 0x1c, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000000140)) timer_settime(0x0, 0x0, 0x0, 0x0) 14:20:11 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, 0x0, 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:11 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6}, 0x14}}, 0x0) 14:20:11 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6}, 0x14}}, 0x0) 14:20:11 executing program 1: r0 = open(0x0, 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:11 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6}, 0x14}}, 0x0) 14:20:11 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:11 executing program 1: r0 = open(0x0, 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:11 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, 0x0, 0x0, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:11 executing program 3: r0 = syz_open_dev$vivid(&(0x7f0000000280)='/dev/video#\x00', 0x0, 0x2) poll(&(0x7f00000002c0)=[{r0, 0x1}], 0x1, 0x0) 14:20:11 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:11 executing program 1: r0 = open(0x0, 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:11 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)) readv(r0, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:11 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, 0x0, 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:12 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:12 executing program 3: r0 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)={0x1, [0x0]}, &(0x7f000095dffc)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000000)={r1}, &(0x7f0000000080)=0x8) 14:20:12 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:12 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, 0x0, 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:12 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:12 executing program 3: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x401000000001, 0x0) close(r1) socket$netlink(0x10, 0x3, 0xa) r2 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) ftruncate(r0, 0x0) 14:20:12 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, 0x0, 0x0, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:12 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:12 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:12 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:12 executing program 3: r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x401000000001, 0x0) close(r1) socket$netlink(0x10, 0x3, 0xa) r2 = open(&(0x7f0000000400)='./bus\x00', 0x1141042, 0x0) ftruncate(r2, 0x2007fff) sendfile(r1, r2, 0x0, 0x8000fffffffe) ftruncate(r0, 0x0) 14:20:12 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(0xffffffffffffffff, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:12 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:12 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(0xffffffffffffffff, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:13 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:13 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:13 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(0xffffffffffffffff, &(0x7f0000001240)=[{&(0x7f00000000c0)=""/4096, 0x1000}], 0x1) 14:20:13 executing program 3: r0 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000400)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000600)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet6(0xa, 0x803, 0x3) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000140), 0x4) ioctl$int_in(r1, 0x5421, &(0x7f00000001c0)=0xfffffffffffffffe) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x78, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r3, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x2, 0x0, "a77760f5a7645bc43c241d69912dda0c63c2a66726f8cfafd6c8fe2c98de7ba44947a79015f0fe57917cb62a93987a938fdedfce7bbba4fec2d8a09c41fb233245f2604b9e07b8ab79ec15ef2818a179"}, 0xd8) bind$inet(r3, &(0x7f0000000180)={0x2, 0x4e23, @dev}, 0x10) connect$inet(r3, &(0x7f0000000040)={0x2, 0x4e23}, 0x10) ioctl$UI_SET_LEDBIT(0xffffffffffffffff, 0x40045569, 0x0) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000100), 0x4) sendto$inet(r3, &(0x7f0000000780)="4dbf3e8efaea4e41bdd59805fb1b0e52d5996616fb950c79bd537407b863cdf4507ee874896786e6c134cc5920ceceb5088d5cd6b66e58378683f0b340e216ce30733372fd6f4132719304559e302a6f843c601b483ef3fc25fe89c809eac31cd2932548280a694ef615dfbaf5efab30febcecfbc51a55a70a95a9aedacfd1d5816851f89fe81ed25b95d3cc0370a3a467afe91f812b1c600342f4606b9c09c77702592cf22710fcee3fe77032f0bcdca92fef6d75dec0256ef36db9005cdcb7b10d5f5ea1c8338a337eb1a688e16d00c2b4c91155917775e4ffe3de8fdff15f94ce10eda2dbc5dd1e7b53ff60c886ecdad129378dbbbc7312ea76ef8eb855f1121494a94c05e526be73534970534f9c60c5ce9071591381ece4649fdbc15e99a412c4b324040c29ab0ec89ee910b104cbda00ab34edcb6e35a5ac42178e1585e013581ad433aee18843732c4c20f5f23246171fa89c5f5bb65a47e3f5ff1bac47cf96d331b7343a6326f2cdaa50bc3189ab7e0a5cbaf253c6126835581f1e05b4b338a4b25c37af8034fd7a21ca93a97155246b7d09474c16b7d0bb8037eeb5c7775f423c71b260753abb78a8786c0319d482410f24204e11cd95610bc70bad8c8fb62cca68252342557e7023ab810b7deb70262d1b27329d9d986a9b1647788e089aa1d7353184102260de4744ce293d6ffec38c7dcfd25c68166c64befe479eb9d898717593fc9668572317c709c8e0b30d87f7fd9893b2afd6d2196c3416c8520b6472949caef587a4d7945e42f5d26dff7880665c649f4651351032e2a24b76a33cb2a90184f514098d99b8ee879b28252c3f16d4fef915e25a25e7d342b270d4120af6dd1d314f6043fe0352f145ade691683e30f18ed72daa3177450cb0711f0771e2a1b388926b880426d526931089ee130a94bd3370e83d5d3798c41ca5c721dabe3bb9df1b0c6febaaa672f12892a7802f6dd75efe02c4636b943f973f1cab4c78731663f1878b50b6f7096a798b7c47200f2fb9ec045940f4800374cee4100e4bee82c7716a9cdb3ebbaf2777271ccdf49635c60483cb7a500b452b969bf0ea9c79bd1144d9495c209aa8768e274d76329a02ef0421587ff37fbad54012af4f2b88cc1164555eb4876cf7ca926460f5ea0a80aed96534b685bed6c3e25ba15345447ae0f346b1fd971ebc7375ae31f76e1d146e6c039745efa9009b2fd27132243c92724d5e52ae758434078100466b1d78ca0296ee3c055d9df60309610b957467dc00567617bbe27c11e7b01c54f53c51d75834d482161aacb639eb2a5e22c2eb1c01a79d355e522acb0b34c46fbd3a1af21327fe026f0757ed4288fbc45fb46ad0fe51ccad151f9d1eea154979663ecc3928cb27dfaa6ebcacbda31e3dd87ed08f64b6662523d49ef158983a61195698053a982cead3c9f4822687ba648d7f540b6f827c2c44e7542419aed8ab140aea8b8aa7a5e51167ce27382dbbf2b69c55dc576e75450300fefca646663fca775d2569aacff075fcfffaff64333b95266f1aa30fb7ad7884affb45c1a6e71f2217a1e3f75faa70fbdebd764c0d1fa68b6bb37cc58f1b5e4fb78ab4a8b7c96fcab8ee41491f78bee38b4c8712e573db08cc6e52a66d839a47526f640381e172f1d90622518b874a9d84c8878beccefef7c047ec61c26e3b05a147de5f186a74f6c0e531e301c31c3294dd3ce046ce669b584b41746bfd06c1f89c9b291a630390a6f8a82cfcfe255a2c4e8f0a1dba5b07f154cc93542c057f954fbd469231476c3b04ff4cf4c35dbc98bb971fb9141f550f782047071795793ce6abb92f3a94fa57b30a7146df98d826ec64365a242488214e7d1132f69c087138a1c3a90212c5cb0ec85cc7b63a830373cb8a56748bb9fa2596d446aa2f30ab27722780012f2c5b351f27db32fe83cadb92e1b2918499df29e6bc41bbcb0ba4554c9d9a8452408d5ab89e1d0f0edd098ccac65807f4f797c95396a8d4ff2bda55dfeb73da5ee6897a47b8db2408581d1651bfa5d526b76cbafa6803891e695af83d36bce43d1b0b2eb3f0f9075ee4053d77b0d04a8fb08933329035b038a0669c5e3d26b1ecde665ae130b0705aa3b8fba6fc34afd86a6ca64f1e43b7e0a16b14feac5f13f6addf4a89a1166b46b235cf3be8a4b5f332893cab9d8252158787a4ef5b8e774f3947239f1e49761eec677f6ea67e8eeffecb5505d71f5bff36f61102adafc063f1c24919a4f0dd6558b52edbbf008281e35430c42f81ea8ad8755b0b05eb70cb23be35bdc2be1a7423b3d2ae2c8c0d818437cbb89c531f1a52a8e3896a8dc79b6f256ad18ba252239932dc82088f5020a71de5c82de3210f0ddaafd23106227f521c007322871dd0ff26dab912270901cd012c8aff6553a9b85363d8f8a7c4f73e584fb159137385fd26d0454b56626fa8cf88f4430b5756166fb9e62f793f15489fcb7c5209f493c4edeeaf44b002b9b84cb8014fb34ab7ad121cff28dda6a1b2718ff8daa68d55656af39feb7b5e0ab7f4cbac4b0f5170e8f9142e535219abb418ba20ad609e85aa64c484352af512a88588980b1c5037178802a8880a811e96f6738202d544b62b84861c1f680bc855458edd6ed0f65dfaa872746df047efbce7547db9f2dea723930c7bc51a0bc6db9cde7cc4da5393b0095f8cdd672007d838423dfe7cebf8403f0c1ae38fb14fbdbda27c03813e5b94d1d3a02c0aa216ecb6e64190e41da41380a53a29a691dc7977b3d5baccb64e7c2699023a1457355d032053653264d67393e6458a892c5ed7683e0cf214df7e2952736ddfcfa8a3fd0388261252193560a33a803e366e37ac11f361252708206e1accd9221f0ee943329470dc74bca3d5c364dca5fd045d0e6c6bf7fb63c4f6af5ea8295cd0b97a16e6a8bba5536e36752671c4ff9de2c935e74a4b555d993feb46c301abe716d3790367b8487b76f3f0132ffedd38e3ec8a3d4592c5b9b6e6213f83337b325fb9a89fcf2ff3d917a893c9e35a1922e47a78f992f2ff0b08662fc782680a3c6a450dfe3cfdc63af940fa2f78060a6b571ed32e3e195c5a7b22ee5241bacaa4f2a21106d7466de1e69710c2ad92a0ae8b856b1c7a16c37a6ef61a6e8baa259a71b59aae347593d440da024fd4c68e4795dc6c28bbbca7844cb67f571d50d251259b834239caae443878b106d57bfd30f04fc1e2ccb60a3361260f10766b8661b5c053ad8515e943f8084649d4df012b21dcea6fbc93d6301d74f7389b5c8469f443b65d1ec50b6ee8c21d7fa4f37fbf40624a9edaebc6fda984a52f0ca03e3fb22a6900649d544af15e2dd9f508b1aea1ce203105b76c933223060c1257dc83da955e19352038530e1c5014df6faed93d16ad734b1b3f454a00a2a7f737ad32ce989233193f539e90b3caf34cb893ff4f12ca96964719167210c8fdd801108c89ed1546b040efa010a6a6756e6022d66d47e8a0e34517633ee14082371b83e79e486dbf9a3309a121928926ea50c531604c52792bf950e768f1e462dbb22dae4f6e14af66ba38937c8df68c7101e084a0e25825be3d4ceda0cc4a84a601869f46dc06a8245c9a27d875a7b54a9f11183d2f38068240e29f92742ee04b0ef358607edf0bc322c53a069007dd7d25e6b0c7ccacf56a11daeaec121491ed83c327633d65d2c5ec3de0330a27dfaf4ad7ad765f3c5c628ac45d6a5f78f9b31727c097e401b5a1e12b283607e76ae9b754e1e1e802c9113084fd49be7bf93e3b3f675453fc552ff16eae7bc026146cf7d48ffc0480dd7f6f9decdd7cf98ef4f79faad3c815324fdfc2900a6324f8fbb53af378142a5bd976faa58632e629a8e993828f15e7b8d0d71f2e0cd2aa23dc503e67621741ffb2993f1108505a0c8ff48d2f766e4b8e76f1344a2763215c68e51d84cd229c52c8c315b4b56bdf37463ba5d226b2e9306c2b1e3384b08ef71746b01225b1f981bee7d6091df2e33260703a83ced8dd6d7c1515227a95c302a6da568935cda79bc86aa711f186e7242d50760b4b4b0ee5bf185612629d18ea0cebb4b47725203188cf209f06431a9d4b36ab8d6dc90cc2724bcdbc65b1a94cd9b543499d8253be487711489c2d4082c76d2149259846218f1c9e6dbf673d1fedbdfa7fca9ef1d741f5ef183221ef32b5aa3687ba6604e47ad3b98e4a0a56ef96a6a54079f3f91be9bb72f5b3106f364fd8381489d62e5f7c11c909c2d747c59856c3d0983d8833d3101c6a2eaf79a25a89830dfff44a5a3f0538d0c4d244a6c522f3dc414104e2d58f08a75bf060f95e7871a771e2694d92b863265b5be04d986911121a0f53cc76838f5d14c432c6139b2e4e5a927194b5c889f89ba719ce8325a19bcf20510866cdfd7d145ef79fb4d389a6f7497c0e5501fe239ee71259250dd417eda470cc230c06f6dead22beeb928afb917dcd448d22f7f814adf8653d5d4ee9bca6d08e0254eb5f319392f45acd0ea3c77d8d17e00eb118d9a40abda7ae1de915d18db03269078b7fd3f82ba3b1e55ebd2f71b6c37ed522225a019f7c8c57ace6f7c3676f3f3024eec2040a07be673d257aa99bfc14e3a9fd9a7b58eea4ba1afd8ba03f90000e13c73dd08601d8be18239593b72442be982a54c3e5992f19801180d1cacadcf2164dbe61389e65cdc6a5577354c1981f120a7fe85cae986ceabb9c3e42c38d5dea58418589372beba12701c824a496b29c2fbfe80f17510290659c92232ef4d99149f5b4a8c2105518091aaec7fa9a1724e135bb5f84d25856c8949c45d16bb5b38f7e1e5995cbe0fbcad6d4dcf8413f8ba66da53a059ca4b0ac8bfe8c2c642b15eaf8e059d678e01dc19a134da4177765f5f59638cfb05643706f1855828720a29fc1c9380d1eb9683424b74dc9887b6a2998bd041657655d83dd61f986e41edc653df84cd52819c576f3b935b23cfc96d6970eddbf4a0704bf7938f2130e5d80d73d1d43c510eddfb243ac2f5c2e6ece7a055cbe44fc5788b6146cd4ad145af1ba1a877890d0b7d4e616644c9d836b3c21a3adf7df43a646ba9f725d0f348dd32279b53834e7adf5c0eafbba548c961fc2a0071edffbfb84deb0359b34c100e14ba86243999a5e0285b0f7d22966c59e648d9c79cbb5ec96590efc835702417214412e1ad8f679ca3932e12ffd3491100f70ccb6c2a7defa0a1ea34a60879f5350d933b8d533eaff431e1fb354b55dc7bc03c6637e7713af3d13a3791aa1958bc4ec944b0c58564e8dec7d6e5680abbf8ab11bef46e236a70ca5f0da59cf7f5a174c56a997a152f6db5122ef1c7ddc328a5ea235a92412d66b4782bc899e9c2d29688c69aaceedcf824c901900c5273724e1fbc5f1e2f903b040f4df9863baeda27230ff6f295a14b827cb305383367d4cbbba0405e87c9dcba97dd38ccea859ff25aeb4b64681cbc0633a6f71f3dd8a6e9ed2a4dcef01aa8160298bba639f5d5d932608f69e141e1971685addf3592b360f8efc73b21b7082577ac1af1b7c125dc5c63adf987b91eecc63be1c77154bf1fd9eddb244e035667774a4bc5b1fea5294f903e1ae4806fcd34248e01223ce1238e84b0ad8c4509bd6424da82e47a7bd71ab8874d38f1dcaecdb9d1432c676c1804c191d64ae1fe229324ed90c333b3da80ab0ba26dd017ee181e81c985b26c7bc875c453c52ff81dadd4e534893c62b6bb778ae8a42d4707f9426d401049123c0a05b1a01115e3e9aa212a12168c6f8ee1a09e3ab4b2e28688dbe6813cde48560774757", 0x1000, 0x40800, 0x0, 0x0) dup3(r3, r2, 0x0) recvmsg(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000003ac0)=""/4096, 0x1000}], 0x1}, 0x0) 14:20:13 executing program 5: sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:13 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x0) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:13 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, 0x0, 0x0) 14:20:13 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, 0x0, 0x0, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:13 executing program 1: open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:13 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:13 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:13 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, 0x0, 0x0) 14:20:13 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:13 executing program 1: open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:14 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:14 executing program 3: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) openat$ppp(0xffffffffffffff9c, 0x0, 0x400, 0x0) mkdir(&(0x7f0000000340)='./file0\x00', 0x0) mount(0x0, &(0x7f0000027000)='./file0\x00', &(0x7f0000018ffa)='ramfs\x00', 0x50, 0x0) creat(0x0, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000000)='./bus\x00', 0x141042, 0x0) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000000c0)=0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RSTAT(0xffffffffffffffff, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(0xffffffffffffffff, 0xc06864a2, 0x0) sendfile(r1, r1, &(0x7f0000000140), 0x7fff) 14:20:14 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, 0x0, 0x0) 14:20:14 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, 0x0, 0x0) 14:20:14 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:14 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:14 executing program 1: open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:14 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:14 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240), 0x0) 14:20:14 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, 0x0, 0x0) 14:20:14 executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r0, 0x84, 0x1d, &(0x7f000095dff8)=ANY=[@ANYBLOB="d4f7cfff", @ANYRES32=0x0], 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000000)={0x0, 0x4, 0xc9, 0x2, r1}, &(0x7f0000000040)=0x10) 14:20:14 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, 0x0, 0x0) 14:20:14 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240), 0x0) 14:20:14 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:14 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r1 = socket$inet(0x10, 0x3, 0xc) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:14 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:14 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) [ 475.169150][T26414] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 475.208153][T26413] syz-executor.3 (26413) used greatest stack depth: 23640 bytes left 14:20:15 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:15 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:15 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240), 0x0) 14:20:15 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r1 = socket$inet(0x10, 0x3, 0xc) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:15 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 14:20:15 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:15 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) 14:20:15 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{0x0}], 0x1) 14:20:15 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:15 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:15 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r1 = socket$inet(0x10, 0x3, 0xc) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:15 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 14:20:16 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:16 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{0x0}], 0x1) 14:20:16 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r1 = socket$inet(0x10, 0x3, 0xc) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:16 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 14:20:16 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[], 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:16 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:16 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 14:20:16 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001140)=0x1b) readv(r0, &(0x7f0000001240)=[{0x0}], 0x1) 14:20:16 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[], 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:16 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 476.794589][T26479] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 14:20:16 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r1 = socket$inet(0x10, 0x3, 0xc) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:16 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) [ 476.988412][T26503] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 476.995064][T26500] syz-executor.3 (26500) used greatest stack depth: 23384 bytes left 14:20:17 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000880)='cifs.idmap\x00', &(0x7f00000008c0)={'syz', 0x2}, &(0x7f0000000900)='\x00', 0xfffffffffffffffd) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r2 = socket$inet(0x10, 0x3, 0xc) lstat(0x0, 0x0) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r3) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:17 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[], 0x0) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:17 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:17 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:17 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r1 = socket$inet(0x10, 0x3, 0xc) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r2) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:17 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0x0, 0x6, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:17 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 477.665042][T26511] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 477.697192][T26520] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. 14:20:17 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x0, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:17 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000880)='cifs.idmap\x00', &(0x7f00000008c0)={'syz'}, 0x0, 0xfffffffffffffffd) request_key(0x0, 0x0, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r1) keyctl$reject(0x13, 0x0, 0x0, 0x8, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r2 = socket$inet(0x10, 0x3, 0xc) lstat(0x0, 0x0) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, 0x0, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r3) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:17 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:17 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000880)='cifs.idmap\x00', &(0x7f00000008c0)={'syz', 0x2}, &(0x7f0000000900)='\x00', 0xfffffffffffffffd) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r2 = socket$inet(0x10, 0x3, 0xc) lstat(0x0, 0x0) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r3) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) [ 477.936248][T26641] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 477.948379][T26639] FS-Cache: Duplicate cookie detected [ 477.954589][T26639] FS-Cache: O-cookie c=00000000e6c7b5d2 [p=00000000dbbc8d1b fl=222 nc=0 na=1] [ 477.963577][T26639] FS-Cache: O-cookie d=0000000083406317 n=00000000e1d67a96 [ 477.970919][T26639] FS-Cache: O-key=[10] '02000200000002000000' [ 477.977258][T26639] FS-Cache: N-cookie c=00000000af4e4e5a [p=00000000dbbc8d1b fl=2 nc=0 na=1] [ 477.986176][T26639] FS-Cache: N-cookie d=0000000083406317 n=0000000002c373a4 [ 477.993476][T26639] FS-Cache: N-key=[10] '02000200000002000000' [ 478.000615][T26637] syz-executor.3 (26637) used greatest stack depth: 23368 bytes left [ 478.081716][T26639] syz-executor.4 (26639) used greatest stack depth: 23304 bytes left 14:20:18 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:18 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:18 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x0, 0xffffffffffffffff}, 0x14}}, 0x0) 14:20:18 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) 14:20:18 executing program 3: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000880)='cifs.idmap\x00', &(0x7f00000008c0)={'syz'}, 0x0, 0xfffffffffffffffd) request_key(0x0, 0x0, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) r1 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(0xffffffffffffffff, 0x4c80, r1) keyctl$reject(0x13, 0x0, 0x0, 0x8, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r2 = socket$inet(0x10, 0x3, 0xc) lstat(0x0, 0x0) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(0xffffffffffffffff, 0x0, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r3) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000880)='cifs.idmap\x00', &(0x7f00000008c0)={'syz', 0x2}, &(0x7f0000000900)='\x00', 0xfffffffffffffffd) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) r1 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r1) keyctl$reject(0x13, 0x0, 0x0, 0x0, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r2 = socket$inet(0x10, 0x3, 0xc) lstat(0x0, 0x0) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r3) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) 14:20:18 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:18 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x12, &(0x7f0000000100)=0xcf50, 0x4) [ 478.499050][T26762] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. [ 478.530165][T26757] FS-Cache: Duplicate cookie detected [ 478.536045][T26757] FS-Cache: O-cookie c=0000000029a354b7 [p=00000000dbbc8d1b fl=222 nc=0 na=1] 14:20:18 executing program 3: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(0x0, 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r1) pipe2(&(0x7f0000000040), 0x84800) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') 14:20:18 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x0, 0xffffffffffffffff}, 0x14}}, 0x0) [ 478.545081][T26757] FS-Cache: O-cookie d=0000000083406317 n=00000000d7295386 [ 478.552425][T26757] FS-Cache: O-key=[10] '02000200000002000000' [ 478.558807][T26757] FS-Cache: N-cookie c=000000002980b965 [p=00000000dbbc8d1b fl=2 nc=0 na=1] [ 478.567571][T26757] FS-Cache: N-cookie d=0000000083406317 n=00000000eba7462d [ 478.574875][T26757] FS-Cache: N-key=[10] '02000200000002000000' 14:20:18 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 478.635174][T26757] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 14:20:18 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6}, 0x14}}, 0x0) 14:20:18 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f00000001c0)=""/17, 0x11}, 0x0) 14:20:18 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f0000000100)=0xcf50, 0x4) 14:20:18 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000880)='cifs.idmap\x00', &(0x7f00000008c0)={'syz', 0x2}, &(0x7f0000000900)='\x00', 0xfffffffffffffffd) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r2) keyctl$reject(0x13, 0x0, 0x0, 0x8, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r3 = socket$inet(0x10, 0x3, 0xc) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000080)=r1, 0x4) lstat(0x0, 0x0) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000380)={0x22, 0x3, 0x0, {0x0, 0x1, 0x0, '\x00'}}, 0x22) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r4) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) mknod(0x0, 0x5c279bd58d2b0cfe, 0x0) 14:20:18 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6}, 0x14}}, 0x0) 14:20:18 executing program 3: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(0x0, 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r1) pipe2(&(0x7f0000000040), 0x84800) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') 14:20:18 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:18 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001e40)={0x14, 0xe, 0x6}, 0x14}}, 0x0) 14:20:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f0000000100)=0xcf50, 0x4) [ 479.333201][T26797] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. 14:20:19 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:19 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(0x0, 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r1) pipe2(&(0x7f0000000040), 0x84800) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') 14:20:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x0, &(0x7f0000000100)=0xcf50, 0x4) 14:20:19 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:19 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1}, 0x0) 14:20:19 executing program 4: openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0) request_key(&(0x7f0000000880)='cifs.idmap\x00', &(0x7f00000008c0)={'syz', 0x2}, &(0x7f0000000900)='\x00', 0xfffffffffffffffd) request_key(0x0, &(0x7f0000000780)={'syz', 0x2}, &(0x7f00000001c0)='vboxnet1\x00', 0xfffffffffffffffb) r2 = ioctl$LOOP_CTL_GET_FREE(r0, 0x4c82) ioctl$LOOP_CTL_ADD(r0, 0x4c80, r2) keyctl$reject(0x13, 0x0, 0x0, 0x8, 0x0) sendmsg$NBD_CMD_STATUS(0xffffffffffffffff, 0x0, 0x20000000) clone(0x103, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f00000003c0)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) ioctl$TCSBRKP(r0, 0x5425, 0x7) r3 = socket$inet(0x10, 0x3, 0xc) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000080)=r1, 0x4) lstat(0x0, 0x0) syz_open_dev$vcsa(0x0, 0x9, 0x440000) sendmsg(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="24000000030307031dfffd944ef20c0020200a0009000100021d85680c1baba20400ff7e28000000110affff82aba0aa1c0009b356da5a80918b06b20cd37ed01cc000"/76, 0x4c}], 0x1}, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000380)={0x22, 0x3, 0x0, {0x0, 0x1, 0x0, '\x00'}}, 0x22) add_key$user(0x0, 0x0, &(0x7f0000000400)="7fccd60d1802ce06741e8361f9d74dcb36d2a90bef643e6e392bb5c2d93f792309ed877fe030301086ebdb69cfb9091a9c7a56fc5cb277c89fdbcc01761471aca8bdffa5e4abd4d2b3e457d0fe7e6a2b4bf4cbe05fddf6a1ddc8de5d261c1f5e57130db7141eb375e05fd21e84f9b4ce54e5b64caa8f10", 0x77, 0xfffffffffffffffd) semctl$SETALL(0x0, 0x0, 0x11, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000180)=0x0) getpriority(0x0, r4) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000300)) mknod(0x0, 0x5c279bd58d2b0cfe, 0x0) 14:20:19 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, 0x0, 0x0) 14:20:19 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) [ 480.183416][T26924] netlink: 20 bytes leftover after parsing attributes in process `syz-executor.4'. [ 480.532046][ T55] device bridge_slave_1 left promiscuous mode [ 480.538502][ T55] bridge0: port 2(bridge_slave_1) entered disabled state [ 480.571707][ T55] device bridge_slave_0 left promiscuous mode [ 480.577962][ T55] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.333163][ T55] device hsr_slave_1 left promiscuous mode [ 481.374138][ T55] device hsr_slave_0 left promiscuous mode [ 481.423331][ T55] team0 (unregistering): Port device team_slave_1 removed [ 481.435106][ T55] team0 (unregistering): Port device team_slave_0 removed [ 481.444292][ T55] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 481.473606][ T55] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 481.522980][ T55] bond0 (unregistering): Released all slaves [ 481.635383][T27039] IPVS: ftp: loaded support on port[0] = 21 [ 481.680467][T27039] chnl_net:caif_netlink_parms(): no params data found [ 481.707127][T27039] bridge0: port 1(bridge_slave_0) entered blocking state [ 481.714273][T27039] bridge0: port 1(bridge_slave_0) entered disabled state [ 481.722094][T27039] device bridge_slave_0 entered promiscuous mode [ 481.729291][T27039] bridge0: port 2(bridge_slave_1) entered blocking state [ 481.736523][T27039] bridge0: port 2(bridge_slave_1) entered disabled state [ 481.744361][T27039] device bridge_slave_1 entered promiscuous mode [ 481.763665][T27039] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 481.773218][T27039] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 481.788301][T27039] team0: Port device team_slave_0 added [ 481.795232][T27039] team0: Port device team_slave_1 added [ 481.872307][T27039] device hsr_slave_0 entered promiscuous mode [ 481.911115][T27039] device hsr_slave_1 entered promiscuous mode [ 482.006097][T27039] bridge0: port 2(bridge_slave_1) entered blocking state [ 482.013168][T27039] bridge0: port 2(bridge_slave_1) entered forwarding state [ 482.020410][T27039] bridge0: port 1(bridge_slave_0) entered blocking state [ 482.027494][T27039] bridge0: port 1(bridge_slave_0) entered forwarding state [ 482.050409][T27039] 8021q: adding VLAN 0 to HW filter on device bond0 [ 482.062122][T27041] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 482.069988][T27041] bridge0: port 1(bridge_slave_0) entered disabled state [ 482.078308][T27041] bridge0: port 2(bridge_slave_1) entered disabled state [ 482.090283][T27039] 8021q: adding VLAN 0 to HW filter on device team0 [ 482.100762][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 482.109810][ T3481] bridge0: port 1(bridge_slave_0) entered blocking state [ 482.116941][ T3481] bridge0: port 1(bridge_slave_0) entered forwarding state [ 482.136112][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 482.144558][ T9066] bridge0: port 2(bridge_slave_1) entered blocking state [ 482.151650][ T9066] bridge0: port 2(bridge_slave_1) entered forwarding state [ 482.172858][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 482.181753][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 482.190109][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 482.201910][T27039] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 482.213494][T27039] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 482.221974][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 482.230405][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 482.249784][T27039] 8021q: adding VLAN 0 to HW filter on device batadv0 14:20:22 executing program 3: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xf7d, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="390000001300098417feb1ae7aa76ff40000ff3f0e000000000000000020001419000200674100000a00005df0474d04671982690000000000", 0x39}], 0x1) syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x0, 0x440) ioctl$BLKGETSIZE(0xffffffffffffffff, 0x1260, 0x0) 14:20:22 executing program 5: lsetxattr$trusted_overlay_opaque(0x0, 0x0, &(0x7f0000000440)='y\x00', 0x2, 0x3) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount$bpf(0x20000000, &(0x7f00000000c0)='./file0\x00', 0x0, 0x2001001, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmctl$SHM_UNLOCK(0x0, 0xc) r0 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x400200, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, [], 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) ioctl$BLKROSET(r0, 0x125d, 0x0) readlink(0x0, 0x0, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000d40)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000240)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4004}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) fchdir(r1) pipe2(&(0x7f0000000040), 0x84800) set_robust_list(&(0x7f00000001c0)={0x0, 0x9093, &(0x7f0000000180)={&(0x7f0000000080)}}, 0x18) pivot_root(&(0x7f0000000140)='./file0\x00', &(0x7f0000000100)='./file0\x00') 14:20:22 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:22 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, 0x0, 0x0) 14:20:22 executing program 4: setsockopt$inet6_udp_encap(0xffffffffffffffff, 0x11, 0x64, &(0x7f0000000140), 0x4) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000005c0)=0x78, 0x4) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000280)={@in={{0x2, 0x0, @loopback}}, 0x0, 0x2, 0x0, "a77760f5a7645bc43c241d69912dda0c63c2a66726f8cfafd6c8fe2c98de7ba44947a79015f0fe57917cb62a93987a938fdedfce7bbba4fec2d8a09c41fb233245f2604b9e07b8ab79ec15ef2818a179"}, 0xd8) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @dev}, 0x10) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23}, 0x10) getsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x1b, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000780)="4dbf3e8efaea4e41bdd59805fb1b0e52d5996616fb950c79bd537407b863cdf4507ee874896786e6c134cc5920ceceb5088d5cd6b66e58378683f0b340e216ce30733372fd6f4132719304559e302a6f843c601b483ef3fc25fe89c809eac31cd2932548280a694ef615dfbaf5efab30febcecfbc51a55a70a95a9aedacfd1d5816851f89fe81ed25b95d3cc0370a3a467afe91f812b1c600342f4606b9c09c77702592cf22710fcee3fe77032f0bcdca92fef6d75dec0256ef36db9005cdcb7b10d5f5ea1c8338a337eb1a688e16d00c2b4c91155917775e4ffe3de8fdff15f94ce10eda2dbc5dd1e7b53ff60c886ecdad129378dbbbc7312ea76ef8eb855f1121494a94c05e526be73534970534f9c60c5ce9071591381ece4649fdbc15e99a412c4b324040c29ab0ec89ee910b104cbda00ab34edcb6e35a5ac42178e1585e013581ad433aee18843732c4c20f5f23246171fa89c5f5bb65a47e3f5ff1bac47cf96d331b7343a6326f2cdaa50bc3189ab7e0a5cbaf253c6126835581f1e05b4b338a4b25c37af8034fd7a21ca93a97155246b7d09474c16b7d0bb8037eeb5c7775f423c71b260753abb78a8786c0319d482410f24204e11cd95610bc70bad8c8fb62cca68252342557e7023ab810b7deb70262d1b27329d9d986a9b1647788e089aa1d7353184102260de4744ce293d6ffec38c7dcfd25c68166c64befe479eb9d898717593fc9668572317c709c8e0b30d87f7fd9893b2afd6d2196c3416c8520b6472949caef587a4d7945e42f5d26dff7880665c649f4651351032e2a24b76a33cb2a90184f514098d99b8ee879b28252c3f16d4fef915e25a25e7d342b270d4120af6dd1d314f6043fe0352f145ade691683e30f18ed72daa3177450cb0711f0771e2a1b388926b880426d526931089ee130a94bd3370e83d5d3798c41ca5c721dabe3bb9df1b0c6febaaa672f12892a7802f6dd75efe02c4636b943f973f1cab4c78731663f1878b50b6f7096a798b7c47200f2fb9ec045940f4800374cee4100e4bee82c7716a9cdb3ebbaf2777271ccdf49635c60483cb7a500b452b969bf0ea9c79bd1144d9495c209aa8768e274d76329a02ef0421587ff37fbad54012af4f2b88cc1164555eb4876cf7ca926460f5ea0a80aed96534b685bed6c3e25ba15345447ae0f346b1fd971ebc7375ae31f76e1d146e6c039745efa9009b2fd27132243c92724d5e52ae758434078100466b1d78ca0296ee3c055d9df60309610b957467dc00567617bbe27c11e7b01c54f53c51d75834d482161aacb639eb2a5e22c2eb1c01a79d355e522acb0b34c46fbd3a1af21327fe026f0757ed4288fbc45fb46ad0fe51ccad151f9d1eea154979663ecc3928cb27dfaa6ebcacbda31e3dd87ed08f64b6662523d49ef158983a61195698053a982cead3c9f4822687ba648d7f540b6f827c2c44e7542419aed8ab140aea8b8aa7a5e51167ce27382dbbf2b69c55dc576e75450300fefca646663fca775d2569aacff075fcfffaff64333b95266f1aa30fb7ad7884affb45c1a6e71f2217a1e3f75faa70fbdebd764c0d1fa68b6bb37cc58f1b5e4fb78ab4a8b7c96fcab8ee41491f78bee38b4c8712e573db08cc6e52a66d839a47526f640381e172f1d90622518b874a9d84c8878beccefef7c047ec61c26e3b05a147de5f186a74f6c0e531e301c31c3294dd3ce046ce669b584b41746bfd06c1f89c9b291a630390a6f8a82cfcfe255a2c4e8f0a1dba5b07f154cc93542c057f954fbd469231476c3b04ff4cf4c35dbc98bb971fb9141f550f782047071795793ce6abb92f3a94fa57b30a7146df98d826ec64365a242488214e7d1132f69c087138a1c3a90212c5cb0ec85cc7b63a830373cb8a56748bb9fa2596d446aa2f30ab27722780012f2c5b351f27db32fe83cadb92e1b2918499df29e6bc41bbcb0ba4554c9d9a8452408d5ab89e1d0f0edd098ccac65807f4f797c95396a8d4ff2bda55dfeb73da5ee6897a47b8db2408581d1651bfa5d526b76cbafa6803891e695af83d36bce43d1b0b2eb3f0f9075ee4053d77b0d04a8fb08933329035b038a0669c5e3d26b1ecde665ae130b0705aa3b8fba6fc34afd86a6ca64f1e43b7e0a16b14feac5f13f6addf4a89a1166b46b235cf3be8a4b5f332893cab9d8252158787a4ef5b8e774f3947239f1e49761eec677f6ea67e8eeffecb5505d71f5bff36f61102adafc063f1c24919a4f0dd6558b52edbbf008281e35430c42f81ea8ad8755b0b05eb70cb23be35bdc2be1a7423b3d2ae2c8c0d818437cbb89c531f1a52a8e3896a8dc79b6f256ad18ba252239932dc82088f5020a71de5c82de3210f0ddaafd23106227f521c007322871dd0ff26dab912270901cd012c8aff6553a9b85363d8f8a7c4f73e584fb159137385fd26d0454b56626fa8cf88f4430b5756166fb9e62f793f15489fcb7c5209f493c4edeeaf44b002b9b84cb8014fb34ab7ad121cff28dda6a1b2718ff8daa68d55656af39feb7b5e0ab7f4cbac4b0f5170e8f9142e535219abb418ba20ad609e85aa64c484352af512a88588980b1c5037178802a8880a811e96f6738202d544b62b84861c1f680bc855458edd6ed0f65dfaa872746df047efbce7547db9f2dea723930c7bc51a0bc6db9cde7cc4da5393b0095f8cdd672007d838423dfe7cebf8403f0c1ae38fb14fbdbda27c03813e5b94d1d3a02c0aa216ecb6e64190e41da41380a53a29a691dc7977b3d5baccb64e7c2699023a1457355d032053653264d67393e6458a892c5ed7683e0cf214df7e2952736ddfcfa8a3fd0388261252193560a33a803e366e37ac11f361252708206e1accd9221f0ee943329470dc74bca3d5c364dca5fd045d0e6c6bf7fb63c4f6af5ea8295cd0b97a16e6a8bba5536e36752671c4ff9de2c935e74a4b555d993feb46c301abe716d3790367b8487b76f3f0132ffedd38e3ec8a3d4592c5b9b6e6213f83337b325fb9a89fcf2ff3d917a893c9e35a1922e47a78f992f2ff0b08662fc782680a3c6a450dfe3cfdc63af940fa2f78060a6b571ed32e3e195c5a7b22ee5241bacaa4f2a21106d7466de1e69710c2ad92a0ae8b856b1c7a16c37a6ef61a6e8baa259a71b59aae347593d440da024fd4c68e4795dc6c28bbbca7844cb67f571d50d251259b834239caae443878b106d57bfd30f04fc1e2ccb60a3361260f10766b8661b5c053ad8515e943f8084649d4df012b21dcea6fbc93d6301d74f7389b5c8469f443b65d1ec50b6ee8c21d7fa4f37fbf40624a9edaebc6fda984a52f0ca03e3fb22a6900649d544af15e2dd9f508b1aea1ce203105b76c933223060c1257dc83da955e19352038530e1c5014df6faed93d16ad734b1b3f454a00a2a7f737ad32ce989233193f539e90b3caf34cb893ff4f12ca96964719167210c8fdd801108c89ed1546b040efa010a6a6756e6022d66d47e8a0e34517633ee14082371b83e79e486dbf9a3309a121928926ea50c531604c52792bf950e768f1e462dbb22dae4f6e14af66ba38937c8df68c7101e084a0e25825be3d4ceda0cc4a84a601869f46dc06a8245c9a27d875a7b54a9f11183d2f38068240e29f92742ee04b0ef358607edf0bc322c53a069007dd7d25e6b0c7ccacf56a11daeaec121491ed83c327633d65d2c5ec3de0330a27dfaf4ad7ad765f3c5c628ac45d6a5f78f9b31727c097e401b5a1e12b283607e76ae9b754e1e1e802c9113084fd49be7bf93e3b3f675453fc552ff16eae7bc026146cf7d48ffc0480dd7f6f9decdd7cf98ef4f79faad3c815324fdfc2900a6324f8fbb53af378142a5bd976faa58632e629a8e993828f15e7b8d0d71f2e0cd2aa23dc503e67621741ffb2993f1108505a0c8ff48d2f766e4b8e76f1344a2763215c68e51d84cd229c52c8c315b4b56bdf37463ba5d226b2e9306c2b1e3384b08ef71746b01225b1f981bee7d6091df2e33260703a83ced8dd6d7c1515227a95c302a6da568935cda79bc86aa711f186e7242d50760b4b4b0ee5bf185612629d18ea0cebb4b47725203188cf209f06431a9d4b36ab8d6dc90cc2724bcdbc65b1a94cd9b543499d8253be487711489c2d4082c76d2149259846218f1c9e6dbf673d1fedbdfa7fca9ef1d741f5ef183221ef32b5aa3687ba6604e47ad3b98e4a0a56ef96a6a54079f3f91be9bb72f5b3106f364fd8381489d62e5f7c11c909c2d747c59856c3d0983d8833d3101c6a2eaf79a25a89830dfff44a5a3f0538d0c4d244a6c522f3dc414104e2d58f08a75bf060f95e7871a771e2694d92b863265b5be04d986911121a0f53cc76838f5d14c432c6139b2e4e5a927194b5c889f89ba719ce8325a19bcf20510866cdfd7d145ef79fb4d389a6f7497c0e5501fe239ee71259250dd417eda470cc230c06f6dead22beeb928afb917dcd448d22f7f814adf8653d5d4ee9bca6d08e0254eb5f319392f45acd0ea3c77d8d17e00eb118d9a40abda7ae1de915d18db03269078b7fd3f82ba3b1e55ebd2f71b6c37ed522225a019f7c8c57ace6f7c3676f3f3024eec2040a07be673d257aa99bfc14e3a9fd9a7b58eea4ba1afd8ba03f90000e13c73dd08601d8be18239593b72442be982a54c3e5992f19801180d1cacadcf2164dbe61389e65cdc6a5577354c1981f120a7fe85cae986ceabb9c3e42c38d5dea58418589372beba12701c824a496b29c2fbfe80f17510290659c92232ef4d99149f5b4a8c2105518091aaec7fa9a1724e135bb5f84d25856c8949c45d16bb5b38f7e1e5995cbe0fbcad6d4dcf8413f8ba66da53a059ca4b0ac8bfe8c2c642b15eaf8e059d678e01dc19a134da4177765f5f59638cfb05643706f1855828720a29fc1c9380d1eb9683424b74dc9887b6a2998bd041657655d83dd61f986e41edc653df84cd52819c576f3b935b23cfc96d6970eddbf4a0704bf7938f2130e5d80d73d1d43c510eddfb243ac2f5c2e6ece7a055cbe44fc5788b6146cd4ad145af1ba1a877890d0b7d4e616644c9d836b3c21a3adf7df43a646ba9f725d0f348dd32279b53834e7adf5c0eafbba548c961fc2a0071edffbfb84deb0359b34c100e14ba86243999a5e0285b0f7d22966c59e648d9c79cbb5ec96590efc835702417214412e1ad8f679ca3932e12ffd3491100f70ccb6c2a7defa0a1ea34a60879f5350d933b8d533eaff431e1fb354b55dc7bc03c6637e7713af3d13a3791aa1958bc4ec944b0c58564e8dec7d6e5680abbf8ab11bef46e236a70ca5f0da59cf7f5a174c56a997a152f6db5122ef1c7ddc328a5ea235a92412d66b4782bc899e9c2d29688c69aaceedcf824c901900c5273724e1fbc5f1e2f903b040f4df9863baeda27230ff6f295a14b827cb305383367d4cbbba0405e87c9dcba97dd38ccea859ff25aeb4b64681cbc0633a6f71f3dd8a6e9ed2a4dcef01aa8160298bba639f5d5d932608f69e141e1971685addf3592b360f8efc73b21b7082577ac1af1b7c125dc5c63adf987b91eecc63be1c77154bf1fd9eddb244e035667774a4bc5b1fea5294f903e1ae4806fcd34248e01223ce1238e84b0ad8c4509bd6424da82e47a7bd71ab8874d38f1dcaecdb9d1432c676c1804c191d64ae1fe229324ed90c333b3da80ab0ba26dd017ee181e81c985b26c7bc875c453c52ff81dadd4e534893c62b6bb778ae8a42d4707f9426d401049123c0a05b1a01115e3e9aa212a12168c6f8ee1a09e3ab4b2e28688dbe6813cde48560774757", 0x1000, 0x40800, 0x0, 0x0) 14:20:22 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1}, 0x0) 14:20:22 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, 0x0, 0x0) 14:20:22 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:22 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) close(r0) socket$kcm(0xa, 0x4000000000080002, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x8941, &(0x7f0000000240)=0x1) 14:20:22 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100), 0x4) 14:20:22 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:22 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380), 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:22 executing program 3: bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, &(0x7f0000000200)}, 0x20) socketpair(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89fa, &(0x7f0000000040)='sit0\x00\xf5\xf7\x9b\xe6\x81\xd7\xd1\xb5\x06&\x80\x00`p') [ 483.998122][T27279] IPVS: ftp: loaded support on port[0] = 21 [ 484.098272][T27279] chnl_net:caif_netlink_parms(): no params data found [ 484.176355][T27279] bridge0: port 1(bridge_slave_0) entered blocking state [ 484.183599][T27279] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.191481][T27279] device bridge_slave_0 entered promiscuous mode [ 484.198674][T27279] bridge0: port 2(bridge_slave_1) entered blocking state [ 484.206247][T27279] bridge0: port 2(bridge_slave_1) entered disabled state [ 484.215851][T27279] device bridge_slave_1 entered promiscuous mode [ 484.234322][T27279] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 484.243981][T27279] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 484.257127][ T55] device bridge_slave_1 left promiscuous mode [ 484.263600][ T55] bridge0: port 2(bridge_slave_1) entered disabled state [ 484.311671][ T55] device bridge_slave_0 left promiscuous mode [ 484.317846][ T55] bridge0: port 1(bridge_slave_0) entered disabled state [ 484.372185][ T55] device bridge_slave_1 left promiscuous mode [ 484.378334][ T55] bridge0: port 2(bridge_slave_1) entered disabled state [ 484.431719][ T55] device bridge_slave_0 left promiscuous mode [ 484.437871][ T55] bridge0: port 1(bridge_slave_0) entered disabled state [ 485.782670][ T55] device hsr_slave_1 left promiscuous mode [ 485.824294][ T55] device hsr_slave_0 left promiscuous mode [ 485.864184][ T55] team0 (unregistering): Port device team_slave_1 removed [ 485.874306][ T55] team0 (unregistering): Port device team_slave_0 removed [ 485.884750][ T55] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 485.924557][ T55] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 485.991488][ T55] bond0 (unregistering): Released all slaves [ 486.142320][ T55] device hsr_slave_1 left promiscuous mode [ 486.194256][ T55] device hsr_slave_0 left promiscuous mode [ 486.243270][ T55] team0 (unregistering): Port device team_slave_1 removed [ 486.253977][ T55] team0 (unregistering): Port device team_slave_0 removed [ 486.263551][ T55] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 486.294863][ T55] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 486.361304][ T55] bond0 (unregistering): Released all slaves [ 486.467371][T27279] team0: Port device team_slave_0 added [ 486.473799][T27279] team0: Port device team_slave_1 added [ 486.512292][T27279] device hsr_slave_0 entered promiscuous mode [ 486.581279][T27279] device hsr_slave_1 entered promiscuous mode [ 486.672886][T27279] 8021q: adding VLAN 0 to HW filter on device bond0 [ 486.684362][T27041] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 486.693440][T27041] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 486.706470][T27279] 8021q: adding VLAN 0 to HW filter on device team0 [ 486.715511][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 486.725381][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 486.733675][ T17] bridge0: port 1(bridge_slave_0) entered blocking state [ 486.740696][ T17] bridge0: port 1(bridge_slave_0) entered forwarding state [ 486.748436][ T17] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 486.757769][T27041] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 486.766559][T27041] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 486.775282][T27041] bridge0: port 2(bridge_slave_1) entered blocking state [ 486.782363][T27041] bridge0: port 2(bridge_slave_1) entered forwarding state [ 486.793725][T27042] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 486.809711][T27279] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 486.820393][T27279] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 486.832190][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 486.840626][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 486.849147][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 486.857597][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 486.866399][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 486.874754][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 486.882956][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 486.891173][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 486.898680][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 486.914422][T27279] 8021q: adding VLAN 0 to HW filter on device batadv0 14:20:26 executing program 5: r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="2400000000000000290000003e0000008102020100ff3a06fe80000000000000b87f25f8"], 0x24}, 0x0) 14:20:26 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100), 0x4) 14:20:26 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:26 executing program 4: r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$kcm(r0, &(0x7f00000003c0)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8914, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) 14:20:26 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000000000)="c7", 0x1}], 0x1}, 0x0) 14:20:26 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x1, 0x1, 0x0, &(0x7f0000000140)={0x0, 0x0}) write$cgroup_int(r2, &(0x7f0000000980), 0xffffff4d) recvmsg$kcm(r1, &(0x7f0000000200)={&(0x7f0000000040)=@ax25, 0x80, &(0x7f0000000000)=[{&(0x7f0000000080)=""/151, 0x97}], 0x1}, 0x0) 14:20:26 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:26 executing program 2: syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(0xffffffffffffffff, 0x40e, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000180)=0x1ff, 0x4) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x0, &(0x7f0000000280)=0x3, 0x4) lsetxattr$trusted_overlay_upper(&(0x7f00000001c0)='./file1\x00', 0x0, &(0x7f0000000340)=ANY=[], 0x0, 0x3) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00000000c0), 0x2ba) recvmsg(r1, &(0x7f00000005c0)={&(0x7f0000000040)=@nfc, 0x80, &(0x7f0000000740)=[{&(0x7f0000003ac0)=""/4096, 0xd400}], 0x1, &(0x7f0000000200)=""/20, 0x14}, 0x100) r2 = dup3(0xffffffffffffffff, r0, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000540), 0x4) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480), &(0x7f00000004c0)=0xc) fsetxattr$security_capability(r1, &(0x7f0000000400)='security.capability\x00', 0x0, 0x0, 0x2) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000100), 0x4) 14:20:26 executing program 4: socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) socket$kcm(0x2, 0x0, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r1 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000040)={0xffffffffffffffff, 0x6, 0x18}, 0xc) recvmsg(r0, &(0x7f0000007180)={&(0x7f0000006c40)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x80, &(0x7f0000007100)=[{&(0x7f0000006cc0)=""/199, 0xc7}, {&(0x7f0000006dc0)=""/19, 0x13}, {&(0x7f0000006e00)=""/180, 0xb4}, {&(0x7f0000006ec0)=""/158, 0x9e}, {&(0x7f0000006f80)=""/143, 0x8f}, {&(0x7f0000007040)=""/167, 0xa7}], 0x6}, 0x2000) bpf$MAP_CREATE(0x0, &(0x7f00000071c0)={0x11, 0x40, 0xc3ab, 0x1000, 0x22, r1, 0x7, [], r2, r0, 0x7, 0x93a6}, 0x3c) bpf$BPF_PROG_GET_FD_BY_ID(0xd, 0x0, 0x0) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r3 = socket$kcm(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) socket$kcm(0x29, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x800, [], 0x0, 0xffffffffffffffff, 0x3}, 0x3c) socket$kcm(0x29, 0x7, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x8916, &(0x7f0000000000)={r0}) 14:20:26 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{0x0}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:26 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, 0x0) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:27 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x18, 0x0, 0x0, &(0x7f00000013c0)) 14:20:27 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r1, &(0x7f0000000680)={&(0x7f0000000180)=@un=@abs, 0x80, 0x0, 0x0, &(0x7f0000002800)=[{0x10}], 0x10}, 0x0) 14:20:27 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000380)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@un=@file={0x0, './file0\x00'}, 0x80, 0x0}, 0x20480) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) 14:20:27 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, 0x0) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:27 executing program 4: r0 = socket$kcm(0xa, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x3c) ioctl$sock_kcm_SIOCKCMCLONE(r0, 0x8916, &(0x7f0000000000)) [ 488.904605][T27732] IPVS: ftp: loaded support on port[0] = 21 [ 488.977466][T27732] chnl_net:caif_netlink_parms(): no params data found [ 489.002118][T27732] bridge0: port 1(bridge_slave_0) entered blocking state [ 489.009231][T27732] bridge0: port 1(bridge_slave_0) entered disabled state [ 489.017113][T27732] device bridge_slave_0 entered promiscuous mode [ 489.046665][T27732] bridge0: port 2(bridge_slave_1) entered blocking state [ 489.053961][T27732] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.061896][T27732] device bridge_slave_1 entered promiscuous mode [ 489.075970][T27732] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 489.085925][T27732] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 489.127108][T27732] team0: Port device team_slave_0 added [ 489.134120][T27732] team0: Port device team_slave_1 added [ 489.192286][T27732] device hsr_slave_0 entered promiscuous mode [ 489.261808][T27732] device hsr_slave_1 entered promiscuous mode [ 489.321493][ T55] device bridge_slave_1 left promiscuous mode [ 489.327746][ T55] bridge0: port 2(bridge_slave_1) entered disabled state [ 489.381743][ T55] device bridge_slave_0 left promiscuous mode [ 489.387955][ T55] bridge0: port 1(bridge_slave_0) entered disabled state [ 490.042615][ T55] device hsr_slave_1 left promiscuous mode [ 490.114098][ T55] device hsr_slave_0 left promiscuous mode [ 490.153850][ T55] team0 (unregistering): Port device team_slave_1 removed [ 490.164051][ T55] team0 (unregistering): Port device team_slave_0 removed [ 490.174668][ T55] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 490.214577][ T55] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 490.310376][ T55] bond0 (unregistering): Released all slaves [ 490.387895][T27732] bridge0: port 2(bridge_slave_1) entered blocking state [ 490.395001][T27732] bridge0: port 2(bridge_slave_1) entered forwarding state [ 490.402391][T27732] bridge0: port 1(bridge_slave_0) entered blocking state [ 490.409566][T27732] bridge0: port 1(bridge_slave_0) entered forwarding state [ 490.418482][T27044] bridge0: port 1(bridge_slave_0) entered disabled state [ 490.426880][T27044] bridge0: port 2(bridge_slave_1) entered disabled state [ 490.450141][T27732] 8021q: adding VLAN 0 to HW filter on device bond0 [ 490.462213][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 490.469898][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 490.479881][T27732] 8021q: adding VLAN 0 to HW filter on device team0 [ 490.491663][T27041] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 490.500205][T27041] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 490.508613][T27041] bridge0: port 1(bridge_slave_0) entered blocking state [ 490.515706][T27041] bridge0: port 1(bridge_slave_0) entered forwarding state [ 490.525401][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 490.534112][T27044] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 490.543152][T27044] bridge0: port 2(bridge_slave_1) entered blocking state [ 490.550204][T27044] bridge0: port 2(bridge_slave_1) entered forwarding state [ 490.559808][T27042] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 490.631201][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 490.640086][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 490.648738][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 490.663931][T27732] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 490.674517][T27732] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 490.687081][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 490.696870][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 490.706650][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 490.717184][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 490.726511][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 490.737053][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 490.746259][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 490.766898][T27732] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 490.774832][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready 14:20:30 executing program 3: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$kcm(0x2, 0x5, 0x0) sendmsg$kcm(r0, &(0x7f0000001d40)={&(0x7f0000000740)=@in={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x16}}, 0x80, &(0x7f0000001c00)=[{&(0x7f0000000000)="c7", 0x1}], 0x1}, 0x0) 14:20:30 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, 0x0) preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:30 executing program 2: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000380)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@un=@file={0x0, './file0\x00'}, 0x80, 0x0}, 0x20480) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) 14:20:30 executing program 5: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x12, 0x200, 0x4, 0x20000000001009}, 0x3c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r0, &(0x7f00000000c0), 0x0, 0x1}, 0x20) 14:20:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'ifb0\x00', 0x2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x1d}, {0x16}]}) 14:20:30 executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x7fff, 0x0) r0 = perf_event_open$cgroup(&(0x7f00000008c0)={0x0, 0x70, 0x1, 0x8, 0x1, 0xd, 0x0, 0x0, 0x6, 0x0, 0x3f8e, 0x2, 0x1f1b, 0x6, 0x70, 0x2, 0xfffffffffffffffe, 0x20, 0x3, 0x6, 0x0, 0xff, 0x8, 0x3f, 0x1, 0x81, 0x1, 0x7fff, 0xfffffffffffffff9, 0x6, 0x0, 0x6, 0x3, 0x4, 0x9, 0x8000, 0x1, 0xfffffffffffffff9, 0x0, 0x3, 0x0, @perf_config_ext={0x9, 0x5}, 0x20400, 0x800, 0xff, 0x0, 0x0, 0x4}, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x9) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0x10, 0x5, 0x10) socket$kcm(0x10, 0x2, 0x0) socketpair(0xe, 0x80005, 0x2, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = getpid() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r3, r0, 0x0, 0xfffffffffffffdc6, &(0x7f0000000600)='lolo^eth1-ppp1\\vboxnet0\x00', 0x0}, 0x100cc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={r3, 0xffffffffffffffff, 0x0, 0x12, &(0x7f0000000340)='systemlo:security\x00', r4}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x100, &(0x7f0000000700)='thr\x81ad:\xe1!(\xfb\xe2Q2\xad\xcf_\xf4q\x13s\xede\x93\xdc\xc6ed\x00\xa4\x87\xe6\xb9\x9aa \xc8\x8c\x9c\xb1\x01\x1aC\x03\x19I\xb2y\xba\x1d\xbfX\xc5\x1fa5\x8b\x0f[=\xcb\xa3\xdb\x03\x89\xf6m\xf3\xf8\x1b\xd6\x83\xef\xc9\xc1(%8{\xc1\xf9L\xder~6\x885\x95&,\x99\x1f=K\x8b\xa5A\xee(+A\x1a\xa5C\xb2\x93T`\xfe\x06\xa2C\x10\xa8m\xfc\xc7\x97U\xb0T\xd5t\xf4\xd8\xf5#\x1d\x84\xccO\x9f\x7fs\xf6\x88_\xaa\xadl\xd8k\xdf<\xed\xdc+l\x9a\xe1\x7f\x8c\xffHY\x1a\x18\xe3@\x85d`9\x8cK\xac\xaa\x12\xafj\x82\xbd\xb2\xb6jx\x9d0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f00000004c0)='lJ,M\xa4\x7f\x85\xc2\x91\xce\xea\n{B\x00'/27) r9 = gettid() r10 = perf_event_open(&(0x7f0000000680)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffb, 0x4365, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x100000000000}, r9, 0xffffffffffffffff, 0xffffffffffffffff, 0x3) socket$kcm(0x2, 0x5, 0x0) sendmsg$kcm(r10, &(0x7f0000000440)={&(0x7f00000001c0)=@x25={0x9, @null=' \x00'}, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000d40)="e32291ff154f7a10b4e4b71d61d931f12f45384e55bd8288580361f54f0c5afff543f5570995cc11e78966623489a7187a7a39184ea686d8507fab24d9e9346f55991ce057cc774834e1e9910310d42bdde644e18df61f17c7f51df4b0ab21754107a007054d2d3385c880e716b9d107fd7ffc896f7f815789e2d8645c15b6d155d8f0045d212491af668c6fbaab6afac75e05582fba0ed69c0417320a3ab0416de5b9ecdfeaf01ba18a5209bb7df3744ab37a20dc97bed6580c3b3c75fefc8c6c9188e69a18e644dac2e8df1b6b5801676dfcc5e9df207d0eae63a3e0eeb414", 0xe0}], 0x1}, 0x4004000) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000400)={&(0x7f0000000300)='./file0\x00', 0x0, 0x10}, 0x10) r11 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000540)=r5, 0x4) setsockopt$sock_attach_bpf(r8, 0x84, 0x4, &(0x7f0000000940)=r11, 0x4) write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0x5, 0x12) r12 = socket$kcm(0xa, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xd, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="e0fe000000002b0011a1cea72e9198db367289a5da950492ab07a600"/39], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x1, [], 0x0, 0x8, 0xffffffffffffff9c, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x70) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000880)=r11, 0xfffffffffffffebf) ioctl$sock_kcm_SIOCKCMATTACH(r1, 0x89e0, &(0x7f0000000380)={r2}) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xf, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x3c) socketpair(0x0, 0x805, 0x1, 0x0) r13 = gettid() perf_event_open(&(0x7f0000000280)={0x1, 0x70, 0x3, 0x39, 0x961, 0x8, 0x0, 0x695d, 0x8, 0x2, 0x3, 0x3f, 0x7ff, 0x0, 0x35f, 0x2, 0x5c1, 0x9, 0x5, 0x800, 0x504, 0x100, 0x80000000008, 0xffffffff, 0x80000001, 0x5, 0x8001, 0x20000000b6, 0x800000000000, 0x8, 0x3b2e, 0x188, 0x98a, 0x10001, 0x10001, 0xfff7fffffffffffd, 0xffffffffffffff80, 0xffffffffffffffff, 0x0, 0x87b, 0x5, @perf_bp={&(0x7f0000000240), 0x2}, 0x20, 0x0, 0x832, 0x0, 0x8, 0x3, 0x1}, r13, 0x6, 0xffffffffffffff9c, 0x1) socket$kcm(0x29, 0x7, 0x0) write$cgroup_int(r8, &(0x7f00000003c0)=0x2, 0x12) ioctl$sock_kcm_SIOCKCMCLONE(r12, 0x8916, &(0x7f0000000000)={r7}) 14:20:30 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:30 executing program 2: r0 = socket$kcm(0xa, 0x2, 0x73) sendmsg$kcm(r0, &(0x7f00000003c0)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) socketpair(0x0, 0x0, 0x0, 0x0) 14:20:30 executing program 3: r0 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r0, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec, 0x80, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="240000000000000029000000370000008102020100ff3a06fe80000000000000b87f25f8"], 0x24}, 0x0) 14:20:30 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:30 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'ifb0\x00', 0x2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x1d}, {0x16}]}) 14:20:30 executing program 2: bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x6, 0x4, 0x10004, 0x3}, 0x3c) 14:20:30 executing program 3: r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x0, 0x0) 14:20:30 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(0xffffffffffffffff, &(0x7f0000000480), 0x10000000000002a1, 0x0) 14:20:31 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r1, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec={0x0, 0x1100}, 0x80, 0x0}, 0x0) recvmsg(r1, &(0x7f0000000f40)={&(0x7f0000000d40)=@nl, 0x80, 0x0}, 0x0) [ 492.631290][T27992] IPVS: ftp: loaded support on port[0] = 21 [ 492.676793][T27992] chnl_net:caif_netlink_parms(): no params data found [ 492.698842][T27992] bridge0: port 1(bridge_slave_0) entered blocking state [ 492.706515][T27992] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.714018][T27992] device bridge_slave_0 entered promiscuous mode [ 492.722713][T27992] bridge0: port 2(bridge_slave_1) entered blocking state [ 492.729760][T27992] bridge0: port 2(bridge_slave_1) entered disabled state [ 492.737460][T27992] device bridge_slave_1 entered promiscuous mode [ 492.752383][T27992] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 492.762008][T27992] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 492.777255][T27992] team0: Port device team_slave_0 added [ 492.784180][T27992] team0: Port device team_slave_1 added [ 492.833729][T27992] device hsr_slave_0 entered promiscuous mode [ 492.871324][T27992] device hsr_slave_1 entered promiscuous mode [ 492.917626][T27992] bridge0: port 2(bridge_slave_1) entered blocking state [ 492.924721][T27992] bridge0: port 2(bridge_slave_1) entered forwarding state [ 492.932092][T27992] bridge0: port 1(bridge_slave_0) entered blocking state [ 492.939134][T27992] bridge0: port 1(bridge_slave_0) entered forwarding state [ 492.964590][T27992] 8021q: adding VLAN 0 to HW filter on device bond0 [ 492.976570][T27042] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 492.984656][T27042] bridge0: port 1(bridge_slave_0) entered disabled state [ 492.992570][T27042] bridge0: port 2(bridge_slave_1) entered disabled state [ 493.000334][T27042] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready [ 493.011465][T27992] 8021q: adding VLAN 0 to HW filter on device team0 [ 493.020242][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 493.028821][ T3481] bridge0: port 1(bridge_slave_0) entered blocking state [ 493.035905][ T3481] bridge0: port 1(bridge_slave_0) entered forwarding state [ 493.053238][T27042] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 493.061775][T27042] bridge0: port 2(bridge_slave_1) entered blocking state [ 493.068804][T27042] bridge0: port 2(bridge_slave_1) entered forwarding state [ 493.077553][T27042] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 493.089564][T27042] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 493.098253][T27042] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 493.107777][ T3481] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 493.119480][T27992] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 493.132248][T27992] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 493.140021][ T9066] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 493.156182][T27992] 8021q: adding VLAN 0 to HW filter on device batadv0 14:20:32 executing program 5: 14:20:32 executing program 3: openat$sequencer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer\x00', 0x4000, 0x0) 14:20:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'ifb0\x00', 0x2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x1d}, {0x16}]}) 14:20:32 executing program 0: 14:20:32 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, 0x0, 0x0, 0x0) 14:20:32 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r1, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec={0x0, 0x1100}, 0x80, 0x0}, 0x0) recvmsg(r1, &(0x7f0000000f40)={&(0x7f0000000d40)=@nl, 0x80, 0x0}, 0x0) 14:20:32 executing program 0: 14:20:32 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$kcm(0xa, 0x3, 0x11) sendmsg$kcm(r1, &(0x7f00000027c0)={&(0x7f0000000280)=@nl=@unspec={0x0, 0x1100}, 0x80, 0x0}, 0x0) recvmsg(r1, &(0x7f0000000f40)={&(0x7f0000000d40)=@nl, 0x80, 0x0}, 0x0) 14:20:32 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, 0x0, 0x0, 0x0) 14:20:32 executing program 5: 14:20:32 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000380)='/group.sta\x9f\xd4t\x00+\x04J{\t\xab\v\x02t\xe1\t\x85\xa6\xfa\x15\xb3[\xa6\x94!\xf2\x04\xde\xc5f\x8a\x06\x00\x00\x00\xb9\x0f\xf8`\xe0\x1f&+\xaf\xacu\nm\\\xe2Y\xcba\xea\f\xd9DXX>\xef/\xc5\x97\xea\x93\xa7\xde\xc9\xb4\x16\x8eF\x8b\xe0Wm\x1d\x0e\xbf\x8b\xc4G\x8f\x8e\xd8[T|i$\x88\x04\x00\x00\x00\x00\x00\x00\x00\x90\x1eB\x8b\x98\xad\xd17_Q\xe15\x84\x8f\xea\x98\xc6\xe3WE\x11\xe0\xc6\x1f\xf2/\xf6\x1f', 0x2761, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x3e, &(0x7f00000002c0)=r0, 0x161) sendmsg$kcm(r1, &(0x7f0000003d00)={&(0x7f0000000380)=@un=@file={0x0, './file0\x00'}, 0x80, 0x0}, 0x20480) 14:20:32 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'ifb0\x00', 0x2}) ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x1d}, {0x16}]}) 14:20:33 executing program 1: r0 = open(&(0x7f0000000080)='./file0\x00', 0x80ff, 0x0) fcntl$setlease(r0, 0x400, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000000180)=""/148, 0x300}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000300)='fdinfo/3\x00') preadv(r1, 0x0, 0x0, 0x0) [ 540.681060][ T1042] INFO: task syz-executor.5:10931 blocked for more than 143 seconds. [ 540.689177][ T1042] Not tainted 5.1.0-rc4-next-20190411 #23 [ 540.695486][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 540.704205][ T1042] syz-executor.5 D28472 10931 9072 0x80000006 [ 540.710536][ T1042] Call Trace: [ 540.713976][ T1042] __schedule+0x817/0x1cc0 [ 540.718404][ T1042] ? __sched_text_start+0x8/0x8 [ 540.723296][ T1042] ? __mutex_lock+0x527/0x1310 [ 540.728061][ T1042] schedule+0x92/0x180 [ 540.732197][ T1042] schedule_preempt_disabled+0x13/0x20 [ 540.737658][ T1042] __mutex_lock+0x726/0x1310 [ 540.742410][ T1042] ? odev_release+0x4c/0x80 [ 540.746926][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 540.751821][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 540.758111][ T1042] ? fsnotify+0x811/0xbc0 [ 540.762526][ T1042] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 540.768820][ T1042] ? locks_remove_file+0x305/0x4a0 [ 540.773976][ T1042] ? fsnotify_first_mark+0x210/0x210 [ 540.779315][ T1042] ? snd_seq_info_done+0x30/0x30 [ 540.784339][ T1042] mutex_lock_nested+0x16/0x20 [ 540.789122][ T1042] ? mutex_lock_nested+0x16/0x20 [ 540.794164][ T1042] odev_release+0x4c/0x80 [ 540.798629][ T1042] __fput+0x2e5/0x8d0 [ 540.802695][ T1042] ____fput+0x16/0x20 [ 540.806742][ T1042] task_work_run+0x14a/0x1c0 [ 540.811465][ T1042] do_exit+0x90a/0x2fa0 [ 540.815622][ T1042] ? __schedule+0x81f/0x1cc0 [ 540.820199][ T1042] ? mm_update_next_owner+0x640/0x640 [ 540.825691][ T1042] ? lock_downgrade+0x880/0x880 [ 540.830652][ T1042] ? kasan_check_write+0x14/0x20 [ 540.835706][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 540.840747][ T1042] ? lock_downgrade+0x880/0x880 [ 540.845805][ T1042] ? get_signal+0x20e/0x1d50 [ 540.850400][ T1042] do_group_exit+0x135/0x370 [ 540.855053][ T1042] get_signal+0x399/0x1d50 [ 540.859561][ T1042] do_signal+0x87/0x1940 [ 540.863840][ T1042] ? check_kill_permission+0x56/0x540 [ 540.869215][ T1042] ? do_send_specific+0x156/0x250 [ 540.874297][ T1042] ? setup_sigcontext+0x7d0/0x7d0 [ 540.879335][ T1042] ? do_rt_tgsigqueueinfo+0xb8/0x110 [ 540.884975][ T1042] ? __x32_compat_sys_rt_sigqueueinfo+0x1a0/0x1a0 [ 540.891445][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 540.897795][ T1042] ? trace_hardirqs_on+0x67/0x230 [ 540.902907][ T1042] exit_to_usermode_loop+0x244/0x2c0 [ 540.908205][ T1042] do_syscall_64+0x52d/0x610 [ 540.912840][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 540.918836][ T1042] RIP: 00cf:0xfbb9b7fb21a0d63d [ 540.923627][ T1042] Code: Bad RIP value. [ 540.927695][ T1042] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 4a39679375ff8206 [ 540.936150][ T1042] RAX: 4899b10292a184e2 RBX: e17acbc97e09a1d5 RCX: d9a38b0f58477ed2 [ 540.944319][ T1042] RDX: e30bed02409c4b7f RSI: 21e621db062777a4 RDI: 3018cb6360e7268c [ 540.952355][ T1042] RBP: c9f430f5a432eb95 R08: 9772c75a4d848924 R09: de8dc8130a8d00e4 [ 540.960461][ T1042] R10: c584612d789079f5 R11: dcb6157f75e34067 R12: c095a216647cc6de [ 540.968477][ T1042] R13: 577ea107cd50fa56 R14: 35f8de53a18627c3 R15: 5909a4034a71bf37 [ 540.976543][ T1042] INFO: task syz-executor.5:10974 blocked for more than 143 seconds. [ 540.984648][ T1042] Not tainted 5.1.0-rc4-next-20190411 #23 [ 540.991024][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 540.999691][ T1042] syz-executor.5 D28408 10974 9072 0x80000006 [ 541.006064][ T1042] Call Trace: [ 541.009355][ T1042] __schedule+0x817/0x1cc0 [ 541.013838][ T1042] ? __sched_text_start+0x8/0x8 [ 541.018692][ T1042] ? __mutex_lock+0x527/0x1310 [ 541.023537][ T1042] schedule+0x92/0x180 [ 541.027709][ T1042] schedule_preempt_disabled+0x13/0x20 [ 541.033211][ T1042] __mutex_lock+0x726/0x1310 [ 541.037814][ T1042] ? odev_release+0x4c/0x80 [ 541.042393][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 541.047229][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 541.053567][ T1042] ? fsnotify+0x811/0xbc0 [ 541.057960][ T1042] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 541.064271][ T1042] ? locks_remove_file+0x305/0x4a0 [ 541.069400][ T1042] ? fsnotify_first_mark+0x210/0x210 [ 541.074750][ T1042] ? snd_seq_info_done+0x30/0x30 [ 541.079693][ T1042] mutex_lock_nested+0x16/0x20 [ 541.084653][ T1042] ? mutex_lock_nested+0x16/0x20 [ 541.089598][ T1042] odev_release+0x4c/0x80 [ 541.093992][ T1042] __fput+0x2e5/0x8d0 [ 541.098035][ T1042] ____fput+0x16/0x20 [ 541.102077][ T1042] task_work_run+0x14a/0x1c0 [ 541.106728][ T1042] do_exit+0x90a/0x2fa0 [ 541.110941][ T1042] ? __schedule+0x81f/0x1cc0 [ 541.115529][ T1042] ? mm_update_next_owner+0x640/0x640 [ 541.120972][ T1042] ? lock_downgrade+0x880/0x880 [ 541.125821][ T1042] ? kasan_check_write+0x14/0x20 [ 541.130743][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 541.135821][ T1042] ? lock_downgrade+0x880/0x880 [ 541.140775][ T1042] ? get_signal+0x20e/0x1d50 [ 541.145415][ T1042] do_group_exit+0x135/0x370 [ 541.150026][ T1042] get_signal+0x399/0x1d50 [ 541.154636][ T1042] do_signal+0x87/0x1940 [ 541.158887][ T1042] ? check_kill_permission+0x56/0x540 [ 541.164525][ T1042] ? do_send_specific+0x156/0x250 [ 541.169556][ T1042] ? setup_sigcontext+0x7d0/0x7d0 [ 541.174616][ T1042] ? do_rt_tgsigqueueinfo+0xb8/0x110 [ 541.179910][ T1042] ? __x32_compat_sys_rt_sigqueueinfo+0x1a0/0x1a0 [ 541.186360][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 541.192656][ T1042] ? trace_hardirqs_on+0x67/0x230 [ 541.197829][ T1042] exit_to_usermode_loop+0x244/0x2c0 [ 541.203194][ T1042] do_syscall_64+0x52d/0x610 [ 541.207947][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 541.213935][ T1042] RIP: 00cf:0xfbb9b7fb21a0d63d [ 541.218702][ T1042] Code: Bad RIP value. [ 541.222797][ T1042] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 4a39679375ff8206 [ 541.231260][ T1042] RAX: 4899b10292a184e2 RBX: e17acbc97e09a1d5 RCX: d9a38b0f58477ed2 [ 541.239240][ T1042] RDX: e30bed02409c4b7f RSI: 21e621db062777a4 RDI: 3018cb6360e7268c [ 541.247283][ T1042] RBP: c9f430f5a432eb95 R08: 9772c75a4d848924 R09: de8dc8130a8d00e4 [ 541.255296][ T1042] R10: c584612d789079f5 R11: dcb6157f75e34067 R12: c095a216647cc6de [ 541.263313][ T1042] R13: 577ea107cd50fa56 R14: 35f8de53a18627c3 R15: 5909a4034a71bf37 [ 541.271361][ T1042] INFO: task syz-executor.5:11018 blocked for more than 143 seconds. [ 541.279407][ T1042] Not tainted 5.1.0-rc4-next-20190411 #23 [ 541.285684][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 541.294428][ T1042] syz-executor.5 D28408 11018 9072 0x80000006 [ 541.300749][ T1042] Call Trace: [ 541.304076][ T1042] __schedule+0x817/0x1cc0 [ 541.308509][ T1042] ? __sched_text_start+0x8/0x8 [ 541.313411][ T1042] ? __mutex_lock+0x527/0x1310 [ 541.318177][ T1042] schedule+0x92/0x180 [ 541.322305][ T1042] schedule_preempt_disabled+0x13/0x20 [ 541.327766][ T1042] __mutex_lock+0x726/0x1310 [ 541.332524][ T1042] ? odev_release+0x4c/0x80 [ 541.337034][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 541.341846][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 541.348089][ T1042] ? fsnotify+0x811/0xbc0 [ 541.352487][ T1042] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 541.358771][ T1042] ? locks_remove_file+0x305/0x4a0 [ 541.363971][ T1042] ? fsnotify_first_mark+0x210/0x210 [ 541.369266][ T1042] ? snd_seq_info_done+0x30/0x30 [ 541.374287][ T1042] mutex_lock_nested+0x16/0x20 [ 541.379061][ T1042] ? mutex_lock_nested+0x16/0x20 [ 541.384033][ T1042] odev_release+0x4c/0x80 [ 541.388378][ T1042] __fput+0x2e5/0x8d0 [ 541.392423][ T1042] ____fput+0x16/0x20 [ 541.396413][ T1042] task_work_run+0x14a/0x1c0 [ 541.401634][ T1042] do_exit+0x90a/0x2fa0 [ 541.405793][ T1042] ? __schedule+0x81f/0x1cc0 [ 541.410410][ T1042] ? mm_update_next_owner+0x640/0x640 [ 541.415831][ T1042] ? lock_downgrade+0x880/0x880 [ 541.420718][ T1042] ? kasan_check_write+0x14/0x20 [ 541.425703][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 541.430863][ T1042] ? lock_downgrade+0x880/0x880 [ 541.435722][ T1042] ? get_signal+0x20e/0x1d50 [ 541.440297][ T1042] do_group_exit+0x135/0x370 [ 541.444955][ T1042] get_signal+0x399/0x1d50 [ 541.449382][ T1042] do_signal+0x87/0x1940 [ 541.453674][ T1042] ? check_kill_permission+0x56/0x540 [ 541.459086][ T1042] ? do_send_specific+0x156/0x250 [ 541.464159][ T1042] ? setup_sigcontext+0x7d0/0x7d0 [ 541.469185][ T1042] ? do_rt_tgsigqueueinfo+0xb8/0x110 [ 541.474512][ T1042] ? __x32_compat_sys_rt_sigqueueinfo+0x1a0/0x1a0 [ 541.481032][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 541.487295][ T1042] ? trace_hardirqs_on+0x67/0x230 [ 541.492507][ T1042] exit_to_usermode_loop+0x244/0x2c0 [ 541.497792][ T1042] do_syscall_64+0x52d/0x610 [ 541.502412][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 541.508319][ T1042] RIP: 00cf:0xfbb9b7fb21a0d63d [ 541.513225][ T1042] Code: Bad RIP value. [ 541.517291][ T1042] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 4a39679375ff8206 [ 541.525739][ T1042] RAX: 4899b10292a184e2 RBX: e17acbc97e09a1d5 RCX: d9a38b0f58477ed2 [ 541.533784][ T1042] RDX: e30bed02409c4b7f RSI: 21e621db062777a4 RDI: 3018cb6360e7268c [ 541.541802][ T1042] RBP: c9f430f5a432eb95 R08: 9772c75a4d848924 R09: de8dc8130a8d00e4 [ 541.549779][ T1042] R10: c584612d789079f5 R11: dcb6157f75e34067 R12: c095a216647cc6de [ 541.557981][ T1042] R13: 577ea107cd50fa56 R14: 35f8de53a18627c3 R15: 5909a4034a71bf37 [ 541.566083][ T1042] INFO: task syz-executor.5:11064 blocked for more than 144 seconds. [ 541.574196][ T1042] Not tainted 5.1.0-rc4-next-20190411 #23 [ 541.580429][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 541.589122][ T1042] syz-executor.5 D28408 11064 9072 0x80000006 [ 541.595622][ T1042] Call Trace: [ 541.598909][ T1042] __schedule+0x817/0x1cc0 [ 541.603365][ T1042] ? __sched_text_start+0x8/0x8 [ 541.608228][ T1042] ? __mutex_lock+0x527/0x1310 [ 541.613036][ T1042] schedule+0x92/0x180 [ 541.617119][ T1042] schedule_preempt_disabled+0x13/0x20 [ 541.622724][ T1042] __mutex_lock+0x726/0x1310 [ 541.627323][ T1042] ? odev_release+0x4c/0x80 [ 541.631893][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 541.636666][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 541.643037][ T1042] ? fsnotify+0x811/0xbc0 [ 541.647389][ T1042] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 541.653742][ T1042] ? locks_remove_file+0x305/0x4a0 [ 541.658859][ T1042] ? fsnotify_first_mark+0x210/0x210 [ 541.664188][ T1042] ? snd_seq_info_done+0x30/0x30 [ 541.669135][ T1042] mutex_lock_nested+0x16/0x20 [ 541.673946][ T1042] ? mutex_lock_nested+0x16/0x20 [ 541.678924][ T1042] odev_release+0x4c/0x80 [ 541.683291][ T1042] __fput+0x2e5/0x8d0 [ 541.687276][ T1042] ____fput+0x16/0x20 [ 541.691317][ T1042] task_work_run+0x14a/0x1c0 [ 541.695915][ T1042] do_exit+0x90a/0x2fa0 [ 541.700056][ T1042] ? __schedule+0x81f/0x1cc0 [ 541.704731][ T1042] ? mm_update_next_owner+0x640/0x640 [ 541.710104][ T1042] ? lock_downgrade+0x880/0x880 [ 541.715011][ T1042] ? kasan_check_write+0x14/0x20 [ 541.719957][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 541.725027][ T1042] ? lock_downgrade+0x880/0x880 [ 541.729899][ T1042] ? get_signal+0x20e/0x1d50 [ 541.734542][ T1042] do_group_exit+0x135/0x370 [ 541.739155][ T1042] get_signal+0x399/0x1d50 [ 541.743643][ T1042] do_signal+0x87/0x1940 [ 541.747940][ T1042] ? check_kill_permission+0x56/0x540 [ 541.753376][ T1042] ? do_send_specific+0x156/0x250 [ 541.758455][ T1042] ? setup_sigcontext+0x7d0/0x7d0 [ 541.763560][ T1042] ? do_rt_tgsigqueueinfo+0xb8/0x110 [ 541.768901][ T1042] ? __x32_compat_sys_rt_sigqueueinfo+0x1a0/0x1a0 [ 541.775434][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 541.781734][ T1042] ? trace_hardirqs_on+0x67/0x230 [ 541.786880][ T1042] exit_to_usermode_loop+0x244/0x2c0 [ 541.792227][ T1042] do_syscall_64+0x52d/0x610 [ 541.796833][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 541.802817][ T1042] RIP: 00cf:0xfbb9b7fb21a0d63d [ 541.808934][ T1042] Code: Bad RIP value. [ 541.813068][ T1042] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 4a39679375ff8206 [ 541.821569][ T1042] RAX: 4899b10292a184e2 RBX: e17acbc97e09a1d5 RCX: d9a38b0f58477ed2 [ 541.829649][ T1042] RDX: e30bed02409c4b7f RSI: 21e621db062777a4 RDI: 3018cb6360e7268c [ 541.837693][ T1042] RBP: c9f430f5a432eb95 R08: 9772c75a4d848924 R09: de8dc8130a8d00e4 [ 541.845726][ T1042] R10: c584612d789079f5 R11: dcb6157f75e34067 R12: c095a216647cc6de [ 541.853812][ T1042] R13: 577ea107cd50fa56 R14: 35f8de53a18627c3 R15: 5909a4034a71bf37 [ 541.861855][ T1042] INFO: task syz-executor.5:11103 blocked for more than 144 seconds. [ 541.869963][ T1042] Not tainted 5.1.0-rc4-next-20190411 #23 [ 541.876287][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 541.885062][ T1042] syz-executor.5 D28472 11103 9072 0x80000006 [ 541.891504][ T1042] Call Trace: [ 541.894835][ T1042] __schedule+0x817/0x1cc0 [ 541.899294][ T1042] ? __sched_text_start+0x8/0x8 [ 541.904194][ T1042] ? __mutex_lock+0x527/0x1310 [ 541.908982][ T1042] schedule+0x92/0x180 [ 541.913292][ T1042] schedule_preempt_disabled+0x13/0x20 [ 541.918768][ T1042] __mutex_lock+0x726/0x1310 [ 541.923406][ T1042] ? odev_release+0x4c/0x80 [ 541.928026][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 541.932899][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 541.939281][ T1042] ? fsnotify+0x811/0xbc0 [ 541.943663][ T1042] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 541.949922][ T1042] ? locks_remove_file+0x305/0x4a0 [ 541.955321][ T1042] ? fsnotify_first_mark+0x210/0x210 [ 541.960628][ T1042] ? snd_seq_info_done+0x30/0x30 [ 541.965705][ T1042] mutex_lock_nested+0x16/0x20 [ 541.970546][ T1042] ? mutex_lock_nested+0x16/0x20 [ 541.975712][ T1042] odev_release+0x4c/0x80 [ 541.980172][ T1042] __fput+0x2e5/0x8d0 [ 541.984214][ T1042] ____fput+0x16/0x20 [ 541.988220][ T1042] task_work_run+0x14a/0x1c0 [ 541.992856][ T1042] do_exit+0x90a/0x2fa0 [ 541.997021][ T1042] ? __schedule+0x81f/0x1cc0 [ 542.001656][ T1042] ? mm_update_next_owner+0x640/0x640 [ 542.007034][ T1042] ? lock_downgrade+0x880/0x880 [ 542.011932][ T1042] ? kasan_check_write+0x14/0x20 [ 542.016885][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 542.021953][ T1042] ? lock_downgrade+0x880/0x880 [ 542.026813][ T1042] ? get_signal+0x20e/0x1d50 [ 542.031470][ T1042] do_group_exit+0x135/0x370 [ 542.036066][ T1042] get_signal+0x399/0x1d50 [ 542.040482][ T1042] do_signal+0x87/0x1940 [ 542.044830][ T1042] ? check_kill_permission+0x56/0x540 [ 542.050216][ T1042] ? do_send_specific+0x156/0x250 [ 542.055475][ T1042] ? setup_sigcontext+0x7d0/0x7d0 [ 542.060518][ T1042] ? do_rt_tgsigqueueinfo+0xb8/0x110 [ 542.065895][ T1042] ? __x32_compat_sys_rt_sigqueueinfo+0x1a0/0x1a0 [ 542.072357][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 542.078630][ T1042] ? trace_hardirqs_on+0x67/0x230 [ 542.083947][ T1042] exit_to_usermode_loop+0x244/0x2c0 [ 542.089357][ T1042] do_syscall_64+0x52d/0x610 [ 542.094025][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 542.099970][ T1042] RIP: 00cf:0xfbb9b7fb21a0d63d [ 542.104763][ T1042] Code: Bad RIP value. [ 542.108835][ T1042] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 4a39679375ff8206 [ 542.117646][ T1042] RAX: 4899b10292a184e2 RBX: e17acbc97e09a1d5 RCX: d9a38b0f58477ed2 [ 542.125781][ T1042] RDX: e30bed02409c4b7f RSI: 21e621db062777a4 RDI: 3018cb6360e7268c [ 542.133922][ T1042] RBP: c9f430f5a432eb95 R08: 9772c75a4d848924 R09: de8dc8130a8d00e4 [ 542.141944][ T1042] R10: c584612d789079f5 R11: dcb6157f75e34067 R12: c095a216647cc6de [ 542.149963][ T1042] R13: 577ea107cd50fa56 R14: 35f8de53a18627c3 R15: 5909a4034a71bf37 [ 542.158140][ T1042] INFO: task syz-executor.5:11144 blocked for more than 144 seconds. [ 542.166253][ T1042] Not tainted 5.1.0-rc4-next-20190411 #23 [ 542.172615][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 542.181438][ T1042] syz-executor.5 D28472 11144 9072 0x80000006 [ 542.187777][ T1042] Call Trace: [ 542.191129][ T1042] __schedule+0x817/0x1cc0 [ 542.195567][ T1042] ? retint_kernel+0x2d/0x2d [ 542.200140][ T1042] ? __sched_text_start+0x8/0x8 [ 542.205035][ T1042] ? __mutex_lock+0x527/0x1310 [ 542.210024][ T1042] schedule+0x92/0x180 [ 542.214153][ T1042] schedule_preempt_disabled+0x13/0x20 [ 542.219723][ T1042] __mutex_lock+0x726/0x1310 [ 542.224382][ T1042] ? snd_seq_kernel_client_ctl+0xe5/0x170 [ 542.230174][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 542.234994][ T1042] ? snd_seq_oss_release+0xf5/0x150 [ 542.240198][ T1042] ? odev_release+0x54/0x80 [ 542.244745][ T1042] ? __fput+0x2e5/0x8d0 [ 542.248910][ T1042] ? task_work_run+0x14a/0x1c0 [ 542.253719][ T1042] ? do_exit+0x90a/0x2fa0 [ 542.258064][ T1042] ? do_group_exit+0x135/0x370 [ 542.262867][ T1042] ? get_signal+0x399/0x1d50 [ 542.267464][ T1042] ? do_signal+0x87/0x1940 [ 542.271947][ T1042] ? exit_to_usermode_loop+0x244/0x2c0 [ 542.277420][ T1042] ? do_syscall_64+0x52d/0x610 [ 542.282245][ T1042] ? kasan_check_write+0x14/0x20 [ 542.287246][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 542.292340][ T1042] mutex_lock_nested+0x16/0x20 [ 542.297102][ T1042] ? mutex_lock_nested+0x16/0x20 [ 542.302094][ T1042] snd_seq_kernel_client_ctl+0xe5/0x170 [ 542.307664][ T1042] snd_seq_oss_writeq_clear+0xe0/0x140 [ 542.313186][ T1042] ? snd_seq_oss_writeq_wakeup+0xc0/0xc0 [ 542.318830][ T1042] ? snd_seq_oss_timer_delete+0x5a/0x80 [ 542.324473][ T1042] ? create_port+0x250/0x250 [ 542.329196][ T1042] snd_seq_oss_writeq_delete+0x20/0x40 [ 542.334759][ T1042] free_devinfo+0x66/0xc0 [ 542.339180][ T1042] port_delete+0xe8/0x1c0 [ 542.344005][ T1042] snd_seq_delete_port+0x266/0x330 [ 542.349128][ T1042] snd_seq_ioctl_delete_port+0xba/0x190 [ 542.354716][ T1042] snd_seq_kernel_client_ctl+0x112/0x170 [ 542.360358][ T1042] ? snd_seq_info_done+0x30/0x30 [ 542.365469][ T1042] snd_seq_event_port_detach+0xba/0x100 [ 542.371083][ T1042] ? snd_seq_event_port_attach+0x220/0x220 [ 542.376932][ T1042] ? kasan_check_write+0x14/0x20 [ 542.381925][ T1042] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 542.387655][ T1042] delete_port+0x87/0xd0 [ 542.391938][ T1042] snd_seq_oss_release+0xf5/0x150 [ 542.397012][ T1042] odev_release+0x54/0x80 [ 542.401391][ T1042] __fput+0x2e5/0x8d0 [ 542.405377][ T1042] ____fput+0x16/0x20 [ 542.409394][ T1042] task_work_run+0x14a/0x1c0 [ 542.414096][ T1042] do_exit+0x90a/0x2fa0 [ 542.418355][ T1042] ? __schedule+0x81f/0x1cc0 [ 542.423108][ T1042] ? mm_update_next_owner+0x640/0x640 [ 542.428493][ T1042] ? lock_downgrade+0x880/0x880 [ 542.433400][ T1042] ? kasan_check_write+0x14/0x20 [ 542.438488][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 542.443670][ T1042] ? lock_downgrade+0x880/0x880 [ 542.448565][ T1042] ? get_signal+0x20e/0x1d50 [ 542.453203][ T1042] do_group_exit+0x135/0x370 [ 542.457796][ T1042] get_signal+0x399/0x1d50 [ 542.462311][ T1042] do_signal+0x87/0x1940 [ 542.466564][ T1042] ? check_kill_permission+0x56/0x540 [ 542.471988][ T1042] ? do_send_specific+0x156/0x250 [ 542.477016][ T1042] ? setup_sigcontext+0x7d0/0x7d0 [ 542.482085][ T1042] ? do_rt_tgsigqueueinfo+0xb8/0x110 [ 542.487384][ T1042] ? __x32_compat_sys_rt_sigqueueinfo+0x1a0/0x1a0 [ 542.493854][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 542.500121][ T1042] ? trace_hardirqs_on+0x67/0x230 [ 542.505197][ T1042] exit_to_usermode_loop+0x244/0x2c0 [ 542.510510][ T1042] do_syscall_64+0x52d/0x610 [ 542.515292][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 542.521289][ T1042] RIP: 00cf:0xfbb9b7fb21a0d63d [ 542.526049][ T1042] Code: Bad RIP value. [ 542.530098][ T1042] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 4a39679375ff8206 [ 542.538619][ T1042] RAX: 4899b10292a184e2 RBX: e17acbc97e09a1d5 RCX: d9a38b0f58477ed2 [ 542.546636][ T1042] RDX: e30bed02409c4b7f RSI: 21e621db062777a4 RDI: 3018cb6360e7268c [ 542.554736][ T1042] RBP: c9f430f5a432eb95 R08: 9772c75a4d848924 R09: de8dc8130a8d00e4 [ 542.562737][ T1042] R10: c584612d789079f5 R11: dcb6157f75e34067 R12: c095a216647cc6de [ 542.570699][ T1042] R13: 577ea107cd50fa56 R14: 35f8de53a18627c3 R15: 5909a4034a71bf37 [ 542.578755][ T1042] INFO: task syz-executor.5:11185 blocked for more than 145 seconds. [ 542.586853][ T1042] Not tainted 5.1.0-rc4-next-20190411 #23 [ 542.593173][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 542.601952][ T1042] syz-executor.5 D28472 11185 9072 0x80000006 [ 542.608276][ T1042] Call Trace: [ 542.611636][ T1042] __schedule+0x817/0x1cc0 [ 542.616059][ T1042] ? __sched_text_start+0x8/0x8 [ 542.620964][ T1042] ? __mutex_lock+0x527/0x1310 [ 542.625786][ T1042] schedule+0x92/0x180 [ 542.629855][ T1042] schedule_preempt_disabled+0x13/0x20 [ 542.635399][ T1042] __mutex_lock+0x726/0x1310 [ 542.640005][ T1042] ? odev_release+0x4c/0x80 [ 542.644548][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 542.649430][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 542.655795][ T1042] ? fsnotify+0x811/0xbc0 [ 542.660155][ T1042] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 542.666441][ T1042] ? locks_remove_file+0x305/0x4a0 [ 542.671632][ T1042] ? fsnotify_first_mark+0x210/0x210 [ 542.676919][ T1042] ? snd_seq_info_done+0x30/0x30 [ 542.681908][ T1042] mutex_lock_nested+0x16/0x20 [ 542.686686][ T1042] ? mutex_lock_nested+0x16/0x20 [ 542.691668][ T1042] odev_release+0x4c/0x80 [ 542.696161][ T1042] __fput+0x2e5/0x8d0 [ 542.700131][ T1042] ____fput+0x16/0x20 [ 542.704152][ T1042] task_work_run+0x14a/0x1c0 [ 542.708808][ T1042] do_exit+0x90a/0x2fa0 [ 542.713016][ T1042] ? __schedule+0x81f/0x1cc0 [ 542.717722][ T1042] ? mm_update_next_owner+0x640/0x640 [ 542.723139][ T1042] ? lock_downgrade+0x880/0x880 [ 542.727990][ T1042] ? kasan_check_write+0x14/0x20 [ 542.732966][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 542.738003][ T1042] ? lock_downgrade+0x880/0x880 [ 542.742895][ T1042] ? get_signal+0x20e/0x1d50 [ 542.747489][ T1042] do_group_exit+0x135/0x370 [ 542.752140][ T1042] get_signal+0x399/0x1d50 [ 542.756568][ T1042] do_signal+0x87/0x1940 [ 542.760884][ T1042] ? check_kill_permission+0x56/0x540 [ 542.766342][ T1042] ? do_send_specific+0x156/0x250 [ 542.771628][ T1042] ? setup_sigcontext+0x7d0/0x7d0 [ 542.776769][ T1042] ? do_rt_tgsigqueueinfo+0xb8/0x110 [ 542.782093][ T1042] ? __x32_compat_sys_rt_sigqueueinfo+0x1a0/0x1a0 [ 542.788528][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 542.794869][ T1042] ? trace_hardirqs_on+0x67/0x230 [ 542.799909][ T1042] exit_to_usermode_loop+0x244/0x2c0 [ 542.805278][ T1042] do_syscall_64+0x52d/0x610 [ 542.809881][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 542.815868][ T1042] RIP: 00cf:0xfbb9b7fb21a0d63d [ 542.820671][ T1042] Code: Bad RIP value. [ 542.824795][ T1042] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 4a39679375ff8206 [ 542.833254][ T1042] RAX: 4899b10292a184e2 RBX: e17acbc97e09a1d5 RCX: d9a38b0f58477ed2 [ 542.841325][ T1042] RDX: e30bed02409c4b7f RSI: 21e621db062777a4 RDI: 3018cb6360e7268c [ 542.849301][ T1042] RBP: c9f430f5a432eb95 R08: 9772c75a4d848924 R09: de8dc8130a8d00e4 [ 542.857366][ T1042] R10: c584612d789079f5 R11: dcb6157f75e34067 R12: c095a216647cc6de [ 542.865375][ T1042] R13: 577ea107cd50fa56 R14: 35f8de53a18627c3 R15: 5909a4034a71bf37 [ 542.873432][ T1042] INFO: task syz-executor.5:11223 blocked for more than 145 seconds. [ 542.881513][ T1042] Not tainted 5.1.0-rc4-next-20190411 #23 [ 542.887731][ T1042] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 542.896493][ T1042] syz-executor.5 D28472 11223 9072 0x80000006 [ 542.902878][ T1042] Call Trace: [ 542.906326][ T1042] __schedule+0x817/0x1cc0 [ 542.910729][ T1042] ? __sched_text_start+0x8/0x8 [ 542.915632][ T1042] ? __mutex_lock+0x527/0x1310 [ 542.920454][ T1042] schedule+0x92/0x180 [ 542.924618][ T1042] schedule_preempt_disabled+0x13/0x20 [ 542.930081][ T1042] __mutex_lock+0x726/0x1310 [ 542.934782][ T1042] ? odev_release+0x4c/0x80 [ 542.939348][ T1042] ? mutex_trylock+0x1e0/0x1e0 [ 542.944185][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 542.950561][ T1042] ? fsnotify+0x811/0xbc0 [ 542.955231][ T1042] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 542.961504][ T1042] ? locks_remove_file+0x305/0x4a0 [ 542.966599][ T1042] ? fsnotify_first_mark+0x210/0x210 [ 542.972043][ T1042] ? snd_seq_info_done+0x30/0x30 [ 542.976999][ T1042] mutex_lock_nested+0x16/0x20 [ 542.981810][ T1042] ? mutex_lock_nested+0x16/0x20 [ 542.986751][ T1042] odev_release+0x4c/0x80 [ 542.991130][ T1042] __fput+0x2e5/0x8d0 [ 542.995116][ T1042] ____fput+0x16/0x20 [ 542.999082][ T1042] task_work_run+0x14a/0x1c0 [ 543.003712][ T1042] do_exit+0x90a/0x2fa0 [ 543.007878][ T1042] ? __schedule+0x81f/0x1cc0 [ 543.012531][ T1042] ? mm_update_next_owner+0x640/0x640 [ 543.017934][ T1042] ? lock_downgrade+0x880/0x880 [ 543.022841][ T1042] ? kasan_check_write+0x14/0x20 [ 543.027787][ T1042] ? do_raw_spin_lock+0x12a/0x2e0 [ 543.032863][ T1042] ? lock_downgrade+0x880/0x880 [ 543.037724][ T1042] ? get_signal+0x20e/0x1d50 [ 543.042364][ T1042] do_group_exit+0x135/0x370 [ 543.046991][ T1042] get_signal+0x399/0x1d50 [ 543.051462][ T1042] do_signal+0x87/0x1940 [ 543.055722][ T1042] ? check_kill_permission+0x56/0x540 [ 543.061140][ T1042] ? do_send_specific+0x156/0x250 [ 543.066165][ T1042] ? setup_sigcontext+0x7d0/0x7d0 [ 543.071244][ T1042] ? do_rt_tgsigqueueinfo+0xb8/0x110 [ 543.076557][ T1042] ? __x32_compat_sys_rt_sigqueueinfo+0x1a0/0x1a0 [ 543.087905][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 543.094187][ T1042] ? trace_hardirqs_on+0x67/0x230 [ 543.099203][ T1042] exit_to_usermode_loop+0x244/0x2c0 [ 543.104521][ T1042] do_syscall_64+0x52d/0x610 [ 543.109128][ T1042] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 543.115136][ T1042] RIP: 00cf:0xfbb9b7fb21a0d63d [ 543.119896][ T1042] Code: Bad RIP value. [ 543.123980][ T1042] RSP: 002b:0000000000000000 EFLAGS: 00000202 ORIG_RAX: 4a39679375ff8206 [ 543.133302][ T1042] RAX: 4899b10292a184e2 RBX: e17acbc97e09a1d5 RCX: d9a38b0f58477ed2 [ 543.141315][ T1042] RDX: e30bed02409c4b7f RSI: 21e621db062777a4 RDI: 3018cb6360e7268c [ 543.149303][ T1042] RBP: c9f430f5a432eb95 R08: 9772c75a4d848924 R09: de8dc8130a8d00e4 [ 543.157346][ T1042] R10: c584612d789079f5 R11: dcb6157f75e34067 R12: c095a216647cc6de [ 543.165431][ T1042] R13: 577ea107cd50fa56 R14: 35f8de53a18627c3 R15: 5909a4034a71bf37 [ 543.173490][ T1042] INFO: lockdep is turned off. [ 543.178252][ T1042] NMI backtrace for cpu 1 [ 543.182618][ T1042] CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 5.1.0-rc4-next-20190411 #23 [ 543.191304][ T1042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 543.201353][ T1042] Call Trace: [ 543.204685][ T1042] dump_stack+0x172/0x1f0 [ 543.208999][ T1042] nmi_cpu_backtrace.cold+0x63/0xa4 [ 543.214233][ T1042] ? lapic_can_unplug_cpu.cold+0x38/0x38 [ 543.219850][ T1042] nmi_trigger_cpumask_backtrace+0x1be/0x236 [ 543.225812][ T1042] arch_trigger_cpumask_backtrace+0x14/0x20 [ 543.231709][ T1042] watchdog+0x9b7/0xec0 [ 543.235846][ T1042] kthread+0x357/0x430 [ 543.239908][ T1042] ? reset_hung_task_detector+0x30/0x30 [ 543.245542][ T1042] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 543.251779][ T1042] ret_from_fork+0x3a/0x50 [ 543.256376][ T1042] Sending NMI from CPU 1 to CPUs 0: [ 543.262003][ C0] NMI backtrace for cpu 0 [ 543.262010][ C0] CPU: 0 PID: 33 Comm: kworker/u4:2 Not tainted 5.1.0-rc4-next-20190411 #23 [ 543.262016][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 543.262020][ C0] Workqueue: bat_events batadv_nc_worker [ 543.262027][ C0] RIP: 0010:do_raw_spin_unlock+0xf9/0x270 [ 543.262038][ C0] Code: df 4c 89 ea 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e 21 01 00 00 65 8b 05 c2 ff a8 7e 41 39 44 24 08 0f 85 cb 00 00 00 <48> b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 80 3c 02 00 0f [ 543.262042][ C0] RSP: 0018:ffff8880a98a7c20 EFLAGS: 00000246 [ 543.262050][ C0] RAX: 0000000000000000 RBX: ffff88805848b210 RCX: ffffffff815880d7 [ 543.262065][ C0] RDX: 1ffff1100b091643 RSI: 0000000000000004 RDI: ffff88805848b210 [ 543.262077][ C0] RBP: ffff8880a98a7c38 R08: 1ffff1100b091642 R09: ffffed100b091643 [ 543.262082][ C0] R10: ffffed100b091642 R11: ffff88805848b213 R12: ffff88805848b210 [ 543.262087][ C0] R13: ffff88805848b218 R14: ffff88805848b220 R15: 000000000000007e [ 543.262093][ C0] FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 543.262097][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 543.262102][ C0] CR2: ffffffffff600400 CR3: 00000000a43cd000 CR4: 00000000001406f0 [ 543.262105][ C0] Call Trace: [ 543.262109][ C0] ? batadv_nc_purge_orig_nc_nodes+0x260/0x260 [ 543.262113][ C0] _raw_spin_unlock_bh+0x23/0x40 [ 543.262117][ C0] batadv_nc_purge_paths+0x267/0x370 [ 543.262120][ C0] batadv_nc_worker+0x29c/0x760 [ 543.262124][ C0] process_one_work+0x98e/0x1790 [ 543.262128][ C0] ? pwq_dec_nr_in_flight+0x320/0x320 [ 543.262131][ C0] ? lock_acquire+0x16f/0x3f0 [ 543.262135][ C0] worker_thread+0x98/0xe40 [ 543.262138][ C0] ? trace_hardirqs_on+0x67/0x230 [ 543.262141][ C0] kthread+0x357/0x430 [ 543.262145][ C0] ? process_one_work+0x1790/0x1790 [ 543.262149][ C0] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 543.262153][ C0] ret_from_fork+0x3a/0x50 [ 543.262630][ T1042] Kernel panic - not syncing: hung_task: blocked tasks [ 543.460830][ T1042] CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 5.1.0-rc4-next-20190411 #23 [ 543.469479][ T1042] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 543.479622][ T1042] Call Trace: [ 543.482899][ T1042] dump_stack+0x172/0x1f0 [ 543.487271][ T1042] panic+0x2cb/0x72b [ 543.491240][ T1042] ? __warn_printk+0xf3/0xf3 [ 543.495821][ T1042] ? __sanitizer_cov_trace_cmp4+0x16/0x20 [ 543.501578][ T1042] ? printk_safe_flush+0xf2/0x140 [ 543.506611][ T1042] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 543.512838][ T1042] ? lapic_can_unplug_cpu.cold+0x38/0x38 [ 543.518453][ T1042] ? nmi_trigger_cpumask_backtrace+0x1a7/0x236 [ 543.524589][ T1042] ? nmi_trigger_cpumask_backtrace+0x19e/0x236 [ 543.530722][ T1042] watchdog+0x9c8/0xec0 [ 543.534875][ T1042] kthread+0x357/0x430 [ 543.538940][ T1042] ? reset_hung_task_detector+0x30/0x30 [ 543.544465][ T1042] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 543.550691][ T1042] ret_from_fork+0x3a/0x50 [ 543.555877][ T1042] Kernel Offset: disabled [ 543.560198][ T1042] Rebooting in 86400 seconds..