x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xa00, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:18 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000380)='/dev/btrfs-control\x00', 0x103000, 0x0) ioctl$VIDIOC_DBG_S_REGISTER(r0, 0x4038564f, &(0x7f0000000900)={{0x3, @addr=0x8}, 0x8, 0x100000001, 0x7}) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r4, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) ioctl$TIOCCBRK(r3, 0x5428) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f0000000280)='threaded\x00', 0x9) ioctl$RTC_SET_TIME(r2, 0x4024700a, &(0x7f00000007c0)={0x3b, 0x8, 0xc, 0x8, 0xb, 0x2f, 0x1, 0x80, 0xffffffffffffffff}) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r5, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000840)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="02052abf7040fcdbdf250100000004000500080001004e220000080001004e24000008000300290100000800040002000000bdd943c7389bf7fdd34b4ed6add76075af9bc458e5777b563da6d7d89739372ee9ae17adc5b5a233c240f1030b2de7fc9fd4a046ea2fe6797b047961f9e3118af19babfa820c4857152526f5bd104956f41a428cc333e374b4d2d4cfbae4c24568a6637e027f40"], 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) syz_open_dev$mouse(&(0x7f00000004c0)='/dev/input/mouse#\x00', 0x1, 0x100) write$cgroup_subtree(r5, &(0x7f0000000800)=ANY=[@ANYBLOB="a940000000000000002a75066119f1b45120a9fd176370ff40d528b8787865ad2040daf2428a5b35a32befe7dc337df96dfd"], 0xfdef) 09:17:18 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x3f00, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:18 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:19 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x4800, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:19 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 941.122143][T16617] device nr0 entered promiscuous mode 09:17:19 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x4c00, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 941.269791][T16681] device nr0 entered promiscuous mode [ 941.281876][T16687] device nr0 entered promiscuous mode 09:17:19 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 941.329000][T16699] binder_transaction: 42 callbacks suppressed [ 941.329017][T16699] binder: 16697:16699 transaction failed 29189/-22, size 24-8 line 2994 [ 941.356019][T16700] binder: 16697:16700 transaction failed 29189/-22, size 24-8 line 2994 [ 941.397764][ T17] binder_release_work: 32 callbacks suppressed [ 941.397772][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 941.411894][T16703] binder: 16702:16703 transaction failed 29189/-22, size 24-0 line 2994 [ 941.446887][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:19 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) fcntl$setstatus(r1, 0x4, 0x2400) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, r0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000007c0)={'\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) openat$ion(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ion\x00', 0x400000, 0x0) ioctl$TUNSETPERSIST(r2, 0x400454cb, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:19 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000007c0)=ANY=[@ANYBLOB="b7077289207e6c79c9623c32ccff2e9e082da757565427132ee61bf86554a6030a2a71fe7d8057bc9f3307b85a5f2b17debdc5e1429d0d41f3d3af145e02ae282ab94fb63b8d8b80ffeb7ee7"], 0xfdef) 09:17:19 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x6800, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:19 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:19 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000007c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:20 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000004c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0xb27) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0xfffffffffffffffe}, &(0x7f0000000480)=0x5) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="02052abd9400fcdbdf250100000004000500080001004e220000080001004e2400000800030029000000080004df1a000000"], 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) getsockopt(r6, 0x8000000000, 0x5, &(0x7f00000007c0)=""/83, &(0x7f0000000840)=0x53) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 941.857056][T16711] binder: 16710:16711 transaction failed 29189/-22, size 24-8 line 2994 [ 941.876851][T16715] binder: 16714:16715 transaction failed 29189/-22, size 24-8 line 2994 [ 941.912017][T16720] binder: 16710:16720 transaction failed 29189/-22, size 24-8 line 2994 [ 941.919964][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:20 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:20 executing program 0: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 942.035122][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:20 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x6c00, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 942.127887][T16767] binder: 16764:16767 transaction failed 29189/-22, size 24-8 line 2994 [ 942.215210][T16782] binder: 16781:16782 ioctl c018620b 0 returned -14 [ 942.254190][T16850] binder: 16849:16850 transaction failed 29189/-22, size 24-8 line 2994 [ 942.269041][T16786] device nr0 entered promiscuous mode [ 942.277778][ T7897] binder: release 16781:16782 transaction 2110 out, still active [ 942.280293][T16794] device nr0 entered promiscuous mode [ 942.292053][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:17:20 executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 942.318613][ T17] binder: release 16849:16896 transaction 2111 out, still active [ 942.344546][ T17] binder: unexpected work type, 4, not freed [ 942.362196][ T17] binder: undelivered TRANSACTION_COMPLETE 09:17:20 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x7400, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 942.378675][ T17] binder: send failed reply for transaction 2110, target dead [ 942.390460][ T17] binder: send failed reply for transaction 2111, target dead 09:17:20 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000007c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 942.471029][T16946] binder: 16945:16946 transaction failed 29189/-22, size 24-8 line 2994 [ 942.498995][T16947] binder: 16944:16947 transaction failed 29189/-22, size 24-8 line 2994 [ 942.517874][T16949] binder_thread_write: 8 callbacks suppressed [ 942.517892][T16949] binder: 16945:16949 BC_INCREFS_DONE u0000000000000000 no match [ 942.556526][T16946] binder: 16945:16946 BC_INCREFS_DONE u0000000000000000 no match 09:17:20 executing program 5: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:20 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000007c0)=ANY=[@ANYRES32=r3, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd88471fc888a8c6865cfe084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a79d8630c231"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 942.571921][T16950] binder: 16944:16950 BC_INCREFS_DONE u0000000000000000 no match [ 942.610348][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 942.645709][ T17] binder: undelivered TRANSACTION_ERROR: 29189 09:17:20 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 942.708403][ T17] binder: undelivered TRANSACTION_ERROR: 29189 09:17:20 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x7a00, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 942.749654][ T17] binder: undelivered TRANSACTION_ERROR: 29189 09:17:20 executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 942.810725][T17020] device nr0 entered promiscuous mode [ 942.837292][T16985] binder: 16983:16985 ioctl c018620b 0 returned -14 [ 942.870218][T17056] binder: 17052:17056 BC_INCREFS_DONE u0000000000000000 no match [ 942.910109][T16985] binder: 16983:16985 BC_INCREFS_DONE u0000000000000000 no match [ 942.918947][ T17] binder: release 17048:17053 transaction 2121 out, still active [ 942.934534][ T17] binder: unexpected work type, 4, not freed 09:17:21 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x1000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 942.968232][ T17] binder: undelivered TRANSACTION_COMPLETE [ 942.997990][T17072] binder: 17071:17072 BC_INCREFS_DONE u0000000000000000 node 2125 cookie mismatch 3f00000000000000 != 0000000000000000 09:17:21 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 09:17:21 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x402c5828, &(0x7f0000000000)={0x0, 0x4, 0x5, 0x100000001}) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="00000000000000000bbede7e1ce547a8b3402bc0b994b712239a08faeb13056e3e092f70f8a3f915a71dd1a9d3cbfde374ef5b6b7c8184cacfba206411ecfa0e8328e4ae863181b6e86862cef5a7e08164fe61ebe747ca1ad186087742ad65b139a6f74a4aa860c1"], 0x0, 0x0, &(0x7f0000000780)}) [ 943.020906][ T17] binder: release 16983:16985 transaction 2120 out, still active [ 943.066982][ T17] binder: undelivered TRANSACTION_COMPLETE [ 943.072998][ T17] binder: send failed reply for transaction 2120, target dead 09:17:21 executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x402c5828, &(0x7f0000000000)={0x0, 0x4, 0x5, 0x100000001}) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="00000000000000000bbede7e1ce547a8b3402bc0b994b712239a08faeb13056e3e092f70f8a3f915a71dd1a9d3cbfde374ef5b6b7c8184cacfba206411ecfa0e8328e4ae863181b6e86862cef5a7e08164fe61ebe747ca1ad186087742ad65b139a6f74a4aa860c1"], 0x0, 0x0, &(0x7f0000000780)}) [ 943.142788][ T17] binder: send failed reply for transaction 2121, target dead [ 943.150135][T17080] binder: 17079:17080 ioctl c0306201 0 returned -14 [ 943.159823][T17081] binder: 17077:17081 BC_INCREFS_DONE u0000000000000000 no match [ 943.168259][ T17] binder: send failed reply for transaction 2124 to 17071:17072 [ 943.180934][ T17] binder: undelivered TRANSACTION_ERROR: 29189 09:17:21 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) socket$inet6(0xa, 0x80006, 0x15) 09:17:21 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x4002}, 0x14) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') ioctl$LOOP_SET_BLOCK_SIZE(r2, 0x4c09, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000800)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000d00)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000840)=@newtclass={0x444, 0x28, 0x100, 0x70bd28, 0x25dfdbff, {0x0, r6, {0xf, 0xffe0}, {0x0, 0xffff}, {0x8, 0x3}}, [@TCA_RATE={0x8, 0x5, {0x9, 0x8}}, @tclass_kind_options=@c_htb={{0x8, 0x1, 'htb\x00'}, {0x408, 0x2, [@TCA_HTB_CTAB={0x404, 0x3, [0x5, 0x115383d8, 0x55, 0xdd3, 0x8, 0x93, 0x1, 0x3, 0x5, 0x5, 0xfff, 0x6, 0xfffffffffffffffe, 0x1, 0x86, 0x3, 0x8, 0x8, 0x6d, 0x0, 0x0, 0x101, 0xffff, 0x3f, 0x9, 0x2, 0x81, 0x2, 0x3f, 0x100000001, 0x6, 0x3, 0xcf, 0x3, 0x5, 0xcc, 0x1, 0xe3b, 0x4, 0x8001, 0x80000000, 0x8, 0x5, 0x4, 0x0, 0xcc3, 0x7, 0x1, 0x9, 0x40, 0xfff, 0x6, 0x8, 0xbc9, 0x6, 0x8001, 0x2, 0xfffffffffffffff7, 0x8, 0x5, 0x0, 0xbf4d, 0x1f, 0x8, 0xfffffffffffff001, 0xfffffffffffffffe, 0x6, 0x8b55, 0xfffffffffffffffa, 0x5000000000, 0x6, 0xb9, 0x9, 0x9, 0x0, 0x1f, 0xcd9, 0x9, 0x2, 0x8, 0xab6, 0xcbd, 0x2, 0x81, 0x2623, 0x7fff, 0x9, 0x3f, 0x1, 0x4, 0x9, 0x8, 0x3, 0x1, 0x400, 0x3, 0x1, 0x6, 0x7, 0x7, 0x0, 0x18bb, 0x1ff, 0x5, 0x8, 0xbf8, 0xff, 0x0, 0x8, 0xce, 0xff, 0x1, 0x80, 0x1, 0xeddd, 0x0, 0x2, 0x0, 0x8, 0x9, 0x6, 0x6, 0xff, 0x10001, 0x4b0, 0x6, 0x3f, 0x0, 0x80000001, 0x7, 0xfffffffffffffffa, 0x1, 0x7, 0x9, 0x1, 0x7, 0x8, 0x4, 0x3f, 0x6c, 0x8, 0x6, 0xdf71, 0x2, 0x100, 0x8, 0x100000001, 0x3, 0x73f5, 0x1, 0x7fffffff, 0x754, 0xd515, 0x6, 0x3, 0x8, 0x46165c23, 0x1, 0xffffffff, 0x2, 0x3ff, 0xfffffffffffffff7, 0x3cd2, 0xc3d, 0x9, 0x20, 0xffffffff, 0x3ff, 0x1f, 0x4, 0x5, 0x7fff, 0x7cf8e0a, 0x1f, 0x101, 0x31e7800, 0x1, 0x6a2, 0x5, 0x0, 0x0, 0x544, 0xb9000, 0x64fe, 0x5, 0x3, 0x80000000, 0x37, 0xed, 0x9, 0x8, 0x4, 0x9, 0x1ff, 0x5, 0x40, 0xff, 0x3f, 0x1, 0x2, 0x1, 0x1, 0x7f, 0x1, 0x3, 0x40, 0x4, 0x0, 0x9, 0x8000, 0x5eed, 0xc75, 0x889b, 0x4, 0x1, 0xffff, 0x4, 0x9, 0x3, 0x9, 0x5, 0x80, 0x1, 0x9, 0x1, 0x30, 0xfffffffffffffff7, 0xce1, 0x49, 0x10000, 0xffff, 0xafb, 0x6, 0x1, 0x4, 0x5, 0xffff, 0x0, 0x3, 0x200, 0xf3, 0x7f, 0x81, 0x3ff, 0x0, 0x4, 0x7f, 0x6, 0x80000001, 0x5, 0xa56, 0x100000000, 0x3f, 0x7, 0x8, 0x9]}]}}, @TCA_RATE={0x8, 0x5, {0x4, 0x8}}]}, 0x444}, 0x1, 0x0, 0x0, 0x48090}, 0x44010) perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/capi/capi20\x00', 0x80000, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="206386dd20"], 0xfdef) [ 943.202445][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 943.223917][ T17] binder: undelivered TRANSACTION_COMPLETE 09:17:21 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 09:17:21 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x2000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:21 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(&(0x7f0000000280)=[{r0, 0x20c8}], 0x1, 0x100000001) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000a00)='/dev/input/mice\x00', 0x0, 0x26400) ioctl$RTC_WKALM_RD(r2, 0x80287010, &(0x7f0000000ac0)) r3 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) lsetxattr$security_smack_entry(&(0x7f00000004c0)='./file0\x00', &(0x7f00000007c0)='security.SMACK64IPIN\x00', &(0x7f0000000800)='nr0\x01\x00', 0x5, 0x2) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000840)={0x0, 0x1d, "ca3d50975c53ba76d2e8f87c942d7fefcd02232d1c8e10f95eb9aca481"}, &(0x7f0000000880)=0x25) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000008c0)={0x0, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000980)=0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000a80)={0x0, 0x3}, &(0x7f0000000a40)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={r4, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r5, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x278) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) write$cgroup_subtree(r6, &(0x7f0000000b00)=ANY=[@ANYBLOB="00000008d00c8e7edefa230400"], 0xfdef) 09:17:21 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000007c0)=ANY=[@ANYRES32=r3, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd88471fc888a8c6865cfe084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a79d8630c231"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:21 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x4002}, 0x14) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') ioctl$LOOP_SET_BLOCK_SIZE(r2, 0x4c09, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000800)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000d00)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000840)=@newtclass={0x444, 0x28, 0x100, 0x70bd28, 0x25dfdbff, {0x0, r6, {0xf, 0xffe0}, {0x0, 0xffff}, {0x8, 0x3}}, [@TCA_RATE={0x8, 0x5, {0x9, 0x8}}, @tclass_kind_options=@c_htb={{0x8, 0x1, 'htb\x00'}, {0x408, 0x2, [@TCA_HTB_CTAB={0x404, 0x3, [0x5, 0x115383d8, 0x55, 0xdd3, 0x8, 0x93, 0x1, 0x3, 0x5, 0x5, 0xfff, 0x6, 0xfffffffffffffffe, 0x1, 0x86, 0x3, 0x8, 0x8, 0x6d, 0x0, 0x0, 0x101, 0xffff, 0x3f, 0x9, 0x2, 0x81, 0x2, 0x3f, 0x100000001, 0x6, 0x3, 0xcf, 0x3, 0x5, 0xcc, 0x1, 0xe3b, 0x4, 0x8001, 0x80000000, 0x8, 0x5, 0x4, 0x0, 0xcc3, 0x7, 0x1, 0x9, 0x40, 0xfff, 0x6, 0x8, 0xbc9, 0x6, 0x8001, 0x2, 0xfffffffffffffff7, 0x8, 0x5, 0x0, 0xbf4d, 0x1f, 0x8, 0xfffffffffffff001, 0xfffffffffffffffe, 0x6, 0x8b55, 0xfffffffffffffffa, 0x5000000000, 0x6, 0xb9, 0x9, 0x9, 0x0, 0x1f, 0xcd9, 0x9, 0x2, 0x8, 0xab6, 0xcbd, 0x2, 0x81, 0x2623, 0x7fff, 0x9, 0x3f, 0x1, 0x4, 0x9, 0x8, 0x3, 0x1, 0x400, 0x3, 0x1, 0x6, 0x7, 0x7, 0x0, 0x18bb, 0x1ff, 0x5, 0x8, 0xbf8, 0xff, 0x0, 0x8, 0xce, 0xff, 0x1, 0x80, 0x1, 0xeddd, 0x0, 0x2, 0x0, 0x8, 0x9, 0x6, 0x6, 0xff, 0x10001, 0x4b0, 0x6, 0x3f, 0x0, 0x80000001, 0x7, 0xfffffffffffffffa, 0x1, 0x7, 0x9, 0x1, 0x7, 0x8, 0x4, 0x3f, 0x6c, 0x8, 0x6, 0xdf71, 0x2, 0x100, 0x8, 0x100000001, 0x3, 0x73f5, 0x1, 0x7fffffff, 0x754, 0xd515, 0x6, 0x3, 0x8, 0x46165c23, 0x1, 0xffffffff, 0x2, 0x3ff, 0xfffffffffffffff7, 0x3cd2, 0xc3d, 0x9, 0x20, 0xffffffff, 0x3ff, 0x1f, 0x4, 0x5, 0x7fff, 0x7cf8e0a, 0x1f, 0x101, 0x31e7800, 0x1, 0x6a2, 0x5, 0x0, 0x0, 0x544, 0xb9000, 0x64fe, 0x5, 0x3, 0x80000000, 0x37, 0xed, 0x9, 0x8, 0x4, 0x9, 0x1ff, 0x5, 0x40, 0xff, 0x3f, 0x1, 0x2, 0x1, 0x1, 0x7f, 0x1, 0x3, 0x40, 0x4, 0x0, 0x9, 0x8000, 0x5eed, 0xc75, 0x889b, 0x4, 0x1, 0xffff, 0x4, 0x9, 0x3, 0x9, 0x5, 0x80, 0x1, 0x9, 0x1, 0x30, 0xfffffffffffffff7, 0xce1, 0x49, 0x10000, 0xffff, 0xafb, 0x6, 0x1, 0x4, 0x5, 0xffff, 0x0, 0x3, 0x200, 0xf3, 0x7f, 0x81, 0x3ff, 0x0, 0x4, 0x7f, 0x6, 0x80000001, 0x5, 0xa56, 0x100000000, 0x3f, 0x7, 0x8, 0x9]}]}}, @TCA_RATE={0x8, 0x5, {0x4, 0x8}}]}, 0x444}, 0x1, 0x0, 0x0, 0x48090}, 0x44010) perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/capi/capi20\x00', 0x80000, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="206386dd20"], 0xfdef) [ 943.511693][T17131] binder: 17096:17131 ioctl c0306201 0 returned -14 [ 943.535430][T17172] binder: 17168:17172 BC_INCREFS_DONE u0000000000000000 no match [ 943.554143][T17164] device nr0 entered promiscuous mode 09:17:21 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 943.613673][T17128] device nr0 entered promiscuous mode 09:17:21 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x3000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 943.716144][T17135] device nr0 entered promiscuous mode [ 943.768274][T17218] binder: 17217:17218 ioctl c0306201 0 returned -14 [ 943.809830][T17245] binder: 17221:17245 BC_INCREFS_DONE u0000000000000000 no match 09:17:22 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) 09:17:22 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x4000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:22 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) 09:17:22 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) socket$inet6(0xa, 0x80006, 0x15) 09:17:22 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x5000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:22 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) 09:17:22 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) ioctl$RTC_PIE_OFF(r2, 0x7006) syz_open_dev$vivid(&(0x7f00000004c0)='/dev/video#\x00', 0x3, 0x2) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) fcntl$getflags(r6, 0x0) [ 944.432720][T17342] binder: 17339:17342 BC_INCREFS_DONE u0000000000000000 no match 09:17:22 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x4002}, 0x14) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') ioctl$LOOP_SET_BLOCK_SIZE(r2, 0x4c09, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000800)={'vcan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000d00)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000cc0)={&(0x7f0000000840)=@newtclass={0x444, 0x28, 0x100, 0x70bd28, 0x25dfdbff, {0x0, r6, {0xf, 0xffe0}, {0x0, 0xffff}, {0x8, 0x3}}, [@TCA_RATE={0x8, 0x5, {0x9, 0x8}}, @tclass_kind_options=@c_htb={{0x8, 0x1, 'htb\x00'}, {0x408, 0x2, [@TCA_HTB_CTAB={0x404, 0x3, [0x5, 0x115383d8, 0x55, 0xdd3, 0x8, 0x93, 0x1, 0x3, 0x5, 0x5, 0xfff, 0x6, 0xfffffffffffffffe, 0x1, 0x86, 0x3, 0x8, 0x8, 0x6d, 0x0, 0x0, 0x101, 0xffff, 0x3f, 0x9, 0x2, 0x81, 0x2, 0x3f, 0x100000001, 0x6, 0x3, 0xcf, 0x3, 0x5, 0xcc, 0x1, 0xe3b, 0x4, 0x8001, 0x80000000, 0x8, 0x5, 0x4, 0x0, 0xcc3, 0x7, 0x1, 0x9, 0x40, 0xfff, 0x6, 0x8, 0xbc9, 0x6, 0x8001, 0x2, 0xfffffffffffffff7, 0x8, 0x5, 0x0, 0xbf4d, 0x1f, 0x8, 0xfffffffffffff001, 0xfffffffffffffffe, 0x6, 0x8b55, 0xfffffffffffffffa, 0x5000000000, 0x6, 0xb9, 0x9, 0x9, 0x0, 0x1f, 0xcd9, 0x9, 0x2, 0x8, 0xab6, 0xcbd, 0x2, 0x81, 0x2623, 0x7fff, 0x9, 0x3f, 0x1, 0x4, 0x9, 0x8, 0x3, 0x1, 0x400, 0x3, 0x1, 0x6, 0x7, 0x7, 0x0, 0x18bb, 0x1ff, 0x5, 0x8, 0xbf8, 0xff, 0x0, 0x8, 0xce, 0xff, 0x1, 0x80, 0x1, 0xeddd, 0x0, 0x2, 0x0, 0x8, 0x9, 0x6, 0x6, 0xff, 0x10001, 0x4b0, 0x6, 0x3f, 0x0, 0x80000001, 0x7, 0xfffffffffffffffa, 0x1, 0x7, 0x9, 0x1, 0x7, 0x8, 0x4, 0x3f, 0x6c, 0x8, 0x6, 0xdf71, 0x2, 0x100, 0x8, 0x100000001, 0x3, 0x73f5, 0x1, 0x7fffffff, 0x754, 0xd515, 0x6, 0x3, 0x8, 0x46165c23, 0x1, 0xffffffff, 0x2, 0x3ff, 0xfffffffffffffff7, 0x3cd2, 0xc3d, 0x9, 0x20, 0xffffffff, 0x3ff, 0x1f, 0x4, 0x5, 0x7fff, 0x7cf8e0a, 0x1f, 0x101, 0x31e7800, 0x1, 0x6a2, 0x5, 0x0, 0x0, 0x544, 0xb9000, 0x64fe, 0x5, 0x3, 0x80000000, 0x37, 0xed, 0x9, 0x8, 0x4, 0x9, 0x1ff, 0x5, 0x40, 0xff, 0x3f, 0x1, 0x2, 0x1, 0x1, 0x7f, 0x1, 0x3, 0x40, 0x4, 0x0, 0x9, 0x8000, 0x5eed, 0xc75, 0x889b, 0x4, 0x1, 0xffff, 0x4, 0x9, 0x3, 0x9, 0x5, 0x80, 0x1, 0x9, 0x1, 0x30, 0xfffffffffffffff7, 0xce1, 0x49, 0x10000, 0xffff, 0xafb, 0x6, 0x1, 0x4, 0x5, 0xffff, 0x0, 0x3, 0x200, 0xf3, 0x7f, 0x81, 0x3ff, 0x0, 0x4, 0x7f, 0x6, 0x80000001, 0x5, 0xa56, 0x100000000, 0x3f, 0x7, 0x8, 0x9]}]}}, @TCA_RATE={0x8, 0x5, {0x4, 0x8}}]}, 0x444}, 0x1, 0x0, 0x0, 0x48090}, 0x44010) perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000004c0)='/proc/capi/capi20\x00', 0x80000, 0x0) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB="206386dd20"], 0xfdef) 09:17:22 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000007c0)=ANY=[@ANYRES32=r3, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd88471fc888a8c6865cfe084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a79d8630c231"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:22 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x6000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:22 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) [ 944.755997][T17364] binder: 17363:17364 BC_INCREFS_DONE u0000000000000000 no match 09:17:22 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) 09:17:22 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x7000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:23 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xa000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 944.988393][T17359] device nr0 entered promiscuous mode [ 945.006774][T17397] device nr0 entered promiscuous mode 09:17:23 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) [ 945.108025][T17476] device nr0 entered promiscuous mode 09:17:23 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) socket$inet6(0xa, 0x80006, 0x15) 09:17:23 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x10000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:23 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:23 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2, 0x0) write$uinput_user_dev(r1, &(0x7f00000001c0)={'syz1\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd], [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4202, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}, 0x45c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000800)={r1, &(0x7f0000001040)="70edccf447304b4f395c4d38110832e3f00f897c7b8202f6c111533954e01f81183c6d730f440dfb52cfc1a9b0641946fecc08bcf07ba056382738b907a32b10b716abf5f4e73bf227fc6618e13b3dad7e3cc6d0894bb8b40c3e44621eec1865e58d2da46b97b348c08924a38ec68b512c2dbf553075d4f1a56656741916ca24eb627d3dfc19a78c9904c9ba5d0a2770640c3cc8de906b175b414803e4bbb120367399e20cc1afc6cc47f1bdd544209c43ad73251f49fa3a54e04784ed84ba554cde128cb8469b6b7e8d9a707eb94a11f7472665f1364af64c4430db70db6fb80eab69e6859de2bd76fd5fe22ee2aeb499f046983443a88de4e0e1d421e14450ba28660c1c6c5a2c9797ffead9b8831715afbd803efa95da77b465ee207901e9aab6272555edfc1600ae048da1918594ff1ca5d4a1b21f63a22149909fd7ad72089f26facbeade23453b3d7b065c3c9765458a4f5ee16ed6b856773a5f48f928208801ba34f20a5bc88da057e6982d46707753d196c9b8418b412bc1e97d5edfd9b5de42c6baca7671414a484e140e3b34e629371c3dd1f1d375525c0600dc6e2e8b00000000000000"}, 0x10) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r1, 0x84, 0x7, &(0x7f00000000c0), &(0x7f0000000080)=0xffffffffffffff52) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0x5101, 0x0) socket$inet6(0xa, 0x1000000000002, 0x0) r2 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x4200, 0x0) accept4$tipc(r2, &(0x7f0000000780)=@name, &(0x7f00000007c0)=0x10, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') mkdir(&(0x7f0000000240)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000640)='./file0\x00', &(0x7f0000000100)='ramfs\x00', 0x0, &(0x7f00000006c0)='.request_key_auth\x00') openat$vim2m(0xffffffffffffff9c, &(0x7f0000000440)='/dev/video35\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x375, &(0x7f0000000140)=0x5) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) chdir(&(0x7f0000000c80)='./file0\x00') symlink(&(0x7f0000001000)='./file0\x00', &(0x7f0000000080)='./file0\x00') getsockopt$packet_buf(r2, 0x107, 0x7, &(0x7f0000000840)=""/233, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0, 0x8) ioctl$TIOCOUTQ(r4, 0x5411, &(0x7f0000000340)) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000c40), 0xffffffffffffffff) execve(&(0x7f0000000d40)='./file0\x00', 0x0, &(0x7f0000000d80)) fchdir(r2) fsetxattr$system_posix_acl(r3, &(0x7f0000000280)='system.posix_acl_default\x00', &(0x7f0000000940)=ANY=[], 0x0, 0x0) r5 = openat$cgroup_ro(r0, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r5, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) [ 945.695928][T17507] device nr0 entered promiscuous mode 09:17:23 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(&(0x7f0000000280)=[{r0, 0x20c8}], 0x1, 0x100000001) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000a00)='/dev/input/mice\x00', 0x0, 0x26400) ioctl$RTC_WKALM_RD(r2, 0x80287010, &(0x7f0000000ac0)) r3 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) lsetxattr$security_smack_entry(&(0x7f00000004c0)='./file0\x00', &(0x7f00000007c0)='security.SMACK64IPIN\x00', &(0x7f0000000800)='nr0\x01\x00', 0x5, 0x2) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000840)={0x0, 0x1d, "ca3d50975c53ba76d2e8f87c942d7fefcd02232d1c8e10f95eb9aca481"}, &(0x7f0000000880)=0x25) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000008c0)={0x0, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000980)=0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000a80)={0x0, 0x3}, &(0x7f0000000a40)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={r4, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r5, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x278) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) write$cgroup_subtree(r6, &(0x7f0000000b00)=ANY=[@ANYBLOB="00000008d00c8e7edefa230400"], 0xfdef) 09:17:23 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000007c0)=ANY=[@ANYRES32=r3, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd88471fc888a8c6865cfe084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a79d8630c231"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:23 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x3f000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:23 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:23 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)=ANY=[@ANYRES32=r3, @ANYBLOB="e400000022f805bc50567e45c64f3f07360000000000000086d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1030000008d22b52940d0d92ba0028fa4e3d7b9bd0fd13d1dfcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c053af40a31d263e8189eb9d7a7968630c2310000000000000000000000000000"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000007c0)=ANY=[@ANYBLOB="3f83722e3f5b22db7c0ffc2b4172ef2114afd46d4c0f93da47ad85ff9b9474aedee3d6261be16f940a41c7a4a25681b5734fcf20fb815cd1dd438003a5f65ab94f96791346a12aac1c133e287131f6453c5781dcb8cc59df8db817cd103712dead5ba6703b34d55bc7d250b00cc904c999fceec729448d9cc56d5169e605e7b0acc709196c7dea34817d8e6357b1aebd97a8d8a0358a4b3d5570a5ff5acf2ed5320d9864785a922acd11"], 0xfdef) 09:17:24 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:24 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x48000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:24 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(&(0x7f0000000280)=[{r0, 0x20c8}], 0x1, 0x100000001) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000a00)='/dev/input/mice\x00', 0x0, 0x26400) ioctl$RTC_WKALM_RD(r2, 0x80287010, &(0x7f0000000ac0)) r3 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) lsetxattr$security_smack_entry(&(0x7f00000004c0)='./file0\x00', &(0x7f00000007c0)='security.SMACK64IPIN\x00', &(0x7f0000000800)='nr0\x01\x00', 0x5, 0x2) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000840)={0x0, 0x1d, "ca3d50975c53ba76d2e8f87c942d7fefcd02232d1c8e10f95eb9aca481"}, &(0x7f0000000880)=0x25) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000008c0)={0x0, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000980)=0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000a80)={0x0, 0x3}, &(0x7f0000000a40)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={r4, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r5, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x278) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) write$cgroup_subtree(r6, &(0x7f0000000b00)=ANY=[@ANYBLOB="00000008d00c8e7edefa230400"], 0xfdef) 09:17:24 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, 0x0}) 09:17:24 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f00000007c0)={'security\x00'}, &(0x7f00000004c0)=0x54) perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000840)=ANY=[@ANYBLOB="000186fb205c7601a0d01152dd40e7fa7f9c5856839b2d65b9e5433b81a7fa88ea784e12f09137c3000000"], 0xfdef) [ 946.178902][T17643] device nr0 entered promiscuous mode [ 946.193171][T17650] device nr0 entered promiscuous mode 09:17:24 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x4c000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:24 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, 0x0}) [ 946.349634][T17724] binder_transaction: 40 callbacks suppressed [ 946.350927][T17724] binder: 17712:17724 transaction failed 29189/-22, size 24-8 line 2994 [ 946.386059][T17754] binder: 17712:17754 transaction failed 29189/-22, size 24-8 line 2994 09:17:24 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) poll(&(0x7f0000000280)=[{r0, 0x20c8}], 0x1, 0x100000001) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = syz_open_dev$mice(&(0x7f0000000a00)='/dev/input/mice\x00', 0x0, 0x26400) ioctl$RTC_WKALM_RD(r2, 0x80287010, &(0x7f0000000ac0)) r3 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) lsetxattr$security_smack_entry(&(0x7f00000004c0)='./file0\x00', &(0x7f00000007c0)='security.SMACK64IPIN\x00', &(0x7f0000000800)='nr0\x01\x00', 0x5, 0x2) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000840)={0x0, 0x1d, "ca3d50975c53ba76d2e8f87c942d7fefcd02232d1c8e10f95eb9aca481"}, &(0x7f0000000880)=0x25) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000008c0)={0x0, @in={{0x2, 0x4e24, @remote}}}, &(0x7f0000000980)=0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000000a80)={0x0, 0x3}, &(0x7f0000000a40)) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={r4, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r5, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f00000009c0)='threaded\x00', 0x278) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) write$cgroup_subtree(r6, &(0x7f0000000b00)=ANY=[@ANYBLOB="00000008d00c8e7edefa230400"], 0xfdef) [ 946.406449][ T3007] binder_release_work: 25 callbacks suppressed [ 946.406460][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 946.530258][T17774] binder: 17773:17774 transaction failed 29189/-22, size 24-8 line 2994 [ 946.568577][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 946.875424][T17775] device nr0 entered promiscuous mode 09:17:25 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000800)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r2, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x30, r5, 0x900, 0x70bd2c, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x20}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8001}, @SEG6_ATTR_SECRET={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x800) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r6, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) ioctl$IMHOLD_L1(r2, 0x80044948, &(0x7f00000004c0)) 09:17:25 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x68000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:25 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, 0x0}) 09:17:25 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:25 executing program 5: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 946.981488][T17887] binder: 17886:17887 transaction failed 29189/-22, size 24-8 line 2994 [ 946.989619][T17895] binder: 17893:17895 transaction failed 29189/-22, size 24-8 line 2994 [ 947.012301][T17891] binder: 17888:17891 transaction failed 29189/-22, size 24-8 line 2994 09:17:25 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000980)=ANY=[@ANYRES32=r3, @ANYBLOB="e400000022f805bc50567e45c64f3f07b20c208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7755bcd441b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c23154d4e54cf1905175a069e053d47ca748e4cb99c529e35db1e6aecd46a790827a90f64b53c5574449830cde4bb58b4dcc444fa46b59c9d393ad646edb66dfd4f15e3ba515935bd4eb4f4a858e4e02e118473bd7a90b5666cd2206f726539e28a9028f0912a9f9f8b7ea2f928496dc722b65abbecdf8810a4286157b0b6f34fe2c2b396a15c2ca35d2bd96111ddb6a76388bfcccd78010736a454feb6c149a765143c5aa9b781776c318be49b62ada039f21f6f5695c9100d24d0b3c719f41091459a31226c61c652b6a6fede306e41541b257599dd19d09dc718cefedfded9e"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') r6 = perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) ioctl$DRM_IOCTL_ADD_CTX(r2, 0xc0086420, &(0x7f00000004c0)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r2, 0x40086424, &(0x7f00000007c0)={r7, 0x1}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) ioctl$FS_IOC_GETFSLABEL(r6, 0x81009431, &(0x7f0000000880)) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000840)={[{0x2b, 'rdma'}, {0x2f, 'memory'}, {0x2f, 'io'}, {0x2d, 'memory'}, {0x0, 'pids'}, {0x2b, 'rdma'}, {0x2b, 'io'}, {0x2d, 'memory'}, {0x2d, 'cpu'}, {0x2f, 'memory'}]}, 0xffffffffffffff7e) [ 947.030617][T17896] binder: 17893:17896 transaction failed 29189/-22, size 24-8 line 2994 [ 947.069192][T17894] binder: 17892:17894 ioctl c018620b 0 returned -14 [ 947.085083][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:25 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x6c000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:25 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40486311}], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:25 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bind$rds(r1, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000040)=0x6, 0x4) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x240000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000048f200000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:25 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 947.268651][T18115] binder: 18114:18115 transaction failed 29189/-22, size 24-8 line 2994 [ 947.276351][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.315564][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.385951][T18126] binder: 18114:18126 transaction failed 29189/-22, size 24-8 line 2994 [ 947.411060][T18124] binder: 18123:18124 got transaction to invalid handle [ 947.442973][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.443482][T18124] binder: 18123:18124 transaction failed 29201/-22, size 24-8 line 2994 [ 947.459040][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.473096][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:25 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x74000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:25 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$vbi(&(0x7f00000004c0)='/dev/vbi#\x00', 0x3, 0x2) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000800)={r1, 0x28, &(0x7f00000007c0)}, 0x10) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r4, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r5, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r6, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) r8 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000880)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r1, &(0x7f0000000940)={&(0x7f0000000840), 0xc, &(0x7f0000000900)={&(0x7f00000008c0)={0x14, r8, 0x8, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x4001) ioctl$DRM_IOCTL_GET_CAP(r1, 0xc010640c, &(0x7f0000000980)={0x800, 0x6}) write$cgroup_subtree(r5, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 947.499752][T18113] device nr0 entered promiscuous mode [ 947.506071][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.523256][T18121] device nr0 entered promiscuous mode [ 947.635224][T18198] binder_thread_write: 9 callbacks suppressed [ 947.635248][T18198] binder: 18197:18198 BC_INCREFS_DONE u0000000000000000 no match [ 947.690525][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 947.872960][T18249] device nr0 entered promiscuous mode 09:17:26 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) r5 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000800)='SEG6\x00') sendmsg$SEG6_CMD_GET_TUNSRC(r2, &(0x7f00000008c0)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x30, r5, 0x900, 0x70bd2c, 0x25dfdbfc, {}, [@SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x20}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x8001}, @SEG6_ATTR_SECRET={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x800) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r6, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) ioctl$IMHOLD_L1(r2, 0x80044948, &(0x7f00000004c0)) 09:17:26 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000680)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="5069a7e58609a7815c97901bad27688942f1c1a068b2768fa47e95fcdb88da0af43ad202676d926b8cb673690b74265cb30bcbef92c18715e3696155efee1275fbbc378df8b142475da92c71f2f68118c4d9a54a61ec7e013b8bf40455137802c1b6f2c900502100fd480000633c5a455517db189ef180823e89eb61e5cd1dc80c77f7b7b6e5f1221558afabe446c7619ca606abdbc6d0d8e86f3e2ed36ef40acf0bd54417a0bb70d24ddd640846717d14168db69871ee041feb310068"], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:26 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x7a000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:26 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bind$rds(r1, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r0, 0x119, 0x1, &(0x7f0000000040)=0x6, 0x4) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x240000, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000048f200000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:26 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x74000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 948.031531][T18255] binder: 18254:18255 got transaction to invalid handle [ 948.039959][T18258] binder: 18256:18258 BC_INCREFS_DONE u0000000000000000 no match 09:17:26 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f00000004c0)={'team0\x00', 0x3f}) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000007c0)={r3, 0x5}, &(0x7f0000000800)=0x8) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:26 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000006c0)={0x3cc, {{0x2, 0x4e20, @multicast1}}}, 0x84) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000980)=ANY=[@ANYRES32=r3, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fd0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd3f29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630743d47e51b87b124c231000000000000000000000000000000331340e489cb2e112ccfceb90ada37ad4a2432478d6c070e675a26fc61e40cd351e60c619f36ddcd85baa7c0617758c70b0be64083db7cc821a3987622dbe5321ab5d53639cde4ca5c8c6436429aa9027fdafb35e22dadeb1fdb03bdea2e6565ba09f466206b6c20fa8a0b68b670b3df6133538a94f3f55ebd91c01321e2b4a2aa8001d7d58df2eca54730cf6b6ca9d77b720f19178c77eade0bfb4b4a"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) syz_open_dev$sndtimer(&(0x7f0000000200)='/dev/snd/timer\x00', 0x0, 0x100) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) sendmsg$FOU_CMD_ADD(r2, &(0x7f00000008c0)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x80000200}, 0xc, &(0x7f0000000880)={&(0x7f0000000840)={0x28, r5, 0x10, 0x70bd29, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_TYPE={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x24000004}, 0x0) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000b40)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f0000000900)={0x0, 0x70, 0xfffffffffffffffb, 0x2, 0x9c3, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x800000000000000, 0x0, 0x400}, 0x0, 0x0, r2, 0xfffffffffffffffe) ioctl$TIOCGSID(r2, 0x5429, &(0x7f00000004c0)=0x0) ioctl$sock_SIOCSPGRP(r6, 0x8902, &(0x7f00000007c0)=r7) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:26 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x41, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="0000000000010000"], 0x0, 0x0, &(0x7f0000000780)}) 09:17:26 executing program 4: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000980)='/dev/autofs\x00', 0x80000, 0x0) r2 = syz_open_dev$admmidi(&(0x7f00000009c0)='/dev/admmidi#\x00', 0x7ff, 0x200001) r3 = openat$cgroup(r2, &(0x7f0000000a00)='syz1\x00', 0x200002, 0x0) r4 = openat$cgroup_ro(r3, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r4, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r2, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000a40)=ANY=[@ANYRES32=r5, @ANYBLOB="e480000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6660428c2ca000000000000000044a7b3fd46e2606aed03fffa118ccb270be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d90864ca4c19874cafdaac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8e000001c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231de0f4575a77c7ea8e9917ec3f5bb78e8652806b5d9f5fc31212625089a93f56a36c89a2ae2d118a590cb83c44ef1ff6f739dd59e09abb447dc4a46a8a0fe646f6f72ee0e05b66ee540f1dcf965280f96f1e81861a42d978f58eba7b38cbcb7715fa26245411e2a64c98e1f0d9cac1640bd2884e6d25c8ebdcada2484717f77b3"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') r8 = perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000880)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000840)={0xffffffffffffffff}, 0x0, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f00000008c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0xd43, @loopback, 0x4bff}, {0xa, 0x4e20, 0x7, @mcast2}, r9, 0x7}}, 0x48) write$cgroup_type(r4, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000800)=0x2, 0x264) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r10 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="02052abd7000fcdbdf250100000004000500080001004e220000080001004e24000008000300290000000800040002000000"], 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0x0, r8, 0x0, 0x2, &(0x7f00000004c0)='{\x00', 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f00000001c0)={0x0, 0x77, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r11, 0x0, r4, 0x0) write$cgroup_subtree(r6, &(0x7f0000000940)=ANY=[@ANYBLOB="fdff8a203770f55a73c1db0dd71c07e81644abd57a81872839e8aad0aa9e416891bc6b5b1152cd567dc11f2a82a58f"], 0xfdef) 09:17:26 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x100000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 948.286450][T18272] device nr0 entered promiscuous mode [ 948.376432][T18295] binder: 18282:18295 BC_INCREFS_DONE u0000000000000000 no match 09:17:26 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4068aea3, &(0x7f00000007c0)={0x7b, 0x0, [0x7, 0x1000, 0x5605, 0x7fff]}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000980)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0xfffffffffffffffe, 0x0, 0xfff, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x7, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x8, 0x8, 0x4, 0x0, 0xffff, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) socket$nl_crypto(0x10, 0x3, 0x15) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f00000004c0)=@int=0x5, 0x4) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:26 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x200000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 948.602993][T18501] binder: 18499:18501 BC_INCREFS_DONE u0000000000000000 no match [ 948.749672][T18421] device nr0 entered promiscuous mode [ 948.769393][T18504] device nr0 entered promiscuous mode 09:17:26 executing program 0: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:26 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x300000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:26 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f00000004c0)={'team0\x00', 0x3f}) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000007c0)={r3, 0x5}, &(0x7f0000000800)=0x8) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:26 executing program 4: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000980)='/dev/autofs\x00', 0x80000, 0x0) r2 = syz_open_dev$admmidi(&(0x7f00000009c0)='/dev/admmidi#\x00', 0x7ff, 0x200001) r3 = openat$cgroup(r2, &(0x7f0000000a00)='syz1\x00', 0x200002, 0x0) r4 = openat$cgroup_ro(r3, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r4, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r2, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000a40)=ANY=[@ANYRES32=r5, @ANYBLOB="e480000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6660428c2ca000000000000000044a7b3fd46e2606aed03fffa118ccb270be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d90864ca4c19874cafdaac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8e000001c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231de0f4575a77c7ea8e9917ec3f5bb78e8652806b5d9f5fc31212625089a93f56a36c89a2ae2d118a590cb83c44ef1ff6f739dd59e09abb447dc4a46a8a0fe646f6f72ee0e05b66ee540f1dcf965280f96f1e81861a42d978f58eba7b38cbcb7715fa26245411e2a64c98e1f0d9cac1640bd2884e6d25c8ebdcada2484717f77b3"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') r8 = perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000880)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000840)={0xffffffffffffffff}, 0x0, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f00000008c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0xd43, @loopback, 0x4bff}, {0xa, 0x4e20, 0x7, @mcast2}, r9, 0x7}}, 0x48) write$cgroup_type(r4, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000800)=0x2, 0x264) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r10 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="02052abd7000fcdbdf250100000004000500080001004e220000080001004e24000008000300290000000800040002000000"], 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0x0, r8, 0x0, 0x2, &(0x7f00000004c0)='{\x00', 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f00000001c0)={0x0, 0x77, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r11, 0x0, r4, 0x0) write$cgroup_subtree(r6, &(0x7f0000000940)=ANY=[@ANYBLOB="fdff8a203770f55a73c1db0dd71c07e81644abd57a81872839e8aad0aa9e416891bc6b5b1152cd567dc11f2a82a58f"], 0xfdef) 09:17:27 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 948.923557][T18509] binder: 18508:18509 BC_INCREFS_DONE u0000000000000000 no match 09:17:27 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:27 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x400000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 949.045243][T18517] binder: 18516:18517 ioctl c018620b 0 returned -14 09:17:27 executing program 1: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 949.211438][T18677] binder: 18656:18677 BC_INCREFS_DONE u0000000000000000 no match 09:17:27 executing program 0: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:27 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x500000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:27 executing program 4: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000980)='/dev/autofs\x00', 0x80000, 0x0) r2 = syz_open_dev$admmidi(&(0x7f00000009c0)='/dev/admmidi#\x00', 0x7ff, 0x200001) r3 = openat$cgroup(r2, &(0x7f0000000a00)='syz1\x00', 0x200002, 0x0) r4 = openat$cgroup_ro(r3, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r4, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={r2, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f0000000a40)=ANY=[@ANYRES32=r5, @ANYBLOB="e480000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6660428c2ca000000000000000044a7b3fd46e2606aed03fffa118ccb270be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d90864ca4c19874cafdaac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8e000001c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231de0f4575a77c7ea8e9917ec3f5bb78e8652806b5d9f5fc31212625089a93f56a36c89a2ae2d118a590cb83c44ef1ff6f739dd59e09abb447dc4a46a8a0fe646f6f72ee0e05b66ee540f1dcf965280f96f1e81861a42d978f58eba7b38cbcb7715fa26245411e2a64c98e1f0d9cac1640bd2884e6d25c8ebdcada2484717f77b3"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') r8 = perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000880)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000840)={0xffffffffffffffff}, 0x0, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r4, &(0x7f00000008c0)={0x3, 0x40, 0xfa00, {{0xa, 0x4e22, 0xd43, @loopback, 0x4bff}, {0xa, 0x4e20, 0x7, @mcast2}, r9, 0x7}}, 0x48) write$cgroup_type(r4, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000800)=0x2, 0x264) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r10 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r10, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="02052abd7000fcdbdf250100000004000500080001004e220000080001004e24000008000300290000000800040002000000"], 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000007c0)={0x0, r8, 0x0, 0x2, &(0x7f00000004c0)='{\x00', 0xffffffffffffffff}, 0x30) perf_event_open(&(0x7f00000001c0)={0x0, 0x77, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r11, 0x0, r4, 0x0) write$cgroup_subtree(r6, &(0x7f0000000940)=ANY=[@ANYBLOB="fdff8a203770f55a73c1db0dd71c07e81644abd57a81872839e8aad0aa9e416891bc6b5b1152cd567dc11f2a82a58f"], 0xfdef) [ 949.303014][T18724] device nr0 entered promiscuous mode [ 949.428540][T18733] binder: 18732:18733 BC_INCREFS_DONE node 2197 has no pending increfs request [ 949.451357][T18739] binder: 18738:18739 BC_INCREFS_DONE node 2200 has no pending increfs request [ 949.508433][ T17] binder: release 18732:18733 transaction 2196 out, still active [ 949.531274][ T17] binder: unexpected work type, 4, not freed 09:17:27 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = getpgrp(0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x82, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, r0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r4, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000840)='/dev/net/tun\x00', 0x2020000, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r5, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r6, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) write$cgroup_subtree(r5, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 949.554021][ T17] binder: undelivered TRANSACTION_COMPLETE [ 949.584896][ T17] binder: send failed reply for transaction 2196, target dead [ 949.618074][ T17] binder: send failed reply for transaction 2199 to 18738:18739 [ 949.631715][T18739] binder: 18738:18739 BC_INCREFS_DONE u0000000000000000 no match [ 949.635777][T18742] binder: 18740:18742 BC_INCREFS_DONE node 2204 has no pending increfs request [ 949.683214][ T17] binder: release 18738:18765 transaction 2206 out, still active 09:17:27 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x600000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 949.728961][ T17] binder: unexpected work type, 4, not freed [ 949.754216][ T17] binder: undelivered TRANSACTION_COMPLETE [ 949.803202][ T17] binder: release 18740:18742 transaction 2203 out, still active [ 949.803223][ T17] binder: unexpected work type, 4, not freed 09:17:27 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000800)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 949.851592][T18852] binder_alloc: 18740: binder_alloc_buf, no vma [ 949.863942][ T17] binder: undelivered TRANSACTION_COMPLETE [ 949.872710][T18854] binder_alloc: 18740: binder_alloc_buf, no vma [ 949.889876][ T17] binder: send failed reply for transaction 2203, target dead [ 949.903596][T18852] binder: 18851:18852 BC_INCREFS_DONE u0000000000000000 no match [ 949.913972][ T17] binder: send failed reply for transaction 2206, target dead 09:17:28 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) ioctl$sock_SIOCADDDLCI(r2, 0x8980, &(0x7f00000004c0)={'team0\x00', 0x3f}) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000007c0)={r3, 0x5}, &(0x7f0000000800)=0x8) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:28 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x700000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 949.962977][T18857] device nr0 entered promiscuous mode [ 950.099224][T18867] binder: 18865:18867 BC_INCREFS_DONE u0000000000000000 no match 09:17:28 executing program 5: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:28 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 950.169545][T18864] device nr0 entered promiscuous mode 09:17:28 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xa00000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 950.374649][T18972] binder: 18971:18972 BC_INCREFS_DONE node 2216 has no pending increfs request [ 950.421003][ T17] binder: release 18971:18972 transaction 2215 out, still active [ 950.435507][ T17] binder: unexpected work type, 4, not freed 09:17:28 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:28 executing program 5: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(0x0, &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 950.463662][T18977] binder: 18976:18977 BC_INCREFS_DONE node 2219 has no pending increfs request [ 950.472294][ T17] binder: undelivered TRANSACTION_COMPLETE [ 950.487727][ T17] binder: send failed reply for transaction 2215, target dead [ 950.511239][ T17] binder: send failed reply for transaction 2218 to 18976:18977 [ 950.592629][T18977] binder: 18976:18977 BC_INCREFS_DONE u0000000000000000 no match [ 950.630294][T18981] binder: 18980:18981 BC_INCREFS_DONE node 2224 has no pending increfs request 09:17:28 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x1000000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 950.637604][T18984] binder: 18983:18984 BC_INCREFS_DONE u0000000000000000 node 2227 cookie mismatch 3f00000000000000 != 0000000000000000 [ 950.675158][ T17] binder: release 18980:18981 transaction 2223 out, still active [ 950.683042][ T17] binder: unexpected work type, 4, not freed 09:17:28 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$bt_BT_RCVMTU(r1, 0x112, 0xd, &(0x7f0000000000), 0x2) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 950.724155][ T17] binder: undelivered TRANSACTION_COMPLETE [ 950.750946][ T17] binder: release 18983:18984 transaction 2226 out, still active [ 950.796221][ T17] binder: unexpected work type, 4, not freed [ 950.809741][T18988] binder_alloc: 18980: binder_alloc_buf, no vma [ 950.824213][ T17] binder: undelivered TRANSACTION_COMPLETE [ 950.835587][T18992] binder_alloc: 18980: binder_alloc_buf, no vma [ 950.861150][ T17] binder: send failed reply for transaction 2223, target dead [ 950.888375][ T17] binder: send failed reply for transaction 2226, target dead 09:17:29 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) fcntl$addseals(r4, 0x409, 0xb) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:29 executing program 4: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(0x0, &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:29 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:29 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x0) sendmsg$kcm(r0, 0x0, 0x4800) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) r4 = getpid() setpriority(0x0, r4, 0x200) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[@ANYRES32=r5, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a2fb1b080e79a8924a7968630c23183b0479b21e65fdd61cac03d1b532e1c17ba75cffd0109bb17446d49ae4be613a6e270a6e898885b8328d8e8a79487831127887fc2d635f81fcd333abea45aa561d379eb7af6de47e27a438a2e5b7b66cec1887b0b05f1ed19d8678463c2c4a49fec70c4d2b6711b0fdd2f1f8e603d374e0be300e805c4c5da8b2fb1e0bf01447bbaf738b2998706c644f1e21b746d2afc3ab0303612737f16a27f8b1a25644b02a57adccbd74af9abd4a20b183aeb4a"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f00000007c0)={0x0, {{0xa, 0x4e20, 0x0, @empty, 0x8001}}, 0x1, 0x4, [{{0xa, 0x4e24, 0x8000, @local, 0x4fb3}}, {{0xa, 0x4e24, 0x2, @local, 0x8b9}}, {{0xa, 0x4e22, 0x7fff, @local, 0x6}}, {{0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x4}}]}, 0x28c) write$cgroup_subtree(r6, &(0x7f00000004c0)=ANY=[@ANYBLOB="34b83065006386"], 0xfdef) 09:17:29 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x3f00000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:29 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000800)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 951.232936][T19004] binder: 18997:19004 BC_INCREFS_DONE node 2237 has no pending increfs request 09:17:29 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x4800000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:29 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 951.295861][ T17] binder: release 18997:19004 transaction 2236 out, still active [ 951.324010][ T17] binder: unexpected work type, 4, not freed [ 951.364996][ T17] binder: undelivered TRANSACTION_COMPLETE 09:17:29 executing program 4: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 951.414096][ T17] binder: send failed reply for transaction 2236, target dead [ 951.418945][T19066] binder_transaction: 32 callbacks suppressed [ 951.418994][T19066] binder: 19065:19066 transaction failed 29189/-22, size 24-8 line 2994 [ 951.478585][T19064] binder: 19063:19064 transaction failed 29189/-22, size 24-8 line 2994 [ 951.514606][T19076] device nr0 entered promiscuous mode [ 951.539921][T12196] binder_release_work: 19 callbacks suppressed [ 951.539929][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 951.562277][T19124] binder: 19123:19124 BC_INCREFS_DONE node 2244 has no pending increfs request [ 951.562555][T19005] device nr0 entered promiscuous mode [ 951.579519][T19066] binder: 19065:19066 BC_INCREFS_DONE node 2246 has no pending increfs request 09:17:29 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r3, &(0x7f0000000000)='io.stat\x00', 0x275a, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000000)={0x100, 0x6, 0x7, 0x5}, 0x8) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 951.590839][T12196] binder: release 19065:19126 transaction 2242 out, still active [ 951.608114][T12196] binder: unexpected work type, 4, not freed 09:17:29 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x4c00000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 951.647314][T12196] binder: undelivered TRANSACTION_COMPLETE [ 951.671399][T12196] binder: release 19123:19124 transaction 2243 out, still active 09:17:29 executing program 4: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 951.705315][T12196] binder: unexpected work type, 4, not freed [ 951.715778][T12196] binder: undelivered TRANSACTION_COMPLETE [ 951.738715][T12196] binder: send failed reply for transaction 2243, target dead [ 951.755794][T19129] binder: 19128:19129 transaction failed 29189/-22, size 24-8 line 2994 [ 951.758854][T12196] binder: send failed reply for transaction 2242, target dead [ 951.788406][T19133] binder: 19132:19133 transaction failed 29189/-22, size 24-8 line 2994 [ 951.807210][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 951.883673][ T17] binder: undelivered TRANSACTION_ERROR: 29189 [ 951.890110][ T17] binder: release 19132:19137 transaction 2252 out, still active [ 951.921805][ T17] binder: unexpected work type, 4, not freed [ 951.933521][ T17] binder: undelivered TRANSACTION_COMPLETE [ 952.128569][ T3007] binder: send failed reply for transaction 2252, target dead [ 952.138824][ T3007] binder: send failed reply for transaction 2251 to 19134:19135 [ 952.154852][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 09:17:30 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:30 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x200002, 0x0) openat$cgroup_ro(r3, &(0x7f0000000000)='io.stat\x00', 0x275a, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f0000000000)={0x100, 0x6, 0x7, 0x5}, 0x8) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:30 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x6800000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:30 executing program 4: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:30 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x0) sendmsg$kcm(r0, 0x0, 0x4800) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) r4 = getpid() setpriority(0x0, r4, 0x200) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[@ANYRES32=r5, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a2fb1b080e79a8924a7968630c23183b0479b21e65fdd61cac03d1b532e1c17ba75cffd0109bb17446d49ae4be613a6e270a6e898885b8328d8e8a79487831127887fc2d635f81fcd333abea45aa561d379eb7af6de47e27a438a2e5b7b66cec1887b0b05f1ed19d8678463c2c4a49fec70c4d2b6711b0fdd2f1f8e603d374e0be300e805c4c5da8b2fb1e0bf01447bbaf738b2998706c644f1e21b746d2afc3ab0303612737f16a27f8b1a25644b02a57adccbd74af9abd4a20b183aeb4a"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f00000007c0)={0x0, {{0xa, 0x4e20, 0x0, @empty, 0x8001}}, 0x1, 0x4, [{{0xa, 0x4e24, 0x8000, @local, 0x4fb3}}, {{0xa, 0x4e24, 0x2, @local, 0x8b9}}, {{0xa, 0x4e22, 0x7fff, @local, 0x6}}, {{0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x4}}]}, 0x28c) write$cgroup_subtree(r6, &(0x7f00000004c0)=ANY=[@ANYBLOB="34b83065006386"], 0xfdef) 09:17:30 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000800)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 952.305455][T19243] binder: 19241:19243 transaction failed 29189/-22, size 24-8 line 2994 [ 952.359234][T19248] binder: 19244:19248 transaction failed 29189/-22, size 24-8 line 2994 [ 952.388715][T19254] binder: 19241:19254 transaction failed 29189/-22, size 24-8 line 2994 [ 952.409148][T19246] binder: 19245:19246 BC_INCREFS_DONE node 2262 has no pending increfs request [ 952.429248][T19253] binder: 19251:19253 BC_INCREFS_DONE u0000000000000000 node 2265 cookie mismatch 3f00000000000000 != 0000000000000000 [ 952.454270][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 952.463279][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 952.488415][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 09:17:30 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) fcntl$setstatus(r0, 0x4, 0x40400) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') getitimer(0x0, &(0x7f00000004c0)) perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:30 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x6c00000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 952.542384][ T3007] binder: unexpected work type, 4, not freed 09:17:30 executing program 4: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 952.595024][ T3007] binder: unexpected work type, 4, not freed 09:17:30 executing program 1: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 952.679590][T19303] binder: 19302:19303 transaction failed 29189/-22, size 24-8 line 2994 [ 952.731699][T19312] device nr0 entered promiscuous mode [ 952.742493][T19373] binder: 19302:19373 transaction failed 29189/-22, size 24-8 line 2994 [ 952.828178][T19303] binder_thread_write: 8 callbacks suppressed [ 952.828194][T19303] binder: 19302:19303 BC_INCREFS_DONE u0000000000000000 no match [ 952.831967][ T3007] binder: unexpected work type, 4, not freed [ 952.834990][T19372] binder: BINDER_SET_CONTEXT_MGR already set 09:17:31 executing program 1: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000a00)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f00000007c0)={0x3f, {{0xa, 0x4e22, 0x401, @rand_addr="c48a47ff74ab07e0ca69534064daa1e9", 0x6}}, 0x0, 0x2, [{{0xa, 0x4e22, 0xffffffffffffffb2, @local, 0x1ff}}, {{0xa, 0x4e20, 0x4, @ipv4={[], [], @multicast1}, 0x8}}]}, 0x18c) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:31 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x7400000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 952.952158][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 952.952302][T19372] binder: 19371:19372 ioctl 40046207 0 returned -16 [ 953.063270][T19430] binder: 19422:19430 transaction failed 29189/-22, size 24-8 line 2994 [ 953.102642][T19430] binder: 19422:19430 BC_INCREFS_DONE u0000000000000000 no match 09:17:31 executing program 4: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 953.135855][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 09:17:31 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x7a00000000000000, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 953.266485][ T3007] binder: unexpected work type, 4, not freed 09:17:31 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 953.308899][ T7897] binder: send failed reply for transaction 2279 to 19492:19493 [ 953.319966][T19493] binder: 19492:19493 BC_INCREFS_DONE u0000000000000000 no match [ 953.361531][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 09:17:31 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x2, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:31 executing program 2: recvmsg(0xffffffffffffffff, 0x0, 0x0) r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x0) sendmsg$kcm(r0, 0x0, 0x4800) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) r4 = getpid() setpriority(0x0, r4, 0x200) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f0000000a80)=ANY=[@ANYRES32=r5, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a2fb1b080e79a8924a7968630c23183b0479b21e65fdd61cac03d1b532e1c17ba75cffd0109bb17446d49ae4be613a6e270a6e898885b8328d8e8a79487831127887fc2d635f81fcd333abea45aa561d379eb7af6de47e27a438a2e5b7b66cec1887b0b05f1ed19d8678463c2c4a49fec70c4d2b6711b0fdd2f1f8e603d374e0be300e805c4c5da8b2fb1e0bf01447bbaf738b2998706c644f1e21b746d2afc3ab0303612737f16a27f8b1a25644b02a57adccbd74af9abd4a20b183aeb4a"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r6, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f00000007c0)={0x0, {{0xa, 0x4e20, 0x0, @empty, 0x8001}}, 0x1, 0x4, [{{0xa, 0x4e24, 0x8000, @local, 0x4fb3}}, {{0xa, 0x4e24, 0x2, @local, 0x8b9}}, {{0xa, 0x4e22, 0x7fff, @local, 0x6}}, {{0xa, 0x4e23, 0x5, @ipv4={[], [], @multicast1}, 0x4}}]}, 0x28c) write$cgroup_subtree(r6, &(0x7f00000004c0)=ANY=[@ANYBLOB="34b83065006386"], 0xfdef) [ 953.483100][T19501] binder: 19500:19501 BC_INCREFS_DONE u0000000000000000 no match [ 953.629557][T19491] device nr0 entered promiscuous mode 09:17:31 executing program 0: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:31 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:31 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:31 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r1, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) r2 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000000)={0x9, 0x0, {0x1, 0x0, 0x5, 0x3, 0x50}}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(r0, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 953.791149][T19512] binder: 19511:19512 BC_INCREFS_DONE u0000000000000000 no match 09:17:31 executing program 5: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:32 executing program 1: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:32 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:32 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x4, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 953.979644][ T7897] binder: unexpected work type, 4, not freed [ 954.044076][T19627] binder: 19626:19627 BC_INCREFS_DONE u0000000000000000 node 2295 cookie mismatch 3f00000000000000 != 0000000000000000 [ 954.074969][T19625] binder: BINDER_SET_CONTEXT_MGR already set [ 954.081563][T19625] binder: 19623:19625 ioctl 40046207 0 returned -16 09:17:32 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) ioctl$TUNGETVNETHDRSZ(r2, 0x800454d7, &(0x7f00000004c0)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 954.117638][ T3007] binder: send failed reply for transaction 2294 to 19626:19627 09:17:32 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 954.188028][ T3007] binder: send failed reply for transaction 2297 to 19630:19631 [ 954.197377][T19635] binder: 19623:19635 BC_INCREFS_DONE u0000000000000000 no match [ 954.215366][ T3007] binder: send failed reply for transaction 2300 to 19630:19633 [ 954.229398][T19625] binder_alloc: 19585: binder_alloc_buf, no vma [ 954.249103][ T3007] binder: unexpected work type, 4, not freed 09:17:32 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x5, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 954.302864][T19641] binder: 19640:19641 BC_INCREFS_DONE u0000000000000000 node 2307 cookie mismatch 3f00000000000000 != 0000000000000000 [ 954.326762][ T3007] binder: unexpected work type, 4, not freed 09:17:32 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:32 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:32 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3f00000000000000, &(0x7f0000000780)}) 09:17:32 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 954.437719][T19639] device nr0 entered promiscuous mode [ 954.502945][T19647] binder: 19645:19647 BC_INCREFS_DONE u0000000000000000 no match [ 954.579545][T19650] binder_thread_write: 7 callbacks suppressed [ 954.579593][T19650] binder: 19649:19650 BC_INCREFS_DONE node 2314 has no pending increfs request [ 954.594536][T19656] binder: 19655:19656 BC_INCREFS_DONE u0000000000000000 node 2317 cookie mismatch 3f00000000000000 != 0000000000000000 09:17:32 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0xfdfdffff, &(0x7f0000000780)}) 09:17:32 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x6, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 954.619433][T19658] binder: 19657:19658 BC_INCREFS_DONE node 2320 has no pending increfs request [ 954.694120][ T7897] binder_thread_release: 7 callbacks suppressed [ 954.694131][ T7897] binder: release 19649:19650 transaction 2313 out, still active [ 954.704546][T19663] binder: 19661:19663 BC_INCREFS_DONE node 2323 has no pending increfs request 09:17:32 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3f000000, &(0x7f0000000780)}) [ 954.744088][ T7897] binder: unexpected work type, 4, not freed [ 954.755394][T19664] binder: 19662:19664 BC_INCREFS_DONE node 2326 has no pending increfs request [ 954.766816][ T7897] binder_release_work: 11 callbacks suppressed [ 954.766821][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:17:32 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:32 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 954.807653][T19666] binder_alloc: 19649: binder_alloc_buf, no vma [ 954.822412][ T7897] binder: release 19655:19656 transaction 2316 out, still active [ 954.852300][ T7897] binder: unexpected work type, 4, not freed [ 954.878391][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 954.881111][T19663] binder: 19661:19663 BC_INCREFS_DONE u0000000000000000 no match [ 954.909925][ T7897] binder: release 19661:19663 transaction 2322 out, still active [ 954.925988][T19669] binder_alloc: 19649: binder_alloc_buf, no vma [ 954.954712][ T7897] binder: unexpected work type, 4, not freed [ 954.965555][T19673] binder_alloc: 19649: binder_alloc_buf, no vma [ 954.981218][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 954.996060][T19675] binder_alloc: 19649: binder_alloc_buf, no vma [ 955.001712][ T7897] binder: release 19662:19664 transaction 2325 out, still active [ 955.037146][ T7897] binder: unexpected work type, 4, not freed [ 955.043391][T19748] binder: 19674:19748 BC_INCREFS_DONE u0000000000000000 no match [ 955.065703][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 955.088726][ T7897] binder: release 19657:19658 transaction 2319 out, still active [ 955.109914][ T7897] binder: unexpected work type, 4, not freed [ 955.123840][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 955.137064][ T7897] binder_send_failed_reply: 7 callbacks suppressed [ 955.137072][ T7897] binder: send failed reply for transaction 2313, target dead [ 955.168714][ T7897] binder: send failed reply for transaction 2316, target dead [ 955.177254][ T7897] binder: send failed reply for transaction 2319, target dead [ 955.185220][ T7897] binder: send failed reply for transaction 2322, target dead [ 955.193660][ T7897] binder: send failed reply for transaction 2325, target dead 09:17:33 executing program 0: r0 = syz_open_dev$usb(&(0x7f00000004c0)='/dev/bus/usb/00#/00#\x00', 0x80000000, 0x200000) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f00000007c0)) recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r4, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000000980)=@get={0x1, &(0x7f0000000900)=""/109, 0x8}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r5, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000800)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="02052abd7000fcdbdf2501000000040005000800015f5ba36bf003a1ce3cd5dcbf004e220000080001004e24000008000300290000000800040002000000fda9ae313e15ac5282643ff074f3e43fa8943c43d6ee5c9c8cb19002af566de8197ca589dd7054db46ececc1c18e590372566ddf514e0d504e62aebb9f1a991a31587dbe6d0623d94d64e44f4b91df61259d299a00e55964d36d9d81b8222aa140ad6970d5315ba928dfc47bcdd17943a1ba5cc9a92534f54b39f0226752d6151b674785"], 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) write$cgroup_subtree(r5, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:33 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:33 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x7, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:33 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x3f00000000000000, 0x0, &(0x7f0000000780)}) 09:17:33 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3f000000, &(0x7f0000000780)}) 09:17:33 executing program 5: r0 = syz_open_dev$usb(&(0x7f00000004c0)='/dev/bus/usb/00#/00#\x00', 0x80000000, 0x200000) ioctl$TUNSETVNETBE(r0, 0x400454de, &(0x7f00000007c0)) recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r3, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r3, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, &(0x7f00000006c0)={r4, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0x4) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r3, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) ioctl$sock_SIOCSIFBR(r3, 0x8941, &(0x7f0000000980)=@get={0x1, &(0x7f0000000900)=""/109, 0x8}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r7 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r5, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000800)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="02052abd7000fcdbdf2501000000040005000800015f5ba36bf003a1ce3cd5dcbf004e220000080001004e24000008000300290000000800040002000000fda9ae313e15ac5282643ff074f3e43fa8943c43d6ee5c9c8cb19002af566de8197ca589dd7054db46ececc1c18e590372566ddf514e0d504e62aebb9f1a991a31587dbe6d0623d94d64e44f4b91df61259d299a00e55964d36d9d81b8222aa140ad6970d5315ba928dfc47bcdd17943a1ba5cc9a92534f54b39f0226752d6151b674785"], 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r3, 0x0) write$cgroup_subtree(r5, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) [ 955.368158][T19793] binder: 19787:19793 BC_INCREFS_DONE u0000000000000000 no match 09:17:33 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfdfdffff, 0x0, &(0x7f0000000780)}) 09:17:33 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:33 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0xa, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:33 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3f000000, &(0x7f0000000780)}) 09:17:33 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x3f000000, 0x0, &(0x7f0000000780)}) 09:17:33 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x3f000000, 0x0, &(0x7f0000000780)}) [ 955.675000][T19904] device nr0 entered promiscuous mode [ 955.709431][T19911] device nr0 entered promiscuous mode 09:17:34 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000900)='/dev/dmmidi#\x00', 0x4, 0x20800) sendmsg$kcm(r0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f00000007c0)='netdevsim0\x00') r4 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r4, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) ioctl$KVM_GET_DEVICE_ATTR(r4, 0x4018aee2, &(0x7f0000000840)={0x0, 0x3, 0x9, &(0x7f0000000800)=0x5}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getdents(r4, &(0x7f00000004c0)=""/5, 0x5) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f00000006c0)={r5, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(r4, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r4, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) r9 = semget(0x2, 0x5, 0xa0) semctl$GETPID(r9, 0x7, 0xb, &(0x7f0000000880)=""/36) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000008c0)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r4, 0x0) write$cgroup_subtree(r6, &(0x7f00000007c0), 0x0) 09:17:34 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x10, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:34 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0xfdfdffff00000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:34 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r2, 0x117, 0x5, 0x0, 0x8) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000007c0)=ANY=[@ANYRES32=r3, @ANYBLOB="e400000022f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f0003d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e3342060000001d29b093bfb17f053af40a31d263e8185ab21887763303f345cddc18d35e1608315633"], 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') r7 = getpgid(0xffffffffffffffff) wait4(r7, &(0x7f00000004c0), 0x20000000, 0x0) sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) ioctl$sock_SIOCGIFBR(r2, 0x8940, &(0x7f0000000700)=@get={0x1, &(0x7f00000006c0)=""/64, 0x1663}) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) 09:17:34 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0xfdfdffff}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:34 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0xfdfdffff}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:34 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:34 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x48, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:34 executing program 1: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:34 executing program 4: r0 = open(0x0, 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 956.315038][T19951] binder: 19950:19951 BC_INCREFS_DONE node 2350 has no pending increfs request [ 956.318020][T19955] binder: 19954:19955 BC_INCREFS_DONE node 2353 has no pending increfs request [ 956.334433][T19949] binder: BINDER_SET_CONTEXT_MGR already set [ 956.354216][T19949] binder: 19948:19949 ioctl 40046207 0 returned -16 [ 956.374967][ T3007] binder: release 19950:19957 transaction 2349 out, still active [ 956.402878][ T3007] binder: unexpected work type, 4, not freed 09:17:34 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x4c, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 956.432933][ T3007] binder: undelivered TRANSACTION_COMPLETE [ 956.433182][T19949] binder: 19948:19949 BC_INCREFS_DONE node 2356 has no pending increfs request [ 956.457549][T19961] binder: BINDER_SET_CONTEXT_MGR already set [ 956.474561][T19961] binder: 19960:19961 ioctl 40046207 0 returned -16 09:17:34 executing program 1: r0 = open(0x0, 0x0, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 956.480227][ T3007] binder: release 19954:19955 transaction 2352 out, still active [ 956.532412][ T3007] binder: unexpected work type, 4, not freed [ 956.536527][T19961] binder_alloc: 19954: binder_alloc_buf, no vma [ 956.548384][T19952] device nr0 entered promiscuous mode [ 956.564700][ T3007] binder: undelivered TRANSACTION_COMPLETE [ 956.571409][T19961] binder_transaction: 33 callbacks suppressed [ 956.571495][T19961] binder: 19960:19961 transaction failed 29189/-3, size 24-8 line 3147 [ 956.587323][T19967] binder_alloc: 19954: binder_alloc_buf, no vma [ 956.589338][T19953] device nr0 entered promiscuous mode [ 956.600994][ T3007] binder: send failed reply for transaction 2349, target dead [ 956.618146][T19967] binder: 19965:19967 transaction failed 29189/-3, size 24-8 line 3147 [ 956.640449][T19966] binder: 19964:19966 BC_INCREFS_DONE node 2362 has no pending increfs request [ 956.650073][ T3007] binder: send failed reply for transaction 2352, target dead [ 956.663797][ T3007] binder: send failed reply for transaction 2355 to 19948:19949 [ 956.704032][ T3007] binder: release 19964:19966 transaction 2361 out, still active [ 956.723463][ T3007] binder: unexpected work type, 4, not freed [ 956.731625][T19967] binder: 19965:19967 BC_INCREFS_DONE node 2365 has no pending increfs request [ 956.741516][ T3007] binder: undelivered TRANSACTION_COMPLETE [ 956.780270][ T3007] binder_release_work: 30 callbacks suppressed [ 956.780276][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 956.806415][ T3007] binder: release 19965:19973 transaction 2364 out, still active [ 956.820343][ T3007] binder: unexpected work type, 4, not freed [ 956.826459][ T3007] binder: undelivered TRANSACTION_COMPLETE [ 956.832452][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 956.839991][ T3007] binder: send failed reply for transaction 2361, target dead [ 956.856208][ T3007] binder: send failed reply for transaction 2364, target dead [ 956.864311][ T3007] binder: undelivered TRANSACTION_COMPLETE [ 956.870209][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 09:17:35 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000900)='/dev/dmmidi#\x00', 0x4, 0x20800) sendmsg$kcm(r0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f00000007c0)='netdevsim0\x00') r4 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r4, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) ioctl$KVM_GET_DEVICE_ATTR(r4, 0x4018aee2, &(0x7f0000000840)={0x0, 0x3, 0x9, &(0x7f0000000800)=0x5}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getdents(r4, &(0x7f00000004c0)=""/5, 0x5) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f00000006c0)={r5, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(r4, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r4, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) r9 = semget(0x2, 0x5, 0xa0) semctl$GETPID(r9, 0x7, 0xb, &(0x7f0000000880)=""/36) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000008c0)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r4, 0x0) write$cgroup_subtree(r6, &(0x7f00000007c0), 0x0) 09:17:35 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:35 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:35 executing program 4: r0 = open(0x0, 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:35 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x68, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:35 executing program 5: recvmsg(0xffffffffffffffff, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r2 = openat$cgroup_ro(r1, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r2, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000006c0)={r3, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r0, 0x0, 0x2}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(0xffffffffffffffff, 0xc048ae65, 0x0) r5 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r2, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) setsockopt$inet_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f00000007c0), 0x4) r6 = socket$kcm(0x29, 0x5, 0x0) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f0000000080)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r5, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r2, 0x0) write$cgroup_subtree(r4, &(0x7f00000000c0)={[{0x0, 'c\x86\xdd'}]}, 0xfdef) setsockopt$inet_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f00000004c0), 0x4) [ 957.032258][T20077] binder: 20076:20077 transaction failed 29189/-22, size 24-8 line 2994 [ 957.039283][T20083] binder: 20075:20083 transaction failed 29189/-22, size 24-8 line 2994 [ 957.099598][T20085] binder: BINDER_SET_CONTEXT_MGR already set [ 957.113460][T20084] binder: 20081:20084 BC_INCREFS_DONE node 2371 has no pending increfs request [ 957.136866][T20085] binder: 20082:20085 ioctl 40046207 0 returned -16 [ 957.136872][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 09:17:35 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x402c5828, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 957.154456][ T3007] binder: release 20075:20089 transaction 2373 out, still active [ 957.186749][ T3007] binder: unexpected work type, 4, not freed 09:17:35 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x6c, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:35 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 957.224186][ T3007] binder: send failed reply for transaction 2370 to 20081:20084 [ 957.294129][ T3007] binder: send failed reply for transaction 2373, target dead [ 957.326449][T20145] binder: 20144:20145 transaction failed 29189/-22, size 24-8 line 2994 [ 957.334556][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 957.378082][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 957.382104][T20112] device nr0 entered promiscuous mode [ 957.402717][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 09:17:35 executing program 2: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0x100000000}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 957.444632][T20203] binder: 20201:20203 transaction failed 29189/-22, size 24-8 line 2994 [ 957.453296][T20202] binder: 20200:20202 transaction failed 29189/-22, size 24-8 line 2994 [ 957.485342][T20205] binder: 20201:20205 transaction failed 29189/-22, size 24-8 line 2994 [ 957.511798][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 957.541839][T20125] device nr0 entered promiscuous mode [ 957.543025][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 09:17:35 executing program 4: r0 = open(0x0, 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) 09:17:35 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x74, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 957.614203][ T3007] binder: undelivered TRANSACTION_ERROR: 29189 [ 957.667524][ T3007] binder: unexpected work type, 4, not freed [ 957.721709][ T7897] binder: unexpected work type, 4, not freed [ 957.729200][ T7897] binder: unexpected work type, 4, not freed [ 957.738900][T20211] binder: BINDER_SET_CONTEXT_MGR already set [ 957.770560][T20211] binder: 20210:20211 ioctl 40046207 0 returned -16 09:17:35 executing program 0: recvmsg(0xffffffffffffffff, 0x0, 0x0) r0 = syz_open_dev$dmmidi(&(0x7f0000000900)='/dev/dmmidi#\x00', 0x4, 0x20800) sendmsg$kcm(r0, 0x0, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8e67, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup(0xffffffffffffff9c, &(0x7f00000000c0)='syz1\x00', 0x200002, 0x0) r3 = socket$key(0xf, 0x3, 0x2) ioctl$sock_SIOCBRADDBR(r3, 0x89a0, &(0x7f00000007c0)='netdevsim0\x00') r4 = openat$cgroup_ro(r2, 0x0, 0x0, 0x0) ioctl$KDSETMODE(r4, 0x4b3a, 0x400) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) ioctl$KVM_GET_DEVICE_ATTR(r4, 0x4018aee2, &(0x7f0000000840)={0x0, 0x3, 0x9, &(0x7f0000000800)=0x5}) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, &(0x7f0000000440)={0x0, 0x3}, &(0x7f0000000480)=0x8) getdents(r4, &(0x7f00000004c0)=""/5, 0x5) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r4, 0x84, 0x1a, &(0x7f00000006c0)={r5, 0xe4, "22f805bc50567e45c64f3f07b220208bd1164d6786d24bc885b25fe4e1361943c3ef0f2703d20d4b6e2fda23ae94e5abc15f77e7f27f45d2bdc6488a58997fb3e038c4c7965ba7751b1adf858e14812f1a7834e6830428c2ca71ecd8e084da013744a7b3fd46e2606aed03fffa118ccb230be4f212bcf6f73ca3b642f7c265261f38df7f918fe2efffb1c7f2cd268d22b52940d0d92ba0028fa41afb16daac74927ffcab6fa42715125dea4145d5bf4c5cd354ea5358419792fb1d8ef29d01c976f4d49c8e33424c8730ab1d29b093bfb17f053af40a31d263e8189eb9d7a7968630c231"}, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000240)={0x0, r1, 0x0, 0x2}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x2, 0x0) ioctl$KVM_GET_PIT(r4, 0xc048ae65, 0x0) r7 = syz_genetlink_get_family_id$fou(&(0x7f00000002c0)='fou\x00') perf_event_open(&(0x7f0000000d80)={0xdf3b1f7d4f7d61f3, 0x70, 0x9, 0x0, 0x0, 0xfff, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x6, 0x0, 0x685, 0xcf1, 0x81, 0xfffffffffffffff8, 0x401, 0x0, 0x1, 0xd3, 0x0, 0xbc4, 0x7, 0x6, 0x0, 0x5, 0xff, 0x691, 0x0, 0x3, 0x8, 0x4, 0x0, 0x7, 0x0, 0x3e0000000000000, 0x0, 0x0, 0x0, @perf_bp={0x0, 0x6}, 0x0, 0x0, 0x0, 0x4, 0x0, 0x400, 0x1}, 0x0, 0x0, 0xffffffffffffff9c, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) write$cgroup_type(r4, &(0x7f0000000280)='threaded\x00', 0x9) openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x1, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="2e0000003e0081", 0x7}], 0x1}, 0x0) r8 = socket$kcm(0x29, 0x5, 0x0) r9 = semget(0x2, 0x5, 0xa0) semctl$GETPID(r9, 0x7, 0xb, &(0x7f0000000880)=""/36) ioctl$TUNSETVNETHDRSZ(r4, 0x400454d8, &(0x7f00000008c0)=0x82) ioctl$PERF_EVENT_IOC_SET_FILTER(r8, 0x8914, &(0x7f0000000500)='nr0\x01\x00`\xa1\x9e\xf9\xd2\xc6s\xd9\xa1W\x1c\xb9\xe16\x9b\xcda\xef~Iy:\xe1\x87\x12\xec\xeb\x1d\xaav\x94\x97\x80\v\x7f\xbb\xd3[\x17\f\x10u\x1d9\xae\xb6`\xd8c\xe4\x9b\x8cO;=\xadH\x90+[-l\xfd\n\xbd7,c\xbc\xf5\xd7\r\xf3\xfdM.\x8dD<\x88\xbc\x0eV7\xdd\x82\xfc45\xbe\xd4\xde]i<\x9ax\x1c\x86>\x05\xd8\xa6\xf8h\x9a[\xe2\x92\x16\x06\x1f?\xf5?\x8bk9fx\xe7\xba\x15^\xf9\x15-~C\xb1\xec\xcb#1\xeb\x8e\xb1\xedU\x86\xdc\xf8\xb3\xb0\xb9\x996\x1aD\xff,\"\xc2\xab\xbe\xf4-\xd2N\xab\xe6r3F\xa6\xe4l\x04\x99\xa2\x14B\xd8\xd0\r\xcbW\xf0\x13\xffu\x95\xed\xd0\xff\ai0\xde6u\xd3A\x17\xa4N\xb0\xe4\xf82\x93m\xa4NW\xe4:>6\xbdH\xd2\xa8[\xf4\xfdJ\x80N\x83\xf2\xf3\xcf7\x8aCZ\xf5\xe2\x87\xd4\xe2s7\xb4\xad\xa1\x1b&!\x982\xeck+8Dk;\x95\xfe7q\xe9\xf4,\xa3\x0f\xb2\x1e\x12\xf0\xa3\xd8\xbc-\x85EJ\xf9\xfc\xc0#-\x8f\xd9\tD\x8b\x01\xf4lY=1\xea\x1c\x92de\xe3ZA\x99\a\x9c<\xa4\x11(\xb1|\xb0\x1f\xbf[R+\xe0\xfd\x02\x02*\xda7\xfe\xcc\x14\xb6\xc8\xc8\x83\x18\x83\xb8Z\x11\x06\xf2\xf8g\x02\rR\x9f\x17\xa3P\xf2\r\xd3\xbfQ\xa9\x8c\xfd\xa7\f.68\xa4\x83\xfd?\x87\x94\v\xb4x\xb0|L\x11\x03\x94\xc0\t=\x17\x95P\x89\xf2\xca\x97\xbb\xe0u\x12L\x9b\x85\x96\xe0\b\xbf\n\x02\x8bS\x9c\xecyl\xec\x9b\xf5\x85\xeb\x80\xfe>\r&') sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000400)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x38, r7, 0x502, 0x70bd2a, 0x25dfdbfc, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e24}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x29}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}]}, 0x38}, 0x1, 0x0, 0x0, 0x4040080}, 0x1) perf_event_open(&(0x7f00000001c0)={0x0, 0x70, 0xfffffffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8984413869d6e3ae, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r4, 0x0) write$cgroup_subtree(r6, &(0x7f00000007c0), 0x0) 09:17:35 executing program 1 (fault-call:14 fault-nth:0): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:35 executing program 2 (fault-call:11 fault-nth:0): open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:35 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x7a, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:35 executing program 5: ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000000c0)) syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x101180) r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/dlm_plock\x00', 0x80000, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f0000000140)=0xfffffffffffffe69) syz_open_procfs$namespace(r1, &(0x7f0000000200)='ns/pid_for_children\x00') [ 957.900578][T20315] binder: 20314:20315 transaction failed 29189/-22, size 24-8 line 2994 [ 957.916064][T20326] binder: 20325:20326 transaction failed 29189/-22, size 24-8 line 2994 [ 957.935813][T20311] binder: 20306:20311 ioctl c018620b 0 returned -14 [ 957.949974][T20331] FAULT_INJECTION: forcing a failure. [ 957.949974][T20331] name failslab, interval 1, probability 0, space 0, times 0 [ 957.970619][T20311] FAULT_INJECTION: forcing a failure. [ 957.970619][T20311] name failslab, interval 1, probability 0, space 0, times 0 09:17:36 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x29, &(0x7f00000002c0)=0x3ff, 0xfe4b) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000140)=0x32, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10) sendmmsg(0xffffffffffffffff, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) [ 958.014599][T20331] CPU: 0 PID: 20331 Comm: syz-executor.1 Not tainted 5.1.0-rc2+ #40 [ 958.022596][T20331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 958.032655][T20331] Call Trace: [ 958.034025][T20334] binder_thread_write: 5 callbacks suppressed [ 958.034038][T20334] binder: 20325:20334 BC_INCREFS_DONE u0000000000000000 no match [ 958.035962][T20331] dump_stack+0x172/0x1f0 [ 958.035989][T20331] should_fail.cold+0xa/0x15 [ 958.036016][T20331] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 958.036044][T20331] ? ___might_sleep+0x163/0x280 [ 958.064504][T20331] __should_failslab+0x121/0x190 [ 958.064525][T20331] should_failslab+0x9/0x14 [ 958.064543][T20331] kmem_cache_alloc_trace+0x2d1/0x760 [ 958.064559][T20331] ? kasan_check_read+0x11/0x20 [ 958.064576][T20331] ? do_raw_spin_unlock+0x57/0x270 [ 958.064595][T20331] ? _raw_spin_unlock+0x2d/0x50 [ 958.084234][T20331] binder_get_thread+0x1db/0x7c0 [ 958.103956][T20331] binder_ioctl+0x1e5/0x183b [ 958.108562][T20331] ? binder_thread_write+0x2820/0x2820 [ 958.114053][T20331] ? __fget+0x381/0x550 [ 958.118228][T20331] ? ksys_dup3+0x3e0/0x3e0 [ 958.122652][T20331] ? fput_many+0x12c/0x1a0 [ 958.127090][T20331] ? tomoyo_file_ioctl+0x23/0x30 [ 958.132035][T20331] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 958.138285][T20331] ? security_file_ioctl+0x93/0xc0 [ 958.143423][T20331] ? binder_thread_write+0x2820/0x2820 [ 958.148889][T20331] __ia32_compat_sys_ioctl+0x197/0x620 [ 958.154378][T20331] do_fast_syscall_32+0x281/0xc98 [ 958.159422][T20331] entry_SYSENTER_compat+0x70/0x7f 09:17:36 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0xff, 0x70040) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) timerfd_settime(r1, 0x1, &(0x7f0000000140)={{r2, r3+10000000}}, &(0x7f0000000180)) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x12}}, 0x10) connect$inet(r0, &(0x7f0000000100)={0x2, 0x0, @multicast2}, 0x10) setsockopt$sock_linger(r0, 0x1, 0x35, &(0x7f0000000000)={0x1}, 0x8) [ 958.164538][T20331] RIP: 0023:0xf7fcd869 [ 958.168652][T20331] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 958.188259][T20331] RSP: 002b:00000000f5da80cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 958.196679][T20331] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000c0306201 [ 958.204659][T20331] RDX: 00000000200002c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 958.212634][T20331] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 958.212655][T20331] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 958.228602][T20331] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 958.235457][T20311] CPU: 0 PID: 20311 Comm: syz-executor.2 Not tainted 5.1.0-rc2+ #40 [ 958.244691][T20311] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 958.254776][T20311] Call Trace: [ 958.258084][T20311] dump_stack+0x172/0x1f0 [ 958.262437][T20311] should_fail.cold+0xa/0x15 [ 958.267084][T20311] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 958.272914][T20311] ? ___might_sleep+0x163/0x280 [ 958.277786][T20311] __should_failslab+0x121/0x190 [ 958.282747][T20311] should_failslab+0x9/0x14 [ 958.284184][T20331] binder: 20314:20331 ioctl c0306201 200002c0 returned -12 [ 958.287264][T20311] kmem_cache_alloc_trace+0x2d1/0x760 [ 958.287287][T20311] ? _raw_spin_unlock+0x41/0x50 [ 958.287313][T20311] binder_transaction+0x8d9/0x6690 [ 958.287328][T20311] ? mark_held_locks+0xa4/0xf0 [ 958.287346][T20311] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 958.287363][T20311] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 958.287379][T20311] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 958.287401][T20311] ? debug_smp_processor_id+0x3c/0x280 [ 958.338778][T20311] ? perf_trace_lock+0xeb/0x510 [ 958.343714][T20311] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 958.349960][T20311] ? debug_smp_processor_id+0x3c/0x280 [ 958.355434][T20311] ? binder_thread_read+0x3d50/0x3d50 [ 958.360823][T20311] ? find_held_lock+0x35/0x130 [ 958.365585][T20311] ? __might_fault+0x12b/0x1e0 [ 958.370358][T20311] ? lock_downgrade+0x880/0x880 [ 958.375224][T20311] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 958.381459][T20311] ? _copy_from_user+0xdd/0x150 [ 958.386322][T20311] binder_thread_write+0x64a/0x2820 [ 958.391521][T20311] ? __lockdep_free_key_range+0x120/0x120 [ 958.397246][T20311] ? binder_transaction+0x6690/0x6690 [ 958.402632][T20311] ? __might_fault+0x12b/0x1e0 [ 958.407478][T20311] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 958.413726][T20311] ? _copy_from_user+0xdd/0x150 [ 958.418601][T20311] binder_ioctl+0x1033/0x183b [ 958.423293][T20311] ? binder_thread_write+0x2820/0x2820 [ 958.428757][T20311] ? __fget+0x381/0x550 [ 958.432916][T20311] ? ksys_dup3+0x3e0/0x3e0 [ 958.437352][T20311] ? fput_many+0x12c/0x1a0 [ 958.441778][T20311] ? tomoyo_file_ioctl+0x23/0x30 [ 958.446711][T20311] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 958.452954][T20311] ? security_file_ioctl+0x93/0xc0 [ 958.458067][T20311] ? binder_thread_write+0x2820/0x2820 [ 958.463523][T20311] __ia32_compat_sys_ioctl+0x197/0x620 [ 958.468987][T20311] do_fast_syscall_32+0x281/0xc98 [ 958.474021][T20311] entry_SYSENTER_compat+0x70/0x7f [ 958.479125][T20311] RIP: 0023:0xf7f81869 [ 958.483188][T20311] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 958.502782][T20311] RSP: 002b:00000000f5d7d0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 958.511188][T20311] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000c0306201 [ 958.519174][T20311] RDX: 0000000020000440 RSI: 0000000000000000 RDI: 0000000000000000 [ 958.527135][T20311] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 958.535105][T20311] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 958.543074][T20311] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 958.561386][ T7897] binder: unexpected work type, 4, not freed 09:17:36 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x300, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:36 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_dccp_int(r0, 0x21, 0x0, &(0x7f0000000200), &(0x7f0000000240)=0x4) r1 = getpgid(0xffffffffffffffff) capget(&(0x7f0000000780)={0x19980330, r1}, &(0x7f00000007c0)={0x3, 0x80000000, 0x1000, 0x2, 0x0, 0x48a5}) capget(&(0x7f0000000840)={0x19980330}, &(0x7f0000000880)) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f000000bfc8)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="5500000018007fafb72d1cb2a4a280930206000000a843096c26234d2500080008000c00080000006300a3c728f1c46b7b31afdc1338d54400009b84136ef75afb83de448daa7227c43ab8220002bf0cec6bab91d4", 0x55}], 0x1}, 0x0) perf_event_open(&(0x7f00000002c0)={0x5, 0x70, 0x0, 0x0, 0x0, 0x40, 0x0, 0xdf87, 0x8, 0x8, 0x1, 0x0, 0x0, 0x6, 0x0, 0xffffffff, 0x1, 0x0, 0xffffffff, 0x3ff, 0x0, 0x0, 0x0, 0x6, 0x1, 0x4, 0x0, 0x3, 0x1800000000000, 0x3a53, 0x687923fb, 0x0, 0x7, 0x8, 0xf6, 0x9, 0x1ff, 0x0, 0x0, 0x9, 0x0, @perf_bp={0x0}, 0x2300, 0x1000000000, 0x0, 0x4, 0x0, 0x8}, 0x0, 0xd, r0, 0x8) stat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)) prctl$PR_GET_CHILD_SUBREAPER(0x25) stat(&(0x7f00000004c0)='./file0\x00', 0x0) mount$fuseblk(&(0x7f0000000340)='/dev/loop0\x00', &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='fuseblk\x00', 0x4000, &(0x7f0000000900)=ANY=[@ANYBLOB=',blksize=0x0000000000001600,blksize=0x0000000000001e00,max_read=0x0000000000000034,allow_other,max_read=0x000000000000483f,max_read=0x0000000000000007,blksize=0x0000000000001000,blksize=0x0000000000000200,allow_other,func=']) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000040), 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000080)}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendmmsg$unix(r0, &(0x7f00000006c0)=[{&(0x7f0000000500)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000600)=[{&(0x7f0000000280)="6944290c53839e5e934b617e9fc364fa7f470fc3d43ee893ef3c5f4dcc65fe0d7e9e5515ec82cea75a1ec85407502b67497d47645d28b2b6a217383c9b", 0x3d}], 0x1, 0x0, 0x0, 0x40000}], 0x1, 0x4000) mount(&(0x7f0000000240)=ANY=[], &(0x7f0000000180)='./file0\x00', &(0x7f0000000740)='nfs\x00', 0x0, &(0x7f0000000000)) ioctl$sock_SIOCGIFCONF(r0, 0x8912, 0x0) write$P9_RXATTRCREATE(r0, &(0x7f0000000140)={0x7}, 0x7) clone(0x8000000, 0x0, 0xfffffffffffffffe, &(0x7f0000000100), 0xffffffffffffffff) 09:17:36 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup2(0xffffffffffffffff, r0) semget$private(0x0, 0x4, 0xd) write$P9_ROPEN(r1, &(0x7f0000000180)={0x18, 0x71, 0x1, {{0x2, 0x0, 0x2}, 0x5}}, 0x18) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f00000001c0)="0402f06dc34ca4ab97a5d003dd0ec1f0ec3a0363873b17ab79c3a01108679cbe58c0484f552777d6b44e6e13626d8d9b52f0fb497a891b136bac1ee859742838f6ac2b3e24e280745fe526671266e60631e0c7c9e3c1fe9a8ac7cae130917247c1b158d46c45ada2a675ba225198fb4de90144779d5deef033d564f667db1ae62f23888aa18a7d01f488a8545e17e6bd17e24195de88024026fd45feab58cffdc6c65ac4af4a34e2ac34e814407fe950663c656f2aea28eb3bc5a7168edec651d5e8f52b55b3c94898e33d1f437433269e14ca213a97d7737d", 0xd9) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000300)={'ipvs\x00'}, &(0x7f0000000340)=0x1e) r2 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) connect(r2, &(0x7f0000000000)=@pppol2tpv3={0x2, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80) sendmsg$TIPC_NL_MON_GET(r1, 0x0, 0x80) clock_gettime(0x0, &(0x7f0000002b80)) sendmmsg(r2, &(0x7f0000001540), 0x24c, 0x0) getpgid(0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f00000002c0)) [ 958.638806][T20333] device nr0 entered promiscuous mode 09:17:36 executing program 1 (fault-call:14 fault-nth:1): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:36 executing program 0: r0 = gettid() rt_sigqueueinfo(r0, 0x0, &(0x7f0000000180)={0x0, 0x0, 0xfffffffffffffffb}) prctl$PR_SET_PTRACER(0x59616d61, r0) [ 958.830658][T20494] binder: 20493:20494 BC_INCREFS_DONE u0000000000000000 node 2402 cookie mismatch 3f00000000000000 != 0000000000000000 [ 958.835017][ T7897] binder: unexpected work type, 4, not freed 09:17:37 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x500, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 958.918590][ T7897] binder: unexpected work type, 4, not freed 09:17:37 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 958.964990][ T7897] binder: unexpected work type, 4, not freed 09:17:37 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 959.126272][T20624] binder: 20623:20624 BC_INCREFS_DONE u0000000000000000 no match [ 959.137868][T20602] binder: 20601:20602 ioctl c018620b 0 returned -14 09:17:37 executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, [], 0x15}, 0x5}}, 0x9, 0x7}, &(0x7f00000001c0)=0x88) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000200)={r2, 0x94}, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync_file_range(0xffffffffffffffff, 0x1, 0x3, 0x5) r4 = socket$inet6(0xa, 0x40000080806, 0x0) setsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f00000003c0)=ANY=[@ANYBLOB="2f0801ff00000000fe880000000800000000000000000001ff01000000000000000000000000000100000000000000000000000000000001fe8000000000000000000000000000bb5c470f88f72732aee0ef25e28c4e339feee422377395f4d4164fb5a081620cfa9d817f4cc2adfc2d5748cc2c14599a61b9c38ad018246cdf06861bda876d683e43939fa402b59126d315598c73df1c268a106f4bc919f0a0fecfcb3ad8a7be0d163b0ba89eeabc73cf10e5da2299c00749e9e695d8115301cd03ba4b3045b6b01ef9b0e83cb40000000000000000000000204b60d5595358a90afb252129f99820bb83848295d109b4d38a0397c5a01187f60e2c968e25aae3db12858c"], 0x1) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000000) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, [], 0x1a}, 0x80, 0x2, 0xff, 0x2, 0x100000001}, 0x20) getsockopt$inet6_buf(r3, 0x29, 0x20, &(0x7f0000000140)=""/9, &(0x7f0000000180)=0xffffffffffffff12) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000300)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0xc3e, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}], 0x2c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000640)={r2, @in6={{0xa, 0x4e23, 0x436, @ipv4={[], [], @rand_addr=0xd2}, 0x9}}, 0xfffffffffffffffa, 0x8, 0x0, 0xed, 0xffff}, &(0x7f0000000340)=0x98) r6 = dup2(r5, r4) prctl$PR_GET_SECCOMP(0x15) r7 = getpid() r8 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x9, 0x1000, 0xbb, 0xff, 0x0, 0x9, 0x8000, 0x1, 0x6, 0x100000001, 0x4, 0x200, 0x2, 0x0, 0x4, 0x6, 0x1, 0xffffffffffffffff, 0x1, 0xff, 0x7f, 0x3, 0x200, 0xe00, 0x5, 0xfffffffffffffffc, 0x3, 0x1, 0x80000001, 0x25400000000, 0x1, 0xfffffffffffffffb, 0x8001, 0x100000001, 0x1ff, 0x2, 0x0, 0x7, 0x4, @perf_bp={&(0x7f0000000000), 0xa}, 0x20000, 0xb31a, 0x7, 0x3, 0xff, 0x35af, 0x1000}, 0x0, 0x8, 0xffffffffffffff9c, 0x3) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r7, r8, 0x0, 0x1, &(0x7f00000000c0)='\x00'}, 0x30) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000140)={0x0, @in={{0x3, 0x0, @dev}}}, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000003940)={'team0\x00', 0x0}) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r9, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x98000400}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="68c80000e0c245667415a8709fc56e169830f6c388c099a0f85c1ba4ae92f57061c5eeb3eb806e75c5ba6af505ad9c42276c3da06461f67d483d55a0ca1c709cb56ee604000000000000000000000000000000", @ANYRES16=r11, @ANYBLOB="020026bd700001000000120000004801010044000400200001000a004e2200000009fe8000000000000000000000000000aab00b0000200002000a004e220000000500000000000000000000ffffe0000002feffffff100001006574683a6e6c6d6f6e30000008000300ffff00002c0004001400010002004e20ac1414bb00000000000000001400020002004e21ac1414aa0000000000000000380004001400010002004e24e00000020000000000000000200002000a004e22fffffffc00000000000000000000000000000001010000002c000200080004000600000008000200000000000800040001000000080003002acd0000080003000800000008000300030000001400020008000300f400000008000200010000003c000200080001001f00000008000300060000000800020009000000080004009696000008000400fbffffff0800010010000000080001000d0000000c0005000800010075647000"], 0x168}}, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000003980)={'dummy0\x00', r10}) setsockopt$inet_udp_int(r6, 0x11, 0x0, &(0x7f00000002c0)=0xff, 0x4) 09:17:37 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x600, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 959.188803][T20602] binder: 20601:20602 ioctl c0306201 0 returned -14 [ 959.224067][T12196] binder: unexpected work type, 4, not freed [ 959.296067][T20673] binder: 20672:20673 BC_INCREFS_DONE u0000000000000000 node 2414 cookie mismatch 3f00000000000000 != 0000000000000000 09:17:37 executing program 4: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) write$apparmor_exec(r0, &(0x7f00000002c0)=ANY=[@ANYBLOB="737461636b203a3a09d09cd372c2ef5509db8ab24e300d4544df8f346497da98f0b453ad6d8a2fcb127375b2ae8bfc030e9a230514289d300b06774494f1ee8ad5379dfed204dd4ee8d1bb83d594cc2086c675750d4c2e9af281fa937d1b0100008000000000baec736202c183a1a0689c60948f3cd9c5f318fe02a98cbefad7c7e6f3f4cd05f5f1e0d23b6e3d245fc76153e613ae187222e4d5f2352378cf0443fcd24b9a4c42931dc0bc58c3bf53ca2b0f34d84557f9ba4d79a9e877734d42aa63a9d67002402dd91f325820354f616deb57144f837f5839b0b3901c315f72c8733dc6b5b3"], 0xe6) 09:17:37 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 959.358350][T12196] binder: send failed reply for transaction 2413 to 20672:20673 [ 959.368422][T20678] binder: 20677:20678 BC_INCREFS_DONE u0000000000000000 no match [ 959.374327][T12196] binder: send failed reply for transaction 2416 to 20677:20678 [ 959.511167][T20684] binder: 20683:20684 ioctl c018620b 0 returned -14 [ 959.520718][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 959.520736][ T26] audit: type=1400 audit(1553764657.603:31): apparmor="DENIED" operation="stack_onexec" info="label not found" error=-2 profile="unconfined" name=3A3A09D09CD372C2EF5509DB8AB24E300D4544DF8F346497DA98F0B453AD6D8A2FCB127375B2AE8BFC030E9A230514289D300B06774494F1EE8AD5379DFED204DD4EE8D1BB83D594CC2086C675750D4C2E9AF281FA937D1B01 pid=20686 comm="syz-executor.4" 09:17:37 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:37 executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, [], 0x15}, 0x5}}, 0x9, 0x7}, &(0x7f00000001c0)=0x88) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000200)={r2, 0x94}, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync_file_range(0xffffffffffffffff, 0x1, 0x3, 0x5) r4 = socket$inet6(0xa, 0x40000080806, 0x0) setsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f00000003c0)=ANY=[@ANYBLOB="2f0801ff00000000fe880000000800000000000000000001ff01000000000000000000000000000100000000000000000000000000000001fe8000000000000000000000000000bb5c470f88f72732aee0ef25e28c4e339feee422377395f4d4164fb5a081620cfa9d817f4cc2adfc2d5748cc2c14599a61b9c38ad018246cdf06861bda876d683e43939fa402b59126d315598c73df1c268a106f4bc919f0a0fecfcb3ad8a7be0d163b0ba89eeabc73cf10e5da2299c00749e9e695d8115301cd03ba4b3045b6b01ef9b0e83cb40000000000000000000000204b60d5595358a90afb252129f99820bb83848295d109b4d38a0397c5a01187f60e2c968e25aae3db12858c"], 0x1) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000000) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, [], 0x1a}, 0x80, 0x2, 0xff, 0x2, 0x100000001}, 0x20) getsockopt$inet6_buf(r3, 0x29, 0x20, &(0x7f0000000140)=""/9, &(0x7f0000000180)=0xffffffffffffff12) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000300)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0xc3e, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}], 0x2c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000640)={r2, @in6={{0xa, 0x4e23, 0x436, @ipv4={[], [], @rand_addr=0xd2}, 0x9}}, 0xfffffffffffffffa, 0x8, 0x0, 0xed, 0xffff}, &(0x7f0000000340)=0x98) r6 = dup2(r5, r4) prctl$PR_GET_SECCOMP(0x15) r7 = getpid() r8 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x9, 0x1000, 0xbb, 0xff, 0x0, 0x9, 0x8000, 0x1, 0x6, 0x100000001, 0x4, 0x200, 0x2, 0x0, 0x4, 0x6, 0x1, 0xffffffffffffffff, 0x1, 0xff, 0x7f, 0x3, 0x200, 0xe00, 0x5, 0xfffffffffffffffc, 0x3, 0x1, 0x80000001, 0x25400000000, 0x1, 0xfffffffffffffffb, 0x8001, 0x100000001, 0x1ff, 0x2, 0x0, 0x7, 0x4, @perf_bp={&(0x7f0000000000), 0xa}, 0x20000, 0xb31a, 0x7, 0x3, 0xff, 0x35af, 0x1000}, 0x0, 0x8, 0xffffffffffffff9c, 0x3) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r7, r8, 0x0, 0x1, &(0x7f00000000c0)='\x00'}, 0x30) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000140)={0x0, @in={{0x3, 0x0, @dev}}}, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000003940)={'team0\x00', 0x0}) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r9, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x98000400}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="68c80000e0c245667415a8709fc56e169830f6c388c099a0f85c1ba4ae92f57061c5eeb3eb806e75c5ba6af505ad9c42276c3da06461f67d483d55a0ca1c709cb56ee604000000000000000000000000000000", @ANYRES16=r11, @ANYBLOB="020026bd700001000000120000004801010044000400200001000a004e2200000009fe8000000000000000000000000000aab00b0000200002000a004e220000000500000000000000000000ffffe0000002feffffff100001006574683a6e6c6d6f6e30000008000300ffff00002c0004001400010002004e20ac1414bb00000000000000001400020002004e21ac1414aa0000000000000000380004001400010002004e24e00000020000000000000000200002000a004e22fffffffc00000000000000000000000000000001010000002c000200080004000600000008000200000000000800040001000000080003002acd0000080003000800000008000300030000001400020008000300f400000008000200010000003c000200080001001f00000008000300060000000800020009000000080004009696000008000400fbffffff0800010010000000080001000d0000000c0005000800010075647000"], 0x168}}, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000003980)={'dummy0\x00', r10}) setsockopt$inet_udp_int(r6, 0x11, 0x0, &(0x7f00000002c0)=0xff, 0x4) [ 959.542992][T20684] binder: 20683:20684 ioctl 2 20000440 returned -22 09:17:37 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup2(0xffffffffffffffff, r0) semget$private(0x0, 0x4, 0xd) write$P9_ROPEN(r1, &(0x7f0000000180)={0x18, 0x71, 0x1, {{0x2, 0x0, 0x2}, 0x5}}, 0x18) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f00000001c0)="0402f06dc34ca4ab97a5d003dd0ec1f0ec3a0363873b17ab79c3a01108679cbe58c0484f552777d6b44e6e13626d8d9b52f0fb497a891b136bac1ee859742838f6ac2b3e24e280745fe526671266e60631e0c7c9e3c1fe9a8ac7cae130917247c1b158d46c45ada2a675ba225198fb4de90144779d5deef033d564f667db1ae62f23888aa18a7d01f488a8545e17e6bd17e24195de88024026fd45feab58cffdc6c65ac4af4a34e2ac34e814407fe950663c656f2aea28eb3bc5a7168edec651d5e8f52b55b3c94898e33d1f437433269e14ca213a97d7737d", 0xd9) perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000300)={'ipvs\x00'}, &(0x7f0000000340)=0x1e) r2 = socket$kcm(0x2, 0x2, 0x73) bind$inet(r2, &(0x7f00000000c0)={0x2, 0x0, @multicast1}, 0x10) connect(r2, &(0x7f0000000000)=@pppol2tpv3={0x2, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80) sendmsg$TIPC_NL_MON_GET(r1, 0x0, 0x80) clock_gettime(0x0, &(0x7f0000002b80)) sendmmsg(r2, &(0x7f0000001540), 0x24c, 0x0) getpgid(0xffffffffffffffff) ioctl$SNDRV_SEQ_IOCTL_PVERSION(r1, 0x80045300, &(0x7f00000002c0)) 09:17:37 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x700, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:37 executing program 4: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, [], 0x15}, 0x5}}, 0x9, 0x7}, &(0x7f00000001c0)=0x88) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000200)={r2, 0x94}, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync_file_range(0xffffffffffffffff, 0x1, 0x3, 0x5) r4 = socket$inet6(0xa, 0x40000080806, 0x0) setsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f00000003c0)=ANY=[@ANYBLOB="2f0801ff00000000fe880000000800000000000000000001ff01000000000000000000000000000100000000000000000000000000000001fe8000000000000000000000000000bb5c470f88f72732aee0ef25e28c4e339feee422377395f4d4164fb5a081620cfa9d817f4cc2adfc2d5748cc2c14599a61b9c38ad018246cdf06861bda876d683e43939fa402b59126d315598c73df1c268a106f4bc919f0a0fecfcb3ad8a7be0d163b0ba89eeabc73cf10e5da2299c00749e9e695d8115301cd03ba4b3045b6b01ef9b0e83cb40000000000000000000000204b60d5595358a90afb252129f99820bb83848295d109b4d38a0397c5a01187f60e2c968e25aae3db12858c"], 0x1) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000000) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, [], 0x1a}, 0x80, 0x2, 0xff, 0x2, 0x100000001}, 0x20) getsockopt$inet6_buf(r3, 0x29, 0x20, &(0x7f0000000140)=""/9, &(0x7f0000000180)=0xffffffffffffff12) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000300)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0xc3e, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}], 0x2c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000640)={r2, @in6={{0xa, 0x4e23, 0x436, @ipv4={[], [], @rand_addr=0xd2}, 0x9}}, 0xfffffffffffffffa, 0x8, 0x0, 0xed, 0xffff}, &(0x7f0000000340)=0x98) r6 = dup2(r5, r4) prctl$PR_GET_SECCOMP(0x15) r7 = getpid() r8 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x9, 0x1000, 0xbb, 0xff, 0x0, 0x9, 0x8000, 0x1, 0x6, 0x100000001, 0x4, 0x200, 0x2, 0x0, 0x4, 0x6, 0x1, 0xffffffffffffffff, 0x1, 0xff, 0x7f, 0x3, 0x200, 0xe00, 0x5, 0xfffffffffffffffc, 0x3, 0x1, 0x80000001, 0x25400000000, 0x1, 0xfffffffffffffffb, 0x8001, 0x100000001, 0x1ff, 0x2, 0x0, 0x7, 0x4, @perf_bp={&(0x7f0000000000), 0xa}, 0x20000, 0xb31a, 0x7, 0x3, 0xff, 0x35af, 0x1000}, 0x0, 0x8, 0xffffffffffffff9c, 0x3) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r7, r8, 0x0, 0x1, &(0x7f00000000c0)='\x00'}, 0x30) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000140)={0x0, @in={{0x3, 0x0, @dev}}}, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000003940)={'team0\x00', 0x0}) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r9, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x98000400}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="68c80000e0c245667415a8709fc56e169830f6c388c099a0f85c1ba4ae92f57061c5eeb3eb806e75c5ba6af505ad9c42276c3da06461f67d483d55a0ca1c709cb56ee604000000000000000000000000000000", @ANYRES16=r11, @ANYBLOB="020026bd700001000000120000004801010044000400200001000a004e2200000009fe8000000000000000000000000000aab00b0000200002000a004e220000000500000000000000000000ffffe0000002feffffff100001006574683a6e6c6d6f6e30000008000300ffff00002c0004001400010002004e20ac1414bb00000000000000001400020002004e21ac1414aa0000000000000000380004001400010002004e24e00000020000000000000000200002000a004e22fffffffc00000000000000000000000000000001010000002c000200080004000600000008000200000000000800040001000000080003002acd0000080003000800000008000300030000001400020008000300f400000008000200010000003c000200080001001f00000008000300060000000800020009000000080004009696000008000400fbffffff0800010010000000080001000d0000000c0005000800010075647000"], 0x168}}, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000003980)={'dummy0\x00', r10}) setsockopt$inet_udp_int(r6, 0x11, 0x0, &(0x7f00000002c0)=0xff, 0x4) [ 959.688897][T20711] binder: 20695:20711 ioctl 2 200002c0 returned -22 [ 959.768312][T20765] binder: 20695:20765 ioctl 2 200002c0 returned -22 [ 959.789340][ T7897] binder_thread_release: 8 callbacks suppressed [ 959.789352][ T7897] binder: release 20695:20711 transaction 2421 out, still active [ 959.805038][ T7897] binder: unexpected work type, 4, not freed 09:17:37 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:37 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x541b, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 959.833538][ T7897] binder_release_work: 12 callbacks suppressed [ 959.833542][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:17:38 executing program 0: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffff9c, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, [], 0x15}, 0x5}}, 0x9, 0x7}, &(0x7f00000001c0)=0x88) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r1, 0x84, 0x76, &(0x7f0000000200)={r2, 0x94}, 0x8) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sync_file_range(0xffffffffffffffff, 0x1, 0x3, 0x5) r4 = socket$inet6(0xa, 0x40000080806, 0x0) setsockopt$inet6_opts(r4, 0x29, 0x39, &(0x7f00000003c0)=ANY=[@ANYBLOB="2f0801ff00000000fe880000000800000000000000000001ff01000000000000000000000000000100000000000000000000000000000001fe8000000000000000000000000000bb5c470f88f72732aee0ef25e28c4e339feee422377395f4d4164fb5a081620cfa9d817f4cc2adfc2d5748cc2c14599a61b9c38ad018246cdf06861bda876d683e43939fa402b59126d315598c73df1c268a106f4bc919f0a0fecfcb3ad8a7be0d163b0ba89eeabc73cf10e5da2299c00749e9e695d8115301cd03ba4b3045b6b01ef9b0e83cb40000000000000000000000204b60d5595358a90afb252129f99820bb83848295d109b4d38a0397c5a01187f60e2c968e25aae3db12858c"], 0x1) bind$inet6(r4, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c) listen(r4, 0x20000000) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000280)={@dev={0xfe, 0x80, [], 0x1a}, 0x80, 0x2, 0xff, 0x2, 0x100000001}, 0x20) getsockopt$inet6_buf(r3, 0x29, 0x20, &(0x7f0000000140)=""/9, &(0x7f0000000180)=0xffffffffffffff12) r5 = socket$inet6(0xa, 0x6, 0x0) connect$inet6(r5, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) setsockopt$bt_BT_FLUSHABLE(r1, 0x112, 0x8, &(0x7f0000000300)=0x2, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000240)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e20, 0xc3e, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x8}], 0x2c) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000640)={r2, @in6={{0xa, 0x4e23, 0x436, @ipv4={[], [], @rand_addr=0xd2}, 0x9}}, 0xfffffffffffffffa, 0x8, 0x0, 0xed, 0xffff}, &(0x7f0000000340)=0x98) r6 = dup2(r5, r4) prctl$PR_GET_SECCOMP(0x15) r7 = getpid() r8 = perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x9, 0x1000, 0xbb, 0xff, 0x0, 0x9, 0x8000, 0x1, 0x6, 0x100000001, 0x4, 0x200, 0x2, 0x0, 0x4, 0x6, 0x1, 0xffffffffffffffff, 0x1, 0xff, 0x7f, 0x3, 0x200, 0xe00, 0x5, 0xfffffffffffffffc, 0x3, 0x1, 0x80000001, 0x25400000000, 0x1, 0xfffffffffffffffb, 0x8001, 0x100000001, 0x1ff, 0x2, 0x0, 0x7, 0x4, @perf_bp={&(0x7f0000000000), 0xa}, 0x20000, 0xb31a, 0x7, 0x3, 0xff, 0x35af, 0x1000}, 0x0, 0x8, 0xffffffffffffff9c, 0x3) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={r7, r8, 0x0, 0x1, &(0x7f00000000c0)='\x00'}, 0x30) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000140)={0x0, @in={{0x3, 0x0, @dev}}}, 0x84) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000003940)={'team0\x00', 0x0}) r11 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r9, &(0x7f0000000440)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x98000400}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="68c80000e0c245667415a8709fc56e169830f6c388c099a0f85c1ba4ae92f57061c5eeb3eb806e75c5ba6af505ad9c42276c3da06461f67d483d55a0ca1c709cb56ee604000000000000000000000000000000", @ANYRES16=r11, @ANYBLOB="020026bd700001000000120000004801010044000400200001000a004e2200000009fe8000000000000000000000000000aab00b0000200002000a004e220000000500000000000000000000ffffe0000002feffffff100001006574683a6e6c6d6f6e30000008000300ffff00002c0004001400010002004e20ac1414bb00000000000000001400020002004e21ac1414aa0000000000000000380004001400010002004e24e00000020000000000000000200002000a004e22fffffffc00000000000000000000000000000001010000002c000200080004000600000008000200000000000800040001000000080003002acd0000080003000800000008000300030000001400020008000300f400000008000200010000003c000200080001001f00000008000300060000000800020009000000080004009696000008000400fbffffff0800010010000000080001000d0000000c0005000800010075647000"], 0x168}}, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000003980)={'dummy0\x00', r10}) setsockopt$inet_udp_int(r6, 0x11, 0x0, &(0x7f00000002c0)=0xff, 0x4) [ 959.898644][ T7897] binder: send failed reply for transaction 2424 to 20695:20711 [ 959.939536][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 960.064587][T20803] binder: 20802:20803 BC_INCREFS_DONE u0000000000000000 no match [ 960.109535][T20809] binder: 20808:20809 ioctl c018620b 0 returned -14 [ 960.131360][T20805] binder: 20804:20805 ioctl 541b 200002c0 returned -22 [ 960.195114][T20837] binder: 20804:20837 ioctl 541b 200002c0 returned -22 09:17:38 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0xa00, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:38 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x6) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f000095bffc)={0x0, 0x0, 0xfffffffffffffffc}, 0x4) close(r1) 09:17:38 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) shutdown(r0, 0x0) 09:17:38 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 960.442942][T20925] binder: 20924:20925 BC_INCREFS_DONE u0000000000000000 no match 09:17:38 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 960.596951][T20961] binder: 20957:20961 ioctl c018620b 0 returned -14 [ 960.636969][T20961] binder: 20957:20961 ioctl c0306201 0 returned -14 [ 960.690515][ T7897] binder: release 21022:21023 transaction 2436 out, still active [ 960.704797][ T7897] binder: unexpected work type, 4, not freed [ 960.742378][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 960.763813][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 960.769662][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 960.787270][ T7897] binder: release 21022:21023 transaction 2439 out, still active [ 960.802060][ T7897] binder: unexpected work type, 4, not freed 09:17:38 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x40000, 0x0) r3 = dup2(r0, r2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xe}}, 0x24) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000300)={0x5, 0x10, 0xfa00, {&(0x7f0000000100), r4, 0x2}}, 0x18) dup3(r2, r1, 0x0) 09:17:38 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3f00, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) shutdown(r0, 0x0) 09:17:38 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:38 executing program 4: getresuid(0x0, 0x0, 0x0) socket$unix(0x1, 0x3, 0x0) ioctl$UI_GET_SYSNAME(0xffffffffffffffff, 0x8040552c, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0xa000, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x29, 0x41, 0x0, 0x0) r0 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000000), 0x8) sendto$inet6(r0, 0x0, 0xfffffffffffffee8, 0x8000, 0x0, 0x0) madvise(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xb) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet(0x2, 0x4000000000000001, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f00000001c0)={0x0, 0x6, 0x1, 0x7fff}, &(0x7f00000002c0)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000400)={r3, @in={{0x2, 0x4e21, @loopback}}, 0x400, 0xfff}, 0x88) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) getsockopt$IPT_SO_GET_INFO(r2, 0x0, 0x40, &(0x7f00000005c0)={'nat\x00'}, &(0x7f00000003c0)=0x54) sendto$inet(r2, 0x0, 0x0, 0x200007fa, &(0x7f0000000140)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000200)='sit0\x00', 0x10) r4 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x4, 0x105082) r5 = syz_open_dev$mice(0x0, 0x0, 0x1) sendmsg$tipc(0xffffffffffffffff, 0x0, 0x11) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000180), 0x0) getsockopt$IP_VS_SO_GET_DESTS(r2, 0x0, 0x484, &(0x7f00000004c0)=""/170, &(0x7f0000000380)=0xaa) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000740)={{{@in6=@ipv4={[], [], @multicast1}, @in=@dev}}, {{@in=@broadcast}}}, &(0x7f0000000300)=0xc4) ioctl$EVIOCGKEYCODE_V2(r5, 0x80284504, &(0x7f0000000240)=""/84) r6 = memfd_create(&(0x7f00000000c0)='\x00\x00\x00\x00\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', 0x0) pwritev(r6, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x81003) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, r6) sendfile(r2, r4, &(0x7f00000ddff8), 0x102000002) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000640)) [ 960.840069][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 960.919099][T21152] binder_thread_write: 8 callbacks suppressed [ 960.919110][T21152] binder: 21151:21152 BC_INCREFS_DONE node 2443 has no pending increfs request 09:17:39 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 960.986922][ T7897] binder: release 21141:21156 transaction 2448 out, still active [ 961.001548][T21149] IPVS: length: 170 != 24 [ 961.013379][ T7897] binder: unexpected work type, 4, not freed 09:17:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) shutdown(r0, 0x0) 09:17:39 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 961.033817][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 961.039834][ T7897] binder_send_failed_reply: 9 callbacks suppressed [ 961.039842][ T7897] binder: send failed reply for transaction 2436, target dead [ 961.057682][T21152] binder: 21151:21152 BC_INCREFS_DONE u0000000000000000 no match [ 961.114137][ T7897] binder: send failed reply for transaction 2439, target dead [ 961.121713][ T7897] binder: send failed reply for transaction 2442 to 21151:21152 [ 961.205053][T21189] binder: 21178:21189 ioctl c018620b 0 returned -14 [ 961.231642][ T7897] binder: send failed reply for transaction 2445 to 21141:21143 09:17:39 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x4800, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 961.259736][T21189] binder: 21178:21189 ioctl c0306201 0 returned -14 [ 961.277951][ T7897] binder: send failed reply for transaction 2448, target dead 09:17:39 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 961.308745][ T7897] binder: release 21190:21208 transaction 2454 out, still active [ 961.347063][ T7897] binder: unexpected work type, 4, not freed 09:17:39 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) shutdown(r0, 0x0) [ 961.379483][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 961.421396][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 961.437833][T21334] binder: 21321:21334 BC_INCREFS_DONE node 2458 has no pending increfs request [ 961.444849][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 961.534108][ T7897] binder: release 21342:21354 transaction 2463 out, still active [ 961.541922][ T7897] binder: unexpected work type, 4, not freed [ 961.547856][T21334] binder: 21321:21334 BC_INCREFS_DONE node 2467 has no pending increfs request 09:17:39 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 961.586218][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 961.609747][ T7897] binder: send failed reply for transaction 2454, target dead [ 961.653934][ T7897] binder: send failed reply for transaction 2457 to 21321:21334 [ 961.707660][ T7897] binder: send failed reply for transaction 2460 to 21342:21354 [ 961.729553][T21391] binder: 21390:21391 ioctl c018620b 0 returned -14 [ 961.739934][ T7897] binder: send failed reply for transaction 2463, target dead [ 961.777655][T21391] binder: 21390:21391 ioctl c0306201 0 returned -14 [ 961.785176][ T7897] binder: send failed reply for transaction 2466 to 21321:21384 [ 961.793040][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 961.796362][T21149] syz-executor.4 (21149) used greatest stack depth: 21816 bytes left [ 961.814801][ T7897] binder_release_work: 21 callbacks suppressed [ 961.814808][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 961.828813][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 961.835978][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:39 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x40000, 0x0) r3 = dup2(r0, r2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0xe}}, 0x24) write$RDMA_USER_CM_CMD_QUERY_ROUTE(r3, &(0x7f0000000300)={0x5, 0x10, 0xfa00, {&(0x7f0000000100), r4, 0x2}}, 0x18) dup3(r2, r1, 0x0) 09:17:40 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:40 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x4c00, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:40 executing program 4: r0 = socket(0x22, 0x80002, 0xffffffff00000026) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000000)=@req={0x4, 0x60, 0x4, 0xd9d}, 0x10) io_setup(0x7, &(0x7f0000000200)=0x0) io_submit(r1, 0x1, &(0x7f0000000340)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, 0x0}]) rt_sigreturn() [ 961.925882][T21504] binder_alloc: 21390: binder_alloc_buf failed to map pages in userspace, no vma 09:17:40 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 961.981891][T21508] binder_alloc: 21390: binder_alloc_buf failed to map pages in userspace, no vma [ 961.993362][T21504] binder_transaction: 14 callbacks suppressed [ 961.993380][T21504] binder: 21502:21504 transaction failed 29189/-3, size 24-8 line 3147 [ 962.043393][T21508] binder: 21507:21508 transaction failed 29189/-3, size 24-8 line 3147 [ 962.058758][T21511] binder: 21502:21511 BC_INCREFS_DONE u0000000000000000 no match [ 962.082108][T21515] binder: 21514:21515 ioctl c018620b 0 returned -14 09:17:40 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000080)='dctcp\x00', 0x6) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x80000004e23, @local}, 0x10) write$binfmt_elf32(r0, &(0x7f0000001480)={{0x7f, 0x45, 0x4c, 0x46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x38}, [{}], "", [[]]}, 0x158) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x0, 0x0) [ 962.095022][T21500] delete_channel: no stack [ 962.098113][T21516] binder_alloc: 21507: binder_alloc_buf, no vma [ 962.111193][T21517] binder: BINDER_SET_CONTEXT_MGR already set [ 962.125283][T21516] binder: 21502:21516 transaction failed 29189/-3, size 24-8 line 3147 [ 962.134259][T21513] binder_alloc: 21507: binder_alloc_buf, no vma [ 962.141001][T21513] binder: 21507:21513 transaction failed 29189/-3, size 24-8 line 3147 [ 962.158892][T21504] binder: 21502:21504 BC_INCREFS_DONE u0000000000000000 no match [ 962.179520][T21517] binder: 21507:21517 ioctl 40046207 200002c0 returned -16 [ 962.188164][T21515] binder: BINDER_SET_CONTEXT_MGR already set [ 962.216499][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 962.225286][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 962.249588][T21515] binder: 21514:21515 ioctl 40046207 0 returned -16 09:17:40 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:40 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x6800, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 962.263439][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 962.283839][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 962.399554][T21650] binder: 21627:21650 transaction failed 29189/-22, size 24-8 line 2994 [ 962.404818][T21624] binder: 21606:21624 transaction failed 29189/-22, size 24-8 line 2994 [ 962.432187][T21658] binder: 21627:21658 transaction failed 29189/-22, size 24-8 line 2994 09:17:40 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:40 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 962.449148][T21650] binder: 21627:21650 BC_INCREFS_DONE u0000000000000000 no match [ 962.461971][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 962.481810][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 962.491054][T21681] binder: 21606:21681 transaction failed 29189/-22, size 24-8 line 2994 09:17:40 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:40 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x6c00, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 962.543794][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:40 executing program 4: r0 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) prctl$PR_MPX_DISABLE_MANAGEMENT(0x2c) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffffff) fcntl$lock(0xffffffffffffffff, 0x0, 0x0) write$FUSE_WRITE(0xffffffffffffffff, 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/snapshot\x00', 0x20601, 0x0) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_SET_CONFIG(0xffffffffffffffff, 0x0, 0x20000081) write$P9_ROPEN(0xffffffffffffffff, 0x0, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vhost-vsock\x00', 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$FUSE_CREATE_OPEN(r2, &(0x7f00000005c0)={0xa0, 0x0, 0x5, {{0x5, 0x0, 0x0, 0x0, 0x0, 0x0, {0x5, 0x80000001, 0x807c, 0x6, 0x0, 0x2, 0x0, 0x0, 0xcb1}}}}, 0xa0) getsockopt$IP_VS_SO_GET_SERVICE(0xffffffffffffffff, 0x0, 0x483, 0x0, 0x0) close(r2) ioctl$NBD_SET_BLKSIZE(0xffffffffffffffff, 0xab01, 0x8) ioctl$LOOP_SET_STATUS(0xffffffffffffffff, 0x4c02, 0x0) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000080)={@multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, 0x6f406dab6bc359a1, 0x5, [@empty, @empty, @rand_addr=0xae, @multicast2, @local]}, 0x24) fcntl$getown(0xffffffffffffffff, 0x9) syz_open_procfs(0x0, 0x0) r3 = add_key(&(0x7f0000000240)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x0}, &(0x7f0000000680)="95f3d95d6a2096149383287690c3dfc629bbd6f1952846ed53f06a05c3dbf8a41aa931612634c860964003307a85b3fad7db6ffeaf85d756af566e117cb3616871b480f35f2d2dac40e2048c2739dad8fdc2202f31ef811fb959270a60fd83be66a9ff7e353ad1a46ef576787fe2e12ce832238497a1ccad48ee43456833f3cd5731ddfc24d2a8ab63a77e89ebe1304e22a6eec3db21b1b4711808f526d5aef68f162434c740d85d04b1b60df6d04b721d1eaecaee163bb6b2782956b6fbbf35446a7b5a56d806196992d2bcb3a5fd48525a47d73927cfa7c61e82603033242e6c2095956fef98d3c73f9996565e0524c2ac5d6d84710ca04dd59bd04852c5544ffbd0a765968a1e06b3d00b0b9daaecc623cdf00ca5e06ee88f496d9db272ed917d21337ee972919fbec0b9d20495fb8af5c42cf47b1847be3f52914a6d4fe30f0306dca928b6d30d4e2653eeb618cf3a76e58d09544ed54e733d157740b7c406ff2744d7ecf6f5529fb4215bdb371d3b7bb11b794c146b731a8a64e3605fa48f36b7697d44d7b621144375247c12b3c2bec0f8dbb5ca455dbb7dc7040d8a727df86f96868529115a34fbfeb264eeb7bbed7cd9fe5c0730fc444e7af01babce034c14e959905f1315b46ae489af347bd697bf466ba097f385b4556905bdf18a6376391f8ad2fd4f527b438aa078a21b6af8d4468c04fcb22e94c37fb7a68bb0ccd5814e41311cdadb539a04cc5cbde7d6e9d7cc8f5ac6de485ed504acc205118ec75a7b1b91deb79bbe7b140591090c7c54f69d47c253c51ab98c1a50cb62472f97b029ad6d7e428da2041f0248e6e185c24f961f3d8b0458f2ded7243d1caec213d44faea068e15977eaced85606e07fdcf0bc6c1dd94ae5bca578fc538052c76cddd84f42acabac764a05ea965b367fff3467ef549b870c9026c02886e5846843b21f2508620b276147a500dee687349e28a18507a5e26a823f5bfb36225561bb6cb214d000752672bccd5dd148940126d1ac8b263da70158fad2187d7c8bacb393e418134cfb9b033e414a360c1331513915403b876e675a706a604f6e31318e2d9c8664610164e4a1ba500318a8cf7aa06f647de8cf5205a950008c92015251432da5957330701a1b89a9a90b576bd59e93a3eb39a4d51d1eac4829c0752d11ea658cdf961a04b44fe37955f024f38c04359bb90ecc1829724d71c79c35dc566ab42daa5b92b729feea74ce2ae3d28f04e0f58f0f5170a2e487804a44985ea10f6ea6dfaf7909a675777c924e0b478b99d15367896bebfe089472397a6a3a86dbdd90a527a8d533e4147641551ffa4ed0bc7474deb07f6476bee5b8a2ec875be2ff8d7cfdf7821fa39b3733535dd113d6e6fe293c7390b1d69f2ebd76d7cab8904ef063dc5fbb45cd1f4e2b313f4a6cac6e9ae358a9b618ca424fd5a88a0ca1e8bf9b6a4ce2a3635923ce4e06291fae682cf88d955d45b25f91d5fbd11cf5e364f900c491fd84bcea33ff340769981298aece3c89f8e4c68320479a346ecda5f42966a03a8b2019a7bf24ea452a6e0157766a8992c4afc834078a0406bcfa74da4667b893ea1fb22e3faa2fae721fb322f90ef489a4f08d2daaad79dfb8aa2c0b1f72d446aa0fecb7e9188a57c0ed543f5630f9a4ca3395c1c642dfd97da3f8b5463fd1aa170ef01e0add591b002d8a1dfb1b1ba9809bb40a085293ef1833cf9d7f5cdc55372869334f15ec9922c977184f1d67c7e3b42797a0eeb8851bcaaeeb2528abd4e8eadbb7c03689f4f6d7ff1f7fa28ceae9efe205f6a534af9982fc8cd277fcef800bfdbecb21355ddc2934436ec7404cb764e3be545af1a468e58b607cfdf803bbd00180bd631e90d342c68fef203e6b92557e8f02b07cc0b41c2bf6b1c21a3825fc2307ce5653ae66c007ba3564ed0fa1e69083070e931c76b99c9ddedbcb8bf6a95082840aa3add5379ae43fc44f87e6efc9022ecc3c3001c462e1c88f8224fabe0c16d753b8d14b8e49bfaf0aab791cc72e98ff13d8ff84d1d8b9cc36c714a97f82783a1c3204cc09a82d51ff4e9ec340813e90d17a8ff757973f4aa577ae61a9999f7fd67d77c2a738af930e6b2ec6da0df1b3995985f8c3d8e6bf2ecde0d0892a9e14323dc3cca663803e8db216c0e7f2702afab0f42f7cb2dcaf25c934c01dd3f67c37fb54aae753b8004656ad6fe482bca384c422e4380b34d0ebc438ced6087ef687ae4f757cbb725ea5396c946da7a1ae7adaf65a8bd3148052fd9e27d7239ede2de1bb0a20c99a90941bc4ee3dc66556a3fedebb07a8c7569fb1cfb2043fb4525614bd3c2421c9956b7029d0a909e25780dcbfa2b99b94e503554d0ba3d9fd0262d3a5c9135c11af05187a09c0422c5e7288269ff08372264f453799366eedbdea58036e85294f2355c88bc471b38a033f23efff41e4ee95099338be756fc1e8bf80edaeab79904d3e2f1b9feed7434cf9b63522eeb357216855153db291f7093ef11a734c032f17b9d39713654bf0e1f30bbb67c55caac01038ca25b005fc4e8315b121b999adf8cbcf49cf7527db49102713887985d214dd9c8ed5d918d1d1901ee7ec5b505b5137b2a7ecf66ea86dae0dc9192467e19b0a7a2257702468d7386fd0cd59ab52b70d3de78d09dd194412dd7b3d06ad9b128d849bcfecfc92878c00db07f04b168e97ec693496c3940e43fa7da2c8859ec68e6f2bfad229c6467610af0169498ab5236fe7a38a32dcad7e2387c2f50a0ed3ca3d3d762cc71083b121eee6a6aab8d7135ee61d29ba76fb5007cfbc0a23072aefe1bf3514f33795a6ecf8269a2624b3e590792887789d8d25f081b1118c4220d06329d9ab05ae9705ca01c46cae6262cde172dd6c4b910ae23d75ec4b06cf66dece7c1796de850d14f8d8c50ff2aea90eaefb0aa6ee96cec8120d08b9f8e4536f7930f36914a7b2c687e9bbc02819e1800c6268e3cacc6b2b1516aac441108a1f188231169482daaa72da707da4a66f4e203b0949e04e63882c9e4c7f365b778141fe04610059513f67876290bfaee2683af38051a8a0174bafe51313241b0153cfbb3f3c15ba1cbc9370f95d3ae44300fb0499a174d741206c6b3bd47ecaddb2c197bfc628100a8f3a2da88c8f9ba2ee8e2c7b3d921eb48190dcf68f6e015889e311eb5dde0ccd100d43f4ded3b9739a19b1683ef74bb771658fb2c12f0c2808329c1d02857b0060cab9950e223c47394b6ce91cd86321202b69f148dfd4b2a7047aa84c5a087c63e5acfb159b2a242f6992eeca20e1c43003f71aa9fe88b73d476c717967d7554eb5c1b8824a4623838a181fcaad61a068fcaad86e184a8137964914fadad30a5c468863adf458c95db72be87c067576e666da9fcc2765b6a71845ec0f462ed278394e58e62d2f2646ca11732c3d49697853ef00e863d48c7ef710cc98237a3035329b40646e7653b3fbbbb1ade482692985ad94613fd6eebe225274bd0a4b10b1f039c5e72735d71b994fa19ce06c23e70b77345628a22826895e1877d019aab55d97cc41a5fc9844f217a8aff1ec50c78eaf0b797c9a48e3c6148491043dc1c82167f8fb4ce42f97f0d5264fde33f923e88daf9f1cf6068576c198b12d5b15420f12109c01b6e8118e22a462c256598333a2b61e1dc51a05ee9ea7e101b687b129299241ceb16d48b76ff4e917f4fc46d066d245c46a1686ac64c3257945666b6ac11687d17b1863a973b6608ce5b548d132d4697d5b3697dacec2c702148a6ebf2be9927bd17365a223ecdaa515f7e585410850ca819ea077be7a88d3f010f1620eb02901455498e060f496648ea6464cdd608274f8956c362cd14630bf2ddb04f52a3907ae240ef92c9b550c6dd33c4f3db9fc429fb618199db1a2f531ac8a6f6e08f4040a0b631a09b0c118e765599a70abf15da75067003254bd690ea9e338870d465ec09a43e75fb5f969465d2e335d3c77c52a96f12faf9c4e60e9c3335191193f3abfe494b1f2ff2bcfe1dda61e06a27e9d5940cc237a7f826f8f6766c628808ad7906033b757dc9e2db927ed41dbebc14df6b99fe4d47179651755c7006675f5810ca361f296819c899a6592d45b09f55b83231cdd52bf116908499af4cc476f94a18aa029c898e3a8c6448d66dad5e71a320fbad2139d53b2fb64aca63ec45297ed0529b9968928e973590c9b3b7dc874837cebe2f55bce6a6feaecceaf8b54db3d564d971ea9d8bca6a593b5a3c2529ebe553c54e53ce284dee50d8ba723e72b69e6812a8cc9efec5faaff7a6f566cc890890274e7a2d33b481c98f4dbd51967b15b4b23b1e03840d2382f90cde94c1c4c7fbd955c1dc0447af74d67f94463ac9d452f40d04c7cbb83d1ceab86e742e163e66ef2c96acf4579973a3deb48477b369e33e4cb29716fbf57f516d2a2fd241f7326473ce9e1dbef8249543ad737a57d8eaa750a2350ac5f3b3e54af0592eb87911a238b47aef79edd74a5e5f80aac4494b13f82b58267c28b7c3cabeb6434aea7793fd0aa9a9930786db7f81ca398877bc62ac7fdb447ae413413798389bdae73b18e7dbc026d50dec3cdb2c24e448ce6265e9856e7b31fb7bc1ea31908af12d5311b5ae5abec461565bf9f353d241224f85f40c0e1f77bc36b4f93f8ee69ca095d3fa5149cdffc510d0d2b9858b11d286a62687d0661e28e6876545e4912fd1d9178f5f711f76eae3c25bb06f1fb405b79e931b1292d18b7478b21f5860262b65ecdf27241ad670e403cb47aeb4cedc70077a28a82b6aad332abe9dca5efcc9d9e653889937f19a38f7d231800bebf635b86fd355228391db5a790b19d613b6ebd591159833a6f938ccf6eee4051cf1c430d23b7178fd444fb7b47649564ec11b72cbf052411ce2952a4bd35c3f595e25fd01c6ed753c11db949a2b96a995227609a9c4163cc9d75419b886e0495611066480f19459dd3e2b31fd7a81ed267a9c4781ea9bfeffcbaab886612adaa3ab3fefab33d8e7231d37b4094864f7033ccf70cfc9472dd5b286aaa13e690db6ef4c3f4c8cdfe103809ed488bf40ddc2d080a60bd37e8754bce5d1802a93987694ab5b022ceb3b79d0264dfe70ea5b0507db05e26133607132642efae0821f0e8e4e0ea96e15ea1576689b09320427cd5ef3be71a76c6cbd343c80d800244574a18c0504671c965b748335c6670344c3d7cf8b7a3bd7acd208785afebf45d3aa66aaf8ea58d14070b3e3e13b6b0d0a4373e0f0c78f2fc91270f82e6c38fdfcc0220f583563075e469c3402447ba5ae368bb2a9cb9fe4ac7d50b72f320da5ee728fc9c6bbdeceec207dbcaf0a01b598c277c34f290be10e47a48879917e154636719e8472da011827b79f75774ca475b52b3f2cfa44dd7bfea9f8b745c381ed7ecf9f6be0ab1dc211e903be32d9ca43f4f208340b0cb3b4eeffcd79f0ad93899c25366a3b6a5ea082d07ed00310b594c5c9a660f95cdbbfacc03c103142532b7d449dcf11f080bb2cb7e75d6e79c72ebfa462486ff33c05bf36474b449ecd25fa43f52a46520d7a8593cb91d6cca154274dc90b64857683814f46def63576b75a7b6662969cceb93846712a7a472f7c0f00437a101e73b7b154c7bf38da2fdbd6b38b6b297faa9a76459ba6bc3697eac69a1862e0ce9b08e87f841643c47791946c44128d20c2684e48bb202a4bd3c9956e555adc441275e5594ab38dfe16c29a86a8957a9a74de52976c3cffdad4641741f45a74c52b2dfaccd1eb58d37bfdc3db2830e3d7ca198dca4e82e2dc6", 0x1000, 0xfffffffffffffff9) keyctl$assume_authority(0x10, r3) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000200)='/dev/video1\x00', 0x2, 0x0) clock_adjtime(0x0, &(0x7f0000000000)={0x0, 0x200, 0x0, 0x0, 0x7, 0x5, 0x1, 0x1, 0x0, 0x6, 0x8, 0x8, 0xffffffffffffff43, 0x3, 0x0, 0x3, 0x0, 0x6, 0x2b68b50b, 0x8, 0xac6f, 0x9, 0x4, 0x8, 0x8}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x111, 0x7}}, 0x18b) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f00000000c0)={'nat\x00'}, &(0x7f0000000140)=0x54) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f00000002c0)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x838, @mcast1}, {0xa, 0x4e21, 0x6, @ipv4={[], [], @empty}}, 0xffffffffffffffff, 0xe0}}, 0x48) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) [ 962.650144][T21736] binder: 21735:21736 transaction failed 29189/-22, size 24-8 line 2994 [ 962.661990][T21734] binder: 21733:21734 ioctl c018620b 0 returned -14 [ 962.696195][T21741] binder: 21740:21741 transaction failed 29189/-22, size 24-8 line 2994 [ 962.744892][T21768] binder: 21740:21768 BC_INCREFS_DONE u0000000000000000 no match 09:17:40 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:40 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x4018620d, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:40 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) pipe2(&(0x7f0000000480), 0x4000000000000000) connect$inet6(r0, &(0x7f0000000340), 0x1c) r1 = dup2(r0, r0) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f0000000000)=0x101, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) 09:17:41 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:41 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x7400, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:41 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000140)={&(0x7f0000077000/0x4000)=nil, 0x4000, 0x1000000}, &(0x7f00000001c0)=0x10) r1 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x100, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') ioctl$VIDIOC_SUBDEV_G_SELECTION(r1, 0xc040563d, &(0x7f00000005c0)={0x1, 0x0, 0x100, 0x1, {0x5, 0x80000000, 0xfff, 0x175}}) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x2002, 0x0) setsockopt$inet_sctp_SCTP_INITMSG(r2, 0x84, 0x2, &(0x7f0000000040)={0x0, 0xcde, 0x2, 0x3}, 0x8) ioctl$KVM_UNREGISTER_COALESCED_MMIO(r2, 0x4010ae68, &(0x7f0000000080)={0x13000, 0x2000}) 09:17:41 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:41 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) [ 963.158058][T21967] binder_thread_write: 1 callbacks suppressed [ 963.158071][T21967] binder: 21966:21967 BC_INCREFS_DONE u0000000000000000 no match [ 963.162898][T21968] binder: 21963:21968 ioctl c018620b 0 returned -14 09:17:41 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x7a00, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:41 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) [ 963.238461][T21968] binder: BINDER_SET_CONTEXT_MGR already set 09:17:41 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x402c5828, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 963.301722][T21968] binder: 21963:21968 ioctl 40046207 20000440 returned -16 [ 963.335665][T22083] binder: 22082:22083 BC_INCREFS_DONE node 2493 has no pending increfs request 09:17:41 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000540)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$amidi(&(0x7f0000000500)='/dev/amidi#\x00', 0x6, 0x0) getsockopt$TIPC_CONN_TIMEOUT(r2, 0x10f, 0x82, &(0x7f0000000480), &(0x7f00000004c0)=0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000380)=ANY=[@ANYBLOB="852a627300000000fded926cc26f37ca34ea8627b0a54d0edcb43885d4f12678698c25a141a0979f69bf766d237a1892b3b39f9ebb372e4d54bf02000000e918c06283df34f03b1e3c0d26f6d81344afb8a0e6175a1f3f6ad59aabdc82f3e190d0e5dfa55606d0e009070df0fb80610f687c9075145a87d486468d78fc8d30abb5efb91646b3e88b256148c2bc06f338134479646c99395ddf1a79fe01000080ccbfd6279f86fbe233e974ac29ecb71de1ece2ae88", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r3 = accept4$unix(0xffffffffffffffff, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e, 0x800) ioctl$sock_inet_SIOCSIFPFLAGS(r3, 0x8934, &(0x7f0000000140)={'lo\x00', 0xffff}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) r5 = dup2(r4, r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x2d, 0x0, &(0x7f0000000280)=[@transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$IOC_PR_PREEMPT_ABORT(r5, 0x401870cc, &(0x7f0000000180)={0x1, 0x7, 0x4, 0x96}) 09:17:41 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) [ 963.432838][T12196] binder: release 22082:22083 transaction 2492 out, still active [ 963.451536][T12196] binder: unexpected work type, 4, not freed 09:17:41 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x1000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 963.500950][T12196] binder: release 22082:22129 transaction 2495 out, still active [ 963.529009][T22194] binder: BINDER_SET_CONTEXT_MGR already set [ 963.564346][T22194] binder: 22189:22194 ioctl 40046207 0 returned -16 [ 963.573978][T12196] binder: send failed reply for transaction 2492, target dead [ 963.585742][T12196] binder: send failed reply for transaction 2495, target dead [ 963.622105][T12196] binder: send failed reply for transaction 2496 to 22117:22128 [ 963.696584][T22265] binder: 22254:22265 BC_INCREFS_DONE u0000000000000000 no match 09:17:41 executing program 5: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) pipe2(&(0x7f0000000480), 0x4000000000000000) connect$inet6(r0, &(0x7f0000000340), 0x1c) r1 = dup2(r0, r0) setsockopt$packet_int(r1, 0x107, 0x13, &(0x7f0000000000)=0x101, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x131f64) 09:17:41 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:41 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x402c582a, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:41 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x2000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:41 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x73, 0x2db) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) r1 = socket$inet(0x2, 0x800, 0x54ec) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) signalfd(r1, &(0x7f0000000140)={0x6}, 0x8) sendto$inet(r0, 0x0, 0xffffffffffffff44, 0x200107fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000340)='illinois\x00', 0xb660604) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r0, 0x0, 0x61, &(0x7f00000001c0)={'filter\x00', 0x4}, 0x68) sendto$inet(r0, &(0x7f0000000f40)="03f4a2c970de1d9c3776a9481255ced5dbc57fe63cd931916a02bae17f7850aea473b1c2395dcc0f572febcadeb7fa0f2ee9dc78ccc69169ccfc0bf46dbaba25f3f5a75b77654c0cb9989ea026da080991348232bc2541328a29ec7e06942980144d2ae1b8811ef7af232c4bcb7d89d1aafda6e27d68ed8047debe4f6acdb39851142538045af7a37276d45101a908acd7e6586aaa477a1ed765207d078f68d3f09646ebb175b64f48673bab39a740b280f8876953befe1c9eb8b1494786cdda1a87dbce11989c23041ee13071a5af0e17e267cc0bf8e310b695e5f3bf0f5e0a5ba3393a682e7d0cc9a93e2c8faa4f71f684e0ac9feb65e2a8cb931b4bc84551fe3bc41bdd5d148b8b366152e78e76a6b4bf34f883b99166fc25192d0ea28755cd248b191b5951e5e9ec835e6346d71f731b28e9ad931c763aa39e5da99743f9456069cc9b68fe6eddab20e52fa3d53cf8185941cfbb80fd2dfe9725864a087c899226425347602b7410d8c069f1e39936f9239cd4d7079f129fb5b4d760a4b2177e7ccc63f264b1c67373615d9eebcf66d939d1370d30eaee458bdd9d0648e176d21f692ac7d4b62fe532af6da0d6d6e3f8d97fb8919fff827fe62c55f0bbcf3a041d3cc2ecb0e834e4d1f88e4983d6f73fecf5cb6d48e28e71ebe59e7539f4300bf6dfd524d315a7e6f6532c51fa36ffbab4885941c0c035ac0806b5", 0x1fd, 0x0, 0x0, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x200, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_CLIENT_INFO(r2, 0xc0bc5310, &(0x7f0000000240)) r3 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x7ff, 0x28000) ioctl$ION_IOC_ALLOC(r2, 0xc0184900, &(0x7f0000000100)={0x0, 0x10, 0x1, r3}) [ 963.862013][T22307] binder: 22306:22307 ioctl c018620b 0 returned -14 09:17:42 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:42 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x402c582a, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 963.907720][T22316] binder: 22315:22316 BC_INCREFS_DONE u0000000000000000 no match [ 963.918153][T22307] binder: 22306:22307 ioctl c0306201 0 returned -14 09:17:42 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x18) listen(r0, 0x53) r1 = accept4(r0, 0x0, 0x0, 0x0) ioctl$sock_ifreq(r1, 0x8918, &(0x7f0000000080)={'veth1_to_team\x00', @ifru_hwaddr}) 09:17:42 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 964.125091][T22507] binder_alloc: 22306: binder_alloc_buf failed to map pages in userspace, no vma 09:17:42 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 964.166058][T22526] binder_alloc: 22306: binder_alloc_buf failed to map pages in userspace, no vma [ 964.184949][T22531] binder_alloc: 22306: binder_alloc_buf, no vma [ 964.198946][T22531] binder: 22530:22531 BC_INCREFS_DONE u0000000000000000 no match [ 964.317447][T22625] binder: 22613:22625 ioctl c018620b 0 returned -14 09:17:42 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:42 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x4000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:42 executing program 5: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:42 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:42 executing program 4: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280)='/dev/nullb0\x00', 0x2, 0x0) ioctl$LOOP_SET_CAPACITY(r0, 0x4c07) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000140)={0x1, &(0x7f00000000c0)=[{0x6, 0x0, 0x0, 0x7ffffffe}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000380)={0x1, &(0x7f00000000c0)=[{0x2, 0x0, 0x0, 0x7ffffffe}]}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x50001}]}) r1 = syz_open_dev$cec(&(0x7f00000002c0)='/dev/cec#\x00', 0x2, 0x2) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000300)) r2 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x10001, 0x10000) sendmsg$can_raw(r2, &(0x7f0000000240)={&(0x7f0000000100), 0x10, &(0x7f0000000200)={&(0x7f0000000180)=@canfd={{0x2, 0xc92, 0x101, 0x1000}, 0xa, 0x2, 0x0, 0x0, "04fcf3811cfa13e5ebeb56e6bcb554abb346a7e44c60e667cb587e290e5665b4f1b9353d2780450d47467daa544d0c4fdf137e02c9e492626011901dabd5f717"}, 0x48}, 0x1, 0x0, 0x0, 0x40000}, 0x80) prctl$PR_SET_SECCOMP(0x16, 0x1, &(0x7f00000003c0)={0x7, &(0x7f0000000340)=[{0x7fffffff, 0x6, 0x5, 0x1}, {0xfffffffffffffffa, 0x1, 0x3, 0x80000000}, {0x2, 0x2, 0x3000000000000000, 0xa3}, {0x2, 0x401, 0x0, 0x1}, {0x8001, 0x5}, {0xfffffffffffffffa, 0x7, 0x10000, 0x4d5a9096}, {0x8001, 0x6, 0x6, 0x7}]}) [ 964.485304][T22670] binder: 22669:22670 ioctl c018620b 0 returned -14 09:17:42 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x5000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 964.530325][T22670] binder: 22669:22670 ioctl c0306201 0 returned -14 09:17:42 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4018620d, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:42 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:42 executing program 5: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7fffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) poll(&(0x7f0000000540)=[{r0}], 0x1, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm_plock\x00', 0x18300, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000000)='^wlan0*-selinuxselinuxcpusetselfem1user\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000140)={'bridge0\x00', 0x0}) ioctl$SCSI_IOCTL_GET_IDLUN(r1, 0x5382, &(0x7f00000001c0)) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000180)={'vcan0\x00', r2}) [ 964.649366][T22823] binder_alloc: 22669: binder_alloc_buf failed to map pages in userspace, no vma [ 964.723391][T22845] binder: 22844 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 964.723455][T22845] binder: 22844:22845 ioctl c018620c 200002c0 returned -22 [ 964.740683][T22869] binder: 22811:22869 BC_INCREFS_DONE u0000000000000000 no match [ 964.762794][T22850] binder: 22847:22850 ioctl c018620b 0 returned -14 [ 964.790226][T22850] binder: BINDER_SET_CONTEXT_MGR already set [ 964.799857][T22872] binder: 22844 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 964.799872][T22872] binder: 22844:22872 ioctl c018620c 200002c0 returned -22 [ 964.815896][T22850] binder: 22847:22850 ioctl 4018620d 20000440 returned -16 [ 964.818977][T22850] binder: 22847:22850 ioctl c0306201 0 returned -14 09:17:42 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000017000)=0xfffff7fffffffffd, 0x4) bind$inet(r0, &(0x7f0000011ff0)={0x2, 0x4e20, @multicast2}, 0x10) listen(r0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000017000)=0xfffff7fffffffffd, 0x4) bind$inet(r1, &(0x7f0000011ff0)={0x2, 0x4e20, @multicast2}, 0x10) listen(r1, 0x0) r2 = dup2(r0, r1) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r2, 0x84, 0x66, &(0x7f0000000000)={0x0, 0xffffffffffffff7f}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000080)={0x1, 0x2, 0xfffffffffffffff7, 0x81, r3}, 0x10) 09:17:42 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x6000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 964.823423][ T26] audit: type=1326 audit(1553764662.883:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22873 comm="syz-executor.5" exe="/root/syz-executor.5" sig=9 arch=40000003 syscall=265 compat=1 ip=0xf7ff3869 code=0x0 [ 964.861617][ T7897] binder: release 22844:22870 transaction 2519 out, still active [ 964.883011][ T7897] binder: unexpected work type, 4, not freed 09:17:43 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 964.913156][ T7897] binder_release_work: 5 callbacks suppressed [ 964.913162][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 965.011338][T22958] binder: 22942:22958 BC_INCREFS_DONE node 2523 has no pending increfs request [ 965.065967][T12196] binder: release 22963:22981 transaction 2525 out, still active [ 965.069512][T23040] binder: 22942:23040 BC_INCREFS_DONE node 2532 has no pending increfs request [ 965.076546][T12196] binder: unexpected work type, 4, not freed [ 965.128189][T12196] binder: undelivered TRANSACTION_COMPLETE [ 965.148711][T12196] binder: release 22942:23040 transaction 2531 out, still active [ 965.190065][T12196] binder: unexpected work type, 4, not freed [ 965.206754][T12196] binder: undelivered TRANSACTION_COMPLETE [ 965.218514][T12196] binder: release 22942:22958 transaction 2522 out, still active [ 965.234578][T12196] binder: unexpected work type, 4, not freed 09:17:43 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:43 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:43 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x7000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:43 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:43 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 965.243516][T12196] binder: undelivered TRANSACTION_COMPLETE [ 965.250164][T12196] binder: send failed reply for transaction 2519, target dead [ 965.258099][T12196] binder: send failed reply for transaction 2522, target dead [ 965.266153][T12196] binder: send failed reply for transaction 2525, target dead [ 965.274725][T12196] binder: send failed reply for transaction 2528 to 22963:23032 [ 965.282612][T12196] binder: undelivered TRANSACTION_COMPLETE [ 965.374505][T23099] binder: 23098 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 965.374613][T23099] binder: 23098:23099 ioctl c018620c 200002c0 returned -22 [ 965.401539][T23105] binder: 23097:23105 ioctl c018620b 0 returned -14 [ 965.405308][T23104] binder: 23102:23104 BC_INCREFS_DONE u0000000000000000 no match 09:17:43 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0xa000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:43 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = dup(r0) bind$inet(r1, 0x0, 0x0) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f0000000340)="120000001200e7ef007b00005380a79a9e58", 0x12, 0x0, 0x0, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') accept4$packet(r1, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000100)=0x14, 0x80000) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) ioctl$sock_ifreq(r1, 0x8911, &(0x7f00000001c0)={'veth1_to_bond\x00', @ifru_addrs=@can={0x1d, 0x0}}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000200)={{{@in=@local, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@initdev}}, &(0x7f0000000300)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000380)={{{@in=@broadcast, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@local}}, &(0x7f0000000480)=0xe8) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000005c0)={0x0, @rand_addr, @remote}, &(0x7f0000000600)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000640)={'team0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000680)={'team0\x00', 0x0}) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f00000006c0)={0x0, @loopback, @empty}, &(0x7f0000000700)=0xc) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000001d00)={{{@in, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@empty}}, &(0x7f0000001e00)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000001e40)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6}}, &(0x7f0000001f40)=0xe8) accept4$packet(r1, &(0x7f0000001f80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001fc0)=0x14, 0x800) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000020c0)={{{@in6=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@multicast1}}, &(0x7f00000021c0)=0xe8) accept4$packet(r1, &(0x7f0000002200)={0x11, 0x0, 0x0}, &(0x7f0000002240)=0x14, 0x800) getsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000002280)={@multicast1, @multicast1, 0x0}, &(0x7f00000022c0)=0xc) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000002340)={'sit0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000002440)={{{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f0000002540)=0xe8) accept4$packet(r2, &(0x7f0000002580)={0x11, 0x0, 0x0}, &(0x7f00000025c0)=0x14, 0x80000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000002600)={'syzkaller0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000002640)={'team0\x00', 0x0}) getsockname(r1, &(0x7f0000002680)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000002700)=0x80) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000002940)={{{@in, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in6=@empty}}, &(0x7f0000002a40)=0xe8) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000003240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x402}, 0xc, &(0x7f0000003200)={&(0x7f0000002a80)={0x76c, r3, 0xfab11eb0a1aa3525, 0x70bd28, 0x25dfdbfd, {}, [{{0x8, 0x1, r4}, {0xb4, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r7}, {0x234, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x20000000000000}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xf5d}}, {0x8, 0x6, r9}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r10}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1f}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r11}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0x1a8, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x28000}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x6e9}}, {0x8, 0x6, r15}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r16}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x7c}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x800}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x8}}, {0x8, 0x6, r17}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}]}}, {{0x8, 0x1, r19}, {0x1e8, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1c0000000000000}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffffc}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x7d}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r20}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1ff}}, {0x8, 0x6, r21}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r22}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r23}}}]}}, {{0x8, 0x1, r24}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x4}}}]}}, {{0x8, 0x1, r25}, {0x74, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x1f}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x2c9}}}]}}]}, 0x76c}, 0x1, 0x0, 0x0, 0x20000000}, 0x1) recvmmsg(r2, &(0x7f00000020c0), 0x320, 0xbac, &(0x7f0000003700)={0x77359400}) ioctl$FS_IOC_RESVSP(r1, 0x402c5828, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x7ff}) ioctl$TIOCSBRK(r1, 0x5427) [ 965.437083][T23105] binder: 23097:23105 ioctl c0306201 0 returned -14 09:17:43 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306209, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 965.585376][ T26] audit: type=1326 audit(1553764663.673:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=22873 comm="syz-executor.5" exe="/root/syz-executor.5" sig=9 arch=40000003 syscall=265 compat=1 ip=0xf7ff3869 code=0x0 [ 965.589681][T23178] binder: 23176:23178 ioctl c0306209 200002c0 returned -22 09:17:43 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 965.649597][T23224] binder: 23220:23224 BC_INCREFS_DONE node 2544 has no pending increfs request [ 965.705485][T23226] binder: 23220:23226 BC_INCREFS_DONE node 2547 has no pending increfs request [ 965.752971][T12196] binder: release 23220:23224 transaction 2543 out, still active [ 965.767021][T12196] binder: unexpected work type, 4, not freed 09:17:43 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x10000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:43 executing program 5: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='uid_map\x00') r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000080)={0x2, 0x70, 0x4, 0x2, 0x0, 0x5, 0x0, 0xff, 0x0, 0x4, 0x4, 0x5, 0x6, 0x8001, 0x3, 0x0, 0x3fb7, 0x7fffffff, 0x100000001, 0x100000000, 0x8001, 0x1, 0x9, 0x62b, 0x4, 0x1, 0x8, 0x7, 0x3, 0x4, 0x969f, 0x4c71, 0x80000001, 0x1, 0x2, 0x100000000, 0x6, 0x1, 0x0, 0x5, 0x3, @perf_bp={&(0x7f0000000040), 0x3}, 0x10000, 0x2, 0xfffffffffffffffa, 0x1, 0xff, 0x8, 0x3}, r1, 0x8, r2, 0x1) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0xd, &(0x7f0000000000)={0x0, 0x2}, 0x8) [ 965.796829][T12196] binder: undelivered TRANSACTION_COMPLETE [ 965.819496][T12196] binder: release 23228:23229 transaction 2549 out, still active 09:17:44 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x402c5828, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 965.885698][T12196] binder: unexpected work type, 4, not freed [ 965.897921][T12196] binder: undelivered TRANSACTION_COMPLETE [ 965.906156][T23239] binder: 23176:23239 ioctl c0306209 200002c0 returned -22 [ 965.973930][T23266] binder_alloc: 23097: binder_alloc_buf, no vma [ 965.985231][T12196] binder: release 23176:23178 transaction 2552 out, still active [ 966.039531][T23287] binder_alloc: 23097: binder_alloc_buf, no vma [ 966.042007][T12196] binder: unexpected work type, 4, not freed [ 966.068711][T12196] binder: undelivered TRANSACTION_COMPLETE [ 966.083934][T23266] binder: 23264:23266 BC_INCREFS_DONE u0000000000000000 no match [ 966.105080][T12196] binder: release 23176:23178 transaction 2540 out, still active [ 966.138112][T23309] binder: 23307:23309 ioctl c018620b 0 returned -14 [ 966.146682][T12196] binder: unexpected work type, 4, not freed [ 966.153407][T12196] binder: undelivered TRANSACTION_COMPLETE [ 966.172688][T23309] binder: BINDER_SET_CONTEXT_MGR already set 09:17:44 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:44 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc030620a, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:44 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306209, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:44 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3f000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:44 executing program 4: r0 = openat$hwrng(0xffffffffffffff9c, 0x0, 0x202, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(r0, 0x0, 0xfffffffffffffdc3) r1 = socket$inet6(0xa, 0x400000000001, 0x0) close(r1) r2 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhci\x00', 0x2) r3 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) readv(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/217, 0xd9}], 0x1) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, 0x0, 0x0) write$P9_RLERRORu(r3, &(0x7f0000000640)=ANY=[@ANYBLOB="ffc0a42105d18c1e9c09000000c50006000000"], 0x13) sendfile(r1, r3, &(0x7f0000d83ff8), 0x2) ioctl$TIOCGPTPEER(0xffffffffffffffff, 0x5441, 0x0) fsetxattr$security_capability(r0, &(0x7f0000000080)='security.capability\x00', 0x0, 0x0, 0x2) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) syz_open_dev$evdev(0x0, 0x0, 0x0) ioctl$KVM_DEASSIGN_DEV_IRQ(r3, 0x4040ae75, &(0x7f0000000040)={0x7fffffff, 0x0, 0x2, 0x104}) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000280)="62cc88215d8cd4d5c53df9bfba24e44d8fc808d0e895156d2cbd0d8f23df4a324c877f0ad1e126c403d0e5d20086e711cff5419814f057f4e016777469d0d9dcba618cbe597c9f365a3b293091268cb4098c2a01a131a0664b2748dd58cdd49663564de699fe020343eb9939858084f5a94f84a4e5f1f28f4323097345f2bd2dabf8a8ed1ba86243bbddf5c10f89b85a106cce5cd2df0034b3efa82f85ac7452930a00af5a96f58fbe51833a8a9b46a163f8e048a25ed629384d470393bb1a3a477cc53f3e564d33e423a59d9fa2961fa3466e", 0xd3}, {&(0x7f0000000380)="abd7cc64d4e553dc14493ae0c6334cb4e3274aca6492c80d54070787c0bd16a69eaf39cda3a9daf4a57b0f3b3966cce861bf34596dd295f4f425a8a6aa7056efde22ff676eeb683326680196897cb3d60dbf8a29ecc236729426557c0a7153c94402ac1cb46fb6836bf908a859e7209d33b52a74e8861f7c8f2df30b35b78b4038595bd52cb3027df6b092f121b91d70aa62b83a6afce6b2a6079216ae747e9a941b10e3c1902d6dce87b86e6e6d9c57bbd7237f36f78de9ca74e014", 0xbc}], 0x2, 0x4) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TIOCLINUX7(r3, 0x541c, 0x0) syz_open_dev$sg(0x0, 0x0, 0x0) socket$inet6(0xa, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xc9, &(0x7f0000000700)={{0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}, 0xfffffffffffffffe}, {0xa, 0x0, 0x0, @remote}, 0x0, [0x0, 0x0, 0x200000000000000, 0xfffffffffffffffe]}, 0x5c) [ 966.214320][T12196] binder_send_failed_reply: 1 callbacks suppressed [ 966.214328][T12196] binder: send failed reply for transaction 2540, target dead [ 966.220965][T12196] binder: send failed reply for transaction 2543, target dead [ 966.239138][T23309] binder: 23307:23309 ioctl 40046207 0 returned -16 [ 966.290647][T12196] binder: send failed reply for transaction 2546 to 23220:23226 [ 966.310879][T23357] binder: 23356:23357 ioctl c0306209 200002c0 returned -22 [ 966.324190][T23360] binder: 23358:23360 BC_INCREFS_DONE u0000000000000000 no match [ 966.332333][T23355] binder: 23354:23355 ioctl c030620a 200002c0 returned -22 [ 966.349105][T12196] binder: send failed reply for transaction 2549, target dead [ 966.373002][T12196] binder: send failed reply for transaction 2552, target dead 09:17:44 executing program 5: sendmsg(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)}, 0x0) ioctl$FS_IOC_MEASURE_VERITY(0xffffffffffffffff, 0xc0046686, &(0x7f00000000c0)=ANY=[@ANYBLOB="000012009e992ba295f7dc1ceffe8c916aace060aa808fe2ed011868a3661861d95a2f43b449d9897a4c243cbe1331133fabfdd5918b7eb9035f51fcc9b6fd93bca6b8d336abdafc3eabfce553988374a989dc62f929a0fd69c7a60276f3fd4c97b639f4e3e5196e5869e60f64041084a462bcd0"]) syz_emit_ethernet(0x6e, &(0x7f0000000240)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @link_local, [{[{0x9100, 0xdae, 0x0, 0x4}], {0x8100, 0x7fffffff, 0x7, 0x1}}], {@ipv6={0x86dd, {0x0, 0x6, "b40900", 0x30, 0xffffff3a, 0xf0ffff, @ipv4={[0x3580], [], @multicast2}, @mcast2, {[], @icmpv6=@time_exceed={0xffffff87, 0x0, 0x0, 0x0, [0x9, 0x4], {0x0, 0x6, "b680fa", 0x0, 0x0, 0x0, @ipv4={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [], @broadcast}, @ipv4={[], [], @remote={0xac, 0x14, 0xffffffffffffffff}}}}}}}}}, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000080)={'bpq0\x00'}) r0 = epoll_create(0x2) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000000)='trusted.overlay.redirect\x00', &(0x7f0000000040)='./file0\x00', 0x8, 0x1) socketpair(0x1, 0x5, 0x0, &(0x7f0000000740)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000080)='ip6tnl0\x00') 09:17:44 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x48000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 966.400512][T23430] binder: 23354:23430 ioctl c030620a 200002c0 returned -22 [ 966.418376][T12196] binder: undelivered TRANSACTION_COMPLETE 09:17:44 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:44 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x402c582a, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:44 executing program 4: r0 = dup(0xffffffffffffff9c) fadvise64(r0, 0x0, 0x9, 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r0, 0x227b, &(0x7f0000000340)=0x100) r2 = socket$packet(0x11, 0x2, 0x300) fstatfs(r2, &(0x7f00000004c0)=""/229) setsockopt$packet_tx_ring(r2, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r0, 0x28, 0x0, &(0x7f0000000100)=0x2248, 0x8) pipe(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x10000014c) inotify_init() perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = fcntl$getown(r1, 0x9) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000080)=0xc) kcmp(r5, r6, 0x4, r2, r1) writev(r3, &(0x7f0000000240)=[{&(0x7f0000000180)="d40f595cfc882841276b2425c23eff5cc4be44b275260019598bcc9178ed275cd324c355e00578e5310c076035d0fe71a0c7f46e165a2a20568cf50ee6e5f5c0399f79f5d5cfe1b3261c8284cbdd5dcde62021dfecfa3488c2de5f9a3235c976270b4f8fa345510291567dd4d8813b93bc5c6e899b47cd", 0x77}], 0x1) r7 = semget$private(0x0, 0x0, 0x0) semctl$IPC_RMID(r7, 0x0, 0x0) ioctl$VIDIOC_G_PARM(r4, 0xc0cc5615, &(0x7f00000003c0)={0x8, @output={0x1000, 0x1, {0x2, 0x7}, 0x7fff, 0x7}}) ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0086426, &(0x7f00000002c0)={0x8, &(0x7f0000000280)=[{}, {}, {}, {}, {}, {}, {}, {}]}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000001580)={0x1b7}, &(0x7f0000000200), 0x0) vmsplice(0xffffffffffffffff, 0x0, 0xffffffffffffff20, 0x0) [ 966.537111][T23567] binder: 23566:23567 BC_INCREFS_DONE u0000000000000000 no match 09:17:44 executing program 5: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet_opts(r0, 0x0, 0x4, 0x0, &(0x7f0000000540)) r1 = syz_open_dev$media(&(0x7f0000000080)='/dev/media#\x00', 0x100000000, 0x80000) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000380)={0xffffffffffffffff}, 0x2, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000400)={0x13, 0x10, 0xfa00, {&(0x7f0000000180), r2, 0x3}}, 0x18) getsockopt$EBT_SO_GET_INFO(r1, 0x0, 0x80, &(0x7f00000000c0)={'nat\x00'}, &(0x7f0000000140)=0x50) getsockopt$IP6T_SO_GET_REVISION_MATCH(r0, 0x29, 0x44, &(0x7f0000000000)={'NETMAP\x00'}, &(0x7f0000000040)=0x1e) 09:17:44 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x4c000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 966.658593][T23578] binder: 23577:23578 ioctl c0306225 200002c0 returned -22 [ 966.703293][T23581] binder: 23579:23581 ioctl c018620b 0 returned -14 [ 966.739836][T23581] binder: 23579:23581 ioctl c0306201 0 returned -14 [ 966.747754][T23647] binder: 23577:23647 ioctl c0306225 200002c0 returned -22 [ 966.766677][T23661] binder: 23655:23661 BC_INCREFS_DONE node 2570 has no pending increfs request [ 966.775526][ T7897] binder: release 23577:23644 transaction 2566 out, still active [ 966.785810][ T7897] binder: unexpected work type, 4, not freed [ 966.805116][T23723] binder: 23655:23723 BC_INCREFS_DONE node 2570 has no pending increfs request [ 966.869577][T12196] binder: release 23655:23661 transaction 2569 out, still active [ 966.881130][T12196] binder: unexpected work type, 4, not freed [ 966.928424][ T7897] binder: send failed reply for transaction 2566, target dead [ 966.940773][ T7897] binder: send failed reply for transaction 2569, target dead [ 966.965742][ T7897] binder: send failed reply for transaction 2572, target dead 09:17:45 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:45 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc030628c, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:45 executing program 5: eventfd2(0x1, 0x801) r0 = socket$packet(0x11, 0x3, 0x300) r1 = accept4(r0, &(0x7f00000000c0)=@isdn, &(0x7f0000000140)=0x80, 0x80000) accept4$inet(r1, &(0x7f0000000180)={0x2, 0x0, @broadcast}, &(0x7f00000001c0)=0x10, 0x800) getsockopt$packet_int(r0, 0x107, 0x13, 0x0, &(0x7f0000000040)) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000280)='/dev/snapshot\x00', 0x3c, 0x0) ioctl$KVM_GET_CLOCK(r2, 0x8030ae7c, &(0x7f0000000200)) getsockopt$XDP_STATISTICS(r2, 0x11b, 0x7, &(0x7f0000000080), &(0x7f0000000240)=0x18) 09:17:45 executing program 4: mount(0x0, 0x0, &(0x7f0000000080)='ramfs\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0xffffffffffffffd3) r0 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x101, 0x2000) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000200), &(0x7f0000000240)=0x40) r1 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000680)={0x1, @win={{0x0, 0x0, 0x34343459}, 0x0, 0x0, 0x0, 0x0, 0x0}}) rt_tgsigqueueinfo(0x0, 0x0, 0x16, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000280)=0xffffffffffffffff, 0x4) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvfrom(r2, &(0x7f0000000100)=""/144, 0x90, 0x40000000, &(0x7f0000000000)=@in6={0xa, 0x4e22, 0x100000001, @mcast1, 0x983}, 0x80) 09:17:45 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:45 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x68000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 967.198848][T23801] binder_transaction: 40 callbacks suppressed [ 967.198882][T23801] binder: 23800:23801 transaction failed 29189/-22, size 24-8 line 2994 [ 967.201761][T23805] binder: 23803:23805 transaction failed 29189/-22, size 24-8 line 2994 [ 967.244727][T23814] binder: 23800:23814 ioctl c030628c 200002c0 returned -22 [ 967.250245][T23809] binder: 23808:23809 ioctl c018620b 0 returned -14 [ 967.272684][T23809] binder: 23808:23809 ioctl c0306201 0 returned -14 [ 967.280502][T23815] binder: 23803:23815 BC_INCREFS_DONE u0000000000000000 no match [ 967.303359][T23816] binder: 23800:23816 ioctl c030628c 200002c0 returned -22 09:17:45 executing program 5: r0 = syz_open_dev$usbmon(&(0x7f00008be000)='/dev/usbmon#\x00', 0x0, 0x0) openat$cgroup_root(0xffffffffffffff9c, 0x0, 0x200002, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, &(0x7f00000001c0)={0xe, 0x18, 0xfa00, @id_resuseaddr={0x0}}, 0x20) r3 = syz_open_dev$vbi(&(0x7f0000001280)='/dev/vbi#\x00', 0x3, 0x2) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r0, 0x10e, 0x8, &(0x7f0000000740)=0x6, 0x4) r4 = memfd_create(&(0x7f0000000000)='/dev/vbi#\x00', 0x4) ftruncate(r4, 0x1000000) setsockopt$inet_dccp_int(r3, 0x21, 0x13, &(0x7f0000000100)=0x800, 0x4) sendfile(r3, r4, &(0x7f00000000c0)=0xf10002, 0xeffffdef) write$P9_RLOCK(r3, &(0x7f0000000140)={0x8, 0x35, 0x2, 0x3}, 0x8) close(r3) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCGLCKTRMIOS(0xffffffffffffffff, 0x5456, 0x0) r5 = dup3(r3, r2, 0x80000) getpgrp(0x0) stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)) getresgid(&(0x7f00000005c0), &(0x7f0000000600), 0x0) sendmsg$unix(r5, &(0x7f0000000700)={&(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e, &(0x7f0000000180)=[{&(0x7f00000012c0)="7570017ad32982f7144c4ae155377c2c50de5dbe1fc54a69731ed37dc268767cc4ae7e22c0d10b2223ddc1ac1159fa93313062ae80e09afaf181904b2221fe848d77a08171598e4cc33c2bb96055aa87f69b12d07175a6103cba7355c8023810984fca3b8bf48be39bf3dc872715e2c45ec8b464df804f7e03341eb0871cf966fed7134fdba63e7d7c2e4f54c6bebde4c4386f5fc3884e8f52d84ac3ea87ccdbad229f68adbbae51c5f758c2f979296bf1830fd05dc32ed1e44b7ef915f984afa65ffc4c79d93e3a71ed95ff87ed747be5044453e2a0c338898ceba43de2d16f5e41238cde7df9069585482771948e0bed96ea46d3739fad8c4ddc77246abbca8c1ef56c901d2eb1c59fff5b88b5ce606f230412713cfaf05d19fdeb398121669fd378ac3611fb9bfe79cb6b61b58dd5a02b79c2d26fec153e3e95756632cd530962ec35a582e1db6be2f7f88c79274306d236b8986c487522005ddf642a4187e825704302d6a21e2478dbb8edb7c06cde0b7c3e170073751d3bf1bbd6c59bf1d458baed270cc23e9f8bd9815266e5b658bc83643f4e3af9269b28b78ebb6b0598ac66288c53153b3a70c4abe2012976d48e8dd4f6da7da6f29449c8beb6358f750c1df76478a620a6cdaaa4b347532582cc8bf5087805dc02ed7dac6a6625dd91456091efd17486b639e55f4718b08ee017150f8395aa625db3ca2b5782a2f7ecbcd116b6029a786d02abc8c0a180c8106f2e491496fbc85e699af5ced10182b6e239cd4b2afdcc65d4db5ef6a3c9b6681021df4d6a3b33b58cf06c40977ea114138288429bd2c76ee44549da7f44e134eb1f6c1a82e805509f20c784e66a9cb3084d0ae11a645cc16ce2b217e157926646e490094d40153df8f69e206433841b5c2e3c1023239753dee80215d158cc2236063acdc206b3bf30d7fca251ea732ef93df4bece9afd365154890d384261a0ab7dd89e336351f6aec68dae1a12c2c69fca19c981be199ace1c70dda17a94572970fc78b4f6aa55c57e32c1acae52fd961c679b47f6810a5141436b274be91600a424193d60c65e00fdcfe714f35db07f7fc2cb32e77059b576c3a481ed947afb8c2edae5d47fc3ebfcc1c1445027270cbca82352d06cb6f46921e3424ce687fb361c6e0e63875850781940c81227f88c9dff5c4671d1b8fdb46200cfa36c38fe5955fce1485e144a5c6ab4954ad1002957af894934aea44ffaa87d5247dabfb71bbe46dc0bc176bf581c343847f666dff21aa104e93f8f09635853ae3ad4b0941e01acfd3861d5e9544f34e225612f0f6cabbdaf9e7296b7286475c994f14665b1d5610643bdfe9430b9b34fc02b8711ee7faf405288cad266b4446f87f0ce42dde1193cf7db558b8af33679924eec121698093af296362e46d198a663070e80fa5bb5d6411c1d3309d0ffd62ce3957c2930772e799a3722acdfd1118ac8eb3e53769d49d9d905a37e3579da1162a098f3f1a781067a4c6e8faf08156ad3f3b201c520282fd35a33a0d4880820de2ce78c25ede29519c13eafc031f057f23f0d9b219407a9ce8583290ce4a3c690280a141058965ab560c0121c0b355e5a412e736c45851193173e45c97a7ed5febdf98566e944a87095511d4fbffeefb00787be4085dd379ecc7f75a4efd2504ee7331d609c7ec4a7461b332ece79c3594c4e7b862ea5b4ee11b77eac4adf6548f9936f93f0c5630529e147489a0ae127716ba1f8cdef568f81c070871978f3a24cfc7fee053dd34aba3d8d9fc48e45b585f24ce45b10eeb2c60d2be822831a91004c75b82950d4776d71bc17094138cd8e1255c763db806f48feaf5afae4d35167b5571cf75b6273a821145cd6f36f698c11956ca59e2b5b40caa0505bb76767690f199d0c16aa39259c770bfbd3f237ded00ba6634da9f31abe0e97d4254e0871bed067547c770384fc46ce8ed137418cb439eff52c151ea15d81d4615c5d8567fdd696bf16f1c7878160290bc7655cf9f315f4754dcb01c00d6b5e17d126e83ca5861b87f6aef09c81e17673933e884c41891942e5ddd9f2a285e7c4194bc483a4fd04d06253593e0b5ffcff92b925001452b56ffb86d9c582fe7c80e2014706648542fcb62fe598e519c435534ca4376bfe2ceb3d9ea9340e8cc282eaf074c4f19e0a94f9828569ef71a0b2b77460f7b221d6bf6d0dd30c9e2b7066c96dbfde7d920408b6634a42afb3f4c981d4a19345977159ef37b7ff33144ad569425c7ba3a99ea79834618a869b39f7bebe76e8646bcf744d32c76c2e6c76e228b787b4070183d5dce8e116c69ddfa85eed3946c4356db02d567ca60331c0a99f34d8d980a6e070fca7628c310c8aeacb30513869c2f7bfeee94cfb2755e8312ca59144861903d70a668c3f70ce9d4f6fc465f6d8c71b2230c53373c58ec5193a2366936151e1b09c9a3e9904bf911d22738cf2f711438ae1f66b9783d4d97bd491771f867a3cfa186b1c2be3d1bd7a709209cfc4a40b1f3455fc650d8a089685a134d754cc9aaab0e5e5c4673c5b3c46443dc23f78cdaf48e8933ce89cbc7f18ff6df46645129c227237b553e6c67b48f1df2a7f755ff45e45e50bb236cc6cbd24219e13339caf2c3af1f58dd3d9d91b1ec84ec88704ae964afb6fb56fbebc1250bec25d1d941f48c5a039294675b81af5469a09cf655e554c30dfc52198c37baf55ef9ee12cc912a1fe9eba5f08b41808c0e96fec4b7f9c57e72d2d82674251329a615106ce0d6a280fe8723351bb24638462502c7d5181fd804a4d08a2c29d773524c63f1b979a334930ba941c97517baf1bcc51470ec5bb3c9b1bd920ee7ba8da89c98ed0597ca97dedf7ade0a1e0318a6b347bf089c5192c2a9642e98fa158cfae55e02b01ce24f17d4683fd9cd50eee75616e0f808889d7884a4e0174870ac7e2bf44492f03a1269f9ce49b4f393d0081461cb50d23fb38b9b3cf66a87c90f743b0c272162344ddca24776b1fb9625b8d9c3f1fda4dd66e00815056c3ca8fe3baedd21bfe301bb4eae055217530734771e434dc012d1cd13e6599ac3f25dad4c32c0dd71bc29f8ee092baea1a981d439a86103a1c00caa032b3053571f7748464930d93e3b4fde26ec9667a2600c71afecc217a1c4031943d55e8157a72ab178c63d3025a39621347e82db001b0d7bdfa5934ef48ed16da4c617a3dbccc2a552fc1adc143b628476da7a6c3eb1ecce0434cc04dbf43c8a5a543e0df0d46727511843852faef52599df833915853074ea77571025cc70298b70b0c9d38bf3ca150c7421eac1bc623dc47dc6c23e813fdbff303ce2a266f39aa7476606fe0b15c86fc8216cd793f271c8b704ad73b855fbce8bbe2a66b1fa9eb542d0df1c1ed39b05937eacfbf339bd63cdd8c9c0707522233ba8264e6c4589d869dd539759e67aeb6f6d1ff7465d125242b14f530040554398c013660a7ab41165e27a83fbabc57ce23bf6757f2bf2e058cdf5090bfc34cec98bc292eaf6c97de88238c76bf89781c6141c3e1e06bbe84caa03070b845215bc83157a76a41d96881f12cb105c65cdb86fd02e9ecb595ac6a2f56c58d13c41c0d2c5d9b9d5575f00fe8151eb82d324a1bceb7e752b017d8959b0370cad4c53d0289d3f8709da7a59af62fcf892b15e690099c901032534b28a4efb36f576da10f51e46757623eb668cae7cbc39dc74dc35c4ad4a35c3157541740a16a1c9101ec0cdce7a669bd5e7500eb300a34b59c14bdb0cb5c9def6e52c9e3ffb0639a1f68b8725897bbe5243e5113a7cfe912667cea85060c63f48222ec0f777520aecb6b04f4fbad1f84f58bd491852848b616aca2257a3e72cfb8827ee00a9b475896eefd0d3dc6f2417e5b50a9e0737ab11f0896ed45e29a4dedfffd54ffbe306dadf9636ee0b31ed057300ac60a447c722e33e4f3f7354ad494539c894af4a04d6c16a3fecc8a1e689ae2db26ca49f1a6d2b0f1e05b7d0c1fdc6a35e9dd39b7fa53c5370ee97b900500ee0f0eae88573899405cc2360bb786d4569ba6068d838549d6d9f7b36a5d94ce88e47019089f191a6352070dafc50ae57954e8b3ac06ea889b82a0127949a01136615db3167ba1c954e7fb2e404461f1efce54f27fb1aa269f7084b26413a8fc0c8a881fa0002bdd3e14d3397c7303c191613a26a48fdc1535a710f53fb7d76ae292ccc0d3fb1c31e1397d3322c9aaf53f630f16e4e53071f8530e452429c7fcc67340ce444ba09081bdbd40d89c2f1e0af858b13296ae6ba16c7db19d7f21eac33873f2676de7647ef8d7d3b1d843fb6c263acb1099b6fe306a449ba3776032bbfcdb43064b6f702c7dfaf08cb824f579326ce68e96dd3f8ed91f90c715eaa700f6aca967b1d35b948919ee543914d0a01e80c6f4a9b201ca98042d77e52007c5834cacccea5f0c47d8c2e368ff0afefddea9fd2ccdbb2747c1eea56224b519ce8f73a0e1de510556536af3c3912235ad39d22888dcb9a35328df6ccce7eafce71e9ede1e94983a2f3b0095e5b75fd0a0fb3ef8770ea23a2f227b2a9bba296c8b782dfdc46cdca072807cb452710e2c81233337dc65fd093dbe20249ddf2720f62b931a4b9982442fa91f6ae2139819c5a973f032df6b0948f31654fcbec16d701d9f289a44fd2b5627738a14910243d7d2b0e8121538526873f384f236cdcecffdab6313c6af63a155e4830d7230e3b19b07768a5fe25d6d39bbc0e2ce3780462312e0603fb5e6d57b1f022a1503eaa554f66bd9d55fccbe0369cd0d249145da6629c54367d8e6e5be8f3a774b7974a34fcd414d195776b045a54d02d19aecda23a9f2efd39f6b18271c6bb282011f4fb76dac57dc32173d653ce684c9911044bbe85a7fc075f900165eeb2452bc40988d252b61a4de6e1327ef6af37985e8b5101447979029058d372f2bf0a6a0a3c0742cd904aef478231293f6fdf282448ddfd649b37e2f51f138ed6168ffd117ee4a1d12ccf5c021b5b45c837e8a10a4a44ec814f15dbda91e1c2d92c8ff7f52cfab4444b7775932d2661cb341ecfbe4d6a49383e42f461a8ce6a7164e9d2b0d31df1390484438a8b6af9a08acd46ef756f2694bc22bf0631b2b7a935d11ed41789fd445760fab5652522cbc824b00c62319465dd8c139dec496d71ba65020fd6b1531395efa660850295932b1d87e34707f92d38dbc8983f4aa36320627c7141e46093888cd122d4537b7e4819c2a0116fb60d45e2b37c6a057549120999a322fc582dd0432c140910443d6d0455a81c3e53af116c1b12547d60a586afd7782c75e0e411453b770c77bdc924fa5bf6e3334150eb855b44bcb8d0656871f272f7e60085f266d21827ad0a5b94953fcb8368c283ca66430f05db54a413ade5bb0a0e2473f229498eccb9a46c94df26c0bcbfca809b09418cbb34f1b6e244f187d0709dc70e9e23983d8ac0a44f675bd2138c5fa5f2aca896752d51a7c1c45ee34a0cae39b2b2d353957328076511e7f5d5f18c76e89743a017dc5dd414d848fd799d30258721113a251b81bc952741ff0fa177845ff0e5d085e35ac67a5e2bb30d077f51d326f1af7bdaf6b18003da70d3731276a773eb3e8a96439e2f98487cf550c663aaabdf7f6ca0a2462b6b1de7499588ac545dc19a6fe213eba224ab9fed19126870b6d38616bec240d2905ea51a67051fe15b4", 0xfc0}], 0x1}, 0x20000000) ioctl$BLKIOOPT(0xffffffffffffffff, 0x1279, 0x0) setsockopt$bt_BT_RCVMTU(r3, 0x112, 0xd, &(0x7f0000000040)=0x7, 0x2) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000340)={0x0, @in={{0x2, 0x0, @multicast1}}, 0x7ff, 0x7ff}, 0x0) ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000080)) socketpair(0x0, 0x0, 0x7, 0x0) write(r2, &(0x7f0000000080)="7bbcf2", 0x3) [ 967.350363][T12196] binder_release_work: 46 callbacks suppressed [ 967.350372][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 967.389247][T12196] binder: unexpected work type, 4, not freed [ 967.430813][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:45 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x6c000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:45 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8c, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 967.471024][T12196] binder: unexpected work type, 4, not freed [ 967.609747][T23991] binder: 23984:23991 BC_INCREFS_DONE node 2583 has no pending increfs request [ 967.638986][T23995] binder: 23987:23995 BC_INCREFS_DONE u0000000000000000 node 2586 cookie mismatch 3f00000000000000 != 0000000000000000 [ 967.666897][T23991] binder: 23984:23991 BC_INCREFS_DONE node 2589 has no pending increfs request [ 967.677113][T23995] binder: 23987:23995 unknown command 0 [ 967.684208][T12196] binder: unexpected work type, 4, not freed [ 967.691953][T12196] binder: unexpected work type, 4, not freed [ 967.724975][T23995] binder: 23987:23995 ioctl c0306201 200002c0 returned -22 09:17:45 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 967.782942][T23995] binder_alloc: 23808: binder_alloc_buf, no vma [ 967.783181][T12196] binder: send failed reply for transaction 2576, target dead [ 967.819643][T24032] binder: 23987:24032 unknown command 0 09:17:45 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x74000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 967.842561][T24032] binder: 23987:24032 ioctl c0306201 200002c0 returned -22 [ 967.882462][T12196] binder: send failed reply for transaction 2579, target dead [ 967.902398][T12196] binder: send failed reply for transaction 2582, target dead [ 967.906290][T23995] binder: 23987:23995 transaction failed 29189/-3, size 24-8 line 3147 [ 967.920290][T12196] binder: send failed reply for transaction 2585 to 23987:23995 [ 967.928383][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 967.965077][T24036] binder: 24034:24036 ioctl c018620b 0 returned -14 [ 967.974292][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:46 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x2, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 968.037926][T24038] binder: 24037:24038 BC_INCREFS_DONE node 2594 has no pending increfs request [ 968.054880][T24036] binder: 24034:24036 ioctl c0306201 0 returned -14 09:17:46 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) [ 968.096912][T24038] binder: 24037:24038 BC_INCREFS_DONE node 2597 has no pending increfs request [ 968.149318][T12196] binder: unexpected work type, 4, not freed [ 968.160744][T12196] binder: unexpected work type, 4, not freed 09:17:46 executing program 4: mount(0x0, 0x0, &(0x7f0000000080)='ramfs\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) kexec_load(0x0, 0x0, 0x0, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0xffffffffffffffd3) r0 = syz_open_dev$admmidi(&(0x7f00000001c0)='/dev/admmidi#\x00', 0x101, 0x2000) getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, &(0x7f0000000200), &(0x7f0000000240)=0x40) r1 = syz_open_dev$video(&(0x7f00000000c0)='/dev/video#\x00', 0x3, 0x0) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f0000000680)={0x1, @win={{0x0, 0x0, 0x34343459}, 0x0, 0x0, 0x0, 0x0, 0x0}}) rt_tgsigqueueinfo(0x0, 0x0, 0x16, 0x0) wait4(0x0, 0x0, 0x0, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_sctp_SCTP_RECVRCVINFO(r2, 0x84, 0x20, &(0x7f0000000280)=0xffffffffffffffff, 0x4) write$P9_RLERRORu(0xffffffffffffffff, &(0x7f0000000240)=ANY=[], 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvfrom(r2, &(0x7f0000000100)=""/144, 0x90, 0x40000000, &(0x7f0000000000)=@in6={0xa, 0x4e22, 0x100000001, @mcast1, 0x983}, 0x80) [ 968.199283][T24069] binder: 24068:24069 unknown command 16400 [ 968.227792][T24069] binder: 24068:24069 ioctl c0306201 200002c0 returned -22 09:17:46 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x7a000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 968.262564][T24122] binder: 24068:24122 unknown command 16400 09:17:46 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8c, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 968.303888][T24122] binder: 24068:24122 ioctl c0306201 200002c0 returned -22 [ 968.396176][T24155] binder: 24153:24155 BC_INCREFS_DONE node 2606 has no pending increfs request [ 968.404714][ T7897] binder: unexpected work type, 4, not freed [ 968.411363][ T7897] binder: unexpected work type, 4, not freed 09:17:46 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x3, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 968.480167][T24155] binder: 24153:24155 BC_INCREFS_DONE node 2609 has no pending increfs request [ 968.504070][T24157] binder: 24156:24157 BC_INCREFS_DONE u0000000000000000 node 2612 cookie mismatch 3f00000000000000 != 0000000000000000 [ 968.584114][T12196] binder: unexpected work type, 4, not freed [ 968.587878][T24157] binder: 24156:24157 unknown command 0 [ 968.592328][T12196] binder: unexpected work type, 4, not freed [ 968.631267][T24157] binder: 24156:24157 ioctl c0306201 200002c0 returned -22 [ 968.646961][T24161] binder: 24160:24161 unknown command 64 [ 968.653085][T24161] binder: 24160:24161 ioctl c0306201 200002c0 returned -22 09:17:46 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:46 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x100000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 968.677467][ T7897] binder: send failed reply for transaction 2611 to 24156:24157 [ 968.687348][ T7897] binder: send failed reply for transaction 2614 to 24160:24161 [ 968.762226][T24198] binder: 24160:24198 transaction failed 29189/-22, size 24-8 line 2994 [ 968.781138][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 968.801592][T24210] binder: 24160:24210 unknown command 64 [ 968.816423][T24225] binder: 24195:24225 transaction failed 29189/-22, size 24-8 line 2994 [ 968.829723][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 968.844802][T24210] binder: 24160:24210 ioctl c0306201 200002c0 returned -22 09:17:47 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x2, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 968.872017][T24260] binder_thread_write: 1 callbacks suppressed [ 968.872029][T24260] binder: 24195:24260 BC_INCREFS_DONE u0000000000000000 no match [ 968.891930][T24239] binder: 24234:24239 ioctl c018620b 0 returned -14 [ 968.903409][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:47 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x4, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 968.931742][T24239] binder: 24234 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 968.931826][T24239] binder: 24234:24239 ioctl c018620c 20000440 returned -22 [ 968.957299][T24225] binder: 24195:24225 BC_INCREFS_DONE node 2621 has no pending increfs request [ 968.973170][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 968.991745][ T7897] binder: unexpected work type, 4, not freed 09:17:47 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x200000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:47 executing program 0: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) [ 969.063350][T24276] binder: 24275:24276 unknown command 16400 [ 969.122948][T24276] binder: 24275:24276 ioctl c0306201 200002c0 returned -22 [ 969.136633][T24308] binder: 24277:24308 unknown command 0 [ 969.143068][T24308] binder: 24277:24308 ioctl c0306201 200002c0 returned -22 09:17:47 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x3, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 969.177311][T24372] binder: 24362:24372 BC_INCREFS_DONE node 2630 has no pending increfs request [ 969.237256][T24387] binder: 24277:24387 unknown command 0 [ 969.246469][ T7897] binder: unexpected work type, 4, not freed [ 969.265941][T24387] binder: 24277:24387 ioctl c0306201 200002c0 returned -22 09:17:47 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:47 executing program 0: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) [ 969.280601][ T7897] binder: send failed reply for transaction 2626 to 24277:24308 [ 969.290123][T24388] binder: 24362:24388 transaction failed 29189/-22, size 24-8 line 2994 [ 969.296504][T24391] binder: 24390:24391 transaction failed 29189/-22, size 24-8 line 2994 [ 969.310730][ T7897] binder: send failed reply for transaction 2629 to 24362:24372 09:17:47 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x8c, 0x0, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 969.340903][T24372] binder: 24362:24372 BC_INCREFS_DONE u0000000000000000 no match [ 969.352363][ T7897] binder: send failed reply for transaction 2632 to 24277:24308 [ 969.378755][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:47 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x5, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 969.406982][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:47 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x300000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 969.449437][T24398] binder: 24397:24398 ioctl c018620b 0 returned -14 [ 969.471391][T24414] binder: 24411:24414 transaction failed 29189/-22, size 24-8 line 2994 09:17:47 executing program 0: setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) [ 969.498887][T24398] binder: 24397:24398 ioctl c0306201 0 returned -14 [ 969.548004][T24435] binder: 24427:24435 unknown command 0 [ 969.570166][T24435] binder: 24427:24435 ioctl c0306201 200002c0 returned -22 09:17:47 executing program 5: clock_gettime(0x0, &(0x7f0000feb000)={0x0}) r1 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x1, 0x2) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) setitimer(0x0, &(0x7f00003f8000)={{}, {r0, 0x2710}}, 0x0) alarm(0x0) [ 969.626214][ T7897] binder: unexpected work type, 4, not freed [ 969.635256][ T7897] binder: unexpected work type, 4, not freed 09:17:47 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) [ 969.672434][T24570] binder: 24427:24570 unknown command 0 [ 969.715962][T24570] binder: 24427:24570 ioctl c0306201 200002c0 returned -22 09:17:47 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x400000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 969.771660][T12196] binder: unexpected work type, 4, not freed [ 969.780441][T12196] binder: unexpected work type, 4, not freed 09:17:47 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:47 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x3, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:47 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x6, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:48 executing program 5: openat$uinput(0xffffffffffffff9c, &(0x7f0000000100)='/dev/uinput\x00', 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000872936)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fgetxattr(r0, &(0x7f0000000040)=@random={'trusted.', '/dev/userio\x00'}, &(0x7f0000000380)=""/4096, 0x1000) pipe(&(0x7f0000000340)) socket$inet6_udp(0xa, 0x2, 0x0) openat$userio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/userio\x00', 0x0, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200), 0x0) [ 969.875702][T24624] binder_alloc: 24397: binder_alloc_buf, no vma [ 969.945537][T24624] binder: 24623:24624 transaction failed 29189/-3, size 24-8 line 3147 [ 969.979597][T24630] binder: 24629:24630 ioctl c018620b 0 returned -14 [ 970.003256][T24632] binder: 24623:24632 BC_INCREFS_DONE u0000000000000000 no match [ 970.017967][T24634] binder: 24633:24634 transaction failed 29189/-22, size 24-8 line 2994 09:17:48 executing program 5: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=ANY=[@ANYBLOB="18000000160003000000ca5b000b00000a4200ba4e155123ba1395d11399ca0dc0e38da7047b845dfe13e39d87f788db921a9299d94f546237cefe24a058deae743de7c4a1e3beb338007dfd8fd2e21d711a3164311e4c6de0337a7f7705f2f890470d9228e1c3cd881b848e9425b5b4848f873571b3fbab279eb91ef419316fca37ffa10454ac8d04dcd3755cbf3b831341096b35ab390ebf0424644b768e0187e4098c99b319eba952dce309e1b905412ccfb96e24a5cc2ad85bf97da790bb94a6cee59d8eab6c65e05557fc8f692d76396495b8e78b8bee298f316bfbc3b7701872e9a3207560213d16b3e7638814d567d9a4b40bac7d2caf90ca943b82925c74faadfefe24257741f460b4b577ab1642212dbaf341db74b9b66abdb256fdf6b0aeedf546fa09a925bb48aede1970b3f69744064e5e1b6b7e9e609c068e14227684658dbc8452c70f6753e5681d0629caa26b02f85699fa7ec2ac4d710b6618e302496ecbdf31451d3a34039b714db95ea4a786e43a1644be17dac01ded36eda5863dc7f8b37218e3dcfe0b1f09386178", @ANYRES32=0x0], 0x18}}, 0x0) 09:17:48 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000002c0)={'\x05\x00', 0x6}) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=0x0) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0xffffffe9, &(0x7f0000000100)={0x200}) openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x28000, 0x0) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) [ 970.054340][T24640] binder: 24633:24640 unknown command 0 [ 970.066392][T24624] binder: 24623:24624 BC_INCREFS_DONE u0000000000000000 no match [ 970.070099][T24640] binder: 24633:24640 ioctl c0306201 200002c0 returned -22 09:17:48 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x500000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:48 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x7, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:48 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306202, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:48 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x400000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 970.274511][T24753] binder: 24750:24753 BC_INCREFS_DONE u0000000000000000 no match [ 970.322163][T24799] binder: 24756:24799 unknown command 0 [ 970.364767][T24799] binder: 24756:24799 ioctl c0306201 200002c0 returned -22 [ 970.441029][T24861] binder: 24860:24861 ioctl c018620b 0 returned -14 [ 970.468913][T24861] binder: 24860:24861 ioctl c0306202 20000440 returned -22 [ 970.511694][T24861] binder: 24860:24861 ioctl c0306201 0 returned -14 09:17:48 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:48 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x600000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:48 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x10, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:48 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0//ile0\x00', 0x0) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) r2 = socket$inet6(0xa, 0x5, 0x1) bind$inet6(r2, &(0x7f00000007c0)={0xa, 0x4e20}, 0x1c) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r2, 0x6) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f0000000400)={'icmp6\x00'}, &(0x7f0000000480)=0x1e) setsockopt(r3, 0x10d, 0x800000000f, &(0x7f0000000040)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, 0x0) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f00000001c0)="313224b9d2a61316f0684eb502f787f5be0cd4bf4059f6154613c6634c7312bcd90fa466ecb84d988d0fb1bb53e1885cf029ac767dfe9897dfdd7ade5bc0b37283d6b08a5c5a88b358804e48e0419c34139f66a237e6b1840e06c231ac21683baa3df79e5585aa176c1c7aed5d7f97c96933c48b8290db180fe29c40005c526992f90cf65297322134eae4e02c9f0ebfcc31d757f02a14802404ecca2696a6a628afffa87de2c9d34239df761d17416d03747d14fd448d1c6e546c07ba3a514e9378c47ce1e386e27640664250837d2d5b6ad7f1c3a2eabbde85aae26a8622850c131508fc3e340ef98285ba7f36e7e59bec9de3e53880", 0xf7, r4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, &(0x7f0000000600)) preadv(r3, &(0x7f0000002c00), 0x4, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x20) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) rmdir(&(0x7f0000000340)='./file0//ile0\x00') mount(&(0x7f0000000800)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYPTR, @ANYRES16], 0x0, 0x0, 0x20000, 0x0) syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000003c0)={0x3}, 0x4) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x4f92) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a45352, &(0x7f00000008c0)={{}, 'port1\x00', 0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x1, 0x8000}) 09:17:48 executing program 4: r0 = memfd_create(&(0x7f00000000c0)='/dev/input/event#\x00', 0x1) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) mount(&(0x7f0000000040)=@loop={'/dev/loop', 0x0}, &(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='sysfs\x00', 0x1000d2, &(0x7f0000000140)='\xccselinux\x00') 09:17:48 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 970.653285][T24971] binder_alloc: 24860: binder_alloc_buf failed to map pages in userspace, no vma [ 970.691964][T24967] binder_alloc: 24860: binder_alloc_buf, no vma [ 970.700791][T24980] binder: 24969:24980 BC_INCREFS_DONE u0000000000000000 no match [ 970.728337][T24982] binder: 24966:24982 unknown command 1056964608 [ 970.750835][T24971] binder: 24969:24971 BC_INCREFS_DONE u0000000000000000 no match [ 970.771718][T24982] binder: 24966:24982 ioctl c0306201 200002c0 returned -22 [ 970.829594][T24988] binder: 24986:24988 ioctl c018620b 0 returned -14 [ 970.862895][T24988] binder: 24986:24988 ioctl c0306203 20000440 returned -22 09:17:48 executing program 4: socketpair$unix(0x1, 0x200000001, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x407}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:49 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x700000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 970.881608][T24988] binder: 24986:24988 ioctl c0306201 0 returned -14 09:17:49 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x48, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:49 executing program 4: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xf7fffffffe000005, 0x0, 0x18, 0x0, 0x10, 0x5}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 971.080088][ T7897] binder_thread_release: 17 callbacks suppressed [ 971.080100][ T7897] binder: release 25064:25077 transaction 2667 out, still active 09:17:49 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x4c, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:49 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x2, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 971.156192][ T7897] binder: unexpected work type, 4, not freed [ 971.185556][ T7897] binder_release_work: 25 callbacks suppressed [ 971.185561][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 971.249770][ T7897] binder_send_failed_reply: 13 callbacks suppressed [ 971.249778][ T7897] binder: send failed reply for transaction 2667, target dead [ 971.334968][T25120] binder: 25119:25120 ioctl c018620b 0 returned -14 [ 971.353956][ T7897] binder: send failed reply for transaction 2670 to 25064:25095 [ 971.369423][ T7897] binder: send failed reply for transaction 2673 to 25059:25069 [ 971.386936][T25120] binder: 25119:25120 unknown command 16448 [ 971.405549][T25120] binder: 25119:25120 ioctl c0306201 20000440 returned -22 [ 971.410554][ T7897] binder: send failed reply for transaction 2676 to 25059:25069 [ 971.428216][T25120] binder: 25119:25120 ioctl c0306201 0 returned -14 09:17:49 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:49 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0xa00000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:49 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x5, 0x8, 0x2}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:49 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x60, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:49 executing program 5: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x200000d15, 0x0, 0x0, 0x0, 0x40, 0x7fff, 0xfffffffffffffbf4}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 971.432121][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 971.441083][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 971.464172][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:17:49 executing program 5: socketpair$unix(0x1, 0x80000000000003, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5be1005e57c3c3e2c9b7d991f347f54a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") [ 971.560931][ T7897] binder: release 25152:25158 transaction 2682 out, still active [ 971.577947][ T7897] binder: unexpected work type, 4, not freed 09:17:49 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x1000000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:49 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x0, 0x14, 0x0, 0x0, 0x0, 0x8}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0df3e1005e57c3c3e2c9b7d991734e424a2664f0ff064a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") 09:17:49 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x68, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 971.614045][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 971.634380][ T7897] binder: release 25155:25196 transaction 2691 out, still active [ 971.701977][ T7897] binder: unexpected work type, 4, not freed [ 971.761114][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 971.801305][T25253] binder_thread_write: 6 callbacks suppressed 09:17:49 executing program 5: socketpair$unix(0x1, 0x10000000002, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000000)="c17f4ca43eff00a1274b30291aca5405f7b9", 0x12}, 0x68) [ 971.801317][T25253] binder: 25252:25253 BC_INCREFS_DONE node 2695 has no pending increfs request [ 971.809295][ T7897] binder: release 25155:25156 transaction 2685 out, still active 09:17:49 executing program 4: socketpair$unix(0x1, 0x40000000002, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x0, 0x10, 0x0, 0x0, 0x2, 0x200101}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0df3e1005e57c3c3e2c9b7d991734e424a2664f0ff064a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") 09:17:50 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x8, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 971.948831][ T7897] binder: unexpected work type, 4, not freed [ 971.996884][T25260] binder_alloc: 25119: binder_alloc_buf, no vma [ 972.005387][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 972.022078][ T7897] binder: send failed reply for transaction 2682, target dead [ 972.044771][T25253] binder: 25252:25253 BC_INCREFS_DONE u0000000000000000 no match [ 972.057255][ T7897] binder: send failed reply for transaction 2685, target dead [ 972.098053][ T7897] binder: send failed reply for transaction 2688 to 25152:25190 [ 972.121008][T25270] binder: 25269:25270 ioctl c018620b 0 returned -14 [ 972.139806][ T7897] binder: send failed reply for transaction 2691, target dead [ 972.160973][T25270] binder: 25269:25270 unknown command 0 [ 972.176441][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 972.197080][T25270] binder: 25269:25270 ioctl c0306201 20000440 returned -22 [ 972.206902][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 972.222794][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:17:50 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:50 executing program 5: socketpair$unix(0x1, 0x10000000002, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000000)="c17f4ca43eff00a1274b30291aca5405f7b9ed4f4d502f", 0x17}, 0x68) 09:17:50 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x0, 0x1a, 0x0, 0xfffffffffffffffd, 0x0, 0x81}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:50 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x6c, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:50 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x3f00000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:50 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x12, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:50 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x3, 0x0, 0x0, 0xd9, 0x5, 0xfffffffffffffefd, 0xfffffffffffffffd}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 972.455004][T25384] binder_transaction: 15 callbacks suppressed [ 972.455027][T25384] binder: 25382:25384 transaction failed 29189/-22, size 24-8 line 2994 [ 972.484133][T25385] binder: 25381:25385 transaction failed 29189/-22, size 24-8 line 2994 [ 972.504514][T25387] binder: 25382:25387 transaction failed 29189/-22, size 24-8 line 2994 [ 972.507614][T25380] binder: 25379:25380 ioctl c018620b 0 returned -14 [ 972.523402][T25384] binder: 25382:25384 BC_INCREFS_DONE u0000000000000000 no match [ 972.543396][ T7897] binder_release_work: 28 callbacks suppressed 09:17:50 executing program 5: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x148a, 0x7fff, 0x2}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) ioctl$TIOCLINUX4(0xffffffffffffffff, 0x541c, 0x0) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 972.543404][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 972.589550][T25385] binder: 25381:25385 transaction failed 29189/-22, size 24-8 line 2994 [ 972.610908][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:50 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x4800000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:50 executing program 4: socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_BPF(0xffffffffffffffff, 0x40042408, 0xffffffffffffffff) mkdir(0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000140)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x06\x00\xdc\r') openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8914, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x03N\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') 09:17:50 executing program 5: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f0000000000)="2400000052001f001515f407000904ff02000722070001", 0x17) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 972.640757][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:50 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x74, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 972.705818][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 972.832126][T25510] binder: 25507:25510 transaction failed 29189/-22, size 24-8 line 2994 [ 972.849245][T25509] binder: 25508:25509 transaction failed 29189/-22, size 24-8 line 2994 [ 972.870147][T25538] binder: 25507:25538 transaction failed 29189/-22, size 24-8 line 2994 [ 972.902259][T25509] binder: 25508:25509 transaction failed 29189/-22, size 24-8 line 2994 [ 972.904256][T25510] binder: 25507:25510 BC_INCREFS_DONE u0000000000000000 no match [ 972.921949][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 972.931565][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 972.959685][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 972.988084][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:51 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:51 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x1200, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:51 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = dup(r0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:51 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x4c00000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:51 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x7a, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:51 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x0, 0x1, 0x0, 0x0, 0x80, 0x3c5}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xa, 0x0, 0x9, 0x40, 0x0, 0x0, 0x4}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0df3e1005e57c3c3e2c9b7d991734e424a2664f0ff064a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") [ 973.411529][T25625] binder: 25623:25625 transaction failed 29189/-22, size 24-8 line 2994 [ 973.420085][T25622] binder: 25621:25622 transaction failed 29189/-22, size 24-8 line 2994 09:17:51 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x0, 0x3, 0x0, 0x0, 0x81}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 973.466665][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 973.468221][T25626] binder: 25624:25626 ioctl c018620b 0 returned -14 [ 973.494464][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:17:51 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x300, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:51 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x6800000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:51 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x3, 0x0, 0x0, 0xd9, 0x3, 0xfffffffffffffefd}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:51 executing program 5: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) ioctl$FS_IOC_FIEMAP(0xffffffffffffffff, 0xc020660b, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) ioctl$sock_SIOCOUTQ(0xffffffffffffffff, 0x5411, 0x0) getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, 0x0, 0x0) getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) 09:17:52 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:52 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x2000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:52 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x500, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:52 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x6c00000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:52 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000023c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0df3e1005e57c3c3e2c9b7d991734e424a2664f0ff064a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x8, 0x0, 0x15, 0x0, 0x0, 0x8, 0xffff}) 09:17:52 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xa9f, 0x0, 0x0, 0x0, 0x5, 0x9ccf, 0x3823}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 974.329121][T25765] binder_thread_write: 2 callbacks suppressed [ 974.329134][T25765] binder: 25764:25765 BC_INCREFS_DONE u0000000000000000 no match 09:17:52 executing program 5: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xfffffffffe000005, 0x0, 0x0, 0x8, 0x0, 0x4, 0xfffffffffffffffd}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:52 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xa9f, 0x0, 0xf, 0x0, 0x5, 0x0, 0x3823}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:52 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x7400000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 974.373214][T25767] binder: 25766:25767 ioctl c018620b 0 returned -14 [ 974.406438][T25767] binder: 25766:25767 ioctl c0306201 0 returned -14 09:17:52 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x600, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:52 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xa9c, 0x0, 0x0, 0x0, 0x2, 0x9ccf, 0x3823}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 974.549880][T25878] binder: 25872:25878 BC_INCREFS_DONE node 2727 has no pending increfs request 09:17:52 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xa9f, 0x0, 0xf, 0x0, 0x5, 0x9ccf}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 974.605259][T25894] binder: 25872:25894 BC_INCREFS_DONE node 2731 has no pending increfs request [ 974.633366][ T7897] binder_send_failed_reply: 3 callbacks suppressed [ 974.633376][ T7897] binder: send failed reply for transaction 2726 to 25872:25878 [ 974.698415][ T7897] binder: send failed reply for transaction 2730 to 25872:25895 [ 974.725809][ T7897] binder: send failed reply for transaction 2729 to 25891:25892 [ 974.741897][ T7897] binder: send failed reply for transaction 2735 to 25891:25897 09:17:53 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:53 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x3f00, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:53 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x700, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:53 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x7a00000000000000, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xa, 0x0, 0x0, 0x40, 0x0, 0x40, 0x4}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0df3e1005e57c3c3e2c9b7d991734e424a2664f0ff064a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") 09:17:53 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x9ccf, 0x5d5f}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:53 executing program 5: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xa, 0x0, 0x9, 0x0, 0x0, 0x40, 0x4}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0df3e1005e57c3c3e2c9b7d991734e424a2664f0ff064a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") [ 975.246539][T25917] binder: 25915:25917 BC_INCREFS_DONE u0000000000000000 no match [ 975.280658][T25916] binder: 25914:25916 ioctl c018620b 0 returned -14 09:17:53 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x9, 0x9ccf, 0x5d5f}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:53 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x2000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 975.334434][T25916] binder: 25914:25916 ioctl c0306201 0 returned -14 09:17:53 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r1, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, r1, 0x0, 0xd, &(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff}, 0x30) sendmsg$nl_netfilter(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0xc2021000}, 0xc, &(0x7f0000000180)={&(0x7f0000000480)={0xb0, 0xe, 0xb, 0x804, 0x70bd25, 0x25dfdbfe, {0x7, 0x0, 0x6}, [@typed={0x8, 0x31, @pid=r2}, @nested={0x94, 0x65, [@generic="21c76f45ba644dd8bc35953a92b312e93068ba7fd68d49ea73601f32ef4b1be25ba09a80038017ae5ee94db04acb2c", @generic="14eaed8e48f94ea2cacccbbf659678cb11c130e574fe852dce4056c54dd8583b4cfbfb9742c5294cb6678b0cbb06ad6c45f21058b869b96e9cfb7b70345c288e7a81486908fb6adfbe3d2138a7a79187a6d4b4d7ab6f096c28e8b43a5816d390"]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000040) r3 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000080)) ioctl$TIOCGPTPEER(r3, 0x5441, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)=ANY=[], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:53 executing program 5: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(0xffffffffffffffff, &(0x7f0000000000)="2400000052001f001515f407000904ff0200072207", 0x15) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:53 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000300)=ANY=[@ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 975.568939][T12196] binder: release 26005:26006 transaction 2743 out, still active [ 975.585604][T12196] binder: unexpected work type, 4, not freed [ 975.614114][T12196] binder: release 26005:26006 transaction 2746 out, still active [ 975.615640][T26047] binder: 26045:26047 unknown command 536871488 [ 975.646344][T12196] binder: unexpected work type, 4, not freed [ 975.677063][T12196] binder: send failed reply for transaction 2743, target dead [ 975.696337][T26047] binder: 26045:26047 ioctl c0306201 20000440 returned -22 [ 975.719582][T12196] binder: send failed reply for transaction 2746, target dead [ 975.748508][T12196] binder: send failed reply for transaction 2749 to 26026:26038 [ 975.756887][T12196] binder: send failed reply for transaction 2752 to 26026:26038 09:17:54 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:54 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r1, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$int_out(r0, 0x2, &(0x7f0000000040)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:54 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x1000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:54 executing program 5: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2800000008000fb}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:54 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x3f00, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:54 executing program 4: r0 = socket$kcm(0x10, 0x1000000000000002, 0x0) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000015c0)=[{&(0x7f0000000100)="2300000052008152915a655067d7aee4050c0000136017edcaa30000000000008b1832", 0x23}], 0x1}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000a40)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000140)={'nr\x00\x00\x00\x01.\x00N\x97\x81\x00\x00\x00\x02\x00', 0x213}) recvmsg$kcm(r0, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) [ 976.139160][T26156] binder: 26155:26156 ioctl c018620b 0 returned -14 [ 976.151382][T26166] binder: 26162:26166 BC_INCREFS_DONE u0000000000000000 no match 09:17:54 executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x2, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffffffffffefd}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:54 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x4800, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 976.180907][T26156] binder: 26155:26156 ioctl c0306201 0 returned -14 09:17:54 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) pause() r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) mprotect(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) setsockopt$inet_tcp_TCP_QUEUE_SEQ(r1, 0x6, 0x15, &(0x7f0000000040), 0x4) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x3, 0x40) 09:17:54 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xa9c, 0x0, 0x0, 0x0, 0x2, 0x9ccf}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:54 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x2000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 976.377374][T26339] binder_alloc: 26155: binder_alloc_buf failed to map pages in userspace, no vma [ 976.410419][T26380] binder_alloc: 26155: binder_alloc_buf failed to map pages in userspace, no vma 09:17:54 executing program 5: socketpair$unix(0x1, 0x10000000002, 0x0, &(0x7f0000000240)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffb000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, &(0x7f0000000000)="c17f4ca43eff00a1274b30291aca5405f7b9ed4f4d", 0x15}, 0x68) [ 976.445693][T26384] binder_alloc: 26155: binder_alloc_buf, no vma [ 976.559940][T26392] binder: 26390:26392 ioctl c018620b 0 returned -14 [ 976.598022][T26392] binder: 26390:26392 ioctl c0306201 0 returned -14 09:17:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, 0x0, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:55 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x40007, 0x0, 0x0, 0xe30, 0x60b, 0xfffffffffffffffc, 0xfffffffffffffffd}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="0fe2f05e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:55 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x4c00, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:55 executing program 5: bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="0c00006e00f2ff00002d99634222bc5c914a08"], 0x0, 0x13}, 0x20) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000001440)={0xffffffffffffffff}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5be1005e57c3c3e2c9b7d991f347f54a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") 09:17:55 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x8000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:55 executing program 5: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x400000000000000f, 0x4, &(0x7f0000519fa8)=@framed={{}, [@ldst={0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}]}, &(0x7f0000000000)='G.\xdd:@\x83\xb90PL\x00', 0x8000, 0x1000, &(0x7f000062b000)=""/4096}, 0x48) 09:17:55 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x6000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:55 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x52d0c66c}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0df3e1005e57c3c3e2c9b7d991734e424a2664f0ff064a460f3038082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754e50c420fae9972b571112d02") [ 977.038763][T26502] binder: 26500:26502 ioctl c018620b 0 returned -14 [ 977.105569][T26502] binder: 26500:26502 ioctl c0306201 0 returned -14 [ 977.155003][T26526] binder: 26325:26526 BC_INCREFS_DONE node 2771 has no pending increfs request [ 977.174689][T12196] binder: release 26514:26518 transaction 2767 out, still active [ 977.183056][T12196] binder: unexpected work type, 4, not freed [ 977.183070][T12196] binder_release_work: 9 callbacks suppressed [ 977.183074][T12196] binder: undelivered TRANSACTION_COMPLETE 09:17:55 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xfffffffffffffffc, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="305c6e9c2e98871dd33b3450a8a87107ae5444e68bb94bf20955", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:55 executing program 5: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x5, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x80}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:55 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x9, 0x0, 0x0, 0x9, 0x3, 0x2000000000003e}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") 09:17:55 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x6800, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 977.259912][T12196] binder: release 26325:26526 transaction 2770 out, still active [ 977.325057][T12196] binder: unexpected work type, 4, not freed [ 977.331169][T12196] binder: undelivered TRANSACTION_COMPLETE [ 977.388800][T12196] binder: send failed reply for transaction 2767, target dead [ 977.421283][T12196] binder: send failed reply for transaction 2770, target dead [ 977.431874][T26638] binder: 26633:26638 unknown command -1670489040 [ 977.451158][T12196] binder: send failed reply for transaction 2773 to 26514:26518 [ 977.469420][T26638] binder: 26633:26638 ioctl c0306201 200002c0 returned -22 [ 977.474136][T12196] binder: undelivered TRANSACTION_COMPLETE 09:17:55 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180), 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:55 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x12000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:55 executing program 5: 09:17:55 executing program 4: 09:17:55 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x6c00, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:55 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:55 executing program 4: 09:17:55 executing program 5: [ 977.859936][T26648] binder_transaction: 27 callbacks suppressed [ 977.859955][T26648] binder: 26645:26648 transaction failed 29189/-22, size 24-8 line 2994 [ 977.939486][T26651] binder: 26650:26651 transaction failed 29189/-22, size 24-8 line 2994 [ 977.976184][T26655] binder: 26654:26655 ioctl c018620b 0 returned -14 09:17:56 executing program 4: 09:17:56 executing program 5: [ 977.990291][T26655] binder: 26654:26655 ioctl c0306201 0 returned -14 [ 978.000175][T26662] binder: 26645:26662 transaction failed 29189/-22, size 24-8 line 2994 [ 978.029107][T12196] binder_release_work: 34 callbacks suppressed [ 978.029114][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.054903][T12196] binder: release 26650:26661 transaction 2784 out, still active [ 978.073869][T26648] binder: 26645:26648 BC_INCREFS_DONE u0000000000000000 no match [ 978.094114][T12196] binder: unexpected work type, 4, not freed [ 978.124523][T12196] binder: undelivered TRANSACTION_COMPLETE 09:17:56 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x7400, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:56 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r1, 0x84, 0x65, &(0x7f0000000040)=[@in={0x2, 0x4e24, @rand_addr=0x5}], 0x10) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 978.154550][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.174408][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.255890][T26773] binder: 26772:26773 BC_INCREFS_DONE node 2788 has no pending increfs request [ 978.286557][T12196] binder: send failed reply for transaction 2784, target dead [ 978.301986][T12196] binder: send failed reply for transaction 2787 to 26772:26773 [ 978.303366][T26777] binder: 26772:26777 transaction failed 29189/-22, size 24-8 line 2994 [ 978.329118][T26776] binder: 26775:26776 transaction failed 29189/-22, size 24-8 line 2994 [ 978.329589][T26778] binder: 26772:26778 BC_INCREFS_DONE u0000000000000000 no match [ 978.346141][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 978.352093][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.374446][T26780] binder: 26775:26780 transaction failed 29189/-22, size 24-8 line 2994 [ 978.375952][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.400372][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.413529][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:56 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180), 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:56 executing program 5: 09:17:56 executing program 4: 09:17:56 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x20000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:56 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r1, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000040)=0x0) ioprio_get$pid(0x2, r3) 09:17:56 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x7a00, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:56 executing program 5: 09:17:56 executing program 4: [ 978.714852][T26788] binder: 26787:26788 transaction failed 29189/-22, size 24-8 line 2994 [ 978.766054][T26786] binder: 26784:26786 transaction failed 29189/-22, size 24-8 line 2994 [ 978.789319][T26792] binder: 26790:26792 ioctl c018620b 0 returned -14 09:17:56 executing program 4: [ 978.826374][T26799] binder: 26787:26799 transaction failed 29189/-22, size 24-8 line 2994 [ 978.836529][T26792] binder: 26790:26792 ioctl c0306201 0 returned -14 [ 978.848801][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.861810][T26788] binder: 26787:26788 BC_INCREFS_DONE u0000000000000000 no match 09:17:57 executing program 5: 09:17:57 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x1000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 978.902512][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 978.922740][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:17:57 executing program 4: [ 979.078114][T26878] binder_alloc: 26790: binder_alloc_buf failed to map pages in userspace, no vma [ 979.127802][T26878] binder: 26876:26878 transaction failed 29189/-3, size 24-8 line 3147 09:17:57 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180), 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:57 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) mprotect(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$VIDIOC_S_FBUF(r1, 0x402c560b, &(0x7f0000000040)={0x40, 0x1, &(0x7f0000000480)="8013ef33c18158da892010aa4251db11086ef6817cb6a3af0ab2999eddb290ce6882e33e4b5e46ad3dc9d0e228dc3008c3ee2656df9bbe785076af375e3b1844355fe6e9fea7fb4964ba8c29167f4b4eabf6d029b6981aabab298390d933efdbee0330583bdee34b7a3876c45ac52b01df09c78e566c75f42e61a78ba1be13bc082a14773f31f6593c9606e2f20b034fbd840c4e572968771469da0d9562a92e2cab7e73fc3a", {0x0, 0x5, 0x49323159, 0x0, 0xb47400000000, 0x10000, 0x8, 0x940}}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$EVIOCGUNIQ(r1, 0x80404508, &(0x7f0000000100)=""/134) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) 09:17:57 executing program 5: 09:17:57 executing program 4: 09:17:57 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x3f000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:57 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x2000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:57 executing program 4: 09:17:57 executing program 5: [ 979.680528][T26930] binder: 26920:26930 BC_INCREFS_DONE u0000000000000000 no match [ 979.690464][T26928] binder: 26926:26928 ioctl c018620b 0 returned -14 [ 979.724086][T26928] binder: 26926:26928 ioctl c0306201 0 returned -14 09:17:57 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x3000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:57 executing program 5: 09:17:57 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = getpgid(0x0) ptrace$getsig(0x4202, r2, 0x37f, &(0x7f0000000100)) 09:17:57 executing program 4: [ 979.958666][T27045] binder_alloc: 26926: binder_alloc_buf, no vma [ 979.982690][T27048] binder: 27046:27048 ioctl ae80 0 returned -22 [ 980.040156][T27048] binder: 27046:27048 ioctl ae80 0 returned -22 09:17:58 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:58 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0xfdfdffff, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:58 executing program 5: 09:17:58 executing program 4: 09:17:58 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x4000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:58 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) getsockopt$EBT_SO_GET_ENTRIES(r0, 0x0, 0x81, &(0x7f0000000380)={'broute\x00', 0x0, 0x4, 0xa4, [], 0x2, &(0x7f0000000040)=[{}, {}], &(0x7f0000000100)=""/164}, &(0x7f00000001c0)=0x50) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xfffffffffffffcb2, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000940)="ee26a8f335631b485abd355f108903eae8a0"}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getresuid(&(0x7f0000000500)=0x0, &(0x7f0000000540), &(0x7f0000000580)) stat(&(0x7f00000005c0)='./file0/file0\x00', &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = request_key(&(0x7f00000007c0)='cifs.idmap\x00', &(0x7f0000000800)={'syz', 0x1}, &(0x7f0000000840)='group_id', 0xfffffffffffffffc) keyctl$restrict_keyring(0x1d, r5, &(0x7f0000000880)='cifs.spnego\x00', &(0x7f00000008c0)='#\x00') mount$fuse(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='fuse\x00', 0x100000, &(0x7f0000000680)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, r3}, 0x2c, {'group_id', 0x3d, r4}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x200}}, {@blksize={'blksize', 0x3d, 0xc00}}, {@blksize={'blksize'}}, {@blksize={'blksize', 0x3d, 0x800}}, {@blksize={'blksize', 0x3d, 0x1800}}], [{@pcr={'pcr', 0x3d, 0x15}}]}}) 09:17:58 executing program 5: 09:17:58 executing program 4: [ 980.601399][T27065] binder: 27064:27065 ioctl c018620b 0 returned -14 [ 980.638753][T27065] binder: 27064:27065 ioctl c0306201 0 returned -14 09:17:58 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) pread64(r0, &(0x7f0000000100)=""/193, 0xc1, 0x10) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040)='/dev/nullb0\x00', 0x1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f0000000380)={&(0x7f0000000480)=""/246, 0xa000, 0x1800, 0x3}, 0x18) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:58 executing program 5: 09:17:58 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x5000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:58 executing program 4: [ 980.780077][T27160] binder: 27151:27160 BC_INCREFS_DONE node 2812 has no pending increfs request [ 980.847425][T27160] binder_alloc: 27064: binder_alloc_buf, no vma [ 980.854698][ T7897] binder: send failed reply for transaction 2811 to 27151:27160 [ 980.878182][T27188] binder: 27151:27188 BC_INCREFS_DONE u0000000000000000 no match [ 980.935015][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:17:59 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:17:59 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0xfffffdfd, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:17:59 executing program 5: 09:17:59 executing program 4: 09:17:59 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x6000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:59 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000060000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:59 executing program 5: 09:17:59 executing program 4: [ 981.487511][T27209] binder: 27208:27209 BC_INCREFS_DONE u0000000000000000 no match [ 981.508528][T27203] binder: 27201:27203 ioctl c018620b 0 returned -14 09:17:59 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x7000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:17:59 executing program 5: [ 981.552582][T27203] binder: 27201:27203 ioctl c0306201 0 returned -14 09:17:59 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:17:59 executing program 4: clone(0x4000003102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f00000003c0)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000180), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000440), 0x176dd) clone(0x2102001ff6, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) recvmsg(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) [ 981.732697][T12196] binder: release 27268:27275 transaction 2822 out, still active [ 981.767172][T12196] binder: unexpected work type, 4, not freed [ 981.805993][T12196] binder: undelivered TRANSACTION_COMPLETE [ 981.819592][T12196] binder: release 27252:27257 transaction 2825 out, still active [ 981.848909][T12196] binder: unexpected work type, 4, not freed [ 981.874154][T12196] binder: undelivered TRANSACTION_COMPLETE [ 981.896591][T12196] binder: send failed reply for transaction 2822, target dead [ 981.924047][T12196] binder: send failed reply for transaction 2825, target dead [ 981.944472][T12196] binder: send failed reply for transaction 2828 to 27268:27303 [ 981.952460][T12196] binder: undelivered TRANSACTION_COMPLETE 09:18:00 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x2000000000000022, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:18:00 executing program 5: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000000)=0x1) ioctl$KVM_GET_XSAVE(r2, 0x9000aea4, &(0x7f0000000580)) 09:18:00 executing program 3: r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x2000, 0x0) writev(r0, &(0x7f00000007c0)=[{&(0x7f0000000380)="6882bbdf2514057cb4bb242a06d4813395d48e1e460e558780e97d91445f3db0087ace6c11b1fcb6a9b93ae331c9343e55df9148f4d930329a74e7761313c4386db122272222461491405bf6e5b1189387bee22ceebe0d6cf1cdac71d1b128e7745ae44f032b48", 0x67}, {&(0x7f0000000480)="cf46fb75aedef1f209d8df2ab4ca83d97024726d8152bdf31477c2bcbd0ada8b4d313a9450b087bcc35a82cdd4cfe1f41da2d2f7a9562e4dcb9972ccb53146b9269c84c2b18bd21f78d343645121c2b03cabcefd5578b63ebe46f5ec3f6ab0ce78e4d611b3f894358344e5f2077295dfa62b6969d51d7451082edce2bbc08c9676093cda0b10a080", 0x88}, {&(0x7f0000000540)="300c2ed3c7d00d61230af8604851b234204cac5bb82714b0320074641ff0e51d55e77ae0d3c8916d94c7a39faee0a87b84cd13e06e71e6412ae9b5fc6530ba8c39dd84ae9254e3287fed0bc53c5e1ef8f560f1537ce9332621b61cf26dcc709d48698c438de488eb7789d9669ddadc0a350d008f467c05cc8faea06623e788fd62ab98956150be6da469e3420d3b64951589c55497c359c45b377f568824a898560f43e5620f83f8983711e3dffbfedc48139b93feb62698", 0xb8}, {&(0x7f00000001c0)="e1c1fcccda0eaedde5a9d095f2a99e2f9315decf8e3a93cf4f753275c064432064c9e0570c18bf9580e4b78df08052c9d5", 0x31}, {&(0x7f0000000600)="131ca5fc57b7c7dbe5fb0cb82aa2f6e89c9e19f792b74e5480d0b37221550035ffea3012b776d3b00fcd609aaa67a15fe5d10a3a952849738de7df1ba5699a4c34b26556adbb41", 0x47}, {&(0x7f0000000940)="82f6de50fd4da9c1c033cd82c1b3dd1a27f379976ddd77d618a22753261910fea745d22811e0dc0131c595c0d996f59b891f9fae4cf185a2c51e4768b8ea5c6cab1eadf5bb20ea60bd8eea0cd7c1640a3fb71a348ff839fa185551d0458287a1e2bfc3d355303ec547243a3c0dd76c8993a53079af47cadf6ba1844058f535112cbfcfc50ceabceab50568406f87d8c108bb8cc511fff722e04065b4f0cc0ba0888f219dedbdf9430517a9bf9aa5e241b600137840a214ca239a21ce15f1224030d985992f5315e7eb86f175599ad38e523a06f63b68b552d060b0b853d317315b869299284499500cf2c2f321a2ad644516d869ae964c243cba080d0c208540e0735129ae7f3f3b24fb3553e7abb58306f748e67fd92f64824dca438bfd8de92ac774bee9250d8305eb69f860883c1af7078e23da450129ad8d7ebcd58ac8f50fee3f8f936a476c1ca5f110f9267f240f4bcd8e9e37a4b7749dfd5bf318ec4dbf3c1c4bef1c31177fc6e7a5b46e0275aca8fb21f24e259eb69ba0236f34f923a68612fde94d8f346baf2e69c8446dbeea925da9a21620c9ea444be4453c1786616ede734d0f61a2bb76a2b6725d717484ca9d5d0282d3830859af6c185f001ac00c893821d9f9230e08fd30520e8a595114b881970b9c28827f84a89bf1bb1ac033fc02c21676632fb509814d467db560ef9c7169b77f2d205b68f469e206f185aadfb8c1baaf0cbabd9fc09afca0d709b5482170c19ce4387cb2fc2fcca7c23c30993ecf1c78495c140418980bcd415b4c1d74f4e8103e96bd623da870559cb5a26f3083c0170c6442b5c8306271a811b557d9dcc81cadc2ca61335ca80e021aee9ccadb47f865eb4120be0fd033134039d48a2866f24abaa71a0ebec56daaba7ed00c02cf4f57644c5b7aba64cf834245355fef6eef5553b317e65425b018dd988719ca8d76dd58d45022a5a946573d7ca36e6b870979f70c47e839faff5333479ef38e40481ba74295bd4484e894bff185387fecb864c592495526871fb61921d9c56b53f6512deac0f43073b3c3d64cf80d02ba3957a49569fa4d59e70645828c8a2f62fa8445c91a029a4c23bcf29922205bd684d2a6db8bb5b2bd3dd1b18f4e787485a8886a29f10b97035bf9fc4226d5a6846e48a90ccc58ecaf3d29c8eee645b98e391c3158b084df56d49bb38d0b1dc7cfe453c66d50c1e8b5a3511c62de05591b0341a8f81e48de122b14fa62d41ba40bac7bb2b685abbb9db95edab4f8beb036eaf835239f7a96fbe064b149a2ab5204f9fce4e2083104825adf7181d5c8c936db0cfb45c3100cd449c064ab2625506e45ea7b5530433b91f605935ac7938a9d9f8940dfb2fc563c6facfc2f699141b3dfffb6486605f13ea88e1ad2ee6f850f202413f3fc11999346094876cb7cdb8b1de19579cf053047fa1532b5bf461c635cf5ce474bdc58bfcd6cd1e2e08e0d02e602def43633619a67e4c97bd144fa54fa92dba30cdec33c178fe56a11e68411ae2a08eed18dfd521e1b2cf845e9ec1de89dfdb38e1a9f6a649e18655f4ffd38bb5a78994d1a66e54759459246cdd776dc9e11662debbe898dad0765844fc6f5ff3bbd5bf54e1586d4684593a0a4371d54088fb7ce1db789de15abf829eca7c07480b5986048eaec9895062179266b69105d3f99ab3993762a6b95c95ab290e6e49ed75d781fb81bd764ae0176026d49d3302c9b133f146ea5373f68e4eff97ce759315aed71c1c3e62a2bcd3c6b61900b434b12c22069c1c1ead44f31dedd756574d72ada50374aac24a2d08f9509526975b6e69b74ae769e3891d5232bcd26dd5401152f85d7571301b470d56ecf551d8d4574b17bb84a2e26d64fb45130b2b8bf2524f93266e3f230b0bf2f7c397a62dc15c8e20101b116f468250647a325748d3267addc738670a921a5ef8eb2f7bd0123929ce8668aa23af368b3a1a35c49827a9c1cdfa8fb5a3f3c56ddf9d56f7e6a65af668c51707fd1ab6c694728a566fe155b0fbbcdf4b2a703913de37ae0dda5d9661c409fbf874b23123e40f650bdd7ca8f5b93ef36c847ce74ceb4cd94278c96f5a65732e430d1c7831c1b0d19c485e6b147cfdccdcd80ec37269526e4751d7cd1d5846da1289873cd798e705a8cef265443c7a2c3a0336caa18fb15b88261b99b3be725810b10cfc8f6df044e3de4cae62ad606a57c32935968adc86cb01e34b41185c146030f301d011622ae55d3d6ab7aa3b960d949f9c5be396051d6cbb2213692c5aced3ba67c3b0b08575bf855e4cd1349fbc648aa286b22ab001a42d47e44069b41f2418c0134fc9198fa9cf55ac6fd82cd6f6bb5c4acadf59def2426867ae01cbf8a40a94d3c610a83998658363c64df6f8caccaf0555564114364b2a376ae253293cb0c63e03a1c363a553f27808225e619cdde6ae016b7d2eece3df87b191c7ce3cfac53c395a9cdd0e5e88c44bbdd074d7565672754386222533cb5cefe59bbe378781623cd559a652ab5dd19c07005372eb9edf4e4f780b8cc89d18dd63ecd2f36fcc75ca9e1f95759be31bbf402fce5b91145cb6328d77f6a80de253e45acddbb9a7849622ab0c6e1792125d349a8702edc6c8962a72df2a1e598cbe3647a4aad982aa39cafc6c5aef58d726ddd71d08f0c3611455e72cd11def0597c89e734571ece53394989551c5803031b5dae43a6b261700351ae263f11a7d57e48b1f445ba6916dd60ae5c154820b9e1c30ff03bffd8ca76db6d60af4f3b383d15f564f5d1d038f97bd99e75cc6080e93596dbb470fbf19332d9375ee8db10e70cc8210c35910b83730055686b5ad7231577bb2026894c9904283735944f18952c5cd8f8e1ceaf50fa9f6037af4c719cf30c63e609b6f99dae33403f90d11db87ff8515b41f82dea35b457835be5657c0c0614feaacb7b293d0986ed4f6488edd833ceac3d2e60d87ded5d661bc7ae020c122cc9f2c00d6f47a0ce42b24fa692757140e4fc56fbf9bd341c18f628606ea705aeb657b125b85532277e49307498eee882a058021515939c5698f808c760210619c7b0867c1ca5f9a889d06989c56260bd73c4b37892b2a782fcea8b4b8ede21fbee0a79a3772e37790f377fb37f8db04a97b73be4d3cd3765b5941c4f8139db3d0f1d3cf3e3fa961b73f411661b2b27d868b6a4f7822b2c762db8aed993b57c33d6d1e23f012163257cefe63af4e39fb7656d62ea571c9eaf906cd0b3f805b909a3e8372313613d0312db25fb97ce86d76f4aeaf115d4e88980671154439f99c52fc5210fe5bc2383957bd7fe81f9f0d6c1516e6025f70dee6e79932065f425a833146583993b9f409a1ceac507bdef8aa5e0168e6309acca8420cc0f1798ac9ffad1f03af2797500a6ea83ff9f3cd73caa7db35a07b1ac8be5af04247794d4a294e523653eed1306d6761d470d0cfec1b43ffae9a6cd6cdb22abf63dd26ed38f9ae04d161fc0a4496895b66faf0928ce9318ad15533df3e56f9caaec90f05e4056cdc88042459b4944a6ee99d8696d335bdd70753c6d4fb27476f82cc3c96ece8ac927a84931516b88d58d2c2144a9c1ee40e7bf9faf7e796e9ca8c7fd03d3dbb73e38d9c6c47c4efecca40ec9ed6aaeda7320319fec00b3cf725c0f302daa3b476b3b7d23ef0b47725c77f8610bc0a5fac1d1a583e6128ceeef53fa13f9b510fd4a9e07654d2f4382bd92294dc2cd1d8a01c4b57d389bd7efe78d86b81320d6945bd9b43c964aec5b563e858f0fe907e1f3ffda70a7d1f85c8b4f000ca651d6e675f8dd9710379adb4a38f2fdaa6281dfc346fce32b4b79219e241f531f39c8b4744d6931479bae8d715289b243afb78bf0dc47d453ddbd3f91f52417b5b7df26443e666a8564712f9f1142db7873fe9859e3de14de9c33414c6e4ebade8335e4e2598d1b3615d983ddffbe8f2387e2923e41ba5af1b34d5614201c0a423f98cc67e45eedd6298db0ed4f2754ae4d6a92f3220ba7fe2a32e21b1b2648a52b79cc1766042b350873a7e0d9773a570512f2ec63bea84f6639ff21350aaedd3f9777dd01d2c7e60b8e7bd42947deb3b11a7e6035f52403fcbfaf53708a2f06cb7006c125d817ba3baeb315e224543fea90207f4cee88251fca536dab812428d419cd0203e597932b6673338ad1f9fc7d122855d61ed5a5fea5136f6b9ee6235396964446df37836ce5950b632cdd42aadea8cb02b073dd1120cf5a8169225ee3aa897b2bcec14a5383a8c2909560eff1615dda9f461717114a2134c489d7b01b08e4bbbf21cb27e572aa5f937b5bb9a03775decc005a871138857a1bd12c62b322c3e055617aff3a1ce20c84d0253311d3b17a7d389ce0bc982a5adadf18b3eea4385b73655042476ed8d0b4f48fb5d887563c8da3727be87ceaa00d9c41a92690db1994adf0fabbee0e8d4d574f579f2dd85e9ca082455f792b249b274ab28f6859b639fcbaa151fb8c54623a7899b5a6e427f2c5c4176e0b210f241351fe7b32fb5cfc6fde946c9226ca660c8de5cecfdb9ea886cbaa201956c72e9dcbaf0d7a5cc65c3b6b04e98163a698b860b441dd985afac318d35a5bcd23921c3ffe193e39827f3f46bdc96d760ddf10780b66c49d89569b769242af0ff8c39d3bb1c6d8d756b836564fb1ed955a26c2343931facb2ab7a24d17a10610cf7fe79a958255abc248fd47f6369fa9d703cd14db1a3e139f2729b457bc79add8309c85dc133818efe0e8bd0052eb373c9cb5588bb187fd1b3a8844ec7589bb461f6fd312ebbd69afc9a9da88546c5aea5e9cc0c98cb8ce1dd3ef9ea44711032ea9589a8eef6b95bcbd8a77abd310677a4bf0d6981d215b7bc1e0fae4d33416a87aaadfa31281bd4b2c1efacd8b16ecfa875f6a57106d1e5f1ba5bf44cd6bb35cd414eacc7d45acdc716f6dd6399ced800e0c517cca8bda92bc813f68c498d4d431c7bf2c24489fbe32117e54810e71af47e75c298e39bd8671086466871cda228e03394d2533c7a16eee2fa1f9b6e299cabd99b8c4ee2dad748ddc55f5c55c00f80de688d0c83f120aee25b9fd361274fb5c2945732b20ae72bbdb591605f92a40262cf885a3ba3f6ee97308da653c3e6d918b773e7113b735f8ffcf4b741ffcc6736673949642bd3d06b0295f20e84fc17a297349609b36af2430ebc0dae675bc8afe73ec4f98237e4deed9c02a1d87ffce8cac62a0e512f4596a3343fd6a415a64a3c43c557dcfe012224253ac04ca9c0a60b82a68be4aee9e99e34a76b6f997c90991e7ec87b30c0ba07a33dcf901b3236c89fa55a4497cf3b4cd5064c089a758bee0e52341138e7722916350ec370ea96075d2086f9283f729ed60a31e96c299e5d75c8a96baf64f9cd0f8aee7412e1be9081d00d26f273a9950bb507d1037956ca63220b58ae9e091c5d6586bf4b959c12865682339d522c28015ca5aa5903a5b4384adada0edb978a5c68d13d83bb83192bc232d10dae57cb6b7e95d00dba943514f15c7cbee8c47b0bce1ce46bffaad986e5fc1fa5f8a1d513070ef67365c10abc8f523e434f71a678a69b1ea43d06619b1ffefc04d33a4ab536d024d2384aba0e47b90c6fbb25abd1f7b3a07f7b3f0554b3a70b75825ff98cb0ef3233a6f1c4b75941888f4c826ee4fa560149657929549b50a5ba2aaafe78c360ba25a4db25cf5901261d3f49f88ddb7df0c797df0dc02419e03f4885bf6c579f967e1ed4d73f790539bb07ec5b5034c9ea5f52df1f6457be9b160b5936a3cac0abc5519e8664ecadc", 0x1000}, {&(0x7f0000000680)="10d2eca9d08c1d881136310db2720b2848555eab2c9dbc7885e6700426564b5477448e867aa28ced64e97c42331fa8512000c2a1afa1dc750656c683c49cff0a87756d9a8327bd746107407dc33c58cbe13c7618e1c753a5837d60ae71cbe985441a8843e5eac460a283d7e9a4969f0f50316d8494f1106fc9ebbc6b3e5ea9c13b7f108fab70dfaffbe911f833c6befa82a6323f78", 0x95}, {&(0x7f0000000740)="2684eb8ef7adbd084e5eb8b45eb59e63e366ac11cbc8ad25b4e6c8351b1c9f95ca7fe5e2d988a990837012a9be0a70e6fa15fddba307bb3e27e28647f939701d422d317f117f1517cbafa2ca44957141a578dcb5db423a4a61102bb946", 0x5d}], 0x8) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, &(0x7f0000000080)={0x1}) ioctl$KDADDIO(r0, 0x4b34, 0x7fffffff) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000040)={0x0, 0x7ff, 0x20}, &(0x7f00000000c0)=0xc) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000100)={0x6, 0x1, 0x4e8c3819, 0x1, r3}, 0x10) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="1b431141", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:00 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x10000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:00 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x100000000000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:00 executing program 4: r0 = socket$kcm(0xa, 0x1, 0x0) sendmsg$kcm(r0, &(0x7f0000000280)={&(0x7f0000000200)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x1, 0x0}, 0x200008c4) [ 982.373150][T27450] binder: 27449:27450 ioctl c018620b 0 returned -14 [ 982.385132][T27451] binder: 27446:27451 unknown command 1091650331 09:18:00 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x20000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:00 executing program 4: socketpair$unix(0x1, 0x200000005, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0xf7fffffffe000005, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0xffffffffffbffffd}) r1 = dup(r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) syz_execute_func(&(0x7f00000000c0)="c4827d5a6e0d5e57c3c3b7d95a91914e424a2664f0ff065b460f343030082e67660f50e900004681e400000100440fe531feabc4aba39d6c450754ddea420fae9972b571112d02") [ 982.418711][T27451] binder: 27446:27451 ioctl c0306201 200002c0 returned -22 [ 982.426996][T27450] binder: 27449:27450 ioctl c0306201 0 returned -14 09:18:00 executing program 5: r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000040)="2e0000001a008100a00f80ecdb4cb904024865160b000000d4126efb120004000200000040d819a9ffe200000000", 0x2e}], 0x1}, 0x0) 09:18:00 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') linkat(r1, &(0x7f0000000040)='./file0/file0\x00', r0, &(0x7f0000000100)='./file0/file0\x00', 0x1400) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:00 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x10000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 982.579082][T12196] binder: release 27488:27502 transaction 2835 out, still active [ 982.593612][T12196] binder: unexpected work type, 4, not freed [ 982.630687][T12196] binder: undelivered TRANSACTION_COMPLETE [ 982.639843][T27572] netlink: 'syz-executor.5': attribute type 4 has an invalid length. [ 982.656346][T27575] binder: 27574:27575 BC_INCREFS_DONE node 2839 has no pending increfs request 09:18:00 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x200000000000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 982.681208][T12196] binder: send failed reply for transaction 2835, target dead [ 982.702616][T12196] binder: send failed reply for transaction 2838 to 27574:27575 [ 982.734914][T27582] binder: 27574:27582 BC_INCREFS_DONE u0000000000000000 no match [ 982.764455][T12196] binder: undelivered TRANSACTION_COMPLETE [ 982.795864][T27581] binder: 27580:27581 ioctl c018620b 0 returned -14 [ 982.830977][T27581] binder: 27580:27581 ioctl c0306201 0 returned -14 09:18:01 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:18:01 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x3f000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:01 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x1000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:01 executing program 4: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x2000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:01 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000100)={&(0x7f0000000040)='./file0\x00', r1}, 0x10) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="c2f31a7bc3fbf25c"], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:01 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x800000000000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 983.176644][T27695] binder_transaction: 23 callbacks suppressed [ 983.176696][T27695] binder: 27693:27695 transaction failed 29189/-22, size 24-8 line 2994 [ 983.207343][T27694] binder: 27692:27694 ioctl c018620b 0 returned -14 [ 983.217466][T27697] binder: 27688:27697 transaction failed 29189/-22, size 24-8 line 2994 [ 983.231396][T27690] binder: 27687:27690 transaction failed 29189/-22, size 24-8 line 2994 [ 983.245499][T27696] binder: 27691:27696 ioctl c018620b 0 returned -14 [ 983.264620][T27700] binder: 27688:27700 transaction failed 29189/-22, size 24-8 line 2994 [ 983.265290][T12196] binder_release_work: 27 callbacks suppressed [ 983.265298][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 983.291427][T27696] binder: 27691:27696 ioctl c0306201 0 returned -14 [ 983.300195][T27743] binder: 27693:27743 BC_INCREFS_DONE u0000000000000000 no match [ 983.317170][T12196] binder: undelivered TRANSACTION_ERROR: 29189 09:18:01 executing program 5: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x68, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:01 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0//ile0\x00', 0x0) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) r2 = socket$inet6(0xa, 0x5, 0x1) bind$inet6(r2, &(0x7f00000007c0)={0xa, 0x4e20}, 0x1c) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r2, 0x6) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f0000000400)={'icmp6\x00'}, &(0x7f0000000480)=0x1e) setsockopt(r3, 0x10d, 0x800000000f, &(0x7f0000000040)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, 0x0) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f00000001c0)="313224b9d2a61316f0684eb502f787f5be0cd4bf4059f6154613c6634c7312bcd90fa466ecb84d988d0fb1bb53e1885cf029ac767dfe9897dfdd7ade5bc0b37283d6b08a5c5a88b358804e48e0419c34139f66a237e6b1840e06c231ac21683baa3df79e5585aa176c1c7aed5d7f97c96933c48b8290db180fe29c40005c526992f90cf65297322134eae4e02c9f0ebfcc31d757f02a14802404ecca2696a6a628afffa87de2c9d34239df761d17416d03747d14fd448d1c6e546c07ba3a514e9378c47ce1e386e27640664250837d2d5b6ad7f1c3a2eabbde85aae26a8622850c131508fc3e340ef98285ba7f36e7e59bec9de3e53880", 0xf7, r4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, &(0x7f0000000600)) preadv(r3, &(0x7f0000002c00), 0x4, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x20) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) rmdir(&(0x7f0000000340)='./file0//ile0\x00') mount(&(0x7f0000000800)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYPTR, @ANYRES16], 0x0, 0x0, 0x20000, 0x0) syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000003c0)={0x3}, 0x4) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x4f92) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a45352, &(0x7f00000008c0)={{}, 'port1\x00', 0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x1, 0x8000}) [ 983.328726][T27695] binder_alloc: 27691: binder_alloc_buf failed to map pages in userspace, no vma [ 983.343621][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 983.358464][T27743] binder: 27693:27743 BC_INCREFS_DONE u0000000000000000 no match [ 983.384021][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 983.391094][T27695] binder: 27693:27695 transaction failed 29189/-3, size 24-8 line 3147 09:18:01 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x1200000000000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:01 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x48000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 983.445865][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 983.487553][T27810] binder: 27809:27810 transaction failed 29189/-22, size 24-8 line 2994 09:18:01 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x3be, 0x0, &(0x7f00000001c0)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) listxattr(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000100)=""/172, 0xac) [ 983.568591][T27816] binder: 27815:27816 ioctl c018620b 0 returned -14 [ 983.573531][T27818] binder: 27817:27818 transaction failed 29189/-22, size 24-8 line 2994 [ 983.581890][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:18:01 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0//ile0\x00', 0x0) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) r2 = socket$inet6(0xa, 0x5, 0x1) bind$inet6(r2, &(0x7f00000007c0)={0xa, 0x4e20}, 0x1c) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r2, 0x6) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f0000000400)={'icmp6\x00'}, &(0x7f0000000480)=0x1e) setsockopt(r3, 0x10d, 0x800000000f, &(0x7f0000000040)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, 0x0) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f00000001c0)="313224b9d2a61316f0684eb502f787f5be0cd4bf4059f6154613c6634c7312bcd90fa466ecb84d988d0fb1bb53e1885cf029ac767dfe9897dfdd7ade5bc0b37283d6b08a5c5a88b358804e48e0419c34139f66a237e6b1840e06c231ac21683baa3df79e5585aa176c1c7aed5d7f97c96933c48b8290db180fe29c40005c526992f90cf65297322134eae4e02c9f0ebfcc31d757f02a14802404ecca2696a6a628afffa87de2c9d34239df761d17416d03747d14fd448d1c6e546c07ba3a514e9378c47ce1e386e27640664250837d2d5b6ad7f1c3a2eabbde85aae26a8622850c131508fc3e340ef98285ba7f36e7e59bec9de3e53880", 0xf7, r4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, &(0x7f0000000600)) preadv(r3, &(0x7f0000002c00), 0x4, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x20) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) rmdir(&(0x7f0000000340)='./file0//ile0\x00') mount(&(0x7f0000000800)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYPTR, @ANYRES16], 0x0, 0x0, 0x20000, 0x0) syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000003c0)={0x3}, 0x4) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x4f92) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a45352, &(0x7f00000008c0)={{}, 'port1\x00', 0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x1, 0x8000}) [ 983.621800][T27855] binder: 27853:27855 transaction failed 29189/-22, size 24-8 line 2994 [ 983.667577][T27936] binder: 27853:27936 BC_INCREFS_DONE u0000000000000000 no match [ 983.679072][T12196] binder: undelivered TRANSACTION_ERROR: 29189 [ 983.728937][T27936] binder: 27853:27936 transaction failed 29189/-22, size 24-8 line 2994 [ 983.764454][T27855] binder: 27853:27855 BC_INCREFS_DONE u0000000000000000 no match [ 983.791691][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 983.812650][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 09:18:02 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:18:02 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x4c000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:02 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0//ile0\x00', 0x0) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) r2 = socket$inet6(0xa, 0x5, 0x1) bind$inet6(r2, &(0x7f00000007c0)={0xa, 0x4e20}, 0x1c) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r2, 0x6) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f0000000400)={'icmp6\x00'}, &(0x7f0000000480)=0x1e) setsockopt(r3, 0x10d, 0x800000000f, &(0x7f0000000040)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, 0x0) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f00000001c0)="313224b9d2a61316f0684eb502f787f5be0cd4bf4059f6154613c6634c7312bcd90fa466ecb84d988d0fb1bb53e1885cf029ac767dfe9897dfdd7ade5bc0b37283d6b08a5c5a88b358804e48e0419c34139f66a237e6b1840e06c231ac21683baa3df79e5585aa176c1c7aed5d7f97c96933c48b8290db180fe29c40005c526992f90cf65297322134eae4e02c9f0ebfcc31d757f02a14802404ecca2696a6a628afffa87de2c9d34239df761d17416d03747d14fd448d1c6e546c07ba3a514e9378c47ce1e386e27640664250837d2d5b6ad7f1c3a2eabbde85aae26a8622850c131508fc3e340ef98285ba7f36e7e59bec9de3e53880", 0xf7, r4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, &(0x7f0000000600)) preadv(r3, &(0x7f0000002c00), 0x4, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x20) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) rmdir(&(0x7f0000000340)='./file0//ile0\x00') mount(&(0x7f0000000800)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYPTR, @ANYRES16], 0x0, 0x0, 0x20000, 0x0) syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000003c0)={0x3}, 0x4) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x4f92) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a45352, &(0x7f00000008c0)={{}, 'port1\x00', 0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x1, 0x8000}) 09:18:02 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x2000000000000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:02 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000040)={0x2, @tick=0x2, 0x8001, {0x7, 0x1000}, 0xd2c, 0x3, 0xffffffffffffff00}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:02 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0//ile0\x00', 0x0) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) r2 = socket$inet6(0xa, 0x5, 0x1) bind$inet6(r2, &(0x7f00000007c0)={0xa, 0x4e20}, 0x1c) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r2, 0x6) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f0000000400)={'icmp6\x00'}, &(0x7f0000000480)=0x1e) setsockopt(r3, 0x10d, 0x800000000f, &(0x7f0000000040)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, 0x0) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f00000001c0)="313224b9d2a61316f0684eb502f787f5be0cd4bf4059f6154613c6634c7312bcd90fa466ecb84d988d0fb1bb53e1885cf029ac767dfe9897dfdd7ade5bc0b37283d6b08a5c5a88b358804e48e0419c34139f66a237e6b1840e06c231ac21683baa3df79e5585aa176c1c7aed5d7f97c96933c48b8290db180fe29c40005c526992f90cf65297322134eae4e02c9f0ebfcc31d757f02a14802404ecca2696a6a628afffa87de2c9d34239df761d17416d03747d14fd448d1c6e546c07ba3a514e9378c47ce1e386e27640664250837d2d5b6ad7f1c3a2eabbde85aae26a8622850c131508fc3e340ef98285ba7f36e7e59bec9de3e53880", 0xf7, r4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, &(0x7f0000000600)) preadv(r3, &(0x7f0000002c00), 0x4, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x20) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) rmdir(&(0x7f0000000340)='./file0//ile0\x00') mount(&(0x7f0000000800)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYPTR, @ANYRES16], 0x0, 0x0, 0x20000, 0x0) syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000003c0)={0x3}, 0x4) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x4f92) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a45352, &(0x7f00000008c0)={{}, 'port1\x00', 0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x1, 0x8000}) [ 984.113187][T28042] binder: 28039:28042 transaction failed 29189/-22, size 24-8 line 2994 [ 984.144266][T28044] binder: 28043:28044 ioctl c018620b 0 returned -14 [ 984.165171][T28049] binder: 28046:28049 BC_INCREFS_DONE u0000000000000000 no match [ 984.172378][T28044] binder: 28043:28044 ioctl c0306201 0 returned -14 [ 984.188234][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 984.197617][ T7897] binder: release 28039:28042 transaction 2858 out, still active [ 984.219080][ T7897] binder: unexpected work type, 4, not freed [ 984.235618][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:18:02 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x60000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:02 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:02 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0//ile0\x00', 0x0) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) r2 = socket$inet6(0xa, 0x5, 0x1) bind$inet6(r2, &(0x7f00000007c0)={0xa, 0x4e20}, 0x1c) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r2, 0x6) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f0000000400)={'icmp6\x00'}, &(0x7f0000000480)=0x1e) setsockopt(r3, 0x10d, 0x800000000f, &(0x7f0000000040)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, 0x0) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f00000001c0)="313224b9d2a61316f0684eb502f787f5be0cd4bf4059f6154613c6634c7312bcd90fa466ecb84d988d0fb1bb53e1885cf029ac767dfe9897dfdd7ade5bc0b37283d6b08a5c5a88b358804e48e0419c34139f66a237e6b1840e06c231ac21683baa3df79e5585aa176c1c7aed5d7f97c96933c48b8290db180fe29c40005c526992f90cf65297322134eae4e02c9f0ebfcc31d757f02a14802404ecca2696a6a628afffa87de2c9d34239df761d17416d03747d14fd448d1c6e546c07ba3a514e9378c47ce1e386e27640664250837d2d5b6ad7f1c3a2eabbde85aae26a8622850c131508fc3e340ef98285ba7f36e7e59bec9de3e53880", 0xf7, r4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, &(0x7f0000000600)) preadv(r3, &(0x7f0000002c00), 0x4, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x20) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) rmdir(&(0x7f0000000340)='./file0//ile0\x00') mount(&(0x7f0000000800)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYPTR, @ANYRES16], 0x0, 0x0, 0x20000, 0x0) syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000003c0)={0x3}, 0x4) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x4f92) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a45352, &(0x7f00000008c0)={{}, 'port1\x00', 0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x1, 0x8000}) [ 984.363621][T28266] binder: 28264:28266 BC_INCREFS_DONE node 2862 has no pending increfs request 09:18:02 executing program 5: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000440)='cgroup2\x00', 0x0, 0x0) mkdir(&(0x7f0000000180)='./file0//ile0\x00', 0x0) r1 = syz_open_dev$mice(0x0, 0x0, 0x0) syz_genetlink_get_family_id$fou(0x0) r2 = socket$inet6(0xa, 0x5, 0x1) bind$inet6(r2, &(0x7f00000007c0)={0xa, 0x4e20}, 0x1c) r3 = socket$inet_dccp(0x2, 0x6, 0x0) listen(r2, 0x6) getsockopt$IPT_SO_GET_REVISION_MATCH(r3, 0x0, 0x42, &(0x7f0000000400)={'icmp6\x00'}, &(0x7f0000000480)=0x1e) setsockopt(r3, 0x10d, 0x800000000f, &(0x7f0000000040)="03", 0x1) connect$inet(r3, &(0x7f0000e5c000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x20}}, 0x10) sendmmsg(r3, &(0x7f0000005700)=[{{&(0x7f0000003900)=@pptp, 0x80, &(0x7f0000003b80), 0x3a5, &(0x7f0000003bc0)}}], 0x3a6, 0x0) ioctl$BLKREPORTZONE(0xffffffffffffffff, 0xc0101282, 0x0) r4 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000380)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffc) add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f00000001c0)="313224b9d2a61316f0684eb502f787f5be0cd4bf4059f6154613c6634c7312bcd90fa466ecb84d988d0fb1bb53e1885cf029ac767dfe9897dfdd7ade5bc0b37283d6b08a5c5a88b358804e48e0419c34139f66a237e6b1840e06c231ac21683baa3df79e5585aa176c1c7aed5d7f97c96933c48b8290db180fe29c40005c526992f90cf65297322134eae4e02c9f0ebfcc31d757f02a14802404ecca2696a6a628afffa87de2c9d34239df761d17416d03747d14fd448d1c6e546c07ba3a514e9378c47ce1e386e27640664250837d2d5b6ad7f1c3a2eabbde85aae26a8622850c131508fc3e340ef98285ba7f36e7e59bec9de3e53880", 0xf7, r4) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r1, 0x29, 0xd3, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) getsockopt$inet_sctp6_SCTP_CONTEXT(0xffffffffffffffff, 0x84, 0x11, 0x0, &(0x7f0000000600)) preadv(r3, &(0x7f0000002c00), 0x4, 0x0) prctl$PR_SET_PDEATHSIG(0x1, 0x20) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r1) rmdir(&(0x7f0000000340)='./file0//ile0\x00') mount(&(0x7f0000000800)=ANY=[@ANYPTR64, @ANYRESDEC=r0, @ANYPTR, @ANYRES16], 0x0, 0x0, 0x20000, 0x0) syz_open_dev$vivid(&(0x7f0000000100)='/dev/video#\x00', 0x3, 0x2) setsockopt$inet6_icmp_ICMP_FILTER(r2, 0x1, 0x1, &(0x7f00000003c0)={0x3}, 0x4) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) ioctl$LOOP_SET_DIRECT_IO(r1, 0x4c08, 0x4f92) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(0xffffffffffffffff, 0xc0a45352, &(0x7f00000008c0)={{}, 'port1\x00', 0x86, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3d, 0x0, 0x1, 0x8000}) [ 984.447989][T28270] binder: 28264:28270 BC_INCREFS_DONE node 2868 has no pending increfs request [ 984.457391][ T7897] binder: release 28265:28267 transaction 2864 out, still active [ 984.473801][ T7897] binder: unexpected work type, 4, not freed [ 984.487601][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 984.493563][ T7897] binder: release 28265:28267 transaction 2869 out, still active 09:18:02 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x68000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:02 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f0000000100)={{0xa, 0x4e22, 0x7, @remote, 0x1}, {0xa, 0x4e24, 0x254, @rand_addr="46eb9677c943ce614da1db6712d56440", 0xffffffffffffff4b}, 0x0, [0x1, 0x3f, 0xffffffffffffff66, 0x0, 0x401, 0x0, 0xe612, 0x80]}, 0x5c) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) flock(r2, 0x1) [ 984.583103][ T7897] binder: unexpected work type, 4, not freed [ 984.612352][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 984.658137][ T7897] binder: send failed reply for transaction 2858, target dead [ 984.740930][ T7897] binder: send failed reply for transaction 2861 to 28264:28266 [ 984.769335][T28354] binder: 28334:28354 BC_INCREFS_DONE u0000000000000000 no match [ 984.774775][ T7897] binder: send failed reply for transaction 2864, target dead [ 984.799563][ T7897] binder: send failed reply for transaction 2869, target dead [ 984.840640][ T7897] binder: send failed reply for transaction 2867 to 28264:28266 [ 984.852637][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 984.884226][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:18:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x0, &(0x7f0000356000)=0x1000000000000001, 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:18:03 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x3f00000000000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:03 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x6c000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:03 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x10, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:03 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:03 executing program 5: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$can_raw(0x1d, 0x3, 0x1) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000080)) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000240)={0x0, 0x43, "8e04c05873de329c3952e72802c18ad80253b699321db251d925deccf644f7ca56c77ce0f031d4bd06ee206980fc4d9b1e27b4d092ca6dc97d17714e589d10d4fac223"}, &(0x7f00000001c0)=0x4b) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f00000002c0)={r2, 0x4}, &(0x7f0000000300)=0x8) clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) r4 = syz_open_dev$amidi(&(0x7f0000000040)='/dev/amidi#\x00', 0x800, 0x20000) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/mISDNtimer\x00', 0x10000, 0x0) ioctl$SG_SET_FORCE_PACK_ID(r4, 0x227b, &(0x7f0000000100)=0x1) bind$can_raw(r0, &(0x7f00000000c0)={0x1d, r3}, 0x6ef) setsockopt(r0, 0x65, 0x1, &(0x7f0000000080), 0x1d0) close(r0) 09:18:03 executing program 4: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x0, 0x16, &(0x7f0000000000)={{0x0, @broadcast, 0x4e21, 0x0, 'dh\x00'}, {@multicast2}}, 0x44) [ 985.064373][T28407] binder: 28399:28407 ioctl c018620b 0 returned -14 [ 985.072609][T28405] binder: 28404:28405 BC_INCREFS_DONE u0000000000000000 no match [ 985.087155][T28407] binder: 28399:28407 ioctl c0306201 0 returned -14 [ 985.096262][T12196] binder: release 28403:28414 transaction 2882 out, still active [ 985.112469][T12196] binder: unexpected work type, 4, not freed 09:18:03 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x74000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:03 executing program 5: r0 = open(&(0x7f0000000000)='./file0\x00', 0x80, 0x100) write$P9_RATTACH(r0, &(0x7f0000000080)={0x14, 0x69, 0x1, {0x40, 0x1, 0x5}}, 0x14) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = fcntl$dupfd(r2, 0x0, r2) ioctl$KVM_IRQ_LINE_STATUS(r3, 0xc008ae67, &(0x7f00000000c0)={0x32cb8ea6}) 09:18:03 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) lsetxattr$security_smack_transmute(&(0x7f0000000040)='./file0\x00', &(0x7f0000000100)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 985.144163][T12196] binder: undelivered TRANSACTION_COMPLETE [ 985.306855][T28543] binder: 28542:28543 BC_INCREFS_DONE node 2887 has no pending increfs request [ 985.331664][T12196] binder: release 28544:28545 transaction 2885 out, still active 09:18:03 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x8000000000000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:03 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0xfffffffffffffb3c, 0x0, 0x0, 0x0, 0x0, 0x695, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r0, &(0x7f0000001600)={&(0x7f0000000000)={0x2, 0x0, @remote={0xac, 0x48}}, 0x10, 0x0, 0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="480000001401000001000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x48}, 0x0) [ 985.360916][T12196] binder: unexpected work type, 4, not freed [ 985.378495][T12196] binder: undelivered TRANSACTION_COMPLETE [ 985.391618][T28633] binder: 28542:28633 BC_INCREFS_DONE node 2895 has no pending increfs request [ 985.400949][T12196] binder: send failed reply for transaction 2882, target dead [ 985.439422][T12196] binder: send failed reply for transaction 2886 to 28542:28543 [ 985.469065][T12196] binder: send failed reply for transaction 2885, target dead [ 985.487158][T12196] binder: send failed reply for transaction 2891 to 28544:28545 [ 985.514880][T12196] binder: send failed reply for transaction 2894 to 28542:28632 [ 985.549626][T28647] binder: 28643:28647 ioctl c018620b 0 returned -14 [ 985.559283][T12196] binder: undelivered TRANSACTION_COMPLETE [ 985.570169][T28647] binder: 28643:28647 ioctl c0306201 0 returned -14 09:18:03 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, 0x0, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:18:03 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x7a000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:03 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r1, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl(r0, 0x6, &(0x7f0000000040)="4a8ce2e8f4392cd8bdebf4bf4701e5d1a86e7257807aea6875d16224") perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') ioctl$TIOCLINUX7(r1, 0x541c, &(0x7f0000000280)={0x7, 0x66decbcf}) pselect6(0x40, &(0x7f0000000100)={0x4, 0x6, 0x644, 0xffffffffffffffff, 0x401, 0x8, 0x80000001, 0x3}, &(0x7f0000000140)={0x6, 0x7, 0x2, 0xef1, 0x0, 0x80000000, 0x6, 0x8}, &(0x7f0000000180)={0x3d, 0x6, 0xda, 0x2, 0x61fa, 0x0, 0x1f, 0x59}, &(0x7f00000001c0), &(0x7f00000003c0)={&(0x7f0000000380)={0xffffffffffff0001}, 0x8}) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="08631040", @ANYRES64=0x0, @ANYBLOB="000000000003e8eeab000051"], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:03 executing program 5: socket$netlink(0x10, 0x3, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x20000, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000900)={0x0, @in6={{0xa, 0x4e20, 0x0, @mcast1}}}, 0x90) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0xa000000000000005) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) ioctl(0xffffffffffffffff, 0x7, &(0x7f0000000100)) setpriority(0x0, r1, 0x10000) r2 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000680)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) setxattr$security_capability(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000500)=@v2={0x2000000, [{0x7, 0x7f}, {0x80, 0x3f}]}, 0x14, 0x2) write$FUSE_OPEN(r0, &(0x7f0000000780)={0x20, 0x0, 0x3, {0x0, 0x4}}, 0x20) setxattr$security_capability(&(0x7f0000000600)='./file0\x00', &(0x7f0000000d00)='security.capability\x00', &(0x7f0000000c40)=@v3={0x3000000, [{}, {0x90c, 0x3f5d}], r3}, 0x18, 0x0) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f00000002c0)=r1) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000580)='./file0\x00') ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000000ac0)=[&(0x7f0000000b00)='z@\x00', &(0x7f0000000a80)='\x00'], &(0x7f0000000480)=[&(0x7f0000000100)='cpusetlo\x00', &(0x7f0000000140)='md5sumeth0.+selfeth0.bdevk\'\x00', &(0x7f00000001c0)='\x00', &(0x7f0000000200)='security.capability\x00', &(0x7f0000000240)='ppp0mime_type\x00', &(0x7f0000000380)='}+\x00', &(0x7f00000003c0)='system.posix_acl_default\x00', &(0x7f0000000400)='systemwlan0^\x00', &(0x7f0000000440)='z@\x00']) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000580), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000a40)={0x0, 0x9}, &(0x7f0000000b40)=0x8) socket(0x2000000011, 0x3, 0x0) getgroups(0x0, &(0x7f0000000840)) sendmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0x40000) 09:18:03 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000008000)={0x0, 0x0, 0x0, 0x0, 0x800020, 0x0}) flock(r0, 0xc) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x100, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffff9c, 0x84, 0x7c, &(0x7f00000000c0)={0x0, 0x6, 0x5}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000140)={r2, 0xd4}, 0x8) write$selinux_attr(0xffffffffffffffff, &(0x7f0000000080)='system_u:object_r:fuse_device_t:s0\x00', 0x23) 09:18:03 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0xfdfdffff00000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 985.896542][T28851] binder: 28848:28851 ioctl c018620c 20008000 returned -1 09:18:04 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000100)=ANY=[@ANYBLOB="0000000000000000b41672d03b005564d7767160ea37b9f6109ff893d604719ae5a765447b422f0c0ebdf444a8c9d89e30a48a9df91b1168b15c3bf195510921d77db381ff977b0530957421d4ff4f8d8f321f9efbbb0f599dec6575e538a814b48f2521bc18"]], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 985.958720][T28853] binder: 28850:28853 ioctl c018620b 0 returned -14 [ 985.981897][T28853] binder: 28850:28853 ioctl c0306201 0 returned -14 [ 986.036382][T28963] binder: 28945:28963 BC_INCREFS_DONE node 2904 has no pending increfs request [ 986.071889][T28963] binder: 28945:28963 BC_INCREFS_DONE node 2907 has no pending increfs request 09:18:04 executing program 4: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x8000000000000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:04 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0xfdfdffff, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:04 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0xffffffff00000000, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 986.101196][ T7897] binder: release 28945:28963 transaction 2903 out, still active [ 986.129257][ T7897] binder: unexpected work type, 4, not freed 09:18:04 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') ioctl$SCSI_IOCTL_SYNC(r1, 0x4) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x802) [ 986.161171][ T7897] binder: send failed reply for transaction 2903, target dead [ 986.195563][ T7897] binder: send failed reply for transaction 2906 to 28945:29054 09:18:04 executing program 5: socket$netlink(0x10, 0x3, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x20000, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000900)={0x0, @in6={{0xa, 0x4e20, 0x0, @mcast1}}}, 0x90) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0xa000000000000005) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) ioctl(0xffffffffffffffff, 0x7, &(0x7f0000000100)) setpriority(0x0, r1, 0x10000) r2 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000680)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) setxattr$security_capability(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000500)=@v2={0x2000000, [{0x7, 0x7f}, {0x80, 0x3f}]}, 0x14, 0x2) write$FUSE_OPEN(r0, &(0x7f0000000780)={0x20, 0x0, 0x3, {0x0, 0x4}}, 0x20) setxattr$security_capability(&(0x7f0000000600)='./file0\x00', &(0x7f0000000d00)='security.capability\x00', &(0x7f0000000c40)=@v3={0x3000000, [{}, {0x90c, 0x3f5d}], r3}, 0x18, 0x0) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f00000002c0)=r1) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000580)='./file0\x00') ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000000ac0)=[&(0x7f0000000b00)='z@\x00', &(0x7f0000000a80)='\x00'], &(0x7f0000000480)=[&(0x7f0000000100)='cpusetlo\x00', &(0x7f0000000140)='md5sumeth0.+selfeth0.bdevk\'\x00', &(0x7f00000001c0)='\x00', &(0x7f0000000200)='security.capability\x00', &(0x7f0000000240)='ppp0mime_type\x00', &(0x7f0000000380)='}+\x00', &(0x7f00000003c0)='system.posix_acl_default\x00', &(0x7f0000000400)='systemwlan0^\x00', &(0x7f0000000440)='z@\x00']) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000580), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000a40)={0x0, 0x9}, &(0x7f0000000b40)=0x8) socket(0x2000000011, 0x3, 0x0) getgroups(0x0, &(0x7f0000000840)) sendmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0x40000) [ 986.267493][T29076] binder: 29075:29076 ioctl c018620b 0 returned -14 [ 986.314712][T29076] binder: 29075:29076 ioctl c0306201 0 returned -14 [ 986.315442][T29083] binder: 29082:29083 BC_INCREFS_DONE node 2913 has no pending increfs request [ 986.345073][T29081] binder: 29078:29081 ioctl c018620b 0 returned -14 [ 986.360047][T29081] binder: BINDER_SET_CONTEXT_MGR already set [ 986.407081][T29091] binder: 29082:29091 BC_INCREFS_DONE u0000000000000000 no match [ 986.423399][T29081] binder: 29078:29081 ioctl 40046207 0 returned -16 [ 986.423429][T12196] binder: send failed reply for transaction 2912 to 29082:29083 09:18:04 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, 0x0, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:18:04 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0xfffffdfd, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:04 executing program 4: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x2000000000003e7, 0x100000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x2, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100), 0x8}, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="b400000075499aa60bb4a0656c4500000000d51b06000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0x265, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0xffffbfffffffffff, 0x0) ioctl$TUNSETIFF(r1, 0x400454d9, &(0x7f0000000000)={'eql\x00\x00\x00\x05I\xe6\x84\xf6\x00\xa0\x00'}) r2 = syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x3, 0x2) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0xf) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x2, 0x0) getsockopt$inet_mreqsrc(r3, 0x0, 0x2e, &(0x7f0000000080)={@multicast1, @rand_addr, @multicast1}, &(0x7f00000000c0)=0xc) 09:18:04 executing program 3: r0 = add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000380)={'syz', 0x0}, &(0x7f0000000480)="22605d920f07ed503185dbf7c36f1627644d8286d444862b8dc2233dcf414380c5f8f74802ea1fd864b12c9ee24496466d4f9a822f178eebea559ab45e39cd0d76b63949208d4109ba44c910507724c53be1259c59fac70b9845d3dce1fc400c4578244e440b1a22d59ec787b6d2dba765d4abf7e5ec3b9b9beb1f84189505c6ae35f7a449a7116dd82a526fb6e68dab7bc27ce735fe4b658cbcbd82d97729ecea614595342f776a0ebcfcfd744dcce15043ef24a152506f9be3ccdc182411144679cea7c5c923a6cb16f21ec589515ecc", 0xd1, 0xfffffffffffffffc) keyctl$invalidate(0x15, r0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc00c64b5, &(0x7f0000000580)={&(0x7f00000003c0)=[0x0, 0x0, 0x0, 0x0], 0x4}) ioctl$TCGETA(r1, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) mount(&(0x7f0000000040)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='efivarfs\x00', 0x0, &(0x7f0000000180)='/dev/binder#\x00') syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:04 executing program 5: socket$netlink(0x10, 0x3, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x20000, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000900)={0x0, @in6={{0xa, 0x4e20, 0x0, @mcast1}}}, 0x90) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0xa000000000000005) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) ioctl(0xffffffffffffffff, 0x7, &(0x7f0000000100)) setpriority(0x0, r1, 0x10000) r2 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000680)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) setxattr$security_capability(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000500)=@v2={0x2000000, [{0x7, 0x7f}, {0x80, 0x3f}]}, 0x14, 0x2) write$FUSE_OPEN(r0, &(0x7f0000000780)={0x20, 0x0, 0x3, {0x0, 0x4}}, 0x20) setxattr$security_capability(&(0x7f0000000600)='./file0\x00', &(0x7f0000000d00)='security.capability\x00', &(0x7f0000000c40)=@v3={0x3000000, [{}, {0x90c, 0x3f5d}], r3}, 0x18, 0x0) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f00000002c0)=r1) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000580)='./file0\x00') ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000000ac0)=[&(0x7f0000000b00)='z@\x00', &(0x7f0000000a80)='\x00'], &(0x7f0000000480)=[&(0x7f0000000100)='cpusetlo\x00', &(0x7f0000000140)='md5sumeth0.+selfeth0.bdevk\'\x00', &(0x7f00000001c0)='\x00', &(0x7f0000000200)='security.capability\x00', &(0x7f0000000240)='ppp0mime_type\x00', &(0x7f0000000380)='}+\x00', &(0x7f00000003c0)='system.posix_acl_default\x00', &(0x7f0000000400)='systemwlan0^\x00', &(0x7f0000000440)='z@\x00']) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000580), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000a40)={0x0, 0x9}, &(0x7f0000000b40)=0x8) socket(0x2000000011, 0x3, 0x0) getgroups(0x0, &(0x7f0000000840)) sendmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0x40000) 09:18:04 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x630b, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:04 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x100000000000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 986.874113][T29234] binder: 29201:29234 BC_INCREFS_DONE u0000000000000000 no match 09:18:05 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x4) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 987.006628][T29273] binder: 29256:29273 ioctl c018620b 0 returned -14 09:18:05 executing program 4: r0 = socket$vsock_dgram(0x28, 0x2, 0x0) ioctl$FS_IOC_FSGETXATTR(0xffffffffffffffff, 0x801c581f, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f00000015c0)='veth1\x00\x00\x00\x00\xff\xff\xff\xff\xff\xef\x00', 0xb) fremovexattr(0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000004c0)='IPVS\x00') r2 = dup2(r1, r0) sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f0000000100)={&(0x7f00000000c0)={0x10, 0x0, 0xfffffffd}, 0xc, &(0x7f0000000140)={&(0x7f0000000800)=ANY=[@ANYBLOB], 0x1}}, 0x44801) syz_genetlink_get_family_id$tipc2(&(0x7f0000000300)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000005c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x14400000}, 0xc, &(0x7f0000000580)={&(0x7f0000001600)=ANY=[@ANYBLOB="20002dbd7000fddbdf250300000034000900080002000400000008000200fcffffff080001000800000008000216b60a1d0008000100080000000800020003000000540004000c00070008000100030000000c00010073797a31000000000c00010073797a30000000002c00070008000300060000000800010013000000080001000a000000080001001a00000008000200060000008c00040024000700080001001e0000000800010007000000080004000500000008000100010000000c00010073797a31000000002c00070008000100050000000800010000000000080003000000010008000300ff0f000008000200040000001400010062726f6164636173742d6c696e6b00000c00010073797a30000000000c00010073797a3000000000740004000c00010073797a30000000001400010062726f6164636173742d6c696e6b00001400010062726f6164636173742d6c696e6b00000c00070008000300070000000c00010073797a31000000000c00010073797a30000000000c00010073797a31000000000c00010073797a310000000028000600080001008a00000008000100c0ffffff08000100010400000800010020000000040002001400060004000200040002000400020004000200940001001000010069623a6970365f76746930002c0004001400010002004e23ffffffff00000000000000001400020002004e247f0000010000000000000000100001006574683a79616d3000000000380004001400010002004e23ac1414aa0000000000000000200002000a004e2100000007fe800000000000000000000000000016010000000c00010069623a6e723000003800060008000100010000000400020008000100000100000400020008000100ff0300000400020008000100010000000800010001000000300101004c000200080003000900000008000200000000000800010004000000080001001c000000080003000f000000080003000000000008000100180000000800040003000000080004000800000038000400200001000a004e2200000001fe8000000000000000000000000000bb810000001400020002004e23ac141421000000000000000008000300060000001000010069623a6970365f767469300044000400200001000a004e21000000d7fe880000000000000000000000000001d9000000200002000a004e2400000006fe8000000000000000000000000000250500000044000200080004000000000008000200f7ffffff080004000000000008000400ff7f0000080001001700000008000400fbffffff080002000000000008000400ff0700000800030004000000a4a5fdea403f60e1a4429aca4cff05d5559291a021224c2d77782690bdfa93de2563edadefa7df20b2e07157cf727fe22a33817101cc49113040c8049517ba06ba00008f547837a6c24c55ad584af67c3d96478098f91d8da8480c6026d49572f9c8e16042a5023823a9a20f2a3250a0ad78d5965e7de7a8574365616bd0692db0f1164da482b58055249b667b15bb714370e0c6a2ed2b81199389ca3a8acc8db84299c4cefb02361269711acb71bc394314f2f239242e60c940f8d82a67d8888287f74bae27ed9cca639c93721ebb918d6447009bd53dd526f3402cf64100cd1777072c9c7dc269d50b11"], 0x1}, 0x1, 0x0, 0x0, 0x40}, 0x48804) sendmsg$FOU_CMD_DEL(r2, &(0x7f0000000040)={&(0x7f0000000180), 0xc, &(0x7f0000000280)={&(0x7f0000000200)=ANY=[]}}, 0x0) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) sendto$inet(r1, &(0x7f0000000000), 0xfffffdef, 0xc0, 0x0, 0x0) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000800)=ANY=[@ANYBLOB="00000000010400bfe3b9f7435306e5000000000000000000000000002857fc74b05576fe51d40eeabdd9e0f06dbbcc47f071a3457824210bf3441d0f24109d7521c457c0840af8be8f7c9bc14461befd92504882083471c5bf46bdfe9071e6697a41a3513c3163a4624d73458cabbd7a16c619ff86e02f6d7baf9490d0eec33c5cb8038591083f1033d5f3553acd4da97f4fa72f19dbf882c2665799168c350e2dbf3145303b83573e633819a0771a9da6670742896ac7dec1ee166d1624531eae4bdf670792a80d5582e2b2222baff0abe837f6476a042f79f5e8652d27e6ab1279534e0e449a164ae40df52d64cae71dc51540e62da0c9b838892736d85433a7b9731c42ac00000000000000000000000000000000"]) mincore(&(0x7f0000ffb000/0x3000)=nil, 0x3000, &(0x7f00000003c0)=""/67) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000007c0)='./cgroup.net/syz0\x00', 0x200002, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000600), 0x4) openat$cgroup_procs(r3, &(0x7f0000000340)='cgroup.procs\x00', 0x2, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000500)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r2, &(0x7f0000000540)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x30, r4, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, 0x0, 0x5, 0x0, {0x14, 0x19, {0x1, 0x7, 0x9, 0x2}}}, [""]}, 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x801) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000680)=ANY=[@ANYBLOB="520000007e0d13ba788a000000000200000182361fbc4465c9339b0ec7bec94e"], 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff7ffffffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/\x00\x00\x00\x0e\x00\x00\x00\x00\x00\x00\a/expire_nodest_conn\x00', 0x2, 0x0) ioctl$IMSETDEVNAME(r2, 0x80184947, &(0x7f0000000640)={0x8000000007, 'syz0\x00'}) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x400000000000000) getdents(r5, &(0x7f0000000200)=""/148, 0x94) 09:18:05 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x200000000000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 987.049225][T29330] binder: 29329:29330 got transaction to context manager from process owning it [ 987.061517][T29273] binder: 29256:29273 ERROR: BC_REGISTER_LOOPER called without request [ 987.084352][T29273] binder: 29256:29273 unknown command 0 09:18:05 executing program 5: socket$netlink(0x10, 0x3, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x20000, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000900)={0x0, @in6={{0xa, 0x4e20, 0x0, @mcast1}}}, 0x90) sched_setaffinity(0x0, 0x8, &(0x7f0000000340)=0xa000000000000005) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x3, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpgrp(0xffffffffffffffff) ioctl(0xffffffffffffffff, 0x7, &(0x7f0000000100)) setpriority(0x0, r1, 0x10000) r2 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000680)={{{@in, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@local}}, &(0x7f0000000280)=0xe8) setxattr$security_capability(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='security.capability\x00', &(0x7f0000000500)=@v2={0x2000000, [{0x7, 0x7f}, {0x80, 0x3f}]}, 0x14, 0x2) write$FUSE_OPEN(r0, &(0x7f0000000780)={0x20, 0x0, 0x3, {0x0, 0x4}}, 0x20) setxattr$security_capability(&(0x7f0000000600)='./file0\x00', &(0x7f0000000d00)='security.capability\x00', &(0x7f0000000c40)=@v3={0x3000000, [{}, {0x90c, 0x3f5d}], r3}, 0x18, 0x0) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f00000002c0)=r1) pivot_root(&(0x7f0000000080)='./file0\x00', &(0x7f0000000580)='./file0\x00') ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000640), 0xffffffffffffffff) execve(&(0x7f0000000300)='./file0\x00', &(0x7f0000000ac0)=[&(0x7f0000000b00)='z@\x00', &(0x7f0000000a80)='\x00'], &(0x7f0000000480)=[&(0x7f0000000100)='cpusetlo\x00', &(0x7f0000000140)='md5sumeth0.+selfeth0.bdevk\'\x00', &(0x7f00000001c0)='\x00', &(0x7f0000000200)='security.capability\x00', &(0x7f0000000240)='ppp0mime_type\x00', &(0x7f0000000380)='}+\x00', &(0x7f00000003c0)='system.posix_acl_default\x00', &(0x7f0000000400)='systemwlan0^\x00', &(0x7f0000000440)='z@\x00']) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000580), 0x4) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000a40)={0x0, 0x9}, &(0x7f0000000b40)=0x8) socket(0x2000000011, 0x3, 0x0) getgroups(0x0, &(0x7f0000000840)) sendmmsg(0xffffffffffffffff, &(0x7f0000000540), 0x0, 0x40000) [ 987.111523][T29343] binder: 29329:29343 BC_INCREFS_DONE node 2922 has no pending increfs request [ 987.122105][T29273] binder: 29256:29273 ioctl c0306201 20000440 returned -22 [ 987.155462][T29330] binder: BINDER_SET_CONTEXT_MGR already set [ 987.207736][T29330] binder: 29329:29330 ioctl 40046207 0 returned -16 [ 987.243237][T29343] binder_alloc: 29329: binder_alloc_buf, no vma [ 987.279334][T12196] binder: release 29396:29398 transaction 2925 out, still active [ 987.297510][T12196] binder: unexpected work type, 4, not freed [ 987.321854][T12196] binder: release 29396:29458 transaction 2928 out, still active 09:18:05 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000040)) [ 987.565026][ T7897] binder: send failed reply for transaction 2925, target dead [ 987.581236][ T7897] binder: send failed reply for transaction 2928, target dead [ 987.614997][T29558] binder: 29557:29558 BC_INCREFS_DONE u0000000000000000 no match 09:18:05 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, 0x0, 0x0) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:18:05 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x300000000000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) 09:18:05 executing program 5: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x400080, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000180)={0x0, 0x21, "d121c4bbf2dde467962a5437d3de9f1d4f6134f8b0ec60e11a84c0b06e7fa1b848"}, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000200)=@sack_info={r1, 0x80, 0xfffffffffffffffb}, 0xc) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x800000000000000, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat(0xffffffffffffffff, 0x0, 0x0, 0x3) ioctl$KVM_SET_TSC_KHZ(0xffffffffffffffff, 0xaea2, 0x0) ioctl$PERF_EVENT_IOC_ID(0xffffffffffffffff, 0x80082407, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f00000003c0)={r1, 0xeb, "270586cfcb1c5ff30a84bea8d2373b2107955f8a38ba67cc20be54a4af574556c3a641a679194a789828a2141e3abbccb0c29b9f0ae55c1d691be65967325e81de70c8c86051619c6390bb6472262544d259a492ffacb77db718a3a4e7d5f3acb86fc11c6b762623cecd8bb09503857ae52ce4f5c7dce529cb1c091cfa68c9f4fbfdeb898295629e8b3054941b9d213428a9267d579427589937edf6bdf8834e0214515411c21599c49ce0f2f48c63120bc05cf3989b2a7e5e487e0ff1925f8ec3195c71e64a0b162ac83c22e8938a8286a4902058d95c990722f32a29083829339a947df649c417d05c05"}, &(0x7f0000000100)=0xf3) fadvise64(r2, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f00000002c0)={r1, @in6={{0xa, 0x4e21, 0x6, @rand_addr="8cc810756c446fdbf50c8011d104cda6", 0x80}}, [0x5, 0x7ff, 0x5, 0xfffffffffffffff7, 0x2, 0x22b6, 0x1000, 0x80000001, 0x9, 0x32, 0x3, 0x8001, 0xfff, 0x9]}, &(0x7f0000000080)=0x100) setsockopt$RDS_CONG_MONITOR(r3, 0x114, 0x6, &(0x7f00000000c0)=0x1, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000240)={'vcan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'teql0\x00', r4}) ioctl$RNDCLEARPOOL(r0, 0x5206, &(0x7f0000000040)=0x4) unshare(0x40000000) 09:18:05 executing program 4: getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0x8}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000700)={0x0, 0x56, "c7eede51b7982d4ddb0282970898e40df2cf6d498e34bc9e68beee7910f07ae18e19a949be764a4ece575b0db6792806dbe78e3d98542d0a8bb1b4e5a268bd2bc15cadd837a408bf4abe9d2c34dd2de33948ca811c8f"}, &(0x7f0000000780)=0x5e) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f00000007c0)=@assoc_value={r0, 0x20}, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000480)='/dev/vbi#\x00', 0xffffffffffffffff, 0x2) ioctl$EVIOCSABS2F(r1, 0x401845ef, &(0x7f00000006c0)={0x0, 0x1000, 0x4, 0x1e, 0x7}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x4, [0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000040)=0x14) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = dup3(r2, r2, 0x80000) recvmsg$kcm(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f00000001c0)=""/84, 0x54}, {&(0x7f0000000240)=""/194, 0xc2}, {0x0}, {&(0x7f0000000340)=""/34, 0x22}, {&(0x7f0000000380)=""/49, 0x31}, {&(0x7f00000003c0)=""/10, 0xa}, {&(0x7f0000000500)=""/242, 0xf2}], 0x7, &(0x7f0000000600)=""/146, 0x92}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)={0x18, 0x22, 0x1, 0x0, 0x0, {0x4000000004}, [@typed={0x4, 0x12}]}, 0x18}, 0x1, 0x0, 0x0, 0x400f}, 0x0) 09:18:05 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x630c, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:05 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1, 0xffffffff}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffffff) r2 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x1, 0x0) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x210) unlink(&(0x7f0000000900)='./file0/file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0xa7, 0x0, &(0x7f0000000480)=ANY=[@ANYPTR64=&(0x7f0000000180)=ANY=[@ANYPTR=&(0x7f0000000040)=ANY=[@ANYRES16=0x0, @ANYRESOCT=r2, @ANYRES32=0x0, @ANYRES64=r0]], @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="a3287516bceb3677dba073e0215cbb40ecd14549e52462aab563f6e331fda8ce8765e22195f84ad81324a45855342cc34d6f8056e1a4d99148247f4ffde19596f939a7898464e9f0835657e17f0301bbb8f7d437c99b790a25dca6c1db75436faa8ce1ee3c128750643b80a3e5110bca92209419de71b7d9bac61c482f0cbd8980774460d002a0d427f94a64e2a83c889384f6c1000000"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 987.725201][T29566] binder: 29565:29566 unknown command 536871296 [ 987.743926][T29566] binder: 29565:29566 ioctl c0306201 20000440 returned -22 [ 987.771632][T29566] binder: 29565:29566 BC_INCREFS_DONE u0000000000000000 no match [ 987.788066][T29569] binder: 29562:29569 ioctl c018620b 0 returned -14 [ 987.815810][T29569] binder: 29562:29569 unknown command 0 [ 987.829166][T29569] binder: 29562:29569 ioctl c0306201 20000440 returned -22 [ 987.850123][T29569] binder: 29562:29569 ioctl c0306201 0 returned -14 [ 987.857930][T29577] binder: 29565:29577 unknown command 536871296 09:18:06 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x400000000000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 987.883033][T29577] binder: 29565:29577 ioctl c0306201 20000440 returned -22 [ 987.925462][T29566] binder: 29565:29566 BC_INCREFS_DONE u0000000000000000 no match 09:18:06 executing program 2: open(0x0, 0x40, 0x20) ioctl$TCGETA(0xffffffffffffffff, 0x5405, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x630d, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 09:18:06 executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) openat$tun(0xffffffffffffff9c, &(0x7f0000000040)='/dev/net/tun\x00', 0x482000, 0x0) ioctl$TCGETA(r1, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0x4008af12, &(0x7f0000000080)={0x1}) fadvise64(r0, 0x16, 0x0, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x4308c0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 09:18:06 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x500000000000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 988.214731][T29690] binder_transaction: 29 callbacks suppressed [ 988.214748][T29690] binder: 29688:29690 transaction failed 29189/-22, size 24-8 line 2994 [ 988.245135][T29687] binder: 29685:29687 ioctl c018620b 0 returned -14 [ 988.285756][T29691] binder: 29688:29691 BC_INCREFS_DONE u0000000000000000 no match [ 988.298509][T29687] binder: 29685:29687 unknown command 0 [ 988.319301][T29687] binder: 29685:29687 ioctl c0306201 20000440 returned -22 [ 988.341294][T29691] binder: 29688:29691 BC_INCREFS_DONE node 2938 has no pending increfs request [ 988.372029][ T7897] binder: release 29692:29693 transaction 2940 out, still active [ 988.389468][ T7897] binder: unexpected work type, 4, not freed 09:18:06 executing program 3: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x20) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0x4008af12, &(0x7f0000000080)={0x1}) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR64=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="0000000060c50000"]], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x4, 0x0, &(0x7f0000000040)=[@exit_looper], 0xe7, 0x0, &(0x7f0000000580)="b367cd39bf029139571e8c48f29c614f4e98ec36070db48081f71ccf7735e91d3132e4582ba1196aaf9fb84dfb2a26156e94e24a43eeb029248612732e5adb6915683101f183030adb2674cce5c6500c84ed2db4d72e13e82a8050acad22c994d06ce56db0401e5b7828210b30594e19676cf3746223ca96c7f6c0e58f2acc0259e8828484d5c83934a8832a1218a30c2316b71e5781b9dae1e1f161e13c75440b4db329742052aa0fb53f766fa5aeb00d708522b9f6059778fd5a365b9de510eaf4eeff915e8f491a0fdbbc0aad209512979521d08949f90998fa5d6b045c4ca428ad51e89a74"}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) [ 988.425540][ T7897] binder_release_work: 7 callbacks suppressed [ 988.425544][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 988.434969][T29571] IPVS: ftp: loaded support on port[0] = 21 09:18:06 executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x600000000000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 988.508336][ T7897] binder: release 29688:29690 transaction 2937 out, still active [ 988.572138][ T7897] binder: unexpected work type, 4, not freed [ 988.612201][ T7897] binder: undelivered TRANSACTION_COMPLETE 09:18:06 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x1e, &(0x7f0000000180)=0x400000001, 0x4) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000356000), 0x4) connect$inet6(r0, &(0x7f00000001c0)={0xa, 0x0, 0x0, @remote, 0xa}, 0x1c) sendto$inet6(r0, &(0x7f0000000000)="eeb2f95e9ebcf7802ebd091224b641c93a935798ed0c2cd7ba4c320121b4cc3def5b9a6a15a9fde0fb6dc63c9176d435d79b528b4a546d793a485f6f42ba95936481e1d6bce3b1e5d02bdb1d40c30c19702558e3bfff66f07d4b3099b0f0a8b0537e31d89385a6403d1b4bb154ac64c5b8f15e0c0f9b68fea1969b5d9d6975f1d25300313b6322a27b0b1cd0f700d66e373ba14431bd9bbaf8afb3125f168f0bfd26754a43c1f9b3876a6feced2b0589c11e28ed50dc5d5ffb7aedf700efb83a1d0760802c53335e92d776e4969065", 0xcf, 0x4000000, &(0x7f0000000100)={0xa, 0x4e22, 0x2, @ipv4={[], [], @loopback}, 0x5}, 0x1c) 09:18:06 executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40, 0x0) ioctl$TCGETA(r0, 0x5405, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0x4008af12, 0x0) dup2(0xffffffffffffffff, 0xffffffffffffffff) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x7, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) unlink(&(0x7f0000000900)='./file0/file0\x00') r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000640)='./file0/file0\x00', &(0x7f0000000780)=""/195) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000080)) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={&(0x7f0000000480), 0xc, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x40001) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0x14, 0x500000000000000, &(0x7f0000000280)=[@increfs_done={0x40106308, 0x0, 0x3f00000000000000}], 0x0, 0x0, &(0x7f0000000780)}) [ 988.629497][ T7897] binder_release_work: 36 callbacks suppressed [ 988.629504][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 988.633137][T29904] ------------[ cut here ]------------ [ 988.642823][ T7897] binder: release 29692:29722 transaction 2943 out, still active [ 988.647295][T29904] kernel BUG at drivers/android/binder_alloc.c:1141! [ 988.688861][T29890] IPVS: ftp: loaded support on port[0] = 21 [ 988.709904][T29911] binder_alloc: 29685: binder_alloc_buf, no vma [ 988.720630][ T7897] binder: unexpected work type, 4, not freed [ 988.738536][T29911] binder: 29907:29911 transaction failed 29189/-3, size 24-8 line 3147 [ 988.749394][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 988.754281][T29904] invalid opcode: 0000 [#1] PREEMPT SMP KASAN [ 988.759990][ T7897] binder: release 29905:29906 transaction 2947 out, still active [ 988.761278][T29904] CPU: 0 PID: 29904 Comm: syz-executor.3 Not tainted 5.1.0-rc2+ #40 [ 988.761287][T29904] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 988.761307][T29904] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 988.761322][T29904] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 988.761337][T29904] RSP: 0018:ffff888036adf6d8 EFLAGS: 00010212 [ 988.784565][ T7897] binder: unexpected work type, 4, not freed [ 988.787094][T29904] RAX: 0000000000040000 RBX: 0000000020001060 RCX: ffffc9000c432000 [ 988.787103][T29904] RDX: 000000000000033f RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 988.787112][T29904] RBP: ffff888036adf758 R08: ffff88803cc2a3c0 R09: 0000000000000028 [ 988.787134][T29904] R10: ffffed1006d5bf32 R11: ffff888036adf997 R12: 0000000000000020 [ 988.787143][T29904] R13: 0000000000000028 R14: ffff888097b42f90 R15: 0000000000000000 [ 988.787156][T29904] FS: 0000000000000000(0000) GS:ffff8880ae800000(0063) knlGS:00000000f5df3b40 [ 988.787165][T29904] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 988.787174][T29904] CR2: 000000000814b000 CR3: 000000008f946000 CR4: 00000000001406f0 [ 988.787182][T29904] Call Trace: [ 988.787204][T29904] ? memcpy+0x46/0x50 [ 988.787226][T29904] binder_alloc_copy_from_buffer+0x37/0x42 [ 988.794095][ T7897] binder: undelivered TRANSACTION_COMPLETE [ 988.813323][T29904] binder_get_object+0xc3/0x200 [ 988.813345][T29904] binder_transaction+0x2b4a/0x6690 [ 988.813382][T29904] ? binder_thread_read+0x3d50/0x3d50 [ 988.813411][T29904] ? __might_fault+0x12b/0x1e0 [ 988.813433][T29904] ? lock_downgrade+0x880/0x880 [ 988.820094][ T7897] binder: send failed reply for transaction 2937, target dead [ 988.825463][T29904] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 988.825502][T29904] ? _copy_from_user+0xdd/0x150 [ 988.825522][T29904] binder_thread_write+0x64a/0x2820 [ 988.825539][T29904] ? __lockdep_free_key_range+0x120/0x120 [ 988.825562][T29904] ? binder_transaction+0x6690/0x6690 [ 988.825583][T29904] ? __might_fault+0x12b/0x1e0 [ 988.834536][ T7897] binder: send failed reply for transaction 2940, target dead [ 988.841531][T29904] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 988.841548][T29904] ? _copy_from_user+0xdd/0x150 [ 988.841567][T29904] binder_ioctl+0x1033/0x183b [ 988.841589][T29904] ? binder_thread_write+0x2820/0x2820 [ 988.841611][T29904] ? __fget+0x381/0x550 [ 988.850135][ T7897] binder: send failed reply for transaction 2943, target dead [ 988.857590][T29904] ? ksys_dup3+0x3e0/0x3e0 [ 988.857606][T29904] ? get_old_timespec32+0x200/0x200 [ 988.857627][T29904] ? tomoyo_file_ioctl+0x23/0x30 [ 988.857642][T29904] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 988.857659][T29904] ? security_file_ioctl+0x93/0xc0 [ 988.857678][T29904] ? binder_thread_write+0x2820/0x2820 [ 988.857695][T29904] __ia32_compat_sys_ioctl+0x197/0x620 [ 988.857718][T29904] do_fast_syscall_32+0x281/0xc98 [ 988.866255][ T7897] binder: send failed reply for transaction 2947, target dead [ 988.874603][T29904] entry_SYSENTER_compat+0x70/0x7f [ 988.874616][T29904] RIP: 0023:0xf7ff7869 [ 988.874632][T29904] Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 [ 988.874640][T29904] RSP: 002b:00000000f5df30cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036 [ 988.874653][T29904] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000c0306201 [ 988.874662][T29904] RDX: 0000000020000440 RSI: 0000000000000000 RDI: 0000000000000000 [ 988.874670][T29904] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 988.874679][T29904] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 988.874687][T29904] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 988.874704][T29904] Modules linked in: [ 988.882316][T29571] kobject: 'rx-0' (00000000345a98db): kobject_uevent_env [ 988.907125][T29904] ---[ end trace f0f2cce7b22a8637 ]--- [ 988.914771][ T3875] kobject: 'loop1' (00000000f2b622f1): kobject_uevent_env [ 988.918728][T29904] RIP: 0010:binder_alloc_do_buffer_copy+0xd6/0x510 [ 988.931120][ T3875] kobject: 'loop1' (00000000f2b622f1): fill_kobj_path: path = '/devices/virtual/block/loop1' [ 988.934164][T29904] Code: 02 00 0f 85 20 04 00 00 4d 8b 64 24 58 49 29 dc e8 4f f4 23 fc 4c 89 e6 4c 89 ef e8 64 f5 23 fc 4d 39 e5 76 07 e8 3a f4 23 fc <0f> 0b e8 33 f4 23 fc 4c 8b 75 d0 4d 29 ec 4c 89 e6 4c 89 f7 e8 41 [ 988.982148][T29571] kobject: 'rx-0' (00000000345a98db): fill_kobj_path: path = '/devices/virtual/net/tunl0/queues/rx-0' [ 989.000134][T29904] RSP: 0018:ffff888036adf6d8 EFLAGS: 00010212 [ 989.017261][ T7897] binder: undelivered TRANSACTION_ERROR: 29189 [ 989.019942][T29904] RAX: 0000000000040000 RBX: 0000000020001060 RCX: ffffc9000c432000 [ 989.029154][T29571] kobject: 'tx-0' (000000004fe644d8): kobject_add_internal: parent: 'queues', set: 'queues' [ 989.029665][T29904] RDX: 000000000000033f RSI: ffffffff854c7d46 RDI: 0000000000000006 [ 989.041115][T29571] kobject: 'tx-0' (000000004fe644d8): kobject_uevent_env [ 989.046735][ T3875] kobject: 'loop4' (00000000ff6ba2d8): kobject_uevent_env [ 989.056432][T29571] kobject: 'tx-0' (000000004fe644d8): fill_kobj_path: path = '/devices/virtual/net/tunl0/queues/tx-0' [ 989.057236][ T3875] kobject: 'loop4' (00000000ff6ba2d8): fill_kobj_path: path = '/devices/virtual/block/loop4' [ 989.070331][T29904] RBP: ffff888036adf758 R08: ffff88803cc2a3c0 R09: 0000000000000028 [ 989.294031][T29904] R10: ffffed1006d5bf32 R11: ffff888036adf997 R12: 0000000000000020 [ 989.302163][T29904] R13: 0000000000000028 R14: ffff888097b42f90 R15: 0000000000000000 [ 989.304520][T29571] kobject: 'gre0' (0000000034d1ca33): kobject_add_internal: parent: 'net', set: 'devices' [ 989.311050][T29904] FS: 0000000000000000(0000) GS:ffff8880ae800000(0063) knlGS:00000000f5df3b40 [ 989.325573][T29571] kobject: 'gre0' (0000000034d1ca33): kobject_uevent_env [ 989.329512][T29904] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 989.343121][T29904] CR2: 00007f4237e57000 CR3: 000000008f946000 CR4: 00000000001406f0 [ 989.343951][T29571] kobject: 'gre0' (0000000034d1ca33): fill_kobj_path: path = '/devices/virtual/net/gre0' [ 989.351575][T29904] Kernel panic - not syncing: Fatal exception [ 989.361300][T29571] kobject: 'queues' (00000000f24e9ec7): kobject_add_internal: parent: 'gre0', set: '' [ 989.367818][T29904] Kernel Offset: disabled [ 989.382168][T29904] Rebooting in 86400 seconds..