7f00000000c0)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, &(0x7f0000000240)={@mcast1}, &(0x7f0000000280)=0x14) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000002800)=ANY=[], 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, 0x0) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="0b00000000000000000000000000fb454dcf028759e145b3d49b1b8d222e8de9c65b8b6d2b9d0fffab33cd36aebd34922d04ee22698cc1cc57587119e911f242aaf00c890d3f341743a4d88623285ce91a44cb527ae991b4dd050b2dc492359ba0c9fbc9645c5afb3327def47819adc5ad4efcb72a57667c0d1866888ff81719236fb107d5cf7f02b2e811e6f181d724"], 0x1}}, 0x0) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) readv(r1, &(0x7f0000000100), 0x0) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={0x14, 0x22, 0x1, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 14:59:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$dupfd(r2, 0x0, r1) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b6b6b00], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 988.971231] binder: 14674:14675 ioctl c0306201 0 returned -14 14:59:33 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r1}}, 0x30) r2 = getpid() wait4(r2, 0x0, 0x1000000, 0x0) getitimer(0x0, &(0x7f0000000040)) 14:59:33 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r1}}, 0x30) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f00000000c0)={{0x3, 0x2, 0x1, 0x0, 0x9}, 0x5, 0x4}) 14:59:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$dupfd(r2, 0x0, r1) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:33 executing program 2: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x40, 0x0) setxattr$trusted_overlay_nlink(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)='trusted.overlay.nlink\x00', &(0x7f00000002c0)={'L+', 0x7}, 0x28, 0x2) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x1009}}, 0x20) r2 = syz_open_dev$admmidi(&(0x7f0000000180)='/dev/admmidi#\x00', 0xffffffff, 0x40000) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f00000001c0)={0x12, 0x10, 0xfa00, {&(0x7f00000000c0), r1, r2}}, 0x18) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r3, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r4}}, 0x30) 14:59:33 executing program 0: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$dupfd(r2, 0x0, r1) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:33 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r1}}, 0x30) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f00000000c0)={{0x3, 0x2, 0x1, 0x0, 0x9}, 0x5, 0x4}) 14:59:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$dupfd(r2, 0x0, r1) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:33 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r1}}, 0x30) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r0, 0x40485404, &(0x7f00000000c0)={{0x3, 0x2, 0x1, 0x0, 0x9}, 0x5, 0x4}) 14:59:33 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x2, 0x0) write$FUSE_GETXATTR(r1, &(0x7f00000000c0)={0x18, 0x0, 0x8, {0x4}}, 0x18) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) readahead(r3, 0x2, 0x8) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r2}}, 0x30) ioctl$VIDIOC_G_SELECTION(r1, 0xc040565e, &(0x7f0000000140)={0xc, 0x100, 0x2, {0x1, 0x48, 0x4, 0x7f}}) 14:59:33 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) fcntl$setlease(r0, 0x400, 0x2) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r1}}, 0x30) 14:59:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x6, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="106308400000"], 0x0, 0xfdfdffff, 0x0}) 14:59:33 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:33 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0xffffffffffffff11, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback, 0xfffffffffffffffe}, r1}}, 0x30) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000040)={0x13, 0x10, 0xfa00, {&(0x7f00000003c0), r1}}, 0x18) r2 = syz_open_dev$usbmon(&(0x7f00000002c0)='/dev/usbmon#\x00', 0x6, 0x80) ioctl$TUNSETVNETBE(r2, 0x400454de, &(0x7f0000000100)) 14:59:33 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r1}}, 0x30) 14:59:33 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) fcntl$setlease(r0, 0x400, 0x2) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r1}}, 0x30) [ 989.859084] binder: 14724:14727 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 989.887432] binder: undelivered death notification, 0000000000000000 14:59:34 executing program 2: r0 = syz_open_dev$dri(&(0x7f0000000040)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r0, 0xffaffff7bfffffb7, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000300)='/dev/cachefiles\x00', 0x311500, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KVM_GET_API_VERSION(r4, 0xae00, 0x0) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x2, 0x7}}, 0x20) write$binfmt_elf32(r2, &(0x7f0000001240)=ANY=[@ANYBLOB="7f454c46ff0403b40200000000000000030003000400000065020000380000002b0000001f000000050020000100050000000800000000000700000001040000feffffff24c10000ffffffff81000000080000000600000053e5746408000000000000008b75000020000000320400000800000001010000b9f122bb28373daa47bf5bcaeff14a206bc4d25178ae0f1ea504bfa402c879fab3ee1bbad934b8150f92f7c1c7356d85e026c514e318fb7dd1e1a69c52be3dd0cf13e474f8235e1569556a29444c594700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a4e70330831eeecb8ca400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000da2240558e9182c0e1cedb2cc35f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000018c1707900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044c672f4c47bcef882315745f6354615a15dd54e0020a0459ad1a20c4caaba470224c6a9202644e9001366471b6ff19ee0c9e9ae5ceef2eead629a97c8884b808c8f79fc1f298b18ee6b25e40c2344e1a49d2561b33f69758410e0d861a145bbb9"], 0x6c8) r5 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x2, 0x800) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f00000004c0)={0x0, 0xb0, &(0x7f0000000400)=[@in={0x2, 0x4e21, @multicast1}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, @in6={0xa, 0x4e23, 0x0, @loopback, 0x8}, @in6={0xa, 0x4e24, 0xff, @dev={0xfe, 0x80, [], 0x12}, 0x8}, @in6={0xa, 0x4e24, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x7}, @in6={0xa, 0x4e21, 0x400, @mcast2, 0xc6}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x20}}, @in={0x2, 0x4e20, @multicast2}]}, &(0x7f0000000500)=0x10) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f0000000580)={0x0, 0xe5, "1b982335b6e95de75f02915feb67cca268af275f92f834973d04be75a78107ffeb935472c52bdc66323004346e5e2723af103cdeb1580a03a114a5575bd5676cbc0ce3835fdb2fbfd8ffd0ddea0aeafc95298ea1309f318e3546a28534db818891b8e6cd661fb73fb642932606526ae59518d3280a01b8ef95802f41ba46b9455e28e156e998e9df504f43cecf77cff2b7cde03395d6d1091ba3793d727c32ae4c7dd8681436f84109cccd8de634cb4dcc4d5a75596457b0a2ec52db0b3e00a67ce55d8d52e2626cc6182578b06e0261db76341946d8558dd5f6874fe68e4f1ccf7c2e7153"}, &(0x7f0000000680)=0xed) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r3, 0x84, 0x22, &(0x7f00000006c0)={0x8}, &(0x7f0000000700)=0x10) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000900)={0x2, 0x0, 0x8209, 0x6d, 0x100000000, 0x5, 0x3, 0xa39}, &(0x7f0000000940)=0x20) getsockopt$inet_sctp_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000980)={0x0, 0x446, 0x40, 0x4}, &(0x7f00000009c0)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f0000000840)={r6, @in6={{0xa, 0x4e21, 0x7, @rand_addr="e7bfc07d318e87b23b9e7c61c3be7c4f"}}}, &(0x7f0000000740)=0x25462c97) setsockopt$netlink_NETLINK_CAP_ACK(r5, 0x10e, 0xa, &(0x7f0000000080)=0x40, 0x4) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f0000000140)={r7, 0x7}, &(0x7f00000002c0)=0x8) ioctl$sock_ifreq(r4, 0x8937, &(0x7f0000000200)={'veth0_to_bridge\x00', @ifru_flags=0x1a01}) write$RDMA_USER_CM_CMD_MIGRATE_ID(r1, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), 0xffffffffffffffff, r1}}, 0x18) 14:59:34 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:34 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0xffffffffffffff11, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback, 0xfffffffffffffffe}, r1}}, 0x30) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000040)={0x13, 0x10, 0xfa00, {&(0x7f00000003c0), r1}}, 0x18) r2 = syz_open_dev$usbmon(&(0x7f00000002c0)='/dev/usbmon#\x00', 0x6, 0x80) ioctl$TUNSETVNETBE(r2, 0x400454de, &(0x7f0000000100)) 14:59:34 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:34 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) fcntl$setlease(r0, 0x400, 0x2) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback}, r1}}, 0x30) 14:59:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:34 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:34 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = request_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000140)='\xf8({em1\x00', 0x0) r1 = add_key(&(0x7f0000000200)='id_legacy\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)="09e2ad7f0b0e0763246832652771e6d025f89189d69d13755eaa1b49a809592b980dc6af5fcac9ae52b8c2804d13f45e1a60cc632aa8e3cbd5be69f770f914bfa2f45ba6a235c24467f0031c3c3465a8c2ac55f8b3c866a21ea2ee012302fc63422ed3f637d2d17d71d3f860", 0x6c, 0xfffffffffffffffd) keyctl$reject(0x13, r0, 0x10a7, 0x400, r1) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/enforce\x00', 0x40, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000003c0)={0x10006, 0x2, 0x10f004, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) ioctl$KVM_GET_API_VERSION(0xffffffffffffffff, 0xae00, 0x0) syz_open_dev$vcsn(&(0x7f0000000300)='/dev/vcs#\x00', 0x4, 0x40) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$UI_SET_FFBIT(r3, 0x4004556b, 0x7d) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffc9, 0xfa00, {0x0, 0x0, 0x10f, 0x2}}, 0xffffffffffffffd3) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040)}}, 0x18) 14:59:34 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0xffffffffffffff11, 0xfa00, {0x0, {0xa, 0x0, 0x0, @loopback, 0xfffffffffffffffe}, r1}}, 0x30) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000040)={0x13, 0x10, 0xfa00, {&(0x7f00000003c0), r1}}, 0x18) r2 = syz_open_dev$usbmon(&(0x7f00000002c0)='/dev/usbmon#\x00', 0x6, 0x80) ioctl$TUNSETVNETBE(r2, 0x400454de, &(0x7f0000000100)) 14:59:34 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:34 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0xebe0, 0xc00) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000200)) ioctl$KVM_GET_API_VERSION(0xffffffffffffffff, 0xae00, 0x0) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), 0xffffffffffffffff, r0}}, 0x18) 14:59:34 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0xc0fe, 0x0, @loopback}, r1}}, 0x30) 14:59:34 executing program 2: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = request_key(&(0x7f0000000000)='rxrpc\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f0000000140)='\xf8({em1\x00', 0x0) r1 = add_key(&(0x7f0000000200)='id_legacy\x00', &(0x7f0000000240)={'syz', 0x3}, &(0x7f0000000280)="09e2ad7f0b0e0763246832652771e6d025f89189d69d13755eaa1b49a809592b980dc6af5fcac9ae52b8c2804d13f45e1a60cc632aa8e3cbd5be69f770f914bfa2f45ba6a235c24467f0031c3c3465a8c2ac55f8b3c866a21ea2ee012302fc63422ed3f637d2d17d71d3f860", 0x6c, 0xfffffffffffffffd) keyctl$reject(0x13, r0, 0x10a7, 0x400, r1) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/enforce\x00', 0x40, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f00000003c0)={0x10006, 0x2, 0x10f004, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) ioctl$KVM_GET_API_VERSION(0xffffffffffffffff, 0xae00, 0x0) syz_open_dev$vcsn(&(0x7f0000000300)='/dev/vcs#\x00', 0x4, 0x40) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$UI_SET_FFBIT(r3, 0x4004556b, 0x7d) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0xffc9, 0xfa00, {0x0, 0x0, 0x10f, 0x2}}, 0xffffffffffffffd3) write$RDMA_USER_CM_CMD_MIGRATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040)}}, 0x18) 14:59:34 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:34 executing program 5: write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:34 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0xebe0, 0xc00) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000200)) ioctl$KVM_GET_API_VERSION(0xffffffffffffffff, 0xae00, 0x0) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), 0xffffffffffffffff, r0}}, 0x18) 14:59:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4030000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:34 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0xc0fe, 0x0, @loopback}, r1}}, 0x30) 14:59:34 executing program 5: write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:34 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0xebe0, 0xc00) ioctl$KVM_GET_PIT(r1, 0xc048ae65, &(0x7f0000000200)) ioctl$KVM_GET_API_VERSION(0xffffffffffffffff, 0xae00, 0x0) syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x800) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x0, 0x0, 0x2, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000100)={0x12, 0x10, 0xfa00, {&(0x7f0000000040), 0xffffffffffffffff, r0}}, 0x18) 14:59:34 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:35 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:35 executing program 5: write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:35 executing program 0: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0xc0fe, 0x0, @loopback}, r1}}, 0x30) 14:59:35 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x2, 0x0, @loopback}, r1}}, 0x30) 14:59:35 executing program 2: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1d, &(0x7f0000000240)={@mcast1, 0x0}, 0x0) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000002800)=ANY=[], 0x0) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f00000002c0)={@mcast1, @mcast1, @mcast1, 0x0, 0x5, 0x0, 0x0, 0x3, 0x10000000280, r0}) sendmsg$TIPC_CMD_GET_NODES(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1200000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x0, 0x200, 0x70bd2c, 0x25dfdbfc}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MON_SET(r1, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000540)=ANY=[@ANYBLOB="0b00000000000000000000000000fb454dcf028759e145b3d49b1b8d222e8de9c65b8b6d2b9d0fffab33cd36aebd34922d04ee22698cc1cc57587119e911f242aaf00c890d3f341743a4d88623285ce91a44cb527ae991b4dd050b2dc492359ba0c9fbc9645c5afb3327def47819adc5ad4efcb72a57667c0d1866888ff81719236fb107d5cf7f02b2e811e6f181d724d64ac5c1f589acfc560f0ae640d785fbf54ed7d80c930aad11a2688311947db8dfbe46c39c578fefb26f05f61ef0a41108954b"], 0x1}, 0x1, 0x0, 0x0, 0x4844}, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x4, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x0, 0x0) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000000)=""/1, 0x2}], 0x200000000000000f) sendmsg$nl_generic(r1, &(0x7f0000000080)={&(0x7f0000000480)={0x10, 0xbbf4, 0x0, 0xd}, 0xc, &(0x7f0000000040)={&(0x7f00000000c0)={0x1c, 0x22, 0x1, 0x0, 0x0, {0x4}, [@nested={0x8, 0x11, [@generic="e2ab"]}]}, 0x1c}}, 0x0) 14:59:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:35 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:35 executing program 0 (fault-call:2 fault-nth:0): recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:35 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:35 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x2, 0x0, @loopback}, r1}}, 0x30) 14:59:35 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:35 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:35 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:35 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000280)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x40000000013f}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000000)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x2, 0x0, @loopback}, r1}}, 0x30) 14:59:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4030000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:35 executing program 3 (fault-call:2 fault-nth:0): syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:36 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:36 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x298, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0xfffffffffffffffd, 0x0) r0 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x200000, 0x1) ioctl$SIOCGETNODEID(r0, 0x89e1, &(0x7f0000000140)={0x3}) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x0, 0x0) 14:59:36 executing program 2 (fault-call:9 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:36 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:36 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:36 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:36 executing program 0: accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000140)=0x14, 0x80800) r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) recvmmsg(r0, &(0x7f00000062c0)=[{{&(0x7f0000000180)=@generic, 0x0, &(0x7f0000000300)=[{&(0x7f0000000200)=""/163}, {&(0x7f00000002c0)=""/4}, {&(0x7f0000000380)=""/4096}, {&(0x7f0000001380)=""/4096}], 0x0, &(0x7f0000002380)=""/251}, 0x94e}, {{&(0x7f0000002480)=@nfc_llcp, 0x0, &(0x7f0000002900)=[{&(0x7f0000002500)=""/12}, {&(0x7f0000002bc0)=""/4096}, {&(0x7f0000002540)=""/200}, {&(0x7f0000002640)=""/148}, {&(0x7f0000002700)=""/222}, {&(0x7f0000002800)=""/248}, {&(0x7f0000003bc0)=""/4096}], 0x0, &(0x7f0000002980)=""/32}, 0xfffffffffffffffb}, {{&(0x7f00000029c0)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x0, &(0x7f0000005dc0)=[{&(0x7f0000002a40)=""/106}, {&(0x7f0000002ac0)=""/136}, {&(0x7f0000004bc0)=""/4096}, {&(0x7f0000005bc0)=""/141}, {&(0x7f0000005c80)=""/68}, {&(0x7f0000005d00)=""/190}]}, 0x6}, {{&(0x7f0000005e40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x0, &(0x7f0000006180)=[{&(0x7f0000005ec0)=""/173}, {&(0x7f0000005f80)=""/32}, {&(0x7f0000005fc0)=""/203}, {&(0x7f00000060c0)=""/57}, {&(0x7f0000006100)=""/103}], 0x0, &(0x7f0000006200)=""/178}, 0xfffffffffffffffb}], 0x400032a, 0x10000, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$SIOCX25SENDCALLACCPT(r1, 0x89e9) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:36 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_REMOTE_MNG(r0, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x20, 0x70bd29, 0x564, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x8000) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 992.166655] binder: undelivered death notification, 0000000000000000 14:59:36 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:36 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:36 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0x3, 0x2) openat$capi20(0xffffffffffffff9c, &(0x7f0000000040)='/dev/capi20\x00', 0x40000, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:36 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0x0, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000240)='\\wlan1(.\x00'}, 0x30) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f00000002c0)='ma\x04\x00\x00\x00\x00\x00\x00\x00') ioctl$KVM_SET_NR_MMU_PAGES(r1, 0xae44, 0x5) r2 = add_key(&(0x7f0000000100)='id_legacy\x00', &(0x7f0000000140)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) r3 = add_key$keyring(&(0x7f0000000180)='keyring\x00', &(0x7f00000001c0)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$negate(0xd, r2, 0x0, r3) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) r4 = add_key$user(&(0x7f0000000200)='user\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f0000000340)="ab11dbfd90489ffe15865149369b46b2f5767f5795cba69eee2bc2e07dd7e1450e7417fbd882240953bf5c741fa7a86cbe711e14f8a7f31d7bde09f7356d80aeab890c8638d8bf81134c8100be6660f4af6fa4e12a4d8889e08f3050e64531dfbf2dab28fe9794074fc7a3c6472707a799d8ab18d511b91d2e19d94042af2d0c23e05db01d6dbbd4b6623f80b93f5f742257c83615ec8fbf58f8c72f6eab435c169bb4d14e1ecd67c270b36f6a877ec4e661579f94e23f1e5aa47fb75b3d723e7f528e6ba3a27e691440786db7ebbacf9a7a25bc23b942", 0xd7, r2) keyctl$reject(0x13, r4, 0x7ff, 0xffffffffffffff00, r3) [ 992.478889] binder: undelivered death notification, 0000000000000000 14:59:36 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:36 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:36 executing program 3: link(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)='./file0\x00') r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) fstat(r0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) fsync(r0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f00000001c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r3, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$hfs(&(0x7f0000000280)='hfs\x00', &(0x7f00000002c0)='./file0\x00', 0x4da0, 0x7, &(0x7f00000018c0)=[{&(0x7f0000000300)="a2e7107b2d391ad0475bad9f4f05364582ec3f1ec03732a8e260b3ccd7c6801c42d5d9e19c2b68e0728c036d0f439d24dcc52f3dcd531a58b0245615ab94e5abf4c78bef57ad9f358b132cb8d396f13fddfb2ea8eb0598095684f4736f35a7e02163c32544617b240ac518185013e4e95dc7612849fe6f6d364ba49197d4e7d2f8c5", 0x82, 0x8}, {&(0x7f00000003c0)="d82fe5e78bcbb3b55f535f67b89b194f56808b51d20b4f5b2e7c738152d34c31a5004d8f6a46b226e990f0df094be68afe05b400b2ea5eff4e731248705690f60f02d8940d414bdbd1ea24864da7a06950977fba7b484dbe414182a5e3864df9446be03bc5813a53e5c5b549ef4a07241722271ffaf1056031144a0f316ae8bc89e615386ae41480cf2e973b5ad5fd2ef97a42bc5c27f7edeae5ac8fcb6e4e97d1ba39e492641a184f69876f2042895a8dab39d9d9a703d6b417635ce6765172", 0xc0, 0x9}, {&(0x7f0000000540)="b53368423735cd35ea765d19033207c0545d4aafa3a4d0384ebb55b9304cceae1ca3d010332a90516055da292247a961cadbcfb26d26ccf98767080eec64925a269ccf24c2f634768d5caedd0d4b7f63bf2304489406c4c36c8f49251dd987be12beda7c9a58f8239a36f87e7e5bbd5eda67a10c90121bb61dce8b0d85ab48c2cc47a002de2cb55009e5935f14196ccdfd04a9e89a0b1f53f9abbafdd0e98fa3b807930557054beeace275627bd077cef25c2f3ba121991f9f51bedadbaf23ad2854c382e26e75c331c796003fd2a5b5fc886600dc2f057674573f730aaa8ccb4a8b753f8f96890eae30329168d0daa80aa100b68019f772c56ec56d", 0xfc, 0x100000000}, {&(0x7f0000000640)="f4fb60e5a86dd56f74c5b8e3c6ae957b520515919716ac1f397889ad947c0ae7d64cb29801882c80b1691183f6846c3b9b0a03de64c3ea6dbf6c8627fa189c05877e7d1dde7db3a3d20f8721b18c26d1622bbf8ab9148173fe8a5d5eedccef4e2c101a476003b85ac5baa821d6e41fdd167c02e8b34e499163441b253c90eb0a00805101c16023e16d7d41873fce5df29931762839cb7bebdfcd222d516311", 0x9f, 0x81}, {&(0x7f0000000700)="db39ead2347a14572b517d93ac2f05cdc1839eb7834d0e44ec08231da406be8cc50e22fb9b660cf239fe6bd234a02a0d811d8186e6acec4e84cf6ec60bd6f9ef52f84a0d8c0d1a2316e4835319116d56e90b2d8dcf5649a5cb211b89e796e4671a117fb3e56b857509dcb7e9ccbea54054894588125eeaef5150330e0cd9d2094630667492400bd65524e383533b6cbfe4cb8160ed7df38d7e256491899d9cc414c3423a3e5d75837cd8f1ed25ee5cf6b9cec5ba89f3c35c9f971536e7d317b47bbedfbaa89c70931e655ed59c1a33", 0xcf, 0x2}, {&(0x7f0000000800)="18496e67dd58c3dc71903bc40ff7f5effd11d7f907b909d04c8774c7a4dd566391542710bed2d617d8c66b428d46319af81764f991fef29e54e557994ba9acb0156d4f4eecb38c2aae608b205e06588fde205fa225f1a9b28b69d588db699c9e4539a88908516694b4447a4f1b8530cf47f86dd7c81a8109a6e37ef6b051a091651f6e049065c97b8d3eceb7fe8abc0af86b3eeac06c47c271938ac839d476674ef4eacc0e7f7fcdfd77e50a85cdee123a19f5c8c48b4d7fe37c95127af1ead2d0a15f63d314b6e4a33d998cd52260a3fd0d85f0ead356f6c6a9e3959364b081fc697edcbe9a5afa5ed1bb72b28b691f6f1661b429ad4d94f2502c056c7337b38346dfd1fd605ec99ae56e3af7cdd05f22b4547145411bad4931fdc1eb0a1091f484905417e636bd741f96fbe955697d35f37fe79a78e7588bd651c8a17a1221e825287f40f202abf9199f00bb228ecb8e2be952369f02d5bc11a5a7469b96439adea0b1a4e752cc93f8e716101a38fa90df6a1eb2421ce17f94119d7c6ce9416f7d1ddc8142518dd8811c69c8e5ccb5e89071eb983c95ce494ec26d6f81d8cb4fe47362086572054f36a2acc4d53a835a87f3569f421fa9da7f9567906c7adb60bfe8638fd061476f3675df1f06ff04f5e786e3b7ec25233b8d48c71aa579aa48c92ea07ad2693a5de1ba634979d036f6064635c58a58ff3bb35a01fac4e9530fc16695c335871f9e39819379ffb44289d86bc355519bca887fb0f09ae44ac4eca0d9b903cedeb8715ef43ffc2a678614705d81423cd592b32ded5bb573492dd9d48b951d824bfe0d069531834a1782b4078a8655dd0c35b1228c764cae08a615fc93c6abf97c7466f8d6b59f3b8a935471d8a86baeb89e5308c08bf4677ec94eb8ef29f18859f5a8ead79ee3ae06e159d476afdb74e1a572301b68127596e12238de5e9f2467442fd46f2073c710b6ecaf879854b117fe6f24bf7d15607380bc0311fba805d6d4ed55ceb1ecc13bc1d3ce97b17e10d9082aee2c2531bf98652464ec16498168b26209454752d7b0711587b3ef0dc295dacee8a9f437c0e11f2ae1d355b54557567721bddfcee9d7246c04892b2011b56a9c334bfb8563d185e4e93c3ed80b353f07210c8512fb8748d17191c48c59c5a56154f488a4adab64f0934d1b1c9c3733646f9fa0e71e93b8433b88b4436b173d4f3a0b02a5bafd9bc994d888e7b3a6a71b205d84431c0d2a5a696ed908c6a7c6a563bac2bfb0cd7f18e4c6ef8fa16c2cbdea03aae05de5b3bdce9f8aa1d9e1e4ccfab37819f6cfef078154b7a2dd20dabf1130d78aa141240d0c8b14fda2fa2456d47bb5bc090baa958d612c80a67eabf7563bcf984d5b045f2622c33dc5e75668fff24a1ed503ab3ef1ab18f3cf9db28a4657f50bfd7580f596508453df4fb1012477b4c82aa3ff5688e9bc547fc8e41171946ec972433ba61d387297d4ee32d50d884e4c49c438e3556818fb825825a112136a028468c76c6accf42bfd2f71cc50e9272b8ba6d01100120b96f59323861bb83d0274e3a26b36c812a6749c72e6be709a65d072a27aaad14ceaca8ab576d0cd850159fd877434572ed9837e2f27cb10f8688de0facb342271a8e67e182499a3b6ec2736e2f07566092c64341f5aab46b91d298bbe884864bd0cecd7eeeb622b37c3317983f79208a994ae13d1fd4c877c8692475621a0d3360e7a16601c2d8a1af1469c5f1c6d36ccdb3945d2b3b8e12f361617aabc4f4f134c97ba8f41409ed6f925b75c7fb5a1868cd4750fe2a5ae6a6ba1df97b9d3f4efa9ba237e857145ea7cd8e18faedd213d6d6c7e3709d1eeaace3df2ff3eb819e0786da9dc88a3be740f870b98067a06e629d58a8213cd37442a9ae98d2b5881167593b0917b12973bffdbfdbb57c5ef1fce2cd0620b3010effde3930e843e8b7e58fdca1394a49e3f833df4dea603d5f25da03527e9c1cc52e9d2dee171b1732f390fc28551345023f3f0d5b26c5cf8afcb6d8bdf6d18224763988c26753d9183a56498988ff94c2dd8b0e2cefa11fda728242a2728f764d0f2c1cc4218d01af05d3b562ef25bd0cb9993bda2c09079dbfdb540bbc3d6f049cbbec5b444e35dc56d476503bcb762c28d1ccad4785bd9f1ec2d7c8689f4b8b7ccc814bfded36c4363acaf3421137d380bacc5eca345e8f292a3df7a53012701f48783761c0f0aa2e3ec17758e44a087f72a425226617b57a55fc411dc7aeedd4a1232498ab293f9b5c68714c86ac343419f1bdf237cddd4f5c445b2b6f2c65f65a2db53444081439f9610e2d3a09eda61401f3a2cbcb023524730a0211cf2ea884875d8330e1cd175b5c5d639fc2ccfd7529a4b4c3ea59e2d68808fd63a5b7baf99c0e7b27e688ea45f9112fb255524bc473bf75d3e5037f742d67f57ff94b1fd4b535d78cc5de871b2daa0f8f67d652aef4841766ffef473db6b7ef9035338597a8e88d6e30222c17bce6455678ddc7101a0b52aabec892aa266c0af02717fec18da521ddc18e6ddc41c68e8b52c7ce8454c0b51e77d01f1777ead80a99003cb5303e78d767bf76ca803fba7dd1c184891e7a0e353dce5db28becb2d6f74d79d0fd4ffa17674c8ee5fef05527a50e702026fb2ff2b381fce2ad66aba77d52ee42136d5b3176c868f1843ca23fcdd423846318930667eefb01dce1ab3c24a6d1854405ef2459c2991fb23b843df91027294e07c533af545a60037d8a47140566ac1dfc6a4cd541a31defafca16d765a57ac5518aca19e36bb75c19c430c1553074f55bf35e9bca835c2556a23f53f17eef229f9604ebfba88a6dac362c448673809d1baf2e99f37043561bcb24a2747292f2cfae5ce92cd8f4d5b3c7c77aef175fd2816f3bb2e92edc23bf6b9fb304a30cfe7d5631b84400a08ec445f4c861f3db58764db6cd7da3d48a5700851742a9789f6c377075179acac63c7d29827e7d70e462b834118492c412c7a838f3202f368e44c5b7a6761f56be679fa0b321cb016c14e856b6e9ccc7e5ff87e38b0e1dbaa0dda1a9b0afe296e9397cc4bfdd1cabcbd4e993b0862dbc7925c5f544942985aa766bf6e9c4288550d003331bcdb15a4dd6a2ee634aa0b2e15004367b482f586a0034281a149df7691b1ee67cddbfd32ff9a592ee53dcccb58953ce2e676932689817ce60c0fef6662768716e0c85f64cb5d087c20346f4e7d13bf8e941fb9d2541df99888cca085c437f70ec5d6e1e916de794d5d372c205f5762d29c6a38b1f5855443f326d4c44192f54dac2e96832c60a1c003f5f3e4a8e43bddb2b00f86f6fed4d9614ab6a8c79f735b8acea42512cda7792913f47b11b92e5f7498e977c370d770ca43ec9301db7df50f1e1bceba01297361452611d3cf2e26871b62fd221235026d5f134a2be0a10e3b7b35de919b51969376a62d6a3b75e9634663b15ca0a17620e48b9993bfccd32ce7516c5948dc33368ba2785a5f7b8319bfdd8556dd95660602d5e299cf78199699a32c5c531bae0731622341b5adccaa06222ebc3000d71d955a9ae50b57874ffecbd3847cc7190f9e0b131ea6561819525c40e01e97fdc1c634a727218500e4fee19998f8ea4db3b9ab9a8166a56d691c833602c280178418acedbda3637725a3ba8e702a6f10ec29e92a2f658835659b20bf7d8cae617a8c9ccda80ba98344eab9e040e9e87311658017657ae99aa2b3fdd020f79b3947b96050b78e30dd51ea96118db72c0602b8062789bbd6ad403fed02a41d1dadb46b4d1356331cb446c4d0e962fd7f0dddaaa8b9bb34311638d2052ba209a3a30f40230af43cd39cd03a54a9dddfe1bac04d25b714174ffed6204f36b9b4c344952cf788f1546aada0c9d59fd3dc490403d28134da170828fa7143b10776ef25ac31a0f6ba0e00ab9e74c3df7c566c093af95dedf64560a1cae759723a44eb635b98f4181351d813f42ff73aab0e05cba8cdf549a86b883982da85819ddb798c9792303c4c70ce7349664f83d05bf0655550e40583fa854aeeb9ca4410ed117c1fdb8f4ba1b77c68fdc5ffeb1d8509ce95eadb19e1679a3ea3febc0efe39817040b2eb444f5d89af71839d13af9945f97073dac0a81960cd47899b8c97e2fa202dd77d48b97f0883dcd6c3196246de20a3a850f6f89110ce65554ac7e836d7e057935270582e8fbbe4ddf817f84983cdb604bb34c3239c4835bab2181ab450acfdace02692920d5e1cf1ef0a37e2282489bc3ecb581f7bf1c802c7f7b109dfb664171dad157c2643a42f50d54d580d829c535e0a3130f763f101251f801ecc8cedc593f1adc3198c891c54b3bb177722effd104e788fd5f1d2d2b44e1741750bce7db08e1920841fd22606e1d4b88981befab672f1f93c787a6c950bb4d1330efbb0ebca10da81d549b98d4fc0d706211a2aeeaef1f8cf95bb5906e00ab583cb95c992033a66677f3d84985507e987342aeb4d6cabf5caf2ccf5ba9fd62fb1c9121d6197640b91867101180cb606f2e64a1602adad41b46e1ffc9640a611a759ad3f76f801a11555b81e368bb1d0aae946d7abb8ea42c9326fe1ad180f9483ca86175573c2f400ed32cccb40cf47bb536504d36ae168404d9e0af393285590dd90d7cf95fe74d4c1b699ec29f53116bc600cd1d8e146925f16a95bf2dff0fc1dc2bf5d534704ccc89e45aa03ff62d88cda127da708fcc1efadd9520d677f5b0d4fe68601a3e33c76bba871882b604578de50b28ba621487f9016d80d58c4de36b25ef07180f1a4daed3d4c126120da6d07589de20f717c4cbda22cc793ac3b62b90e4302ffca0cc4c4b293b2ee0f812b998a133a6ec3a0ea59c206353181761fc75b2899dc796914591b788bfbc795061af622e491e9567f3f3c4528f9c88212c2d961a4642aaab1341ee8b3c6b0e03c43895958609ce0b954752d34c53341ea9b311cfa1573f13ab60cf55db1548df43e60d8fd8c23c14777ce586222c967e82be34c8de9eaec1c24622456da06763486e1cdc7270f4239170061d45fcd116e50b37c2a077102763c0ec1543c62beb2227df42176e34c0282505dc5b74f0fd638ba380f39155bdee09ce38af090a3e5ca8eb1df211fd5057982a023910a16a990fbfdc707cc65edaee0ec256666467a89116821a1785595db135dcd302dadc8329a494aa528fe05681155e7df0bce2a60ca5dbc92d5bcde967901aaf4641a4fa949192d5af3e3731160a4dbedba0234197ecd199219f1e380ef262d5c2ed690b705c033bf13be9f39cd8b06ff00e99d3db188539c34bf650b3afef2694a7b7606d58c94bfc81b1d3deccb341d4d676bd6e89dc7f0e066bd3070accb8d631e9f119ff83c091eaa32498fda0f6915b0b2ff2d90facf9d580b18baa2ca67815f2373fcd9cf693c65fb584d8c12a509b65746fb6c676cd0a47258ea26d0e8bf2d44ca78f1b71577d17fcf4e902c0c73a375da0c2419787963fae9d42f0bdf816e34bc9a23b053f5e18b9f65ab9654a8c777b661d4df0e992b7b960ad3cb166283093ae665af266e40f3db86165c3008b987daaf4252476717abdeba1ebd663a191e11e7cb01a0cf4b778708012c0b3addf8a05cd4bf4fa3727389e96efc9fcbf0b5920aef4e0b36f3df21cd01874d379bdde954e8d0a53b5f7b4165941fb23b63a3ab81b4871ea8f884189eeced01ea7614011a10fa585fb375e04321fcb5946c2fc7fe817a4059f5c0d8a8fca7932369389634838926609ee96e8fb8d4d7eb27728c60d1f424794f8c2a016e697a48", 0x1000, 0xa3f}, {&(0x7f0000001800)="7085815145e6f4528863f681da5d0b5a7f4d47d82476b46ba5a3767edbd7bf484d27b1b3f6745cce5827990e046496875c0d2b091255b5f41589614ac0952ff88c003a0b636616182b338bdb501110688a575e102ed415a6872f07dc937371c344384bceac3fdef24213bf7c67a346f847c2440f4e0a20e3acc3c6ed2075d4c4fa272c923722e36df49d24db8bb4902154750fd562e6467ac7fa2b91c660cccff27e9a31b4fb00ce78339f8ef8a340c78d974d742b8165c36d", 0xb9, 0x5}], 0x420, &(0x7f0000001b80)=ANY=[@ANYBLOB='codepage=cp865,quiet,file_umask=00000000000000000001777,fowner=', @ANYRESDEC=r1, @ANYBLOB=',euid<', @ANYRESDEC=r4, @ANYBLOB="b3f2bec52c6d6157524954452c6170707261697309006d617369672c736d00006b6673726f6f743d73656c662c005bfbe82269ab5c6faf42ffd8938b717929f1ef58cb87259087451913df151abd5c14979af7acf4836852b02846d05b19e01e78e61d5365f24012d56558414fb5b9fe672d37f6cb9d2fcd77cd2390bc3edc7dcf7319e20101742aa6bd803aff999acfc87c3375b730272b28412637e6ef80602caa52000754a75609daca"]) getsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000040)=""/151, &(0x7f0000000100)=0x97) 14:59:36 executing program 0: r0 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x3, 0x2) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x7}, &(0x7f00000001c0)=0x8) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000028000/0x18000)=nil, &(0x7f00000000c0)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r2, 0xc008ae05, &(0x7f00000000c0)) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000240)={{0x1ff000, 0x101}, 0x0, 0x8, 0x4, {0x6, 0x6}, 0xfffffffffffffffd, 0x1}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, r2, 0x0, 0xa, &(0x7f0000000100)=']keyring@\x00'}, 0x30) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0}, &(0x7f00000002c0)=0xc) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000400)={0x105, 0x7fff, r3, 0x0, r4, 0x0, 0x3, 0x2000002}) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000200)={r1, 0x8, 0x3}, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)}}], 0x1, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') r6 = openat$capi20(0xffffffffffffff9c, &(0x7f0000000000)='/dev/capi20\x00', 0x200000, 0x0) preadv(r6, &(0x7f00000017c0), 0x0, 0x0) ioctl$UDMABUF_CREATE_LIST(r5, 0x40087543, &(0x7f0000000440)=ANY=[@ANYBLOB="0100000003000000", @ANYRES32=r0, @ANYBLOB="0000000000100000000000000000010000000000f0bf8f3f4ecc0929aaaa445d08d730e0bb213198243b64d74588adacb65466ffc33beeadf8b1f371c0de5f92b770f29b9b7ac003688676f33f9a17f652977da87e6cd65ead9856ea591087d953d42c539a2b2208835614773fb038d2b56c1b3e89c5e3aa13bba56067693470c37bc2525a12", @ANYRES32=r6, @ANYBLOB="0000000000f0ffff00000016e436ffffffffffff", @ANYRES32=r0, @ANYBLOB="0000000000800000000000000000000000000100"]) [ 992.708008] binder: 14891:14897 unknown command 536872576 [ 992.708413] binder: 14891:14892 tried to acquire reference to desc 0, got 1 instead [ 992.746063] binder: 14891:14897 ioctl c0306201 20008fd0 returned -22 14:59:36 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, 0x0, 0x0) 14:59:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b6b6b00000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:36 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 992.809112] binder: undelivered death notification, 0000000000000000 14:59:37 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0x0, 0x20000002) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000040)={0x3, 0x3}) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:37 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1, 0x0, 0x94}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$TCGETA(r0, 0x5405, &(0x7f0000000100)) preadv(r0, &(0x7f00000003c0)=[{&(0x7f0000000140)=""/181, 0xb5}, {&(0x7f0000000200)=""/213, 0xd5}, {&(0x7f0000000300)=""/57, 0x39}, {&(0x7f0000000380)=""/13, 0xd}], 0x4, 0x0) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4b47, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:37 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, 0x0, 0x0) 14:59:37 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 993.098577] binder: 14922:14927 ioctl 4b47 200003c0 returned -22 14:59:37 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000240)='/dev/dlm-control\x00', 0x4080, 0x0) getsockopt$inet_mreqsrc(r0, 0x0, 0x2f, &(0x7f0000000280)={@initdev, @rand_addr, @local}, &(0x7f00000002c0)=0xc) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000580)=ANY=[@ANYRES32=0x0, @ANYBLOB="d600000044464fc66bd703d988489011e24165f565fd2ccaf11e57d46194ff914c48005ec4c58698b7ab5954a5774207ee9d4bf4725e11fdc5372800257134e917f5db7dc4e1f3d77597c875b543a7b5e32e1a175c0c06a2273cb2e5ee7ffa5898b2a6a4c7ca5ae2f735c1187b707ea74d3c79a5b8587cd490a72fe420e1a3b02025cc83a13adc5ef5de5bf11687d8ecb24b89cc6cd73d76c64bcd924d20b5a316efa4cf6b3a23275dfa4a97b85629ee6c696ca38c3360c9b30af4118b9d5aa99b0e070d18f818d2e97da801b78bf3b4f0e2b3f3c10000000000"], &(0x7f0000000680)=0xde) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000006c0)={r1, 0x2}, &(0x7f0000000700)=0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$SG_GET_ACCESS_COUNT(r0, 0x2289, &(0x7f0000000380)) r3 = request_key(&(0x7f0000000140)='trusted\x00', &(0x7f0000000180)={'syz', 0x2}, &(0x7f00000001c0)='net/wireless\x00', 0xfffffffffffffff8) keyctl$get_security(0x11, r3, &(0x7f0000000200)=""/25, 0x19) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300)='/dev/sequencer\x00', 0x42600, 0x0) write$P9_RMKNOD(r2, &(0x7f0000000100)={0x14, 0x13, 0x1, {0x0, 0x0, 0x1}}, 0xfffffd61) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, &(0x7f00000003c0)={0x0, @in={{0x2, 0x4e20, @remote}}}, &(0x7f0000000480)=0x84) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f00000004c0)={r4, 0x1}, &(0x7f0000000500)=0x8) setns(r2, 0x0) [ 993.168428] binder: 14922:14934 unknown command 536872576 [ 993.172019] binder: 14922:14927 tried to acquire reference to desc 0, got 1 instead [ 993.185829] binder: 14922:14936 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:37 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, 0x0, 0x0) 14:59:37 executing program 3: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000180)='/dev/sequencer2\x00', 0x400001, 0x0) ioctl$DRM_IOCTL_INFO_BUFS(r0, 0xc0106418, &(0x7f0000000100)={0xfffffffffffffffc, 0x3, 0x4, 0x8, 0x1a, 0x2}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f00000000c0)=0x4, 0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000040)={[{0xffffffffffffff42, 0x400, 0x1, 0x40, 0x1759a744, 0x7, 0x81, 0x80000001, 0xffffffffffffff81, 0x85, 0x9, 0x99, 0x200}, {0xd64, 0xfff, 0x9, 0x9, 0x5, 0x100000001, 0xfffffffff222102a, 0x4, 0xffff, 0x6, 0x9, 0x0, 0xffff}, {0x6, 0x0, 0xfffffffffffff51e, 0x9, 0xe2, 0x4, 0x80000001, 0x10001, 0xfffffffffffffff9, 0x8, 0x400e7e70, 0x1e0000000000000}], 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0xffffffffffffff4c, 0x0, 0x0, 0x2da, 0x0, 0x0}) [ 993.233283] binder: 14922:14934 ioctl c0306201 20008fd0 returned -22 14:59:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4b49, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 993.299589] binder: undelivered death notification, 0000000000000000 14:59:37 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x3, 0x2) ioctl$VIDIOC_TRY_DECODER_CMD(r0, 0xc0485661, &(0x7f0000000140)={0x2, 0x1, @stop_pts=0x4}) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:37 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:37 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:37 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) accept$ax25(r0, &(0x7f0000000040)={{0x3, @bcast}, [@bcast, @rose, @default, @null, @rose, @netrom, @default, @null]}, &(0x7f00000000c0)=0x48) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000100)={0x0, 0x1, 0xf}) [ 993.500710] binder: 14951:14953 ioctl 4b49 200003c0 returned -22 [ 993.569000] binder: 14951:14962 tried to acquire reference to desc 0, got 1 instead 14:59:37 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000300)='/dev/vsock\x00', 0x1, 0x0) bind$isdn_base(r0, &(0x7f0000000380)={0x22, 0xffffffff7fffffff, 0xd05, 0x8, 0x20}, 0x6) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000100)={{0xd001, 0xf000, 0x1f, 0x8, 0x3, 0x6, 0xfff, 0x0, 0x1000, 0x0, 0x5, 0x503}, {0x17000, 0x1, 0xb, 0x5, 0xffffffffffffff81, 0x2, 0x1, 0x9, 0x3, 0x3, 0x7fff, 0x1ac5a145}, {0x7004, 0x5000, 0xf, 0xe0, 0x1f, 0x8, 0x2, 0xfffffffffffffff8, 0x8, 0x6, 0x3, 0x4a}, {0x2000, 0x2, 0xf, 0x7, 0x6, 0x1, 0xffffffffffffff80, 0x7, 0xf0d2, 0x1, 0x7}, {0x1000, 0x0, 0xd, 0x7, 0x6, 0x8, 0x1c, 0x6, 0xb56, 0x101, 0xfff, 0x1000}, {0xd000, 0x4, 0x9, 0x400, 0x9, 0x8, 0x40000000000000, 0x4, 0x1, 0xf2, 0x4, 0xfffffffffffffffb}, {0x4, 0x6000, 0xf, 0x0, 0x8, 0x9, 0x6, 0x80000001, 0x1, 0x100, 0x8, 0x6}, {0x11001, 0xf005, 0xb, 0x8000, 0x6, 0x40, 0x1ff, 0x5, 0x4f8, 0x2, 0x81, 0xfffffffffffffffe}, {0xf002, 0x1}, {0x5000, 0x2000}, 0x80000029, 0x0, 0xf000, 0x2000, 0x3, 0x0, 0x4, [0x81d, 0x1, 0x7, 0x73]}) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:37 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 993.644804] binder: 14951:14953 unknown command 536872576 [ 993.668733] binder: 14951:14953 ioctl c0306201 20008fd0 returned -22 [ 993.671060] binder: 14951:14973 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:37 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) [ 993.738235] binder: undelivered death notification, 0000000000000000 14:59:37 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r0, 0x10, &(0x7f0000000040)) r2 = getuid() mount$bpf(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='bpf\x00', 0x20, &(0x7f0000000100)={[{@mode={'mode', 0x3d, 0x3}}], [{@obj_type={'obj_type'}}, {@fsuuid={'fsuuid', 0x3d, {[0x0, 0x32, 0x35, 0x73, 0x33, 0x67, 0x3b, 0x30], 0x2d, [0x7f, 0x0, 0x62, 0x62], 0x2d, [0x67, 0x66, 0x67, 0x33], 0x2d, [0x61, 0x30, 0x37, 0x37], 0x2d, [0x36, 0x30, 0x63, 0x71, 0x62, 0x62, 0x33, 0x61]}}}, {@euid_lt={'euid<', r2}}, {@obj_user={'obj_user', 0x3d, '-self'}}, {@obj_user={'obj_user', 0x3d, '/dev/cec#\x00'}}, {@subj_user={'subj_user', 0x3d, '@selinux['}}]}) 14:59:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x541b, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:37 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') inotify_init1(0x800) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:38 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 993.960308] binder: 14986:14988 ioctl 541b 200003c0 returned -22 14:59:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x0, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) [ 994.011457] binder: 14986:14988 tried to acquire reference to desc 0, got 1 instead 14:59:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:38 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0x0, 0x80e) write(r0, &(0x7f0000000540)="d34ae41d77a6eb4563676656671865ea6e83c1203841a50612e10bd0a8ea6d3674dea80711cba50df4f48d8d92d3b140e5587a6e51f81aa1f6a1c7b8f4cdb3f8a24c12b90b22a7cf909064921051128636e13a1b26e4d3fba4152c1d94d467c676c2180a3d3646376583de9e560a52eb683ed4a17c729d4fe63eb2340b6859fcb24286e63a96c00e55cffb3eb3b50a183173571d0c4be20ff5d70daf34304d67aa190aa304a975e52f31f9d3b9c7abdf593a893313b5b6ed43b5fd435c1e1a50964b210f863bf8d932d33f9507060160345af1efdbf9cc91fa42ab4491bd33150cb608155c1892bf22645996a76fe07f3641f4aea068599203ab94132fc783a8324856d5dfdcece060377f72965b6c2722da75a673286990cd80b10065f577be459ace3fd1bd7e6a6c1be824a550565827f0951afb2cf9757cb88560d7632f1555789f7a89d860b97f48a4bab10ec3b6fac4da1ef4a01dbc5a9de25601b495d132d93b7ab4668b5b406b51d1cbc030d119c684e0f9b0a2ee076d4ef2cc02f9e971c4e28c535ae0e34aff1572076b957472dffbae5111a470f9a12ef8ea59d1b8a33aa0ac7ba33ed555c1541d48a003423a2e36866ab2d589c880fb8d763c28abee89ec62f1c1c36d955e609fae1b996f4c407d21eeced62517a15ea965ae114a6467faf09b255e2527aadad21a5759e6d41039adb8842ee014d4fbedecc999718452fea589b0cad370b5c7f25d6ba8ae19820aa4f52e4e7b559d42b436d371ce6b73030960c28d432916c7055a540d0bd0147d1505fa08f49e0730cc5643b563ae59c34d80d30efbf3e32192df1cc4b2804b4555f23cf0c6686289c16067f59700dee151c4e0e68024c1f4496e679e0355f3f973bc596c9e3d4b3cfabb39f6a4afc1ce96ac9ebd96e394fae0c57d43de41ec3233846dfcd78411b80a3fba6438c0849907d1f9e034005d343f4afce0089ade55c7914e9ee3eb82dfe9f1b0677a04533874bdb1e93b0ca61e5298c92790eac22a68d48f10a9ac48936b0708184cb2d227b7b7afdc2bf412df115f6fc742bebb84073c7d3553fc35590f0368be0300deb33e562d695d120ea8b4b498a9f2ab0d85125b409e0d896df8231077bb3efa3b9290e0ee08804f95324aba3734a5285d63de032c538785d55b58c38d6a19c1d829d92e97ba2b58f89dd73c36c3eba5a30863b6d96512a787f7505963c5f6fad7202431df1c51fee8d5201dcc8e17717685547a2e70b300d5c25a3ee625e39e2432cb303bc4d9b92570e24b12911e9545dbcac2a614394e68f5d244f4939856e166bb0ce5277b1f29cb691802715efc9aa38da7eeb63bd2e2b335f3e0ce12e2d5590a2e1caadf4f3c53aba922818040893431245f9ff0a85b99ea5492b29855cc4e7dc3b4725ba9c1ba9ad79d7d8a2bae8078c95c20d6cd220bc96b31276b7c5f6700aa7a538a155152a2b006aaf93237651ef02cb732dd0d9c1ef1dc44977c977076d31ead346cea0da73eaae7087f775c805fb6131f21ad3e97f9cc82980c234dff0461517b325fa775b01c743e2afa86e15e5c78ce0054e58aa1d5a7473ea448911480add6c76e7a54bc0111de78047b16537f5a72ee409c0bf38e9afa8b7580e51608719ac9c7db1dae4cf2f6f81b3937c6392f63e0eaf2c6260076407858925b9dd0a2081d70fad5ee08a714e49c3659f8fcab90dea8eb2bd10d9a723ddeec686e8d6edafdc62c229c91e32306dc4915639abae82b8b370ee4a0c631420f1fe0d0e2f58285a33c5e689770f4858700d3eabf8cf76c61cbf9553bd53d0fc4b55172a9912133016156c64c39c14ad226f84e485d3f0cf43a44531780af4c6bab22cfd967c3d9fc5f35e8186d2e59a6004406e4c8597cff5514b057f69adba72e14303ce2083200bf9d06c00e4053912a8a7c3ab54db08b6faade6f20751ddd38dc0fc7ba8adda8099a224ac85355c3b6a4d1b38d3743c0928bcb78400b190a955c045bffa907208a57432733c357ee5484116990f66f25209faa1866b3cf21f567cf8065885b7ec22efde9ec1be380bc483503e2499014c15338b4fea2eb04c06738144da978b3c908f760240be9c2326796de406eb0c0206b09c275824738a77a512874740e9b6e822176be5c761edae186e51b44eb7b768053fb30c7d5eb430cb8123aab2038cbe3fcc699d2d8b3525d3f28e56304e7375436945e1c97a3dd5415f928ac7c5f9fe466d498c139819cd0826eca101f72e7b4c79bb1c2fba724c4f9783f721b369a2db22de222485b20f8705012af2a3dca2ace2e2c8b9fba91d405d0c4cb9e022e1fb1896852ac83fc2909c6f9989779c7fa7766e144ebc53a8ac27fe7f9215068d135b280c082768bf512187a215745b78324c5bf40e6a5ed59e663e5c256179bd0bb1f5690ae550353c4474e65dc41086404a5302ac02c12d0c9e3d9aab80a687d55499277a7671a14e793873bea15bfbc96925aaf8169a7496f08790a368cddceb7fbb96d9e81706db4818b555f0062948397b636b4097977b229ed39b4e6506589fb0f14640c443b0864a218540b649df19638d7b0c51bc0eaae03e32a3009d4e61ab764f8e0b940efd0e15338b36e84842d06dbd158616db278f150b45bd14f4b388f364afb7b0f84856facd4e630ef68876bf1e7fead92a1027145b18c93907708f0775ec6b3e01d630fd1bfd94781373138b5bd57a5cb02718ad294f7aeaf12e5943bebec09406e8bd964f9776518282c4c5b67b18abb31f420ac2116e3be44320612d1102f6a939bb1954ec5c2793fdc94746ee732131b7fd22c0de5dc2aaecdf885ee76d0e484561b1d6a4b9634f59655ac813dc31f6fe63d8f5c756d02e4ca55b29ed5edb9b3fffee930562b88e71eae888f94e940ee1909e7d3222f5f7d70b399b77052af7a95737d4d763a8819889dfb1924747d50560e1bcc1e135cfd15a22299e32cb29f2b1db3a34a9b13975c9cff9da05b0b696345efefa73690fa43897df9ab3ae852cebdddcb2adc254b7c0065228d083321bf3190e4a0ca2db5025a43a5395bedbb8765752ce9e1ca24d524871b3b1bc9d945108b315fbdad56cff272365a27283acd81a9457cab764ac4a890e20fb103b9aefef49b93a418450a4f95b787a9fb0c43a34beaec41b1ec71bea6cd63e4353b58664f987ce47302a82f40f76a103cd915176aa6d4e054909011e44a280193646c503c6ed31ccbe67656d8230d32d538ea0894d513f991c8a30a3b588c2ed31d98c15500cb26e7a83eae5dde93e7ad883c7ee629db863304ae9b73c6c9411b9354402b88b6f38fd2acff456233395b10d791f9318bdaaaee58c5248b412d9bba1836533f8019530e50c93b800e0e0f8cf5b8a5f0513bb927b0793e867322ed113f0772c31b8f65205b90647166c81198c3d8869b483dbbc4eed90b09c0fa459bbe6a90a636bdc7e4dc3a1d68d47c0b9aba99483fa0e442da5cabc4cb98c8d9a02b1d360416cbf7aedafbf28b5e1e3589295ad2dbcb820d9fb0fc3693651a4bfe7e8855d87e7cb8badde81d6c814302984b292629dffe1ca43b5dec989d3513ad64e8ac615584f33a25cbfdd054696f1f3dd049b4d3eb45f833d2be89aec863c9599729aab8d23dc4cfb6dc4c87f7c26fce2d101bc34466c33cb21d4410a7022d5a698ccc06063400fd3389ea97aec571ae71ab771eeae925275881822653a9424d66ed6e9e8ebf74430a64fa79fae09ab90266aa6b090071bdd859cf6a4efc2896dc8cc71fb0b929da4a30aed8229d8384bd55e8fda4a8edbe56a989e6e41967a6dfa4a4aea43ad1671073ef35729971b9710dda4149552380dcd8bdc3e0e66edfaa88f07530de8564d9a46f06801aa75d09e860e03b1773ae401d7f949140f5bab93f72a6f93810faf4a16fef53d5d364f4b53eb948a18dde640358874a1c47a8d75a86e68c54eb97ad9447bfc570e02f0d2d280dcbcfb7e2b5ae0c8258221e1d326bdc59eb314f47c98a4533a9d5a76da58116eb6abfaf8375843f31bd321ad61ec68c0036470ef27daa87544c801744c40f61ac5a97c512e17eb2eb2a1232c2ebdf7e93ead15f7c007b8eb5fc8c944ae23b01673057637f7f63f0294d18795c0e0332d052b13e201ab6edb618d639a77c06684d53b567c44e10faf0f3b5f2c3b0450bdb8d7754ed03b9ddc241f5f0f9a010307f599393978b9cb41cd12db1a70cb18ef49558a5edbb5de6ccd36cdb27849ad92b2e578ffea2601792f3915aafcfcc04f0465c720412b28448a52a04cd415488b061bd27e906fd626934ef933df49aecfc802c7ec8fccdd8d592e5d7e0f116fa6b2967b1975c792d1099669bfd651244f30479a9b2d5410c2bb7e14c79f00e375e668be24c7d5def607fa8532fc37d0093a3249c98a0e1068233557d43fd47a58b1cdb836cdf1647bd67f9e400f02664e59f94bc9010b2d31b5b494f020b9fb369d8e205313a89295718c5e52b748cf4d4a5f526195ccbebe7ebbce6a76c2ac6763716eef13d5fc794b94531a234490c6e8254b29b4e38a8a8b66564636e2763f6c4b29fad6f86e0316b834357e70eafbe3eced79efb8515affd6be6b30eb61c97f406167d478bc735c8fc03b8b44cb989e55832d92f51383a3076161804b8caa998341bc9ad9b9868610cd1e372e5032deb3324385df533d403a6a8044bcedc3651a4ad5aa0ba91b8bb01c48268e18b2a49aecb8a3bcb7fad2b41c4a5e6c6f3800b7827e9d055d59e6bac9c05b962b430977786d6eded4c4335520c47e5023648343103019bf969509f7afd549e842e32df0873300127d50d2d4829f22d19332fb45777723e1c342b3e7967826ee7f99f9a282acebb80bdd32dbf338aad8a785e9354789b9e9bfca8190593046df92afdbe45086c9bc4b41315d189f6b295f56705476693190024d2bae8274f43ecba4dc7242f9f29fe3bdcbd00cd2593e876df15a14d5601ebae62c777c8f5b640876f48332631343541df0c02a480be1c990d3e4c1d80ea29412cf02239c65d0f935720ed211e828b5ed95e520571f3a2655cc07ecab0d411120401b54eb5b6d9c3718ef79269b7878664259629491c410dba82d8ac6eeb525d723f85f09471eab639dc7d7c3a9b549d7ac86f7add5a411316eebe608cd44f578132c88f00e2d1ffb775b3faffce74cefc36775bee6a98ef5799909fcfa92e376f74c9458e04710d37a95e0a4cb34b48ec0d8bf35790a546602b7c74a82cabe03c7c80eff707ad1d1c8230ec197da41e2ffd9749914c128446d841b2e882e3811b0dfad17a1c167b95fcc2d87646ed1c7f1c0aeb32eff6559330cc566a29535654a2a22b42b187bd1bd53cbbaa22ecd29a1fad1e341f7db7be8537246390fbc9fb243da5d8c9cb8b1c61f1e76bb992d2f8915485a8edc105580abf9b90a563bcc95da1aaec80a261a32b971cc636eac01070e8695c6bd371b778a575d9f47ebc4f60284fde95d6cbf213b4b2dcbf238d8de9569ef54c3b944f6df7462ad534bdff879953ecc35e6ffe4913f6be8108245a27dbcddbcfbe07505b220d9ab95f2d8afefaf9c4cff6c33905651bda9b28db62b0386e2b54f8f218afd048daa188e9b499a990acba44d6ddd7b153629578ee168e88c8d5f93df6524d86318813e6f5beaafaebe7157a44644e4c72b30f58f1ae6437ecff934f4530ec733516937a185bf8838c591ae896f0bb5a9b12eae6278314d52dd9cc2ae650704ed75a451e94ec9fb2b28b2e497a76048ea3c027440fdfcdae33576dbf339163c885016cdd", 0x1000) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) [ 994.083361] binder: 14986:14999 unknown command 536872576 [ 994.087989] binder: 14986:15000 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:38 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$PPPIOCATTCHAN(r0, 0x40047438, &(0x7f0000000100)=0x4) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) preadv(r0, &(0x7f0000000200)=[{&(0x7f00000001c0)=""/41, 0x29}], 0x1, 0x4000000000) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f0000000140), &(0x7f0000000180)=0x4) 14:59:38 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) [ 994.218800] binder: 14986:14999 ioctl c0306201 20008fd0 returned -22 [ 994.253933] binder: undelivered death notification, 0000000000000000 14:59:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:38 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_tcp_int(r0, 0x6, 0x10, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000140)='/dev/autofs\x00', 0x200000, 0x0) setsockopt$inet_sctp_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000100)=0xffffffffffffff01, 0x4) setsockopt$sock_int(r0, 0x1, 0x2a, &(0x7f0000000040)=0x4, 0x4) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f00000001c0)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f00000002c0)=0xe8) quotactl(0x26, &(0x7f0000000180)='./file0\x00', r3, &(0x7f0000000300)="87ebedcd5ac49b383e28b2edfa21de1e89aba6") 14:59:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:38 executing program 0: r0 = socket(0x15, 0x3, 0x3) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000540)=0x0) getresuid(&(0x7f0000000800), &(0x7f0000000840), &(0x7f0000000880)=0x0) r3 = accept4$netrom(0xffffffffffffff9c, &(0x7f00000008c0)={{}, [@remote, @null, @remote, @bcast, @rose, @remote, @bcast, @null]}, &(0x7f0000000940)=0x48, 0x80800) stat(&(0x7f0000000980)='./file0\x00', &(0x7f00000009c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r5 = getpgrp(0x0) r6 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000e80)='/dev/cachefiles\x00', 0x400, 0x0) r7 = socket$inet_smc(0x2b, 0x1, 0x0) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001000)={&(0x7f0000000ec0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x84, 0x9c, 0x5, {"f2e0683818e484c9649d5ad23e1c11c131a171aa58d7c05975acb9078cbd4f72a58945afc2465d4382450b17b805516ee823b37e35bbec1bae28fad2ca7cb04935808fb874534ee7853b3d3262511fc3730d28eece1b745ae15f0c380af90d048af6d16040be4a3273f04538abc80630efce93f9e16a39a4e82448baf9b0943db6"}}, {0x0, "dd50d5cbdf111c9d423da32ad34c798da74ef7bdde17303cbb"}}, &(0x7f0000000f80)=""/88, 0xb7, 0x58, 0x1}, 0x20) r9 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000001040)='tasks\x00', 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000001080)={0xffffffffffffff9c}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f00000010c0)={0xffffffffffffffff, 0xffffffffffffffff}) r12 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000001180)='/dev/video1\x00', 0x2, 0x0) r13 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000001280)) r14 = accept4$ax25(0xffffffffffffffff, &(0x7f00000012c0)={{0x3, @bcast}, [@netrom, @rose, @bcast, @remote, @bcast, @bcast, @remote, @bcast]}, &(0x7f0000001340)=0x48, 0x80800) r15 = signalfd4(0xffffffffffffff9c, &(0x7f00000027c0)={0x400}, 0x8, 0x800) r16 = socket$pptp(0x18, 0x1, 0x2) r17 = socket$vsock_stream(0x28, 0x1, 0x0) r18 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000002880)='/dev/video1\x00', 0x2, 0x0) r19 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000028c0)='/dev/vga_arbiter\x00', 0x100, 0x0) r20 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r21 = socket$pppoe(0x18, 0x1, 0x0) r22 = openat$full(0xffffffffffffff9c, &(0x7f0000002900)='/dev/full\x00', 0x210000, 0x0) r23 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000002940)='/dev/btrfs-control\x00', 0x101000, 0x0) r24 = socket$caif_stream(0x25, 0x1, 0x3) r25 = openat$smack_thread_current(0xffffffffffffff9c, &(0x7f0000002980)='/proc/thread-self/attr/current\x00', 0x2, 0x0) r26 = openat$full(0xffffffffffffff9c, &(0x7f00000029c0)='/dev/full\x00', 0x1, 0x0) r27 = openat$audio(0xffffffffffffff9c, &(0x7f0000002a00)='/dev/audio\x00', 0x4080, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000002a40)=0x0) getresuid(&(0x7f0000002a80), &(0x7f0000002ac0)=0x0, &(0x7f0000002b00)) stat(&(0x7f0000002b40)='./file0\x00', &(0x7f0000003ec0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r31 = socket$caif_seqpacket(0x25, 0x5, 0x4) r32 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000003f40)='/dev/video36\x00', 0x2, 0x0) r33 = openat$null(0xffffffffffffff9c, &(0x7f0000003f80)='/dev/null\x00', 0x8000, 0x0) r34 = socket$inet_udplite(0x2, 0x2, 0x88) r35 = accept4$unix(0xffffffffffffff9c, &(0x7f0000003fc0)=@abs, &(0x7f0000004040)=0x6e, 0x800) r36 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) sendmsg$netlink(r0, &(0x7f0000004180)={&(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfe, 0x200}, 0xc, &(0x7f0000000e40)=[{&(0x7f0000001540)={0x1258, 0x33, 0x120, 0x70bd29, 0x25dfdbfd, "", [@generic="1f98e72d383a4dc5481bf6bf400906f14f9093062f18fd093e22de5baa3bb11672e8840b9866709477e49b55aed1b522bd857cb6bb5300d20937bf25f25822f167048cce5182044a3bd3c550d0de6c5d54ef457e30fde646180b9c6305fccc5b4f28a0dc269b2cd5eb2faca8507470547e2b808a4bae8df0aedb3e80c076457b19bcfb0d2be691aad7fe3b425278f0d4e11ab73dbee59eaa8e5afaa48d7c20590d682eaf2770526c8f230aa3f8d6b6fd49235a5b6f8809e1cce1e504f0deabbef962a340d168d03efb0276478e4aaa0347a13b119456c4ff58001381652892552f4ac7a40fd0d23a0e33b4de04c144e061243c253703e68a8920345a23a47a", @typed={0x14, 0x14, @str='net/wireless\x00'}, @nested={0x18, 0x52, [@typed={0x14, 0x53, @ipv6=@remote}]}, @typed={0x8, 0x37, @str='(\x00'}, @nested={0x10f8, 0x39, [@typed={0x8, 0x34, @pid=r1}, @generic="df8ed1c139b411fcc96e55b69b76e7229c1d86754afdcda635735902283367e3902968657d754aa951cc046d1790b11a0e6b03720538be8671b26d3674078c9511c92d45a53482cea385051fd985e789932ef6cf492e585cf11ac14f7241408ee5af20c5717c2e94361f18ed63bcaff9c5da65a79262d4fdda71fe3ff4b3c8d18df5f2acfb8348d5bc420c7c13f29506c390280f2c6ddfbe46fb0ff63467070ad6b4a01635d57553dc47aebd41b3d2fb825805c8bfa055fe89bf9929a602abd509f9ddebf2c064775bbc82f724e022dd28f033c74e987591445a48c7ff1cb1a98491ea", @generic="13d7a0cc37c9c0feb4718e8c77126f4ee3789d11eb8c376de3c0d494bf27b346748243afaef9cd4b1ec6e2ff27b8ee71ef5ec2118a4c76db80ed13ecad197c7a15cbaf7396375dd26f18fa0211ec7116dbbb3dc9b0a0c3c662663dcbf08029c08bbf587aea2d5c675fae8779ceba14f6b68718de59cb70a96354e6e81e3b4e792c3ea309255db3773d0de934d8c1a298175b6a214fc595b4301f4e4406e531dd1061ed884c3cc0b52a0d4da6b2edba2769da7f944047be656a86daa5abe04deb527e68d555099ac1e42764e31dcec65d46c8bf6c6bb8603a8a88f9cc7b5f242e295fe055a17f2e97e15794035c802cc42835b556bef83fb32acde070926ed9e3ef3a909c5b5c48654443feb4dcb19edcf9e512ae00eba8c4bff852efb1b337a752ca0226311fe65b125e33f1f0459164ebd7f851abdfefa65504b45cad890ef416d862098c70179d899be517bddab8ae1cfa633a89785069a3fe5cf1f18ecc250540d802e7eca1c00f05b62a35f95aaa6b7cf90c2aabcd364a3f3c583a076e25f380f56e95f44257cb00716d5e68391b1f61b2fd0b4d911a5ace36519a5636ec4169276f8f665546ce3f8a51b60b1df06381145bbec1434c4a3cd77bec57213cf50c5f85b419cca6effeb5d174f50fa54844982a24c74adb4fcad785a98f4af5f17ce7d859cf750f3350635e730ec1f92b03d1de959633f6686e4c86af58037499e577c2d2d2ead4b9ee5e0980bfdcb9a136359f928fc44f701bf79ecb1287132fd62dc06b429f7ac0425157b870538da5db899c50d82291301c5810dce206f6dc46937a49d0bf11837ef5e824fb2183855a32aad08b8cc8460e2dd0118904cb85bcc79b04497604db318bd30461dcb09da251c38f1f5a8581e3997651e93fce2daf2ba806f7f6ebfc2c3e631029795e83b5927fba0bd0c345dfec1f86dae24ee6cfd54834691f003354d0473d0c6c12a77e32d80f522db7ad0c0a7bd2dfcca9afbcfcfe891b28a3fbd1b5a535004dd8c40debb85124c330fad6e6d30dc26e3ce3eb4dbd87d83f88e839ffb0464b2762505c9e379dee83a52f82946944a5ebd25a198c1e1b554b5d04b615fe746a7f6d4e197ab8099138555b949409eacdaa2f370a0b8aa92d50a977d5fe146d926fcddcee429978cb7c2903b90fcdb6dc9f7ced86302b1b7e6f03e9c41fb49108a62f2b919d52738883eadf64ef8756fdde11be16f68e0719f1d10b45c20982b065fdb1986bc887ac0d36fc2d213c863c082e7a9fc983e3757b6ce3b5d58abce34d2ba62501d788f59e4cf0b189eced1e1d8f36e5bf1eefd1a95a5e2af7aafa3f88ff484a095ec085d3c2ff9046c1d60a31725380811ac5b1133cbc643640742d8a3825a9c927a9565272e33829efaca4254058b97c81ad937b8e306c43443b46de8e9e96e9590a19f299561e8b99067d3868cb78cb2d9df23552e5b9d44a7462964f546f754bdf5fa29599db32015695a7747aae9e2ed2d6372753106508fffa72f273cf343052f408a0734f5aa8a4b787614ac4c69c68eddbb079661883db78d6ca80be65c5c14e75d872354bcf0d957d4014a35470255d5c3dd93d6e6f4633b78047f3b6891dcb6962ec02e48e1b09c395d4de58d60a2626ce784e84d9addac9ae0a043c1a5b0507ac893bc5b26dc2d9297239a04aa7470722cbe599ade80fa2a3ea68908faa7c9aef688bfa0834fe0b0ebc0fe50da83789aef48a634b22b3bace14a44411391f36951f56db8829b4fbb7e75052cf1fa0424f9f229c3a192602a9f6eb39378d7e56c06e1d8cc91f1d94c45e73df1ec22a1926ee2766c9a57290e0e7fe51db80caaae35ef035a62a410b460c516dfe6607029d674e806701a36e6b826666ef52950632fd39e373cb6d3656dec18dbc08917cf1da72ffa1f3cb19d8bde8fb638bec930b320dcf5d28c74b30e40cdc801b0cac798e8733bf398c03cc598e5c5d015db2b8d16d47593cf063ee8a537e5fb66e74e137ea1751208bd7a0831677d1a286502988871b3bb64c56b7343a2f5799cb09f071a8f057bb14f105bb0f8c13d22b32e687ba6df0abc62060bae0f797a99b4da5352b957db89afcbca627d86cb9b66d86db15c6ea872be2356ede282786b58c1a4af5e0976c77dfa1dde828dac4bded3300280e895937b6388fb509290936d8b5eb65c78609a81cdd0f67d2a0a396ed18b635e83dd3d7e4e3606918168d930767489530aad3b47930efd5781755b87ae5d5903e2d0c27e4c725ffe81483cd24379e407e1ebaa9fcd4ecc71a98d5fb2bd30f650c051f2b34e55189169956c03f79c5065844bfbe179fa05958bbdfbda24555c1888a55e1017d7af8bc2f33398506c837764653aee3d6bebf83d053be0fe8309193bb09a7ec22644ab2e0bf7e37c990a00bf6b48c17d7759900f0a60ea37b26bc77fdec385406a8107fb2712f680c24f52ab32362476754706a146312fd3aa719b9b0867c2fd09bfefde293e084e6d460ef74c451daec39aaf8842d8e61155610a84e5a46a151db7d33d022cbe0b8199ad6f698fbdba0a11f45b3a5a3264040e66efc8514b6d8edf4757ad72c44e1a31a800bf18ea5f988a47a5235c42927be231e5a5ecf6b608142a597b798071a0771cb58540fd0dbb25e367592d98e93552b0a9d3c4e6e5a48cce5ddc3ef211afa762fb278af0c1be3a265966401a49e69faad8286ca0423f00d58bec3e25a0994d5298a2dc44c84e4e0e70ec43a6b823fabaa41b48a05c2984c7b8b62d0afe95a303386872280aa0a60ae3ecd538969d760fe33be00bdfbe4521a1bfd528832035a7bb18aef04ae94056d810f24e7397a6c4f66a48750d1bad2cf2083d7f33525bf6ad93c5e1cb3e713d0a069e30a0c6eef9ca5c01b080e276902914f367fd2bd466763624b4b5d61689006fb55b26773868a81bdb85c958198b7ee4ff3485b6bd563279682d05d00c5612f3045b320f769040837d3c314d8b1cc0107c1de731c9fba8bd13e714849aa1c6955a5cb084316fa248f0a485f91bc8740ac6a8f79f81db21345592c7dc21b6c8873b008d750e3b403895d936c84fcb8f22a6b68ec3499a48036fffbf4f96925ad773ec72f9ad30335b2128b7283ccf56adce9720ac3bdca65eab15ff189b2e451868ea4bf4f663552b2bb08d13420f904fe0dcc4e7030a5bdf2d5a05d553c0ef9d89f98ddf38ce4d1928c6d7fa65134a1ba942ab071f0b3a215885d0f913ea323df92bf23c7b87b7381288181fd9af38f1ea0ad9aad79e65132d7f27ea82759a8a0f2b2a68e3544549cb651f46de11a01356461d75d9d39aee40420b005ebad1a014d2df0752586eaa4c5536c5cfea8f410b42b8781e6dec85911c0fdbfd035f99069d63584c4ed14d1728f4dc57d7a3e35355de4a2190c921f6aaae97fd7702de3d3abcf6067193828fb321971389544b5b892abf1d1efa5912f571b11ff4feeb65392261053f30350a2607d369e01dc467f59cfa1652b574483ee3ed0ba4287446b7cc735ce5b07b3580ba7bd6f90a740a8a99e367f18ae01bed6eb7399b75d06a3ab35491db22b88f7f9916badfbd2dc33a92db21c161295df10525f8d60f9dc26176a5c1c32682d1a4af65b0cc905f38e7c1a53fa3e029602d38be1abd8c1e2a80a85fbabaca452efd3d7d1c24357fb2824b5000ae6cf43a165e6f9da622a261d9edb43ac04de3535d6db83d50c30f2f48252afdfffc248c1783b7f2c9e11d71ac199771e8b9ee46220e766c16284300f3b947ceb284f601cd0f1b656837693e79dd16b2d9bc94b7cff2c8236c5bf202c2f17a5c38eafbaf95932ded367c68968d88915f6d9277955432fcddd0057b095c7aec5cadec542c1eaaa275308568211889ce59b89bb628ce37ffa58faeff2d3e575e5e8e2a060dfd6cec22af804584980f982ea82a20b952b5be82c8ce1c86e90e0cfee9ee92b84ecf2fa905b7310a4634300b651c9242151941e55f83de24e31db2726811d198c0cd4a83f5e5094974ecc81894cf1bd9ed307acdbb0d7ceaff67ab5a0699f79f24d2913dfbc1cf794051841e4dc795cb1200b382d7c1dbf50cd0fccf74f19669344671926f8ebc2b1184a0a2a5380ebc94276d572bbbdb284b56e125d6fbe76d6e0c90fc06a0277e3b6cac9c040c406b2103dd2d158b9daf4bffa6ea5dc7fce6b2d05182f51c60d4e1ca43c2cad32750e65b53086c7777bb4f05a6ff3bf3239395202ff02d690c087ca4b73b3dfaf38d20fb027a1913d8cdff62bb6f22ea9250d7662576a85ddc29da345dcfe200a9c93f94706586eaebcebf472ca728f14d163b13c5a371b42345b95a033c3f1ee8b8b012391fc6da1f26a7304a92c0e964c1360224e61dd3ca85f1666a9832e35762434ca4338e79ff93d36844b9a374eb0948a47a06438b67b79e43f9868cbf1967283b8d60fb1984fa0c1b83458f771586d03809998265844d7ba292bff5f7c33b089a074e32cec7a3fcc6c44492de982be552421ae339e65bc0ab019bf02c2ad4aadb18c5217662b9c98b6d5b09083666b990a1835fb7ed678d003a6728311b4a447b0da246043bb90a0cc843beff6f3ee49e4e1cf989f923c4e6878fb92a3945921b9c4628707a0fc1b46379c0240cc08c3c506ab1724252ab1615851bb7a262539f9991d2aa60af2b548086aaedb03f5c5d71b6d1ef71795740968a39a086915927e195a8eccd7fb0a5b6b118833b0763629769952efb37a06599f32e770232f935b7a4851cf108dd4fb4f8b238f154cf3f7f43c3c40e87936b96fcd3c43e3dbef73742d4501250b59b42d3651f77683657e493282c23cb2e4c26f86211c93aa0122d591d509a775b2e250ad1c7908408532dfd234c084c80b4df5913bea8856c502ffd285024d5c37bf50825e7cb4fb73c191486f0ffa30b4da9bb129ed348676d1379452bbcea4879dfaf58ceaa5f90c60d6d30f23f5d3daabf7d7bcdac036641e579d8c4a2447aa61c6e8b9087a752330792e65feea56c6e507776008f3dd4695965f64f219e424200634d189e5532a5229eae337f52697f175b69d23e969aaf65ee2e599ac07efe4fc27d6d342bc189280f0eb4f53a2477d0e4bc1c105bf275ecb07d6dfcfa9a5bd4bcedc0d7d9a92eac50026136db3d2b1fa6f96bf220e94f94f62eaf92bdcec002cffe10da6951849aa906f795cbaac8d771f25dd8278a6f67ab6d3742cb0b78def7d1c6e2ff3cc5083b2cd7e68bddc5c657fe2939e3d0ac86bc7722efdba4d57e72ddfeb7e139e66663788017b329ccf271c74f5ee37b44ad042e1bfafbbe9e8339223825a38060f6a5eed969288ceb39c5a72c09b2e99804402bf8962c13f1ef524c13f98165a86cd8b3bf2072ef8c420c8aa67532827af839194909a820c9b9598fbc6738ce75eca92dd3a6aeae7cb928a46862e2d040576892d9fc796f31b2c64ad9011324d8bc5f78278d6fa6f68e08fcb6a2d6375dcf508f78b4b6ee87f19118b8ec9c9842e09e32cfc09800bfe0e07480232b7932b07f0a6300622fcdb1ca84a99b5e8e6af676e5a028e9fe555a4c6074b22391331a4395c47756716179e0053d554b9a11c8fcda586ef330957c0d7ed409dc24e4699d482de0b3db92be7880ef7df9134fe05a8075aa83474bc252371c3c76e861293ac39ad0cd5e6ca067913ea7854b5fd7c53051e71947e586e55aeb72c5c5adca04067940b446b1e60b9d37a002060795379c343526e0e35af300f4a955e195959528d894f3fed49467f445f63c7e9b8f8f3a08fc14f5da84dbf85304dea5e1f", @typed={0x8, 0x7a, @ipv4=@empty}]}, @typed={0x14, 0x1, @ipv6=@rand_addr="eaf3e83e6dc67651a5285241a6c0805c"}, @typed={0x8, 0x49, @u32=0xf5a}]}, 0x1258}, {&(0x7f0000000580)={0x264, 0x16, 0xa00, 0x70bd25, 0x25dfdbfb, "", [@generic="34035fdf44924c0806097e84e27c7a994a083acb94218f88afe9bde4246360c159947b176c2466ac753095f055259ce46bda30ad1446c0e8f091deeeb39a7e483005748a8460f0a132369435a0bb07311858e0b831a203269668b8625ee92b5796621e4a30b44fc731cf29216dd58bc3deaaf9adde8f6ebed051e7a0d09d424d71b70ae9cb40c5a7c1fea0c5f6628f1c8d5d33c58091e15309bbeb0e1565bb7533961711bafbdab2504bab37913a7142e06854f9c87de0b3df35ada6253c33df101918bad2dd980f0fe4b2", @generic="b428d78421fd1e30644549d4b8447c", @typed={0xc, 0xa, @u64=0xfffffffffffffff8}, @generic="87f2418d0b536e28ad6aa84031c8f9339d7966be5b5a627f46438aef324ab841d53f4add6750eba53c14c5de0179e7647147e5c6ae7e17c09c181bd31ed23cfe35eeee8b2219a920505063b6f53c93ff5c6e9f17236e5bb404edf0ef138dba0a5ce518fe19ec23f1f3bbf230d21ce9d967c35254516c115c6afe4a9bfd7ed0015e3d01ab4f043bdafd5ad6b765d880e144c3cc61a0f94046b2114cca0d0b138859ac3a2d02ec09ee73481f4ff5735cea1ad452e3fce446582ccb8f60dfa1b5158f79a5ee874c158d0d00f824e4c903a6e6e9286f3cc2309a08e574bf24a0cc06df0faedf307a910e4ba0", @nested={0x80, 0x63, [@generic="5671beed9488c2028bfc435a65b256c0f80b212facf1c196faaa0d228e7769736246fa168733b9aabb521264e6f9e9353b05f266fd917335ac2a13ad1154b8f614f77dba855f5daf38fe098cc517426d221ba3fafde572c133794f6d5a9b8034368e269744e4964fc6dfec9cf5742c2b719f2d8a488c27fe4dc428"]}, @typed={0x4, 0x5b}, @generic, @generic]}, 0x264}, {&(0x7f0000002bc0)={0x12ec, 0x16, 0x210, 0x70bd2d, 0x25dfdbfd, "", [@generic="02dea8fcbfad07a1dd40a18c706ade157a56e42b1418f14becabc3b415e95c5261f81941009f40e610080dd27cc9ddd532c74d0537d932aac7d268e9a0bf08c7b5c6a7c57069492c8065ea1945d2d3f362db0242e94afe83ac5df1fb1d0c38c5c7a88097d868467276f17cc311bbd2bd727a572852d16beced8be37032f043fada4c34d9dee6ee31227effb3bc12d415014aaf51aa446152eb313252d727783dc78f3ea4daae3400f5facd175beec306455eeb925c4925bbdc79ad0aa9e1a13666c80cdecaec3f46abf850d7ac71b42a1cbc924568d48c0e06816c499e6dca03dac37596bc71ae38c7bcd9a6de9c4c07c6cc0695e1d92250abb8afcf88c1b0a460c543df548a141e405215ed021274f78a156b63071b931f9ff62cc57e6325d0454d73cd047bdc44a03d17d51180e7a6ee5f77ea435edc4191600c48ad7923b48c97a0cde77c9dfe0c68cca83053d15591c3d1ba4eca1684598352f307b91af342574e5f2d031e5167a841375449d8c726a64a36ac68e1ec60fe3e91511fbbcbe156445bcf39bb945c294e130b3bd6b7b9ffec01e0bef69c1153f891c208b3b1787f3d97c11262601021ceada848e565d15052402fd7f18f65a7518d0f6610f3b3361f828d0756484a54e2206defdbb8be9982b7991cfea32da5e28512b2631b28ae30c8f192e83a205a39625d95eb84893a2025cebb7a3afedeff47c9f93f4604ab3fc8c95a2990aa4639e30616e747e8455c92a63476b113b47e405ea23ffe3f173d6ab0cc43ad3afdef5d7bbc5fe6ccf4a47233587beaa02f5b1709fd7396db47411b1ea57e73d7b8c77da8ee23f2bbd9edce7366a5cca59eb6d92f36efd3333ac09168556cf3c4fa0fc25de6ce9549268263781f4f0afd2b5d5721b09b39c03fe84ad5ed4ef1f46dd0ba5a2ff5ee932f5c7c3401e48366c513eed313028c7e61c45d6b2aea7702fb6c3e6395fb158c7ac126e2c0950fbd011decbae00ead0e52e72ba876496880e26b6248e224826d0a5f7254f9f343d32dc51511b0e9b604f373609e884e21212c589f98e7c86565d800db0c52e5d36b52ac1189d6d3b214c7defbd402bb6f35cbf65a368c0084a4f03d9c11ee1506095851e3c4a74d4e0ff523267fe57b22aa648b2bb113cd5cbbd25ca53f3dda492fa6478dca45c03aaa428a60e3e19143a679d639b455053962e1dd22f440f52a2c8688503e589384b8ffb941588784e61eba8bb9eca42d79e99f9ec8acfc740ce9f1bf8e2682b614e3bcf487de5464ef4815016ed708578a98372a2ba9b22fe05200b67d347ee4828634fc44f8d1fff0ec336e4342a4699450501b132781ae43fa54ee74f87e883e6ddbd9ef290012fdb8fe39713592a83454598894938a62aa66bf73bd8204ad06d9b2652eac108d506d2140d050e868a3b5f0f4531f942460741abd1ba84c9840e4a26fc1ed6fb3f5f53a00555a6e3ca40267070ed2c6912117865805c1467fb3bbc473cba368365f5aec79bed3a05f0be791acbd437e89a8c78cea9edd152ff50beb9a4e382777faa46808a423b5ca4975ca68591b5e1c8f22a6c09f33f39c0ae5a2aaa67d1ed1a070656a8e66269f7cc914925f76cf39989b9dfbea5c2ca36d91260a4e94efaaaf09d94e3b4b86698308882f28df5a3f041ea32d0a6b4b9f32d1da5248d128260799197e5e6c58709f5b730270aa9e9ea48fa20c9e7931789dcf10e184699374733e0a174c5bc614d265f03e520f790b0f2915565a22d1cc69743ca45e82e27b5717367aceec77f24135362e9a2f9093f415811014e35374e6047a4d5f7d090b275be15821b0a36224baa6c95282837f70f61227ba36681c4af7ea92af851c2e120382e8a1e8e5c9edbe1a36c8c497ac0a8d1f018b6ebd5664fe5af24b4592a0abd4202c8285a57a94cd0bc6a7a11efae34d517a917bf668de1053c63c5cd7ce515b1800f62c337840fb233ebc959324daf9c2482f35b374af72ec3a1245f1f2e3fc27c9adfe29895e40eecc498c6f39d955516619800bc013c693e9120a709de67df4dde16071850214aefc4789c752528e2169bdb7ffdc289f14b55bf72e85bd5f1b5cf943a7ab613c6dd88d80dd9f5e64fe983dce12dbf88f59771da6736854242a832e63795c64a09e684d10b2c2ce57ceb4ae4cd0f97975317a276c2e817f2783c452b94de8c436208d75e02c4d067b4a56509f39e2cf009495f3539481376f30845d4ddf9c70a47f7f2539e7c694d1773f6ba596eba3a02448e3d851e7192bcdef5273d6600c54f3ae12df69f214c5913bd4cf1ee65e373dccb4165413f01e4da6d400b79b6a4618629803eef9e5d7b41ec13dace733046eeee224ccf37fc772801ccf95bf5c411faa7d90cf99ba70e6c6a6c22e1e944adb3d04700469dd425ef68acf4a5435de2eed05712600c08c3e9411d4fc7b6aa4bf547a655a67c3b8f8afd0e3577ca53c32742b2b31c6205b5a06b826e6153d8747bc6c7d2b8ca937b339e3c33895e480be815677e57887f85234ef7902ac2d3ef3e63a7537b95be7d52d2007bd7054ec77a124c60ad3102234223e8431eab7d518a5f60854a08b109297b117b40c47c03fe6a46c5ea3aa4cc58aa62f194811ad48dd0107b53edecb4b462ce298d720d9cfbe78736b46fd9b3be1d3a6e7bd6586a2522b1beb904ef61eb2ec783142a105008f4e3795c50a024508dd3c1c029255d8c7e7b43101fd68c05506a60799a54d3b36b279d1d6809ec9fdefd926f9beb6346aef0f307a6edb9c694b4c3cc2ec9f1182de236be8b72ebcef718137296589a46b49dc3f785bd88c35c0454d3d768de37be90d8a3560850127e5845806ee927744b91d1d14c347240805e1af45562b549149dcb604e2fa9eccb9ee844b5b7869d18bc715cbf67cd6339560fe04c1db3b3a6f01c789477c5193e420e3e61069a2d399534bc7332b7f2e65e630932725aea626d4a7b20489a8d065c3f2ad9ba1375c8d18d4b3c8d4cff3ee208b7ee9af1695eeb3ca8396ac7ffa93fddb124c5254f62aa7f5eb6d815f8e9b218eacf4861417325868f10c994c6e52265a0143359af4e3e3b8cc343a87a255bcd98ca611d4fd01cf7ac5d275a82bfb9c92aa3ac9961e0f0461eb014e8e1b70c639324eb164464959024540ff17703969329bfa2a6cc59933365b0605d590f0281ca26f7dec3d6e37d5255010f64d726c2c8042e57bc5a0b50009fcd3061df77a43b4480d3cf5d489b7d884aa0dcaca33004490316858014d45944640f0289c0443ba298a656e43b2c8d5583410e70891db69a98030b5a0ca698a41402c22763b9c892342decefeca1a6c228e3237544cfc6d1b6ee21a23516150eab8c38c939e58d72d5a238ed373905bab1a09be6df1ccb8bddc96500b256d266b6cda9f01516d30fec4f478bd357a050ea1a39d13cc0b46810c2c0b1f87f8f4019e30fe860732a2c1821c3f6042876319fac52dd26e05ea3aeeefd605b70e58901ebbd50e9474b38409870e927b4a5e863d3062c258839fb9f003906235e9503c5eb203e96bacd3a1fbbabbfd2ef9405e4c0db3cd0d2aaff84845d3f1a038d28e1165fdf47a06d1ce7d1c2e3f718c81a8c5d0f5f61e74026a7d772c04050325b32014591707f6ede3a1b3477c6d35fdc3023061a9d32ea943cef6ae4b822b24ade469d12c55ce52f68dfb1ac32affc910426711a6ce428a1c9a8698eb1cdfddb346963719039152996fff2cf7da55444a88857d7b18e9b44f972baf56e83f86d7814e9e1f6cf68d94f8170651d3aeb4a3bdffbfc0e5387d9aa1988ecc08fdae318dcf08844360326c2fb252dfc73afd7eaa6e95c179b4cd44f9deaa5834f55037e9eeb34d5decef9a5083dd8acf3ba50510194fd2eaa6c105d8ffb2b58766b8dfe5cbcb8350047726cd0836e9ca26f6e988cd052a436cf0093cef9d9eb5fb2d7be5ef6270a699d0c1cc4547a36c650b48363d619a8724419a659c2b33a15c8dcf37e141bc3050c2b3cfc4c185074b4324ca914dc34aa3f01750664c7ab2c83c029893208ac6769e27300b65e621a87c34a432dc3e58d6103872539bd0c333fb9d16605f8bea828b97598f5b21a2f46388c111606a1a47228301c801793c6e9c843bb02182bfd2133fb4066f621ebe97bbe8695630fbd59f0dc4aeb7d0ba5ef0f4cfdf76fa5c6f5bc0786f9659e6741f3c63c4245480b17ba14f4ad6a4411725b5413702331a50e2286787b21de990a16b41a85ca41a15aacb30a18f02f7f6a611dfb01ba13f1ba586fa51bde8308d74598283de978f97868452d827bee2bf28941987530c5ce62e72267b4fdf261815284013c1d17591d4beb0a34bfeb1c5f62a030b4bf50e3aa94a22732fa67effe2caff99a3993fd009b3b76026f66f5787a2d7ce7ab8701d44ecd10c637b73f326880f4c602db4756ee66c03fd051ff4368d9aa22756452aa58e54a1920c5c44dbc16d0c567d00eced080e85946124c8a8849c1b296760072bc33648446eaf3a319eb59c5af4b06816e1366352f18d426c7b25b996acff4dcc2c09df71e2cf846e335ce085453de68bf647115bb338c42866d29ade27e6d24aeba17b41b0fa8562ad3abeb21a1dcf9f7a5416dd9b5c706823b9e0c7c89ba7aaa2e337f362b1ac9963119e7001d9bdb5461e881dc5e5debf02298b0722f8c103b537a5b8eff9df3dd303af48ccc12a2a2751d0d484d47650fe16f4601ebe642b24428e2d1b3956cb064353de359cd03f814ad529b70d36dfc796ca1df39db7f6d6bbee4af11d6541106fdcf8be25602780db6eab1977a16e0b7772bc07c785373a2cb4a7696b2a3c6dcafb3dae7b86c50a2b80d53368ea1413a2aec886cec2a0bdcdcf0a9bac68ed7316e9de730b511e7c2a83c3f636eb3cca32d626206a4f9046ed9c4a739a097610ae02f7ef820f863f7fa4af3516cb218593bc6c70c8c97de486a232fea79c4cea783305f86f08554cb3a2f57e1f960a9d5e5b4071ed310f5480c378fc59f42b518c0f10c29d3ab56e519b07adc1a1a168438899cc70347d2eb6b4e1043a051b22c74ddf88d4736352000d49f9061e957e0a06e3621ca35291af04eebd1576e191a672997b3468305cc5d2902511e068abb65ef41d5041563ad307bd59448290624b7562ac8b243b49afe3ac2cb046fa5b97c2e955a554d34dfc2b4ed1328ccaae1e394432989c44e7de77b2582f6155407916f14ce825d0e77e5a2653334bb513ac45480857d875571ef3c679f3330ac44191a14f914f3df0898dfe37ea5d744c169204db96d936fd4aeaa16968d19711b3d5583c19289edae012b10b79f28c8f92e93a6c5db6d28c691a0457c64f21e805a19b65ff9bcb8c94f710a4b85035bf3ab850f1da031345b8d3b5063fc570510a22bb0f106a67be4ec27dd7322fd5fe49c9cdd7b2fc2ac43f11681ac9636beebda575c65a1f5e04ce41bd437f69cbcf3dbd210132bc1ea6a88d9f4b2d7e999a716e3b3422de0b1493b83542d2aa447a4a265fcddb068874c2f1cda2380384b9ed53985a6e8ed972ee67d2a60bed19fe0adf8fab7fcf7c251ed0b02347828be0a37f570296c4c187760c93ebaffa679893574c8e1c28a61abca712348912134bdeca39e6bf4dae314568e4e3de354479a13a4fc7b0b8cf195e34a776d85869ecbfd29acc60cd1362b1f1530c94a43f620df084d4c3de32c95ab5461af68e052e3e5a70082ffd749f5b74b6b0bfb3c337d2e414a6b61e18f51057ee4790f51b679660d8bb406a4900e102464f10b6d61e5302123e1f96a9e7", @nested={0x2dc, 0x80, [@generic="95a130e1b16771100fb6164ee421c29ee5ceb06b12a6c3c0ddd98907292b7e2e0e3241119e69208af83f59cf26aa8230d96fd74d5caf9b66f6", @typed={0x4, 0x22}, @typed={0x8, 0x7d, @uid=r2}, @generic="d9c4a06c2404ee42ac4fd1612b290d8ec699291431533cfa8c6ac72087590631a4cb18a51ef788759ccf72627a21790156b619755ec14177c40afb965e15f2949429d890db3c8a8ff51b8406cb45ac06d902a207872503043368a5b5f2da634a", @generic="e5b878fe3c6cf993c6b02481087965aba2b1748663c7e0a554929221edaae4ca7804c87433a5f6f40ea1830f8fd8a5054231fa9a3c6e94776894ea836caf20a7c789f4ac3f2b66bd7089f9140971852fe44751f522974b73bc4bcb6bc8d75fd7ff5385bd279d819a3dff09b768792d0e4941e27c7009114587ca711f27c9bdafaada4966924043d6959b1f2d739925b8715c50d0bba5cc2d1d745091bdbf6b1342e3f17c93368c2dd6af1c3e7cdf439070aae125ef74696d7809b9c958bb4432c3869f8f701d6a76dbb4408e48034e1093ef44565550a358e6246bee1c395a3bd263b1599ce653e46e", @typed={0x8, 0x87, @fd=r3}, @generic="10c58d5894a0ae825836b5928c78f6807cae6d23158fd69afb7705cbdf2944193f183be45ec50d6dd52a8567310ef1010494669c3ca8d919853e9000535f0ad47a7881020a9987cb3f3f2eff008a5e22a1c2fd5294bf1218bf821c888b220fd1389a64debb998f4d57f8fff96e4876dfa1ba38b0745b4569", @generic="377f93cdfedc5ba4b1d6ecbdf89916c016eeda212c128a655dd5adde85e661a174d6b9f763a68f6262e7f73f7d73dc1b56694aba9c29103421b67a0be22a43c1971513596d09d068dff4b7d28b50a6842c77629796d3372758a9d89610c861f7c38d8187da308dc66ab835beefbe", @generic="40ef68db89fe7785e025c3d3322abb697770bfd7e70109706318b0853230121b1322f4790186615ccbf71bd0fc598d6cab02d6b8c1f373771eacedec8c8f0c2ea46f0480a4ce0d57686491531adc04870a3896170408c7cf41f19ab4"]}]}, 0x12ec}, {&(0x7f0000000a40)={0x3cc, 0x3a, 0x8, 0x70bd2a, 0x25dfdbfd, "", [@generic="3aac2c01520327d8466c405ad2ca3b135ce6d1a4feb17a707add29cc28dcef2fec38678fdf461dc2aa1c870a6f4776b70ca2884646d22173213521b1d092f8a9f1af38014cd50d7d21ce2de3fc24f74935dc554965b38b9c18991a45663d457d01510d7f46c0eea2d39b10abb68a53f1b8c340aae5e9bee8668fddf385c74ce7a1862162d7cf657956c4c453978ee5da2d3a0604ecb19a4a007872e0f2592f7d9c8ae5009c", @nested={0x1c, 0x34, [@typed={0x18, 0x8d, @binary="39d057d705b4b21c86be1893e8a77e658812"}]}, @typed={0x8, 0x33, @uid=r4}, @nested={0x2f0, 0x6f, [@generic="940aa4bef86e1d9922ccca3ed56bb22948600f791b4453a1e202da460ca222b88217289f6ece824d1c3f780c2a961c66f181509e1fe037113ee14e02b3f0b27e04e07a657501f5756d7d39bbefe91b973a2b1e91a3f712b6f73ba288d1a5f5c3351f87b671e3aab82c0d37c3245ba7461785ace97c8c724e4134d5c491db932d56514a8ea1aca711366f888c1314bfcbfd784de7987483ec0879da2f85", @generic="73ccecb3a1634c324843faf71cce330b09b826ab4ad70b58b648906f4fa64dc35b359a295bfe3b59c15e21fb13f5a8002fcf38142bb9ca1d9799a7abc3c33ce671f7af80dd4bc2e4e7b6dc21692f589616d9c891fc1a7cf0d99580707eda5594bec45fbef8b3e5bc570453a1d1d466ca9f9e7b07d7a9f44fc934e8dd60c9e4b3afaabdda7136144ffb706f8648e35ae4acf58e474c5cba0edd286e1c7c2f17c035ffd9b803b03351ed4269593a4907b786cbafbc5710b673452e7c23f4086cee4e1fa6b461eda35fffb1cf4d2a0d799fc8", @typed={0x8, 0x3a, @str='\x00'}, @generic="edb257df7fb3b79fce3513d9d3760c4b0d0b801d726a91dc934a9dff67d331d669e78483bd2e0f2b908f91bf2001a779370695", @generic="9a0d3de2814447cc2a4b55da369b22d0412040350c92f523da42665c757b0167a07b3cabcedd68bc02977c9c407bee9e7eab83e0d8438d9581aba2754feb34482932646b09", @generic="cfa8af5ada2c6020e1f4aa2adf9a6d211824560d31a45117273182463d04efdbc934cd22be126246a49a08c9fe9514847303b50a86af728c8dbdd3688e581704ad6c6c4285bcead47e0f8e320db7e19787ef649b13d1c9ca8ddd7c3b17a37ee81de69cc12b8aa82b74a9d83f106d518fa631b54f5d99c2f9b48f8662d9f7dbef4dc6fbb6f15f6c4c2111a524dc653a21e3b2256f02f5ff60ebc9ddb083158cc4288a50ee86e6937460064a118459ef51efc81195061627b441c522cc311991c6f76baf578e4befa1f052394b194468a2737063da862018af429062750ad124d1b60899b7a6041cad0eb2b2ac335bf17d", @typed={0x8, 0x49, @pid=r5}, @typed={0x4, 0x90}]}]}, 0x3cc}], 0x4, &(0x7f0000004080)=[@rights={0x30, 0x1, 0x1, [r6, r7, r8, r9, r10, r11, r12]}, @rights={0x38, 0x1, 0x1, [r13, r14, r15, r16, r17, r18, r19, r20, r21, r22]}, @rights={0x28, 0x1, 0x1, [r23, r24, r25, r26, r27]}, @cred={0x20, 0x1, 0x2, r28, r29, r30}, @rights={0x28, 0x1, 0x1, [r31, r32, r33, r34, r35, r36]}], 0xd8}, 0x24008001) r37 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x8, 0x8000) ioctl$VIDIOC_S_INPUT(r37, 0xc0045627, &(0x7f00000004c0)=0x5) connect$vsock_stream(r37, &(0x7f0000000480)={0x28, 0x0, 0xffffffff, @my=0x1}, 0x10) getsockopt$inet6_IPV6_IPSEC_POLICY(r37, 0x29, 0x22, &(0x7f0000000380)={{{@in=@empty, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@local}}, &(0x7f0000000500)=0xffffffffffffffee) setuid(r38) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r39 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r39, &(0x7f00000014c0)=[{&(0x7f0000000180)=""/44}, {&(0x7f00000001c0)=""/116}, {&(0x7f0000000240)=""/243}, {&(0x7f0000001380)=""/218}, {&(0x7f0000001480)=""/55}], 0x1000000000000127, 0x0) r40 = getpgrp(0x0) ptrace$peekuser(0x3, r40, 0x1ff) 14:59:38 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 994.499503] binder: 15022:15023 tried to acquire reference to desc 0, got 1 instead [ 994.573708] binder: 15022:15035 unknown command 536872576 [ 994.602803] binder: 15022:15036 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1001000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 994.650005] binder: 15022:15035 ioctl c0306201 20008fd0 returned -22 14:59:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev, 0x46}}}, 0x90) 14:59:38 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getpeername$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14) mmap(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000000, 0x8032, r1, 0x0) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f00000000c0)={@dev={0xfe, 0x80, [], 0x1b}, r2}, 0x14) [ 994.701821] binder: undelivered death notification, 0000000000000000 14:59:38 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:38 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:39 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sysfs$3(0x3) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$PPPIOCGFLAGS(r0, 0x8004745a, &(0x7f0000000040)) 14:59:39 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) [ 994.920245] binder: 15054:15056 tried to acquire reference to desc 0, got 1 instead [ 994.989720] binder: 15054:15056 unknown command 536872576 [ 994.999462] binder: 15054:15056 ioctl c0306201 20008fd0 returned -22 14:59:39 executing program 5: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:39 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 995.138742] binder: undelivered death notification, 0000000000000000 14:59:39 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x400401, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x2800, 0x0) setsockopt$netrom_NETROM_N2(r0, 0x103, 0x3, &(0x7f0000000080)=0x8, 0x4) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x10, 0x0, 0x0, 0xffffffffffffff91, 0x0, 0x0}) sendmsg$kcm(r1, &(0x7f0000000400)={&(0x7f0000000100)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e24, @remote}, 0x1, 0x1, 0x0, 0x2}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000180)="dc56e118ed3e8a4b77004b495dcba4d792f6c030d74722fcacf95869ae49508e13e23f5f2b6ce1262ecab84d443ed74310c8b845bdaa789ee5d51aea63b837bfd7d161714b9000cf77989561d43d1f73c0929840ace1b12bcdd8c6727d3d93efb2e67a3bf422f98c6fd05978e317dea02a6a867d9658c454c69dbc9fb31841a38952d24607e455052325067b56dbf79a36e58e6f3e6848b749ce39a2ace383a58a5b682f9f711e1fe8319c4617cab65594d12aacb5b8fe313a4e4a310d17af0d812809cc9464", 0xc6}, {&(0x7f0000000280)="ff60b3ccd8b6d6d39caf9c6cecc795833a4f816c68115eb6b78cde02192bb7ec9870ef99e135461266d6b5a2a7e129247e0109cfdc0ef5306195937a3837a88e829bf9ad5f962fdda60c152609901756be8f73048d47b99b5dc6543dfd57988c30aeeb9a45913e19d9047f227d8d0a6a44d095fe", 0x74}, {&(0x7f0000000300)="1717f6b1e0d8921a6cc5ec251c324e63cbbb01a175fdb51356628662bc99d957b2e845863bcdc0cfb4787fbe67e943db75b2e45d1f1f57ff75c6505e4ac10cccbc464bcd45fccf6e1ab80e5d27a2a7386372b4afae2dcb41e1402367c31848279dfea35a92e16c4c837d5524e81565e00ddf5acd7e31f50763e6cf4fd56b826dccba75d30dd3919d5a8a", 0x8a}], 0x3, &(0x7f00000016c0)=ANY=[@ANYBLOB="10100000000000001f01000000000020ef0b728a7a5cb393d14d08bd03fc00e294c31b1281c7c1115d6f4fd125e836c4a160d246497a0caee725add8069658875414d8359220916d8c5c096d73983fa6324ad46e5099d27e1291c68d92e1a88040ea55e094951357f9bb0ccf6a8887d53642814e05991de20f47f9fd104430a265c3851519aa41b138654a19b085e09780bcf82ab9acd4eedf00482d13a2ace32e60716b4e72191ccd5dca6dc90de22d08b77757beb4110fc9004686c92e13949c22051d94748b0978be9bb54435a371165e627e0ac5e30040aefc42da76a2f8a5e38c09ba353f503b430d39254af0d3617c0517c7881b4eef77bd64d7bc5fb367b40bacd752370b2bd228583b1729704bc8e0f53d1f931e777f1c1fca8e821526e7a5a96f08cbf2fc1a04528c3c9eadc61769a66eeaf760827c8e3703c22e4e8f58b667177326c267e557e72750c8659f0421595e9ced26d266f77e6cd44c0c7ee921a80aff363e6ada274ac8e16215e851490b97207415702573f868da7720b66c8993b5db4fc08af0701e7c114d007e74b9b677ae3dbce96f0dd89c4c7f8ef717ecd6d0c5c1fbf870189eeba315b07075190cc914c6571925f5569d77f97c729af59130c334348d560bb0ca9ac4121fedac1c348a266ce10ad8077b315abfa364c12d3a0c6659fdf5c253a460d95e927e3b3ef2ffbc7a1dfc13c2b1a40957bca5587acaabe53a6e4777322b271baa747380c8f323207d08fb41421149755012f2014367f2ce424c42c1fe60eef6462e6f0f42a713625ed3686788d0e16187c32bf87786c8b775917783f21ed31104b912c682218c473395f983b271e3834fa20aef6ea6752f163dce0c7f852b1f3b18f1739b04be93078c73982a47c8c4f6d90464cbd35932d284bff798e19e9f198088b2d20dc28a37e537c976b5d498a21457aa4bd6091cca18f2dd8171dcf2b1d9cb853c70a344d48cbffeaa7f9423559bc556ada2dc6bbf1326f560de244d30bef3e9fa2a4ea6437c86541bf5fb3c29d5a403c6c7763b5fd22c24898c5cc8da7c9c8f7bda0ffa46594522d6f5504407be03ea89b00b1b8ad7e769ddcf93d2110e33fd172fdcbaae3bb4ce41613ebcb8cd7a90153d7f2c983ba3b18577b4bb8caf75710b094af30ef049849b7402e79b29ba78c978e7639ea2e1a18cd2c0b4c304c843bfffa116a7ed4fdc5baf7e8679b9c4be9ed459987206bd51beca9b53ce1782002c8d3a94a6965aeed60e08414523be9ae3a3d0b08f2290c52467e5768b0e42aad2b6cabab44e13f7fa5a10ec2f7136efca453484f11d3d1ef0c67d3937a636b008e8c32fee310f714955bde8ae67e5af31d6719afa73903ca6e2afafb309c68ce2aa0ca7e5d1edce16f2dce5861f5d3a5545039c48879ed67a0e3034eca5d02c43fbba9e8f5b7a74043225cfe004c0d50beabff2697360419b0af3b671e40e790b01b47dd810b49e776235afcd3e0654c91045ac04c42eda63104705466598db2551dba57a96c5a063ec0ea313aa2db6d2745ff170a3ab176fa4f003b29d29fb4e60791a64f86ac93561819ab5a35331db1771685c420d6be4db85ef64820783ca28fbec398db2c1f4d6a06e4700630840ec66c118c6671f5b7ce0e957584ec5044e6fb4320142f6062e84f789199605c86d39b706b9319b6d404b2cd20515cd6c15a64137b911568d671aeaa0ef90d34accdb4295a4577e17da6cbd3d8ff67474f900620d95784ecfad6e2247dd518f50d983100cb0a44700e8779bdc1e01fcda6ec68b4f1a956160b1f467fe635aa4c5e6101148da328391cf4b17ac61769cc8bdc38b77a6e303856f96b2b51b64a39d619d7ad385b2900a37755ca42d1c2ba1f9cf3995ffef7c80a78cce5a615b94174f2780a9405e3cdcc2be3ac79c37897fadf1fc80ec7dba12b5fd362688937a3f551f7d05eea976e5bf3969049273e704ed26a4667371e926931639bda5e3463f82f6757d4fca31ee8d114420cc7817c4cc9bdb3224cfb2126a6d2a6df2cc50aca0772a2dfc7a295aa4d0659915eb56ba8b7101fac6b9d2b1152d9b092db49354e5ce6b00d68d6aefff6ed83c5eba2b2718e45e42c2329212bd70c6ab139dfeb5ba1cbefdf03949ff5ecfffe86b453605dce7c6bbdf676e01b5378a92d67911e909e0fc7b1960c9e552ce3186ee2ad7defd8c46c250c2f6b380005a89f5b733843957beff08e289e6341e4abc7ba7464da909824bc154c983e61cfb7b02687270a59617c133d56a8ab1db79732a8e9e8fd2edb6dc23b5636f01919f3f877243743e9f5a70e12d18c5066c6e1a34029e7cf4d3f78db98d20d81a6e06a70be73df749992b69944ed5fa6e995d9f568008981b28700c43ef2d1dfc3025ee4d834a8c23bd0c7ede3c3e56036e20c797ee1bb125badc2297c5af8bdb3f8609ed47c76e2cf4ce4408329eae3704921d11b17fbc4fd208f8b2978240906eb5d89f66fa178dd9fd24a9e28e0ff3a7c71ff9d8a14c256e4ebf3fe73f78835659187e710da43e93ee7fec7ad5ae4de20990a7a4e527904b18b68d70ee31003d6e2116c274a4ba4022eb1acfdad0203d3dea7f692b2d849c65537756b137555765280d0af81fd0ba1533f00854b1fa81f81a7cff42e13631e5325695361b7f18d9dccecf54849fe335910ea74632ba193e00b5233b0038ca170053e5b2885bb821897ed79f00196fa67d404a97574e771334c3368936c7832e2a5910cf7c873df3bffaea9857bf9cd1b06a80cbf0dc37f7c226d602f87d203ef8fc994ff4533994a85a122e71d0a2bfcbcc0daa6ec44443197cd54bb495d05a41b6f25831c571c2380057f101b2c45057c2e4850f52d48e8250b72bc6b3680c21f45cf5f87d1d15baeb4a8542c44f9c4a396841e349e9f06f04d52c99153f8eb439bf2beadce8eb37453bf8cbf6fb4bee43f75fed9fd879cddc42e98c891882e51eade19841e7e851877e1fe6494399568cc15610075440d16d440fd4079675f49a5e0909e98414ce938ee94cc233acfe931f7b89eab19fc806a6ad5111e6a68654055bc63315a233b8e9a77458f6c91fe3ddcbe7a7a5749d31c52449099cba67d109cd7d744af2159c36a72fccde446200c39b805701b11e4d99796a457579f565cdefcd827b777e34694b4197d7901f26145e5561c153c9abf98e2244c8307958ece6c5dccbeb4e01b9cd954ec03aee908becc7cb221019b908ef0c2a22d09347f002823f78c3dc059b434f84bfe7ea5e33b2f8669de5aca807fbabfca1723310e8f31c22d0f2deb6cb44588de48496e7d76d63ef6f05fce8c4f7489dfff3fe86c538f05c54b11934d6597666863d2cc8acbdd53f0906e22a29cb45559803d93dcb39da67606dbf427ae84d68f516626e6f0d56ecf315bc7379b67998dae9396e81507bc659d2b58a7b4b679134d2c1562ed57b0370ff229de4162c11bd4a40769514203f0dcd81a729e4f5031fd0aa7026bbc7ff6c656f14df18de60b2119af737df1a9931dd7feea11d194e7b07879dacffaae6c07c2ca26f69830baed8e404d99db90d824bd2a04af9a891ea4570c3ef44353cef00af858bf094187deb94ff5f077404bfe10b035160afa9fbd33a1312e1deb9373aeab30893c16fc2b8e384ad270531fb463fbfd678cb4ebc6c3e41ba57b86066e96fb30180d929e7253a883f0932d4b2a70554d9c6a90ced56b6e20bd58bc5ebd702d15f9d0cdf72a83188bda43af354c3f22caf6b9094f1e33c427eaf82c358cf71956e13fe8df6aa4f219a5aea3fd72a5af76c44ac74e3c92d31ce6ff0534027aef77307d480141af06e38c61762ecc287a0bcca6070ab14d601cca61b757fde3ac5b6feec8b79136a097930a44c133bf8fefd2bda110cb0a4ba72c0cacc38f9e4259bf32ffff4025b8df87232bf88f434164ae4c279d4cebcc1cfc0445f821f7d97c59303444c52177a906db8802f059ce52cbabd725cdfec589ae05f75b5dd2fa47dbca62522f1380703df645a31b66f53fe492b9900e1def8e20288c785c4f1384df8bc947e35c42b278033844cb4eb298097ce9a64d6b6c57506d455e4cb610e44e6f0cbdc819ea7e48e150389c8dc9d15ae21ccc65d06643bb60bd7d8016bf9275a68310724f325359bd252b636853cd9c6a1e2118c91268ffd4a5944d4131feeb4e1ab68e24ff369bfcb4505595b8551ea6e5abd41e29c2c0d052069cfecb06c011ff8738451a23ba60d7ce23f21b5ae0467e1a1db82da17d01c9761cfae71b477c3b4fb461f250bee87239eee845f70038563d2b65889627476a3beaa91182d76f680c3154451d6f000512d03c7a77cba972214f7c23d35576c24e59e1a7bfe0a1a6f83f7d72337b579905234ccd1c2960a212caa8ee507adc625d65e58dfbd8155da72e5e5b7959c100b1358653c31f68aa7daeff8b46f5dbc2384fb39771914af4c86f8d515cce90b9436f0cfb36ff390ec9e1795b088c3484c3d737be531d61ee384aae1b38c41e8071d17c04171f3a9249d4566ae7ceefc383c26ea87bdb3f089084b15d12fc1d1fc014a29ede597c0ce021ec55ac8f484b71c072abb225ec9e102eecaa04166015ae45bfb9c1cfc9610dbafc6d052bd6a654b53d48fc9ad925d8cf1fd1d350210f4c2bcc61ab561eba77e2878ee95fb42c74a4de6f76744849a7dc22590507ad76365454b4ee28de7a2949a1711f7f2657f3068c97ea5684610357f013c6edaa47f60dd9c18a7d81c272028b14ae40282b18a375a68c4f296ff2387378757396d4f190a74a2c37ffb29a82ea6b578dafc922b90ef2bd0353ad7faf169892127ddeb2921e16631d6870c2b725070f52b5ec07265954c6f1519b3ddd71f9890ec1d7902acc6792e5c6f1fc463a2c4b615096dcc0f500e3a2e87275962718e2eb07348ed284f6a1f8c4d545fbe118ad80416b6c763596ed3d5639d50a0c5aae9ddf70d7ff9a53f69432a8f3e095205564d3dd95b4f5523f7842d9d35cfd5fc6c2410219cd190ad566b8fa3ea1e178c1a7f5c55c8d6dbb4cf970d538acd1be1ad61404721a6d337e1d69f41db605f519e569b403251f6b85002855a27e63d52b8056e47be511e78820d4ae8ecb85a190d8a72064f0e4f518f6b8d186e3f4ebc386b25209f0e97ca6b4a5569b57b119afbcedd2cf9aa23a119baffbe3fed807da5782c2996f2376ce667574fcebd2f9fe18e4cc28a439ddf714c460a04039588266fbcb1f53e3657e37936455e6bbc26465612f4d75a8b84fb8436e104aa1a3860c7201cc6314b8204c5d661175217e0ebebd3f744279f687fcfd8d34c35d4dd73e3984da79616c96264c202b5e5514d6d31293581faded6168827af3920bcdf463e545bf11c91c717a0a8cbe39c7d51eb685d4d4786594d6046f498efffef474eec7c5ea0f1c3c14c8f6610714f28e4d632185c4e4b61f596aab7a22fa500a1b79fb07f9c2ded12b4e613610aedb78f10236bba9a92e1e725146ad6d9e9d58f1b1e7e35c2152905b37a130b41e62ee3b87a32706e8606ff0ff0e4d32cda0c6215d231427245f9062e005c945956ff776f0bf85c916071ddd42c788dcfd0fa9d7a850eaca0275b44b88e746632b64e798aa82147e94fa6fb4a7a795acd96f31460b3a52bff4bfc4f03f6aedf10ab5f93135d5a4cadb65d1bb73f9cd05381db3908c9d6fc19258dd03f06db04459da6ca09d1a30bb33ce385de7b179fdad47ee23a8baa2ce147740d3385a7eb12dce473f44fac206a412accf59fc8022d542aac015eb04a7596f178d9ae9b54570089c84c64a344c1f95f9797b02db6b0e000000000000000130100000400000039c13af6ab82aa56eef5780ccff151e596e2844931e0ea23b42144078b2a403852b5b854f5f176f00f7773470b9ecaf89cc0ce9dd85dc8db44f8c1531741bde8d6af31bf338b2baab8b013639468fd4909b45b837a96a9b77ddd52b7aeafd9f3ea1e1564452ae90828ed8b5dbbef78eab045a7e2a6817387e4b0c9c155811a1245a0e32ed6df30eee23ddf9fd622ed160903b5edcc9028050c3f86f13fe52243820e8e6b8e8321bcc7558b613fb605ff1d8511e007db25cd3ac6839849ea94c7ff15c0750b97fac4394c7f0000000000500000000000000094010000870d0000156c7252b5c42e92cc01df5444351697d556f47114fe7047b181e78a2bdefcabe5b24adbd7c2c1fb59b3e29b02856742eb03c09334c9a1536070740000000000"], 0x1140}, 0x4008004) [ 995.272734] binder: 15077:15078 tried to acquire reference to desc 0, got 1 instead [ 995.302567] binder: 15077:15080 unknown command 536872576 [ 995.322779] binder: 15077:15084 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:39 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f00000008c0)='/dev/vcs#\x00', 0x6, 0x40) accept4$bt_l2cap(r0, &(0x7f0000000900), &(0x7f0000000940)=0xe, 0x800) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) ioctl$SIOCAX25GETINFOOLD(r0, 0x89e9, &(0x7f0000000a80)) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000840)={0x0, 0x8000}, &(0x7f00000009c0)=0x8) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000a00)={r1, 0xffff}, &(0x7f0000000a40)=0x8) r2 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000140)='/dev/urandom\x00', 0x2040, 0x0) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000180)='trusted.overlay.origin\x00', &(0x7f00000001c0)='y\x00', 0x2, 0x2) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') setxattr$trusted_overlay_opaque(&(0x7f0000000800)='./file0\x00', &(0x7f0000000980)='trusted.overlay.opaque\x00', &(0x7f0000000880)='y\x00', 0x2, 0x2) recvmsg$kcm(r3, &(0x7f00000007c0)={&(0x7f00000005c0)=@sco, 0x80, &(0x7f0000000300)=[{&(0x7f0000000640)=""/79, 0x4f}, {&(0x7f00000006c0)=""/224, 0xe0}], 0x2}, 0x2) bind$rose(r3, &(0x7f0000000100)=@full={0xb, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x40) preadv(r3, &(0x7f0000000580)=[{&(0x7f0000000200)=""/11, 0xb}, {&(0x7f0000000240)=""/173, 0xad}, {&(0x7f0000000380)=""/194, 0xc2}, {&(0x7f0000000480)=""/212, 0xd4}], 0x4, 0x0) 14:59:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c00000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:39 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x4e20, 0x7, @dev={0xfe, 0x80, [], 0x24}, 0x46}}}, 0x90) 14:59:39 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:39 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) sendmmsg$inet_sctp(r0, 0xfffffffffffffffd, 0x0, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0xfffffffffffffda5, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 995.416911] binder: 15077:15080 ioctl c0306201 20008fd0 returned -22 [ 995.485422] binder: undelivered death notification, 0000000000000000 14:59:39 executing program 5 (fault-call:1 fault-nth:0): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:39 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000140)) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000100)=[@in6={0xa, 0x4e22, 0x0, @mcast1}, @in={0x2, 0x4e23, @multicast1}], 0x2c) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:39 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r0, 0x4020ae46, &(0x7f0000000040)={0x1ff, 0x2, 0x0, 0x1000, &(0x7f0000ffe000/0x1000)=nil}) ioctl$KVM_ENABLE_CAP(r0, 0x4068aea3, &(0x7f0000000080)={0xf9, 0x0, [0x8, 0x1, 0x7ff, 0xff]}) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:39 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 995.741847] binder: 15104:15113 tried to acquire reference to desc 0, got 1 instead 14:59:39 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 995.788342] binder: 15104:15114 unknown command 536872576 [ 995.801631] binder: 15104:15120 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:39 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x334, &(0x7f0000000100), 0x241}}], 0x1, 0x0, 0x0) getpgid(0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300), &(0x7f0000000400)=0xc) fcntl$getown(0xffffffffffffffff, 0x9) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000500)=0x0) r1 = syz_open_procfs(r0, &(0x7f00000004c0)='net/ipv6_route\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000000)={0x0, 0x0}) kexec_load(0x3ff, 0x2, &(0x7f0000000080)=[{&(0x7f0000000240)="25d27784e769bc07cf585a0e52ba3aeac64f209bda1bfa5e076f579d1346c40ad6a9a99c41bc087a935e909516d3e9b8b3bee81c88b1377b71404ef9d0ccc2e60aff7d8118109ff011bd5d00581b73feafc6395d9146043b6a9d1f9190a46399222cb8e3262f0fbd43f0ee5790acd4d647869e1d6c293470907d226022f425dc7b59e0b4ea337d60eac59c7e3971d7a17e0150b08df191afa9d0e37bf685760a0c501234ed262c0d6db8e23cf7c83d22aeb72ce031", 0xb5, 0x0, 0x19a2f42d}, {&(0x7f0000000380)="5d00a1b079d076392ed7641bcbf3a9e71c0a3cc7ef642433adee058866114b5dc6d5fa2c46769276dcaf330b5a93514511bfcec0418cf94632a699d71b447d99bf68915f94ee5547", 0x48, 0x1, 0x9}], 0x3f0000) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r1, 0xc1105518, &(0x7f0000000100)={{0x8, 0x0, 0x10000000000000, 0x1, '\x00', 0x9e}, 0xffffffff, 0x18, 0x5, r2, 0x5, 0x36, 'syz0\x00', &(0x7f0000000040)=['nodev\x00', '}\x00', '(wlan0nodev%.posix_acl_access\'\x00', 'net/wireless\x00', '#bdev\x00'], 0x3a, [], [0x8, 0x81, 0x9, 0x401]}) 14:59:39 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VIDIOC_S_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000080)={0xbd0000, 0x200, 0x6, [], &(0x7f0000000100)={0x9a090b, 0x2, [], @string=&(0x7f00000000c0)=0x1}}) [ 995.830039] binder: 15104:15114 ioctl c0306201 20008fd0 returned -22 [ 995.856011] binder: undelivered death notification, 0000000000000000 14:59:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:40 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:40 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x16, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:40 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = fcntl$getown(0xffffffffffffff9c, 0x9) r1 = syz_open_procfs(r0, &(0x7f0000000580)='io\x00') ioctl$DRM_IOCTL_AGP_ACQUIRE(r1, 0x6430) ioctl$DRM_IOCTL_MAP_BUFS(r1, 0xc0186419, &(0x7f0000000240)={0x1, &(0x7f0000000100)=""/187, &(0x7f0000000200)=[{0x10000, 0x18, 0xb66, &(0x7f00000001c0)=""/24}]}) getpeername$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000380)=0x14) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000280)='net/wireless\x00', r1}, 0x10) 14:59:40 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x80000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 996.183908] binder: 15136:15141 tried to acquire reference to desc 0, got 1 instead [ 996.217380] binder: 15136:15139 unknown command 536872576 14:59:40 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 996.257958] binder: 15136:15151 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 996.279784] binder: 15136:15139 ioctl c0306201 20008fd0 returned -22 14:59:40 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x200001d0, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 996.313582] binder: undelivered death notification, 0000000000000000 14:59:40 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') sync_file_range(r0, 0x1, 0x7fffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x20, 0x0, &(0x7f0000000100)=[@request_death={0x400c630e, 0x4, 0x3}, @request_death={0x400c630e, 0x1}], 0x60, 0x0, &(0x7f0000000140)="f39927a76d482fbd6f8bcefa21abe7c939ed073335d711fd69f648415c701eb1ecf16e53b5c6add17cb9d169eef03b311cc6d3e989cf1f540969a030f9596ee788c01e4a131b16669cf3e3bebdd58334b3ebe15a30c45860538ce95fc5094fd1"}) 14:59:40 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r0, 0x29, 0xd3, &(0x7f0000000040)={{0xa, 0x4e22, 0x5aa, @rand_addr="fb4b8350fbdc56404163bbac522ead07", 0x81}, {0xa, 0x4e20, 0x7fff, @local, 0x200}, 0x30b4, [0x9, 0x7, 0x9, 0x3, 0x5de, 0x72a83288, 0x5ea, 0xb3]}, 0x5c) 14:59:40 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:40 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x0) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:40 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000040)={{{@in=@broadcast, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in=@loopback}}, &(0x7f0000000140)=0xe8) r3 = getegid() fchown(r1, r2, r3) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) listen(r1, 0x9) 14:59:40 executing program 0: getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000002b40)={0x0, 0x0}, &(0x7f0000002900)=0x2) lstat(&(0x7f0000002940)='./file0\x00', &(0x7f0000002980)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$jfs(&(0x7f0000000300)='jfs\x00', &(0x7f0000000380)='./file0\x00', 0x2, 0xa, &(0x7f00000027c0)=[{&(0x7f00000003c0)="bfc08422f7f749d4de5ecf0f5ba2d47b3b065607c30616f31d88558329a5e4c0d9a902159119190ef6a1312bc2542932248370ca547fb47753e88b224088720fcadd52d5b73d2722d938f7b34660601d37684cb61fe36aef9e9cc1163769757bb4ee5f95c8cb804c8f900b9758e6c70a777c304a0765c41daf3ef6b667fad6d607915433e69b871423a33b466502029c42f1f7fbdd4588d76d11f0cf447a7e76880f2f745f3227063b47cd180407414e94817ab5e0829fe123156dc1c8a4b3d7cfe33523dfb9104f8cb0850da6ee5cbd9f543ef8652428045af7624d6ea65ba7ab7cf8a0fb6dbabea49d13657abe204f2ae66cd4c150213455107c4fe00a6227d40affd3566eb56689f3ccb97cde8c8c5238a3b732b82dde496d66099ad7ccbb5cd3e0c67e552212dde58cc924efd8436cdf08f3387c1ba9e5486b2e0d07860050fb974a89c8ff8b8bb3af75b4b15437ca9919e4e1719cd071980337f0019f6720c1fa3f4280d6031746090a45f5d80149af100b7d91056d54c3c5e3a85650be52b9d8a068b851b68b02f4bc6339778fa77080446f18b74ee70c2c0b65b90c6b3d72eb516ac5cd48f5b8240ce6aa17715946cd05f893e613e796789270645acd37f3478405b13e4c0651876537aef6406f44f89fa8bd71642d8a63fba9f3b0e14cbdfaa59101c21c5e89e04c2812a59b27c9b5e495038bc88fa26476d20bd30e5a575993d3971c7f439fae6df4c2ac8ff314bc79603f36e04b6168c4835447586feec8184f0117ea45c1bf74370dc2d69d01f276e8fe73d6720ada8f90b9315c480f8acf4357cec0da2a1defa8e6369dee27c8d4c260c2549b56df269e59d714f74ebb10db2a457b2e40a75edac57ddb6e76c9be465974f38c6dc932af2ab5b2aa4cc4a12496a0fb0f85ee8837d2897441c3832c1f1d2fa49e17243445d648416df9463882963b9186dfc0736bc6d743d489290b34d4b56be4b7ce5c755b26cb5fb9db96d179e075a4f32ed178386ed249673e4ee9cacfed8bfc07ee600e84fdd2c478df3a30d1940869d0c9feab90f2d344b9d8ea19d82f2d4e5924c7a6882dab573e1517bd09c7105cbb687d1459678fd40d3a1673783f94b0617612a89a7c7228389c32708fc291d06f0fb3df11e6adaee72e3c780671e2a70e2d1b93b56e5396a1ede3a3bd18748670554db1085c42b4e34b20648c23d0567afdf90a0d0ba8edfa1f4277c64c4767105c042be62a4d9b05eec909098fe8944a4136a680d9ae4e3c4713696b52d81836ed21876d2191b23ffc1e404086447bb3fc8fbed2d970d90d0cf51fa9ba584d8dd8e69a0d12da86dd27a91e66ac298a17b0740b2df705cec96b8c0ad8ccb1eec214514e5d6f7a6fc45928d6e735386ad6d627c9f6c18b2208a6073a805aef7fb96b27d79d2b6e5209e8f7f17eb9a1357536830b16cd65be95239db862cee7525b3fcfdf17e273785c36a8fdd0f15d88ee2cccd8e1915bd75813ec54c07f901c16982408e909c16bc7e15aa4d5bd4df4cc180364c15ea3a853782ffe9465fbc2f43740c02edc37097b36f06f6c4dbad8fc436121bf63b49c48b6e33ce3cfc37fc46fc0a69a011f65675a5e795812adb02b93b04c84551816b355efe0f44e50a809814ef87d1edaa1c425468640de5cb3a8c6a753e4b6301c828254ec011ab1626a5ce3c55cc10139adcf6db774441137742b32beaf05609697b952ef9995edd0e8f276f2e69b6ecf8c10c400fe64397b21713e060007bb3f11e9f0c8d2f6ba27f20ea8b03e38840e4f27c436df1e7114b3fe4270180b25b48a8b7e3382059861a8e1fc5a4fea578ec9caf852244786b6aed09bf5aa779c4f0e2eaf897275e48b5a67643baa2bf8992642ddbb414b7b980a76a6a906bbce394a01112b38de261dbecbc3945794a25c803e92082ec2b454e7bbddc9edda34761e92f3fa367ca975417a57bb894f38c1d75f2a5b7c787f24f6d7175a220c2957019acbee3ce9e31cc0df73c2323203ff44f0cdf652d6f65fd524140367d1b47b8fa8c8039eb465cc09f678b0b0276b1367a3e6e010d2712c606367f1d004affb59f0473303bcac2194795718e8fca0658460c35c7e822a38111e99f7cb95eaaa16a0792f52d77d706943f9ac2891bafb3b2f2a304f17716e2482cd7b8aae11921b44476ef1376bfeed9a985082f39103dc34aae5e0ab8fb0121dec2a5154b921f956d5d01fd63548ca001ef86525e661a8360496beabdfbb6281305bfd354e00402d7c5d1531ca3503324d44d4740ed72142f28fe4da139b5341d6da62bc5238801ef7f4d616140f94b69af5ac615391acc78fc4eb930598a20d52394ce42691d4c3b3eada0c9495bd1ae00164e378f0395c3ea1ab89deb035c4433421d6da567873ef625b4d99ea9616e543e09fdb2fb280173550598d610f6b17371364c4b3ca4ae0caafd451369b200901f2f0691656b8699f46b16cd8b545c5db6d011254ba7341b7abcf2a33b960171615a636afd05c26ba0eae8b26371096dd6259ad3c7d901c2b4b0179dbcb0748293d8be8be6188fcbcb3026fe02a1f584755e38929bd2e23447bcd7b77a2880fd3c6bf234532bd56d435595157b909071e002165f74a98ffd78d79d3d2ca0b326e9381449d2805645b7b86457e3346a2664ffa289963a07674947d3bbc7c509b25c5ba4a1c0278701b3c5ccdc3df30ac456c48b062bf5c510239d01f5fff0749fd64457e4dd3b17ef53656a59e0c63c3e6bd331dc3f24a87777fd1a79c7bf8589ac9c4325b950b7b1d250fa280a574e0d31e1415fac1a57a4db1facfcedb6726a0874c259b12f5a65c422ff9470eb37b2c0e1b486bb122a6a68929ce2db72808f70d700056448869938ea12e0058ce647ee8ca22c557995fc56f737b951cafc04605cd6d15e064702dfdbd2dd93f32f8192dec8741aea9bc00785f24035981384044f6490d89808ba2c7a5058d963b80db68b06a3ae5abeda8abb3c9ba9ab3b52fb0ba1ca02775c94feffee8f8549787bc1da5145fe170745593e7853218cc962559e1fe05cd0e865620232d4eda697aed7a7edb4472d74990f171a497c3fe29126b52a95998c4f310ae188b82e12f624633b346bf7a500f9426008ca9d159a8985bcc0a3f06e4d96c51936dfadd52d3bb571cfcb2798cff5134391e363740698c3471a5c2c1516966e1b79271dc2ea07285adddfa5ec6e08168d7c5b662eeb5e010860c81c7efc3513068da03f2fa5d29cee8c779ca33ebc5e0278bc5173d12441dc3fad4456eceb01ffcd48b0033e7d4abc9813860c02e20014ff3c9fa4934ea099703def9184902b1e537d9481e5ca642564a0481cb383671f2d9bfedae5295819e5f3b960c66fb5737d901cb319017895ef79a3043a0145068dab4009cc0c447056376e8de2c275802c7af527114eb09e30abb34f15301249c9bcfd7ea3c40ad9ec40d01c9ac7ee943c95ea1ca1d2933d04af4f2989b818a82eb558d139ef6c877506ec5deac8a1a6c7fc0ef74c0f89384656edf7c596eea8d50ea4a79789875a138ff2be9a83cae01fdfe67e485d6d4e5d3641f1353a33601169178252b05b803fbb1acddbb16d80e76d11a26d572132d4afecc4f674323d70555fc4a9526ee00435d84455110d482a83039f710305933bdbc7ac0bc80abeecbb0f226d36e20d065942d071c7150fa97017d767642065202b400a0bfd32c8013ee0251166a1742ad8e8ceb5ec7d7a0f2318e512d3a60a464b7d4f6d2d56fd3ccf6b18b7896e5f674d7ffa1709ed17e421ae6f8b5edb1ce47121fa4dea5867c0621308bb258e252f1943cbf931aa62a29320a57c5a4f017d8aab9ef715732b3fe631156facee350717169bbe88b80727a3fec15d0bb9cdcd732df39343f72a09f988c859919d99189327c66d2799117dc2a53c566f21751e6abd7747a99ad5399c1fc90f6f0297e3f6c28132302bcc283f8c1db6c5fb8fec37501bb71e21764b7472bc3be303e1e6d50e3a5bcb9d691d1e3a8cf06ec42ebb3bce984978549f3b9e070a38345a1fff57f0de4269d373d5fa8df9399591cfdcac45a0d89854815b1f9f0325686c912d4caa3c4f2ef3c068305e95f7be452dfbc77c277b03fee62660a6fa0964bfe5a79aa25a3a7f1d1445ecd29985f2360662ed5972dc171eec5473c631ae3bf85b4ac402b68a6908abe564f3f8d32f4af2c57725f75f5050c7fea17e15ced474350536eb61febc98f0bb5c994a26e832cdaeaa2b50ad038f35a277adcadda18c10052bf100c608d423a4ff209a171a3fde34cbd24d067f7152de7b3148f051490dc5fe77583f364dd76b13a8b19b929c073733104c494ad84a718110c60d234d6086d8854ae458c4e9724a6bbebbb52b4a38d4ccc3c13a646267b1c5d20687c8e7beadfa691c0458747f220c4f679582b7563149261875c9e4ecfd8ce0b98515c17af76a116246193bee7cb1fc5a46ab41310a01a0a0715c6415b80507e8669e5963c40bc138785c197939f0180d1ef7ebc16f36ae22352df9df551f3fd0780f3c5fa5cddb39f116c85c7c4b2d95de9128768ade1ea3cd3109dad58a056f849375cbbe45ebd3ccca6ffb178690e974deca807276589f45a9c5c0166550c39537aa1b1e94325a9a1b636750d73929a8be708137264efb1e70a485b807dbcf953f6ee78897cb7eb0d213f60f20bda34f62c698619d7e6db2517dbdac39186e79c7931e5dceded4f1420ffe60526dc1b6e11ad3a4cc288eeb82cee2fb12b550594e33dd60ab29fb6a5bd2351cee1c41380cd7427c253202b6e992008eeb0bbe6a2d76ae18c27b663441f224690b33a6a504f208db13213f93bc64a06138edef6e3882163f345d6c3dea69825044f566bc954995226c55398d1797b77044284c572ee743b24d890805a8f3f45d4e48c56237ebe89546a6639e8271e7eb7f6096027fce6520b72d3d978d994a296b71b3a4b28f3d37d5b0ffc2b2f0c092018ff5995a865522dcb0c7ac69efb292bffb42f99b9a876491704979767fe72d9285651203f94493edb0b803ca560979b0eafb0a8804d61d7fe71bcf78d0b56414ef82277467fd83d38c2b06b31cda46f66ff09147764d39ae7bd25436f4779c3b200f5dd6e646d4b59221530f37ce039529df8027830fbfada1a96ccd3a4d6665ee7d8a45c2c5c9c45468408e54b5a94086ae4a7164a9be651bb63e7eb373352f1866f4159bca9e15f789f47d2ebf1c1fe4a30aa86156e3030597c0a0521b48224b8d2f9443e78f9b885991f196b9b3cfabcddf1e85288ce855fed1fa95e1813e07ddeb33b2d352b6b8ec8cca60fe99e7d9b73143a0c866c167ae89fb93514f3153e8420e165348f91e394bec2c3ab0ba0e9efd851bf58bc0fee5e5963934c1d290635235fb30554fdb616041d2ec225b3864064a7a7412a2817de90da53b838f107f9e8043b31bf953a3e63f73f84c04fe6460e204da73dc62d1c4cc73233f97b9f5383b6294e17c0905edc79e455ed554d8bdce581d6d13a0a0a1f794efd5ef54cf0eef1f0b977b2c528b70b3397e24092dd040de3453383216b9ce3bf0eeb1af0065ed9fc2789d3a1d084e6d23c5a2f0cf480ef94096b6a4d30cc36029c1d1704de14e85d1f21cfe6ff3a2e57f0964637389f6e6c01cc19e4f3334021594cf7e15fb45bc9dfb084e8a30c41efefcc4d4bce2dd4c8de673e64ca8e17ad22787d737efc369e00cc42da588f38df3964498007d9b9348cf9e329b50e3a3ac7ee90665cde4c8de3304c9049ee99a96831aa7f2ab3e2e8", 0x1000, 0x6}, {&(0x7f00000013c0)="9be6b92e13ad3c4afab2b3fd028fb7257de970532c5222dbd8b98dcf91656e6f015f", 0x22, 0x6d8e}, {&(0x7f0000001400)="f4bb47f05e32aeab380c2c2d72651c5827c6dbecbe7e44a76dca702fc0b2dcbb47b08011ea0c0ea6f5703c53c8b7e96fbdb5c36275e5da630a2483e5207ef633", 0x40}, {&(0x7f0000001440)="24047ec3ad960e46f9e53fcc6095ef5b24ea63e55cdf628e7f7e2349163befba10075744e458fa3b65b3d3de05bd4e7d1edb95ccca0947139eedd97e9ab562b6dc8975fff7b0316ce8d08f437542e052bd8c27ea7da93edfdeac9d79086f21c2ae1e0512a4ce3126bfe55eb1ed615e1c1b7a4c18322d447e7d49ce79d677c2aa6d584530d45b68903aaff24db1bc48ae883365e0181473fe8203454c0c3a6354a228e849d167c92de5a249ec3a70ffaed84d33870f674a70645028311b0c0086ae81cdaecc2e8a61a99a584f940e8739e3cf97c03181701c325c44f59e127104840b1572b259e9caba4b21", 0xeb, 0x742}, {&(0x7f0000001540)="125df128d2b5f54722c4cc21722a712a23e7ac138053cf9d82aa133ea8bba711c4579ea5d65f24214dea3ce700d0e5bc2d1a6d999ff7724774313caafff847fd5b0abf631dbf0675e7fee15b23e97812fe8c687e3bd1998c86d052bd3b6371268083d33c6cb76180cf71ed473d", 0x6d, 0x8}, {&(0x7f00000015c0)="aae29f16258625a1c2066232c59d1826f913b5a183a89555bbe9b819fe472872b08af0d3226fa40922b30e1085e0513446f0e23c7d0a947cb6072ebf8052d8c9101af36f85b8d6d39e5e864a9eaaa48675da28259eba80b6b1076713084b7426728a63f8099c67e38ccd5b91fd7b1baa973301b7c5b8076397b280c9a13ba7bb707ee0db574185b2c1550f246556eb5971719feda89c08652a69d265fbe2ef579742b654e4e26e4810e69ced9d6d28a0cec8442ed030564c4bd4e81a77e0afc66bb14be2a09191a9b271ffa56e0ad6b4491f085c5383d8311b3b4b0fb4457a7c19e0217b5bc161ec7fa6cf9991f4c0f41ba559c80172f5573bfe100834c67db87b3818f76f2b96d7aa22d79b5677930a34f4f8db06df962cf807eabb2c0103cbf9d81872f001c771ea88b3c26011e5154c2f25a635d94b2d7f21abbf41f1c822c48a66241ccfc720a4a185d8fd603084668a2362904866f4d8b103557bc46989e526c78a83bbd6fa02c939945887c8bef5eb61dabbb40abf29bda2b7fa8eb5ca9de4e4be0074403ac978ca943da0bdaa01bd8b1b3eace3ad9a0b2677ee933c8ea35eab10ec57755599b1793ab06c463f80c85dc3556b91ef16beb3cb78fe17c2f81d5c52b5091425e30b06698a93130b0b604f5d53a4169cbf2423588e38c522d64d585239678a662cc8a95e6ca66e4c310e28444028e2d416f1d1f2803d074048eb42db7215b09d12e310d55fd26b5317a05a66e2ac1297a790de05b6c4113302a73b6d0d438a9525400446c6eb65208a004eff71d15dea5a629bb14ec89021e7e5bbac7688978790f1482c43142d35da250a36960a16059b60956eec8970db6606a149e9b5e929fb3ae3c9f393eb629d9ac84b32191091e4bbe338db81f97948e5be83495fbe2d7337ce27974cc3fbbb7f2161c994f0f742f7374ae61569cec5f42c10d3157f820c2056c521921ab169cc8449ca6c0d275c00c581852492b8cae3c16760bc4f1ebd7150b14793a9aef5fad5220abd6dabd764d4a8a5324f838aec3ca79ed956d8f2cf4989ae7a923693763a00ef41ccb4d0ff2ea4405cfe058ee8630d26ae70f3bab3de6f60a8ddd5088d1a130cc961fb72fbfe87b60e99d7056382faf77456c408a6354d108c785a530b048ff0e575a6d17050b98c40687f01ac7baac1d2bddc912afb2ca60fbdacc640adbd1e6bdfd386a1f97cf2c0cda96ef21d7a612ce2c12873fbece68093a5d05fe1a82880e1e230e6f60fcaf65fe43ab50db84df98bfb1a977d434ac19745a86d8bf35d958d3d4e1ef710195f6e878521a33e3191b49498c7cf34aa179ad059e957bc58390a57330f75d18a8a1bffd830560705a0670ff196951d094ee287a32bbd7c1c6b7c78db5f284a40fc5d4793dab8d5964bf83623a2f8124862dd504115077a548286f0e31946371deb0935953e862758649766664a39de10879b7ecdecacb978b89e87b16e7f566e776bd6f365e0d01d20ef45077864881bc91aa43855c0d69f0e1015e82cffc485d5ae4fa8ab5d3df67b4ba16f7acfbd60fb8d9a8e2af0bcd2a4a7d4cd631c7c69ad4f0698091c1fd2cf09f2b69676584f5e14e449c858ff2673c389510779b2b0f7b3964c0bcdeeebb3160722342dbcfb3017e9e488b57e8aaae4e65db549cc0cdbe27e2b6419027bf41c1d2f974a3a25469449ad90583a48489650f42d36bcbe1bf301d6fb3240714262069217d8696575edb89aa07c892115324bcbd4cf719f03c82b6c62af07dbda98efb0aa87c09703f818c6b43c826a87423a2e5beddf27b231a2446d25da90d404931139de67ca389d720119885094658bf4662bccbf03a33f66628f530c76c8d65bf8011fc6ea172660d1c888eb8d8accc7a9dc2109bb6a4da49074fd5faff5e603e431b5ad3f180c42c5e3ac4c7fc3301ca09d1f10195e001b83f237176a42976188acd27d2447835894b21c28e934cb7bedb41e2c67e8361947ccc350737c38cc308754893f295207a1509bbdd4615ae77773eeb9fd64af1995603277514886751059e2f0dbc988a9bed822376e5bc8a2bf28133dfaf2f0023bca0ab9662a09bec3f0191c3c51c1c360b8a45bc0532493ec8926a35fc45a286ea859c983ac104ce34917193236497198f8560d9c6918e70ea7baa01f058a7e3a6af26d131f1cda02fe9098f6c1828b8c9b297e149b2c38a2870b68f2e63775a358208df0fb757d8bfc49d50de52ae392200b6f78f240b2bb214c5fc3475fb93b899e1e3785c1f069a1ee696c98ba8eba98ef51e235e6ca1c2b69d399484da1814b0a04b016299666da7b2f97b5ddce072fabafcf09c949cf070340f4901e77be74833a49d879d2f4523d39f6818d6e6e08a2625f849120f82f4cda5eee78fbb2fe8d92391f02c96147304eb58aff3e43861d051cf81d54d82dd54b9d2bd020b2dbf8f506774e7e393681639c0ed73acb94ca312d2ab45bc53da3ca14efe80ecf2ea7900ed65a47c7194522d377ae3eb12426e37367936e022d1523f415b474d5b2fad202b987477e59e1dfe7b44f380f92a43bb6a96f110838ba4eb3eac25987bedc9bc077a1be4f7bf071dee09ed2161fe142a3224740515a6de8d8d61197454227e74a10e2f15c42e2e362bb60266e770c09a679bfef4b5680161c9e3bfffcdf737f25e7c8f804fb92330b36bb4fba0a9c9f6a3c0b90c232997fd2d71b405d5b3c2177a664c24aefceed581bf0ef40466010c4159f22af155cf8a344261ee26c68515845877652aedd8cf26a313ede5f4b0c55693ca366815849adb5a582307a9e8847b35aa501abaafa93218364d3cf03e129d2f23c335762e94cd3281f068ee43dad65f7e4e31ac6e3f367f7895e6aec7bf169bdd2bab6d342878390449fe49b782bfadda3c7e41df0ed7dbe734cf8ea682dca5b46709297dcd2d8b78a02194c0b65c06833012254f6a075ad23122b199ceee40a8d47761e503638080d7a6fe964efb36e2a896973a01e2147aa909b4fc45063f7f19817e301e9ed3a9b9160e51f28c254c2eddbee77d79f29c79b265e871a511f6b7f0f64851943ac5ea7db978c9adfb9968d0c08a664fdbaae6069cab414b8581fe4974e9135b7d42c79de649796860508c49d7fc9915ed3e0b6d1bd4a873f0fa4a1bc8177d4400cb28ae964fb237f00a37de2b0efff8b84adb2dc2a6e9111fd2aad04ec9e8ab19842d956094cb9a2a4e68e7190596ad9419728a9f143c23f86f0142ff524d26c62a988ecfc259bf4321f19eb0489cc86c2d3cbbce9b770494eb6d09d2fbb1bbd9e714e44edf1e07c49957cf1f534eba912821ecc4b7935191b2e70a5ec69e688837d52b9bb2872492cd2a78d99f2c7e577ba32a1535dcc822271589f8c68b6d3951d5c8a6e517ed7aa754a7af7cab63826492d369b9cc898d35dfaa82aa2619af8b08577c11effbc106fe66f814365b815c37e881d3bafe2200bf0fbf4e07c769500f0885015c5f7a9b562c67ab14d95de42a485e70b115675515e45b49b67cc5dd0c02951e331503714a034f08dad9090c6bc2688ce382f0fc2d6166183c71bcbe108eefda214f5d448197cf145ba7ba1d8883967ce6158c554fceb69349e91f7240390fa4a8949b6d89ef1bbe88f03aa4009d3f9528ed89799a07134b23e7208f24e6944316bcaee4f617a98c3dc9f227140512616c3d2b87cecdfda410713c81911030af8de2dfefe493789dfd0dd11e2e73e35ac91301be6887bd020765729179ecd197f57a925ea55758f7ae67446e21546f39b1cda1e1b08e256c9a36dc329637a41015c31ccd57f4f9eca170fbe0adc9f13b0030a4a58e605c0b87b6ec68f3267ed0dee1e0daa74649b1302c320259c404da178bce842cc45c8639f87306fa38aa410ce6618632c4dbd8b3a9193f8f61eb16c3551bbb72305ba09d05aee37a254b323aef2c59ccfdebdc68181c92b4ad3a3125a6d14b8df680d26fc8ea81ab7edd1fd5467618af17bb4fb937171adf5c1db818999ee5795206890289bb6342a6dcf1dd18f7b157c5161343dc220bace78d7d54368f59c544e19237575e1fcc84a9edfb968b947ed7d39451a49abf0c20347cc38651d122e3e5c5b4b328799cfe463d0a0c45035d18d049da6382bf4d387858ac8a660f6888530ab3884e595270238d318656f9a0cfd164273b5f0e1f6aef3771b775f3c7b6cb884529b8c10c497c786fa2fdcf1e67ff8879df328f83185c4b98f118f654901cd52e798e17cb00a92cb79233233bdc3107f9bc5d05ea53f266da8a1c3120b57ef1f263341186fb83db02846c1a226a54820c2e51d6cc0c08f6205cefeb698c3bf3a3c1682bab49be968090422777f591a5bbcdad14c9f9ff8e253cab8c0d0a5161bc7f04132d747a40dd2c1ad8f8c85ad1620b862725bb23c074ce151512bddd5284f08a429a9cc1aeccb17b00e184693d39f164e6a36301800387fbcb53257b1d7d6126dae81bd4dd016ee3dbc04ea26eb5ff673906dc837f2a8385df1a7063f430faf2b795e18b9f055b7f6c17121480c4b5bf526e74d19fba6d0e15b79e73e1e553bcf02e500a6d2a41976a874044c8962647d744ef94459b71616656db6a06edfc60ac6c64a041c63b5fbe4dad97bb3c62e7af6c3a4a6aea5973e3a15148cb3ec5eef33d8e640829e74774361aa21072fe53e1db7836840ba729ea7a8e75dc38e887550d4aecd7e811278721b33d7c1fd5d3c1ffa013d6125f147eebc48bcb9e2ed4a75d744afc6486c2de50d8d3151ad5ae9385088b3d95e8e78d194468f7d710ff004c70fd5eafa127e2030e9a456aa1834effd4ddf7559e0d08f76266c906248300557072e6d689a09ae30e752444948bf636f5c3ed7690546d3dc6d7b4f87152b9dfe3ce60881244dd942093a7c063069faf135eefc594a534a108a44bd822d57be70852dd2636017cfd8b32d5967012c91052ccddf37c12ca5e6d06098bbe9fe4c59b2cae51d074be8f2725347a60bbbde4e4bd4ccc2c3ab83690b85b337acc3a2f9fb77be1314314b382b56ff69dd40e5e2cc5e5bfafeb1f3af1a2e74a2bbf602b57f09627097648427a06efbb6b781a6d599685c8f1078c273e986be5adfdaec2a8dccb685582404b1ccc7587fb34befb4fdb158680c7e393cfdad5884ee7359f08e38dc2020309f76dc6651638f7cb0c55672dbb8f8c816e4ef23e16c2dd2e88be6b5e87a7b574fe99081296b3494d0a550ea8237205ad953470319358b7a96aa146a11981794d3588a849c07ea88864f3a4332ead37579b718328985ab5913c60c22b9130a586c90a35ee4d4d0978def898566521f164a268a8a046bd5afae4e53fce3ce757e30900dbbbf8e2e796b1590a4731d7bf9f3ef32b563f6d18419f6073c2984b8851ca4b218d10e2dd3aaef12f71e8ff56fab33764aac3b38df26e5889e037570a625f8fca391d9203044fcf9d8c07987fcd13bc70e4ec1c17e47f0dab5cb128af5539bef9c4decd5d59d90d03b724dc39339183e7fb4b76ee724d6f57f4fcde04fe0e35e04dc3dc20c2adc59cef34ebec7d986d49ff5dad8df505f92d4f3ee316be44abcb1213ea94ccdeac848dbdac1691398a64a6416b5a96c14551633ee640668678598b0741fc3cb1e5eeec99f11e8281ae708f5acf8ee4f9525243e4568f4a5625c6edca2ba9a5660a5827b9ae49acf93fd33c12c04d6ef951df6ed005bcd473279cfd34d2b381f0b8d2a66e914485a9e0b5c43d5b9cc77a7fc9926976b553bfd2aafbb935fcb764fe5049673d80395a7e9709afe66ec43", 0x1000, 0x5}, {&(0x7f00000025c0)="485e60cfb1ad68cae452b368d5c5a1168df558945f7ad76d89f7c7dff6c8c56fef448f0eb5597d9fcc93c5a7788fbd0e5f5e20a2d4f9b077cf99088f4f867f0ecb656f3de991f853c9f03551794e7ed3fffb12d3a79733c5c2aae6bc3f8bb343ef79f5cf56ac5c7fb5eac7ef640466f4decdd07b0b001895765ab77ecd33fec61be05fffca1762a55e69c5ad7f3f6c9e436614de1d9fe778b359573a0ee9d0b05f0580396b8428a9b4a50801dd370e7ed995853edb0975a2263c168efcf7f13483601426", 0xc4, 0x8001}, {&(0x7f0000002bc0)="0e5b35218e3593055fc8c1e333759fc37d7de8a0e522a8642d5d401cb2eb2f83f90de40c532fb43466ed739283719e18a0cc44943906cd446b96f3dbccb583387a95f1ebd2e9653b865d1619374f96364a43d2a69bb118238ef44383199b3afc71c1b85e21f9f20487de9695d4cfee2b3115dab21277f2b102cd5a67e290261e45f62a4241af1b7921701e39528e38c7eaf5a3cbfb9fa3acc7c778c1bb83a735c687857fb6874391172aa36f8f9f9201eff9ba8fcd6a1d68e0d5b626479629cc90c738de596013b639ff867b54e9157b5f8f4d81a26bf01cdfab12550d284b89ccb1a93734a5761344647908467afbef0fa2f2c89546a67d8456438dee85f168bd6105cc2aab783c549e2de9d156b38d9215c49da727e507242293e042213e3ed466a60288ed18545c1cadd641d62a74ebeeb34769c20c56ee0143d33805ed38fc3b9bd7916dc7fa49418589f9c3a3839447dc2364a2bdb266bf7c21a762b6804b929e71b1f7f4eedd5a6ceb7fb2c2d268c6fdb688d0b586645255e67bd866620334ab829c8211f017ef108a84c7eaa5c5093f89a21161c9e1ec5571ecba63fd69008299248ffe1d8334506f899b7970fa3577c90ec53d9d0fb7f73635361722bffd5918b0703f171858a54f2ed6e6b04b9f929e4e9749a4af8cc877b0a66363f9338e489375128850a46dbc3cc968d63d10a0222c03fc236fc31963cf36dfff560381c0981152a7961acd9e446d522567847ce52b2975909ff9fd96ae7fd5f3fa30582ab2854484ee9dd6ed387d2f280f85c5ac83c1599c7c05d052de43b3618269c748cca79d16cc912780e9c701e52a31bffbecb80cbcbb1ebdc50998f0b2dfca696a59f7a71c7a28a3af96462534fe333383935a5b224b1d761ed6ae35bbdf4cd351e53c051c73d8e5d85819f1072e48c8e4886ac77c870bcbdd400700643ab7f41272084de826f7068dc083f1ae403ba61e4a3db28c12c7b86a0bc497ea32b39498c201cac47ca54dcc06246248379ab06b90a22141e473bf87df55f52ba776e1d34e69106b15cdc61b05e96d4d589dff89e83721da50c966293fe4fe2e5ec28f57aa7095144e1333a8036238cef910934f2ab679337d4c4014346e3ae3eca062d5463fe0ae8f25755180c4fa358248b2fb95a3a2233000f2e3168406fcd9b8bcf951f9d59e00f60e17cdda32c30475325d8e7324216c0f1e1605db2fbf462ffde9a665f5605be9088f1bbc2682c7a36711923efecb3f0e09e5d0d585fa9aa536bc71acaeb83ef8f4b8f4012221aa92933c13f193f41db7ab1ede4652ed42c9205a514f6411be0d94c4a0e48b94ac16db59b42fbbb3a8a219adef77033c41dead58153f2b8fe77eb2371dcd96ffb12f691d6978872f16d18cc8a56d86657de21c4ceda1933931f5fe444fcafbba34e60084e5b032f1586a3fb3d669e6d64ddb362419e655a50fa138f0c5b854f864d58b9d1de70ea4cb464a68df1b84f7cc522944bf6acd928b229c6feb1b1f86837e3eb06d8fe38f3b589c25f7e327f46811914670a72bf2c89ebd2fad7e5b430d79dbe9fd4d1d45611a5add4dacd989c68535ca6ee11aba3b39ad638458019743c21529131cf594595880b70ef0b021b320ce1997d6c3ed6816fc416200fe94806051b97ecb492bbd0f4bd3fba862a58b71da60e3b1075f86453895e5df2b7d1e01c50d125e0c202f7cd29d5d91976a5e168134515b4c35db4b51b0f315ab0170746240b2716177ad5e9c89e65389754c84814f596f94fb07fca9e4e29674b5ae45c7a5b6b51e1b44fcd33e4b4f2f367229f8738d329858e95ef70036c7172712f4f98161cb73676cc70b44b45ca386acf96e4e9fe7ab8a4a1812518c4164bc927cbdb9e6e1abb2054ba97cc4e046c6fc64528c1a7dfbf95d0173a20e64308091679a797d91827bbb2fc8fd13abadb9069cd1865a93616b5894c25d40857bd39a5ad45f81e81497077c4ee2d2be3bed37a6985b68f3ca85b9cfaa007b09253269651b63bc39faf4ee5bfa12c669fdd74d3d5aa3b353694a22cc2619ad2e6b661abdcf69d408d2746fa55c3e70159f71ad1ceb6c7207be670a380bee5a83135e0ec52714734f278b44e4302286790f45a6a731d4ed6129a070a216918a08743307e0c09440ed63b2b3b31a882a3584b67fcea019f41bc6dd28d8c07323d7e3dc4d4e83aca348e640fb020be7773a045806bf4d0fc18d5b5ae51efe29114a5c54b61516d7c62717c25bd6e0b7be13a7e19fafc9ab5b7a1adda8048ff846c09b7badfde9383d4d6f53639cb54a0bf53b7e5bc88cb45fd236911df41f8db668a4128f913aee6e68372cb1a3fda279c57d4725c39e94c94f7aa0baa3eb39fdf144be6c755705eb4c8306dd56f4a1e3a3fd8e44fbab8b0be82bc392ab8aa79121ad0a51282658f0d099cb647ca973c687b732ec4f883d4aefc30eae1c08e09671ace334c245fe88689b18bf8aef1ade0aa5c77fdcdfbeeb373d90a140269323840d90a5f860af9f368de7afbc751239edaeffa5e241a445484ce9f8eb48006856b2a2b844dbb277003cf659fb761e05ba4141f2cf83d408ef7ec28c4db2fffc223c75cd68000080220409b882a7e47c9bbfa9d9376470475a231fbf05bbc34e32c85527665480607a955fd97b42db4775f60ea5a570766bd5a659b25b9ceb12231c4d73554aed80d339a2582838d3ea59ee500bfddfd9d619f28245c4f48ae4dd8110c4e37d8575750180eb631faf1a43b84123bf027283e645e00851f8030614238ff6de74281d8d64e7f25aa99e523edab3a722af81eb523cf25f26d9eaf9415a518cc0af09255f86ca8afcffdb9ed25fe489cd1eadf253ed55e7698b6a24043d0f2c9b3f9cf7e52b2beb9b53edfc205b5acd009b14030880afb3d5d52241a554c8bc744c15ad18bcbc8e542ab91507c85fbfa4b14eb93568462e65e9d0a118194f071ae3f6242f7bc2a7bc6f38780c68e31cfe3ced61a9c375abcf1331edf0cec78999cca55daa0dd6d2da8de6f8d2e94724c77f489b2657be379aef66b22b52435c285213bf5116a15bbd431425167c230cc0640b7bdb2d1fc157524a1d47aea56521d5a501eddc4e59267cb39d8bbf20bf8d8ed9ff9052aa847b5c6670b6bf653e0df83fbff23aa87dbd9b04f941937f578293d4fb531e81db12e85f06f6506a44e1111de9237fee955dc953af77897f152a557958a0ff416e7536fdcde390cc59e1d309f97559cbabdc0b6e0e2192810ad7274b8423a9bdd77642e40ea92bad83f4588ce59cd3e42b5c499baaf8d8401845b2970470276ad89734c02ac2ebfd2204a339b6554e27d01d80c7da47e0992be7d8ce2e61bf1c02ce4f93bd869c0ddb7daedb23ee90723121e24d1e9cf073aaca3e12edaa9405c21bdaf53caa75a18c007af649d71db1b9aeb8f420f46d4412dffd5a033d14a2ee0ebd3f36618c4a8b0cc1e42e80e5e6a2683bcee5ddf087dcca911c00240c9c5314e9cae566e1e787130def5395ef2c25c756a3dc66c4640aaf846315654bec041aa8ad28168f06d4a16f13a735f677aa14e5d2b9f5475c6724bbe737dca5c4b28ae8ad3031874d6293afcaef5a20eaa48d2551418524b48c5c5356f03f56611da4e0128331b088607e0045d8e80b9c1881149523e95cd2d0327543de228f330b054742dd044a6401c74ed8f68b3bb167d872d3928aa674ca40b2958da4aa36915b88a4cc17560c346b83d0b4598dabb856bb4cb419e0690d7692b1e4a39d4347074423f37364ade8f6e0ec2aaa66235aecd4f0fd050a34453d4e332cb11e4b17a27e5a0d3a43745ef6d6218a7effbb5f5e47364c9e44a949c8f9228df1f591b6b69a29bfb4a57a21a86fefc70efadf76e1fbe19dceae06ae065ca815aa5327c6142d09cf2eaa208d5dc243b52c06a7aa472ecec4a5399bc739adebefd554b7cefc5f0319689aad7d3dc9bdd4142bfeeb2e3d8638ef5246daf16caf5b4204a46600f4950700eb63c1849c13492ae8d31fb9a8d95416b1080af353fb98f769e6ae00e01a8c7353a1b4e14f5f665d102491d458f6b96684608f5641a778f5cca9279ed540b7235700569d49ac0be66f56129dca96c65e9860e45cb607f45d176521fa3ac9f5dfc6645e6602774eb887c9a091a3ee1ccbb37df29a8de45d52143fba8fadffb3e8022c39e87704897ad9ee69976a58a1edd36f5b37c404834a9a0289aff104bce8ac2026f7a31c111e6327b29803b9c5b028504560ba5d9a5c13bdfa51d7388c12703a0629fca580335c0cd57e094efd3c72bd008ab8c580cacef4b66787643051efc5a7881ddb6bd4bcf72009ca45e10aef76770f59cae1e1b07f13d4f923ec1ad6d959e8e0bf454b6e2a6bbca4d0fccc64f51245e8b2789417ecedc867d1f0e31d85aa7a06fb308f6e13fb94d29a0fd3cfbbc570c8863c0c22c2af7981892741b4e7f33f21300298e070374def16c5dbd7e35daaf439eb61488dfbf3b04ec877e7f8dfe4a18feffffa2fe636905db252b19796d3a9e199ddec93cee7d381f26630b4444072846f98047c172d633f89595dcc6ceb7e04a934b16b4af13c3670f7f908dade07785e10f6525844fba51d9d52ba97b9a988c0af61ab2ef6bcf72c2a5d1146254ce507007f6ea9ce41d43d9747b677545d29579e7e73af54d8168841b1d1b3d6ab434480852e52fd9ed30375fa398da1ababcc606672adba338af98784111fe6ff21d8dcc026600eb696f19a2085dfb591f66a9873353f98c673fea6edf253d4899dde7f3cc1341c962b76297ee4bf5765f5d185473c105a98ec02a9804df88f2d9d9a670a0df1edffba787a878ed85fef7c73073d46712be2f717b03f9967f9bd3d64d3356746a4cd0464797ff1ec33e03a8659e6a930c7511cd106f36678e633103eaa027d6727de8de776c6bf0b86e8eb793b412b1aed6d1a63e05ab46ab69889ea188bc408158803950858dd6591e6fcd67576184d920ef185e401b0209a30f8404878013cd1e5d8c2e0a74fabd40aa9381c403afd56cdf5bd3fc3809eee59e6a3308de70a19ac79035cb00d0877db2f8dde820fdd44025abcaf95213131bebcc92f88180bb174f93a22d7c971d943997dec99ba78384743a962d427afdc5b1129c6a549b348e7c4b07163ed7c0b9a0967ad73f229bb80c77d65ee266ddc32d0ca8d7c6746da9f79f6f120f85d52590e7e4be61ee1eb10ecd54f53e077b91f34c8e231a80316fcdfc37ca651df4fac35d27cc0232fad75bde782ff296cf22e10caf56de13e036160f0a1c1b8d6416c6f1c616db2f7e9b006ce9c5db9fe2cb7ea8359ac7979090433f63bc3b75e5fef84ea33a686b7b964507a7c0138c20620d6fbd0a45c4edef0c144367b9784c97bcad62ddb47e91052d73ef395ec901e5879423c9858686096574e1a0c306c1df2021a559bd8d9474f1c71fd648bec10f0393f8431db54d9ea20f70e692ddadab97e6c2bdbb60fc7a8a02397331defbebf4b9afd5a4388ba0d84daf1184c7b0c05b2b0a73a549d8b5e6f05624316c4284edf89eddcc6f0c78f833d779e7bc71888fe3131002a227a6599017a033fde5c7331ea3e72472d98820286f5d5329608af8acc3b177041c98afb85b06ef92668ed8ab40e3ef43fc6d9ebe76666be81d1e8ff9611327d3bd6ef630a70eeb94703de07d7276e5e9ff6a42980562b3619eda92af1c19f1ea55b001be435d42bb11b9c5457209bed2a84bdc8cafa6ded6ba241a72fe17ad5239ffac1c7389df47db7d9ba74d8aa436ec79e3a4e05b2a0", 0x1000, 0xe91a}, {&(0x7f00000026c0)="f938a8ce76e605a6dd1ba519a4ee624ae525cadbc91dd20cc6aeb69c7f6e62cb6f05f9bf8ac70ad3fac7e52d1788f49f6b81cae7dff2f968f767da37579a56afcac39e71b73bd4f2a9e23e8f446e4a0562cbb66f4c8e9f57dcbe0cfcb90bf3224b33d398d0ac86d5512eba490cdb97739fbbd844751922f6f11e", 0x7a, 0x120000}, {&(0x7f0000002740)="1c840ff119d8517285cab9288d3a6de99eea05c1715538280168b0c08e5651d58dd39bb3a2b38d13797858da50e5552b694b0ba1125c53be45504aafe27978d337a2ef3921720c2369a334a13bc4978a86b47b5d516ed01843cb9a", 0x5b, 0x6}], 0x0, &(0x7f0000002a00)={[{@resize='resize'}, {@nodiscard='nodiscard'}], [{@func={'func', 0x3d, 'MODULE_CHECK'}}, {@uid_gt={'uid>', r0}}, {@obj_role={'obj_role', 0x3d, 'net/wireless\x00'}}, {@uid_eq={'uid', 0x3d, r1}}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@fsmagic={'fsmagic', 0x3d, 0x400}}, {@appraise='appraise'}]}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) fcntl$setstatus(r2, 0x4, 0x42800) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r3, &(0x7f00000017c0), 0x1d0, 0x0) getresuid(&(0x7f00000028c0)=0x0, &(0x7f0000000140), &(0x7f0000000180)) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0, 0x0}, &(0x7f0000000200)=0xc) write$P9_RGETATTR(r3, &(0x7f0000000240)={0xa0, 0x19, 0x2, {0x1482, {0x80, 0x2, 0x8}, 0x40, r4, r5, 0x1, 0x7ff, 0xffff, 0x4, 0x3, 0x9, 0x1, 0x9, 0x8, 0x0, 0x9, 0x1, 0x3, 0x101, 0x8000}}, 0xa0) 14:59:40 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0x2, 0x0, 0x0, @dev}}}, 0x90) [ 996.722072] binder: 15173:15179 tried to acquire reference to desc 0, got 1 instead [ 996.772386] binder: 15173:15182 unknown command 536872576 [ 996.800663] binder: 15173:15182 ioctl c0306201 20008fd0 returned -22 [ 996.836890] binder: undelivered death notification, 0000000000000000 14:59:40 executing program 1: socket$key(0xf, 0x3, 0x2) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:41 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) timer_create(0x7, &(0x7f0000000100)={0x0, 0x22, 0x3, @thr={&(0x7f0000000040)="91c509dd39603f1c63ed02012b7e25a7466d3ced8e98577e4ea1bb99c6d31c2c15077efacd672987a1fe4af2538afc9a2ad782ec45946acf112620ff03c38803bda3aafe30ae52e8394f1b855db7fd880324b1de1d0c726f9e52d578d2678fa6e1b06541176bacb4b5717080c079082d9621f2", &(0x7f00000000c0)="8b31cdf921efa503"}}, &(0x7f0000000140)=0x0) timer_getoverrun(r1) 14:59:41 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x6, 0x14100) ioctl$KVM_SET_BOOT_CPU_ID(r0, 0xae78, &(0x7f0000000140)) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) [ 997.004664] binder: BINDER_SET_CONTEXT_MGR already set 14:59:41 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0x1b, 0x0, 0x0, @dev}}}, 0x90) [ 997.050694] binder: 15203:15205 unknown command 536872576 [ 997.078624] binder: 15203:15204 ioctl 40046207 0 returned -16 [ 997.099847] binder: 15203:15209 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:41 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 997.148894] binder: BINDER_SET_CONTEXT_MGR already set [ 997.157809] binder: 15203:15205 ioctl c0306201 20008fd0 returned -22 14:59:41 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f0000000100), 0x1000000000000160, 0x0) [ 997.194393] binder: 15203:15208 ioctl 40046207 200003c0 returned -16 [ 997.268800] binder: undelivered death notification, 0000000000000000 14:59:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:41 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x7) 14:59:41 executing program 0: r0 = socket$isdn(0x22, 0x3, 0x25) recvmmsg(r0, &(0x7f00000000c0)=[{{0x0, 0xffffffffffffff12, &(0x7f0000002b80)=[{&(0x7f0000000180)=""/190, 0x7}], 0x2a2}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000000)={0xffffffffffffffff}, 0x0, 0x100b}}, 0x20) write$RDMA_USER_CM_CMD_ACCEPT(r1, &(0x7f0000000380)={0x8, 0x120, 0xfa00, {0x3, {0x49c, 0x3, "60586b48a87fd3fc9bc50573e8ccb2696f4e06cdaa9ec3eeae2394aa6cbe9cc0740584ac1c68e8057d0f0d8291748b290cb188a5abc99a491dcf1afe8ec8e80b5c5142387614f2fe1d89402a98d1484dc302e2d89e7754554ecb80a23dbd65eda50a271148722be1b1acae56551b1b7dc0cf156f4012e5d8ea112836895820ea4743750efb2dfc4a81d2e69bddc6161be411b62af1071c282f9cb27875322ae5a6b446b5e37b0bf2b3182305cbd7a38c413bfa5f2e6945874dfd6f56b35f6419131827c77d7e60cb27a921f94e73f0b9611ecee82d9cd1d56a27d062d85357bc548e33e36d83bd860810d0356d5b7a64490cfc8e026a315e083fcefae5528a77", 0x9a, 0x5, 0x8, 0x400, 0x9, 0x6, 0x1, 0x1}, r2}}, 0x128) ioctl$SIOCAX25GETINFO(r1, 0x89ed, &(0x7f0000000100)) 14:59:41 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:41 executing program 1: socket$key(0xf, 0x3, 0x2) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 997.473902] binder: 15231:15233 unknown command 536872576 14:59:41 executing program 3: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x0, 0x0) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000000080)={{0x10001, 0xd002, 0x1e, 0x3, 0x8, 0x8001, 0x80, 0x8000, 0x0, 0x1, 0x1, 0x8}, {0xd002, 0x1005, 0x1b, 0x7, 0x3, 0x7, 0x7f, 0x8, 0x84, 0x4, 0x101, 0x81}, {0x2, 0x10000, 0x0, 0x401, 0x9, 0x1, 0x5, 0x1, 0x5, 0x9, 0x4}, {0x6000, 0x4, 0x4, 0x7, 0x400, 0x7, 0x4, 0x0, 0x3, 0x7, 0x7fff, 0x8}, {0x4000, 0x3000, 0xe, 0x80000000, 0xf0e9, 0x3ff, 0x0, 0x1, 0x10001, 0x5, 0x0, 0x5}, {0x7000, 0x0, 0xa, 0x800, 0x1, 0x5, 0x5, 0x100000000, 0x6, 0x2, 0x2000000000000, 0x9}, {0xf000, 0x10d000, 0x0, 0x1, 0x100000001, 0x1, 0x1, 0x4, 0xfc00000000000000, 0x7, 0x68, 0x5d00}, {0xd000, 0x6000, 0xd, 0xcd8, 0xfffffffffffffffe, 0x2, 0x8, 0xfeca, 0x6, 0x272, 0x5, 0xdf7}, {0x4001}, {0x4, 0x10000}, 0x40010001, 0x0, 0x1000, 0x0, 0x9, 0x0, 0x1, [0x9, 0xfffffffffffff801, 0x5, 0x1]}) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 997.514536] binder: 15231:15246 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:41 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x200001d0) 14:59:41 executing program 0: openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000480)='/dev/loop-control\x00', 0x88000, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000200)='/dev/loop-control\x00', 0x0, 0x0) pwritev(r0, &(0x7f0000000440)=[{&(0x7f0000000240)="b6aaf92224182b0c7413bbab33edc7a3c284545594488a2c7e6fc27fa360e106e11c8b6c0c1db4dfe980577e9d04b345d9cb9dd772dddb60", 0x38}, {&(0x7f0000001700)="d66e0a9aa45c7b095327886e54c049d51a524fcf1896cb33a14705d49dc6889385513c8c236d08114491bc041f7a5cf3d4d2da948c68590ddb01914ef09062f0f96ce4149ed96b64df03f2eaff886e9e6bfc931e1fda015ed82e606a48165412e17a14936d24642a628ef89f285644656b8d95baaa7503de0d8a01351e70a7fd87ea99cc50ee71470b2262b59a333b304d300f95a10d45ccad850c0ac2d6c3568ce5ba1028c74e71d5af97850d63db73e139f602fdd8db0b569f5f0b067709be80c0cd17d08b54bfa33d3c5190ab59c9a295a0d4b5712dbfec2141a26c370de503f9f6f0aa7c61fba8aae3140bcfbb2c286c486a0918298fb74dbec962353e9c72fc5dd3c8b419dd83b05cef04967126d5c1b64d10b357a9069da95b55f09e0fec353760854287d350c976a287163cbbbd6bf8f0d3d850831d3744d427244534966014158feb97c253624f8ebd4643c1541280fd3c6657e9c5ab2a9b0cf9d6e18e245db1ed08079e2fae99873aabefa7699dcea3c75092e8e7e896096f5dc3a0dfcfd7a1b639776d0f6b9241041955f988fe89008d4fc933bcecb1904fb466a18d7c5ab4632678e43e9f06a1ba47be874ea2aa46e33d8612e9e910ca735b36d56bebe309f2874569c977cedd82c4ba28895dbf669df4e4a33ccb9ad39a03843877e0cb6571034cb63031dda47cf611892fc41af0947c8e22e40a239b83c01434ae25e57429ab86c370b347b341ac2bd65dd843437cbebd0dfc062609b90551fb6a5835ef04baad7acd1ec9b6d069ab4942d9fddb230996dc689854a320f6d9bb5e1e4dffd2f064bd903aeb24bda87cc4d19a1459ee5a896e35303daf768bfc1a305fad2559b76faa104e1a7e5b56cff134ddf37648b93ba9e63583374ec33e75f9a62af110cf62d779a4ecb683cc509773ba64630a1047526fa1b982d166094e666d1327d9f8b3a836aed7b119bd52d19d209b7a8e658450139e094fb80e5a9f016336176b4868e8a1e1893821b7c0a16301a58e7ef56653f3caacec4e29c14113232a10540f3befc69f803506d533d16986756d72b7d0f93c3c3ca07a3f4d9d6eead443b8e3ee64d17b8f31fe5e33f56da527e24d04b6dd63cfbe4d2b4a6aac972af013ced17d614a3858b6b412cff3900b2dea60317a999b0ec035eddd4eae4239caa75784043f874bad6073dc230128a7885617fc7f1b0a4e044e5afc44eec02f6edd0d08380c1f911f4145e7b2d1dce7acbdd8b1617647baa9706efa65bb276b3e79b9cf8c8b725cd70a4e8b7efce0f297fdca61527f0ebe7814dac900e6f887cff34ea1d29ab5be3077c915275d61e66a4f8d30e27954604ae4abf09fe1f6fbd288829604b3ffad2644fba7b6c43dcf07fd68fd3050d138ebf896e557a0713aa35cc7f56376be860cb005a3234a409d24b75f1d42f8dc7730d0ea6d76c04dc33bd993ea9c0e9943def7e838c69c401930b8813ff6d74de246028c35349fe051ae196a926e805431ad4011e573f40a57908e07b274ba2ce50bf2ba384a47d35c709feeace7aacb79b33d2cfe677d735d295f24e6a6e949abe730208710d2260d1cb1029ebfefce510245fb86d3a1c70472ea9bcb153412469ad84796e31d2a11d6b078862b2e95107079d91943a895244661834facf424c700f8012746dd1a2ef169ed2f1ee2b9f9e335bc568dd1810de1be4ed81008caf36ea703c52f58bd0f0bc407fddbf3c86fdfa63a7ae1d4bfe9721a41bd3feae882e47408391cb06a67c118cccad4aaf4beee6ec5e67dca5ad69dad6c0e48d2187808de170ff289b753c4fdb013c678a7b329498d3d3e14e1e93eca3f183bafada293970542d8c7ff76319c00e92798b9d71b68ba4dd797a086df2c0fd1e6614b011efb6ad32787183467e49d43a23a59ad1b12c7ee0ab3cd49cae257bea624e708192d7c7a9cd66848a0e242124b7865d9dce68f537d7e774df069b6b97b23bf8d9f2d8f66326acbb81840bc192d5f6d6afd4feb168a742857fc37e2f21fc63d56465d5727c886e15fcc9ee5888f3340d12774d425296e84a38509666c4b2931bd483d3201454e00f0eaefc687e52f99ea35b48fb5970b3f69cce475687422ad72df4da0a036093ffd632be9ce49b247c08c33ff8635fda202648c791e49e3686cd2c937c5cd75522acaec4f3fa9fd9148efd2f33f6d546f21a3522e928c1ad9f297d4392c1e3510b472c06143cc3a5cd3e78e3ebc0615970773999a3039f9d0a4d0b14d12ed48d244e3a6227247a4e857b2249f8e1d67243cecc601df3c7eb28a7d057f3daf587709235ecdf3cc3f67c5ff01664316dcef9800212139e9995aabdc691bc4f25ecf25675bfc2439cf546dceb112025a3dc25b461ff330d45945795db788355d5ed098f6eae4ca9ceb40f093735bbea53be30bbef0858c71d9de280247fbe5f74f7ca05587a7265c1a7b330343c305a30d5372da85bbdbbcf87634c37c4b72d3c11d151a446aa19709331decb867e448cb2d865ee67b96c36d7a47b88e5a46634f2c946c52bc970103dd4ba28f20c5974f8234e818c45f4874f000f0f29723972a637be5aa5009865589b898d24f1b00dd1e82ceb37ea02db5bc4147efc75b6c717c591f40646fda2db7be129597cadd481f6ff250b56a45601df035c9339217d4bbe83a9cdac858e332dbd30a42be529041b6d3627608a379e2fa5c04443e0b16532134010a49d1a270751396b6f35c93e5ae52772ce28684d1736939853a8973712940e363966b2e06608b24a592e92ba89a7b4ea88aee84f3591e10edf7940d8484ed0103d004d6b2bb0e929b79646f9d6c090b4122491ca81a6092a9f6706ec56bb3979fe83b29627383ae93d6e6fb19194cfc378a68d460797b43df2f6a2a2bfa25446e0ac9033fa1bc8cb383b5e8f2b19ed2bf08c132c12589d5916613983f6d24afa0a98fe15e26b47fa82e2fd7942f605b13c42c33c768053972852440db81aeb882c753747549744776fc590e73e1e6985fae52439a8a884a5b65403072e95c41905e68d7a90cc22809a0e687f65e3b692f67e231d5cab00d3760f36245b37734a64243004cca889bc04a53a21dc7bace324442a147402760a9a43b2ed7c85574ea74876edc839708c7a2a1adb05df042c39f151db884650a6255ea6135cbf9484175ca554af25b845303d484a585a60e3aed695f828e242a578dd7339505c7062f7bf29d8a76cc7395043332ca0c8ba6c8734280a2bf2a0ce3f134b7940f0331c6d476a8c5f3edd702846b4e35e9ebabd1dfe3a72c42e9b772abd33188483945f81c233c66c4684dda3473660b1af2df8b5ca2051621a300f17bef4cecae74cbfcaace5f51b3216c1dbb5052c73968294e4535cdbc2dd7cf8eda4c85a3e033a23060b22f8f3c1aa80ff2b4c3645b0220a1d8d358d799ff5a4ca0cb4903dc098b73b6bc6ce96e9cff28383e12e51367f5d5d3f8ff4294ba50f72dbcd0fc3c071f3d0d71f96059d5be2b86ec5b9ec9190ade2fd4a45f114dcb9bde775c96eafaca0a1b8347f98b8ea8c9b4e52c17092e6f51e5efad50a6f79fc35f1a27a5da86b1570c90dad49525db1db320bce2e77cf4e8b5ffc411f3af51ad1f77a55c0befee3d33a149e12ee4d09ecd1cdd52105eacbcb4586901e304dacf9792efd223ebee7cd5b596623bd58430d61a709e92537b684139cb56c65712444aa339d2beb192c7c68504789acf36d6d877096639abac55647f2ed9cdf6009c88e57c4ced7ed6341748756f78ba8a5243c23f3741b2f3abf19373541911ab0f238af330880ba2ca30ba317f8c18a8897b775f7963371d50a0ea83d5efa70e854c79199493cce9bd29486d49b6dc314d503b30b1e2d566cd90500c84e9a331246bb65f44fa0baa6947067db1223a566b81666ebbd2542a31ed4c5812a999c609bc172bdf8f3ed5b294e53c78d842b8ea160137ee60a9b9f59aaed71afbf6ce7f59e2f785375c66687024dc47a8fc76f34fcd28034c4db38e52515acd47394625892e52a94b589f22860aa25c5d6758dea31c3774793126dbe634382587652c11080ab075669883f65bdfc3412239ed16777d6e455d6579050a4728c4a3a6b3270b8f0c196a6a7180cb0c4422c7a4f98507d61b6637984fb517bf74b758302d3525754b877187aa0fce2ef938bd66ece0828a960d236796fe6c36d053228c0a2479c8640ded2e34c81f003c36f65bc5c9d59f4153fcbd1b2ef3f6049b20866a0b99d6de10e58506c77fbfe0499e91b324d82e1abb471bac823c9fde16b07c86f737ca6a4ac55dc7e1ed5935c7aea9c1fe47cffd3e478413a8aa9427d0322839e5a6e6fe74f680e7c667930e30f0ba22546bb580c19e423b963d1483ed957397556bab6313fe1758ce11994ae65bef02fb0bb5465bd7baaa8511345a4954fc2ab7f8cbc112fb2a89326cc009cd4a6283df32c4ec98f25b8139f61ff0b6f074e70c8e1dd979354ba2aca7532856a974458044e8e11c77172626d9350e2826a1749017f7a93e512615256bae22af8cdd6103509614dddaecefec489984c08fcfaa3783bc5c54beb52f5c8471af6a235863e29b822f9eb9998499474ed9092df7f84daf52eb2ed2d2f1327768657d56abd8aeced90d20c3d830f85bf314f95a4aa1d6afcb5fa3c6e9e5dd3d6e1f6a2f5905026f9643cd82e2ae68cb712f246fbc2e0e786163910b30423df118dddead63758a21d798e1495c4d77177318f7d421df8d0bcbfa7bcc48ac829dbac6a527ecdf18bcd96736672949451a69abf47f21f8bf133695d599ad6d3f6a4dac338c0ce641b930ba22bbb41f23e143db05c418e1ddc22a4924f459c3f15dd26799b2676836d9b62026c7e8daf4fd02207090f099ceaf96912c751739ad317c916b907e8018ac4f6b22707702fb5aa3d3a915b8ef690e010c7b765ee24bcc0cdaa7f97ce622b4f101b9ba38bb39a4ac365311d6806f71a89b99092a1a50a58c70a1ae277dff24cab823c7228809f2ec20bead84e1fe2319607ea76ee8fe26542bd260472a236145d9820b5ce852130dc141f7397d7ecbd4a431fcb6aacd6807a82580348604adb9b45f4e265f3533f5b4fe64186f0f6000e77d665024cd36f7bcb6898746b7bc2686419678cbe9227bd17622aee316e326242c942f0a369f50315a9d4120408e1075dc5aad5518d4911edf5cc5f28d28b7a4b0a2a37b86b7ef74cbc0e76d4d9243ece86730f00106e0bffd0d49bcd3e23dc91e3d1fb6eb8e48e87b5f92eba584f6f269e7209c4ae28bc5e568bb3578e36e62674cf9aa6ebc64711d0b9998212dfb99fed6f897d86bbcc2cb1ce189743f8e6a37055ce4638ccd03dfc75657c55852c412b03051f385b4b4974222b894f6cd090949dd47f3b7149cac9b0e88319538f73b6a975a3198aa14bba20a7eaddfbd9998373bb96cc4c278e59a5a1b1900fa725dcb804ff21c4211d51d7882365699e886323f59d79e99720ba93dc63ee86d20ab5697487fc14bf117012a5ef5831bc94c2b7c56085741e500d028b053ad27f3a60f4297d5a8cf74a017cc4f98a1f1a1800d9dea4731b170cb43d24f1464c098ee0cf01a92facfe748ed9f7478188cbeb83013b28dbbcc86e7e9ec6278ad497331478665d1553a3c679d5851fedb19cc8c16545f06978ebe51f24efceea99e911e1c6b1d8bb1976a3636ed775b4c771f8d589ae9f4aad25675338417632b60b4321fdf51e265ac3d94d06025075ce97f3a29e9dd827017204516c33b65e462f079814cd8a2978abeb2658a789632a1b3", 0x1000}, {&(0x7f0000000280)="e2263d73520e38882d339fe17754d0f3745d19fb1589bc1aca8cc19b947c88e6d0f57f8de3bffd9a78a7000ebdafa8ba484bc4be57208f8a3bea5849ecc7193e966ed3ec1d515e2b4ebf3a5d9d", 0x4d}, {&(0x7f0000000400)="ce69161983dc394da67c275158ef5dba10ffdd", 0x13}], 0x4, 0x51) sync_file_range(r0, 0x5, 0x9, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='net/wireless\x00') preadv(r1, &(0x7f00000014c0)=[{&(0x7f0000000140)=""/123}, {&(0x7f00000001c0)=""/33}, {&(0x7f0000001600)=""/210}, {&(0x7f0000000300)=""/233}, {&(0x7f0000001540)=""/184}, {&(0x7f00000004c0)=""/4096}], 0x517, 0x0) ioctl$NBD_DISCONNECT(r1, 0xab08) [ 997.577504] binder: 15231:15233 ioctl c0306201 20008fd0 returned -22 [ 997.600384] binder: undelivered death notification, 0000000000000000 14:59:41 executing program 1: socket$key(0xf, 0x3, 0x2) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$key(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 14:59:41 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0x0, r1, 0x1f8, 0x100000001, 0x1, 0x40}) 14:59:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 997.899580] binder_thread_write: 2 callbacks suppressed [ 997.899593] binder: 15267:15268 tried to acquire reference to desc 0, got 1 instead 14:59:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5603000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:42 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$cec(&(0x7f0000000180)='/dev/cec#\x00', 0x0, 0x2) ioctl$DRM_IOCTL_SET_UNIQUE(r0, 0x40106410, &(0x7f00000001c0)={0x1000, &(0x7f0000000380)="396c6d3398b56d1a17e5dc25a64d4e33c197f2d47b25632b1da33a099e385f86be489befd56ad063beef58f9a0f47ff152d6cbe02a4d289c26bb06a9fe4e53665ac533c00d35fc88004c3b1ed346ca3c732bba940709a7ca4cfeaba691cca0896630254de3ff3f6eefc1fd6dc10a187db1b556012a1ddbdddf13e022df86ae44acd9da56aa342426e2b52f6e750a18078cf0ae0060606bf22e17bcd0224f84575f73702e19e8a8c05cddd92e7cd4f5d50f6280932c8efe1d375466a7769aaf2470acac2c41ee26126e57d428973adc832f004471b7aff05911aaf0ca1d35f7959686b07f9c7ccd879c2e29db4c68ecf9d187045516ee8d13d14520b06c9278864af82765d49626aba7f8573ad2b0d202c324b39ee50880b0ec66f940e63f3b5b23db2aeca4636e51ca921c53965cf0909a70d557bc5c51b94f216805431426c778b8a7201a67b5c6f578bae2c2cada6abbb9cbcb4ecc87efd7fd3be4bc6465e6a891b76b2b713fdeb7c359f81db05af8245025d020397472f3072428ce763c385d0297bbae68b1ab3e041b3c0c5fc0d72e8a5c4a6dcb793be91d1a13d1658499536593468a1f13d17ca7adef72d5be1ea4419aada26cf7e14889117810f428c5c884bf9a8e4217ba3801e128430a16370a40a22bb924ae23ace6ffd43754e9853e784c082f0ed07fe44d94481309fd10d42df4836cbacd2cb3ebed6338ea3d950ca0f11a6e99cac66077c14702c582d5405bf805b6c98bfb4978f6a99023a0796f9642f08495dc6463ce160e8d243e7a8ce22db5a32bd53e8522c3bbf364b1228d9745dde4ff05e686536607d7ba1c861936bdc8a7ae425e848e59c933b8f014d729ed6480bce79ed4b322e1320b98267e9b6632918e9c5d81f2cdf8307d371840bf40fa3af09c33614b01c51d4d688e0f28e2c208d705d86644ad198b5fc61b9c624a6a7f6a537987253ced5a9ba2f7c50df99a4f32e95fcf284d3ebb125f244ec98f7eade1dae7a346f7d3822971d97a1e86eab8691ff6ce1824c1aef14fc311e4964d5fde4a91d8db5474df4f5c7675ed78ad699b01ff96a01eb69897615c84445b0d6c147a290a8c1a6a372dbf4df78c331da96db7021bc71f38e2b1e9f282ed8839f3dcdbf9531da08de36da7d07ab407faa075efee0e5498344384bad5003c61ca3171b3726daefd1023df5d82aa92ed5ccc7112d62ca604d39a5041677f419c925ece5ae956dbc82b7a06bbb4398bc8d26c016dd405cef408206e66bc02a9880a9600e067ef9e466355210ed2881616fc578caaec54ca5145da4314e046b649fc2abd9dfa51212670e366ca81d5682d993607592b76c30af952bf824b897c79250b8e10a02229206aef150a8375749ab0b72253ceeec86ec549be62cedc12da345269145dfbea5530206fc87e4d6d2e0418d91934aff2ef26d963e9afdc093303cc7c6c7ea64490908c57b6059e1ff2fd7963f5c3b31c042a5e60f288d2b727c160c028ef04fdef6243f9e9f3332419425ea20088df52f2d8e2cdf2e649c7bc370971f5d43ba39dab3e41958e02f5c0cd84ff9e665d5b1136fa61746a229bac5bf59738734eeeee06981d2582c27746525ceacaa4614d85594f1b7f2b4b7b7c4c684966d1a21cdc812d5fe8f29e2f5e2b366b3e6589b35939c806439b6acef4fafb5c73303fbbd228fff6ca2e16047ff1ab6c1b2288aaeb5a28d47aa1abc2ccae561ea62edf98a43c04eae600e6efaf0bb4a7eb9293ef2251e8272d4b43b56fd4a05456b419f08d8b12b24d71f7bed5e20b57427ba2a903e08fe68a65e098d8ae6e6b52a159ece049c17c5baebdd5a38236b5db3ca7f3834ba2ec7b04ce2d9d9fde544b9809aaf08753d0396da758a1df2b80b7f70728be9e5492bcfad7ca727920a934d86434c7d1273f4368d3c27425d20a708c75595a36439f9d19d25d032ce2ff29a8f378c54963baae6cf756b956c9ad99533b6d26d0b88110a76f4ab13a2f38e41ec102da68c6f6ecfadf52761dc1583875253a502006e734e92efff9909ce9ddac1387c37d192689ed2d572ac06c0d329fd6438e6d78415e496fb296debf065572fe51d56560e388b32c739439afc3f2acfcd3a1c5ab6ba6e8a96ef9450b940fdb30d9537772f6fab6615ab1c6614a40ab7f6a3568cf2792932840bbffa0a952939cc819e74659685fcd0e310fb5c797c86463e6330943c7e42b37fbae114656fd65c85e7260ad70f07969dd55c23123396078703a45b69e157f818df4493fddb3e15c58df0e1d11096806ce8a523adde3cb535aa13411ef1f7106c541a13e8916d005eae68df9a43b38c55b7c90d8c3dcc5f8a224a9564280231e181916f29c9e502ad06ac9a27543cc888d10dc2fc0c471b4dabd35b8dd35c19c8a7f8eb62c7318c3e68e619b7636dfeecd7e8f3a503b0724bebede8d91ac89dab32057a481808ec54a268a9ec320c1b505f3c989aab7bf83aa2581e00ed32fa8bffd82169494c8d855cf25935e4518089a2fb14af9998f8a131c7db59265845554ac22d47b80665293355f9955a998a831676bbcccda3e872341bbc1fb13229abc872d5cf67661099feb1def44aed3da43b056fdd9eaec8719469a8ef8b3a6e83e7ea918e63c29ee0482ec922796d45464994c8bbb7f5ce53de8c59982f1a140b43cf5a4dc36cfab9d1c1d8fbfacf51489fbf77c7a310a53508cd209fe7369d6653ad1db71cd87b57ff6f5e2c4ead9c5fd4399cee9a4c70fc924fd869c4d0d3e02aeba100725f8388502fd7921b0f735c25c8afe42a1cd72f92a2dffb44994e21baf7eb8e343b3cd6d22788df9880242307dcdf1f7bceeb59503a89a46326b72ef342bada86cba9aec701b6ddaee26a5c58155ba8bbacf19f85bb7597d8d44129936198ff60c2052072c4207a3bfbcaf15c0ba557452c4f5bf0c76bde2c45c2f87f16dc12eca2c13ed832544752787b6d36c4b1f08f24a03cf4a56c4d8ed1ccd204e4465d80ac340ff8b3c9444590d57ae9fc9e9c366a75f56d3aa7f2650d68f5404429e1f574875cc83422ef95000d34f6a048d6d409ab6dfa65fe473ebe4f1c39a424d7ae0f968c6b13a42f977dc472b276cf415d245f7efc5ac94f8436b66b947837781cb011feed7420e8f0553dbc954e897f4d27853d9ba13ec9992b7bc77639b131513a7b8598623d23aed0ef05fab874195a83c56f21779bb0d1ca71b5c476f6a8f48e7be1f5fa51ede13bbf982cc63eb71192095582229f9a29c8ab1245338812ea47db6a85af62d905c7c1190287169cafe31df11e6bad3b32c9970d06c653bd602170f1c4aaa39dea37a6122507b1878ee4ed6386e643418a4d046b35682e0b4d1cba0d2f4deb40af0f6b7fcd1993efe6794d65c7d41cef9c9ae6203d173456a2ab83a94b66c0028bff808f7c0c00e795ddf6bb787453d421bebbd5b7cc7fa03cf4a39a1fc96a39247c527a11a971c37676813ae614032f69f601ac6d44053313fc0497adc58d42acc98cfff06d23ef7ddb03e08b470c40031450818bef8c5cec47e166ff74ad3988fa740b86ee016441f66f8452c8f2245a4c4732a3187f80e1c5ebb4ce7f93da5e7e2a55ff615580e5657b0e31ce5426beb52bda73ddd6b116a51a697559b4aa999d24c0eaf527a22fc1677e0d559ab76243f97c10ee155ad7ecb9f018973b35cb66fcaed9e5d5cf7c4b7ad12c4e4f06c4a166a964dfd238433893a4754dc3f223f4a96c808110e9a84ebc4fb894d5c424f028fee1661904b1fba9c039e84e58eb679c323bd27e8972e1f78460a734fc485ee7ff96481efd9a671ccefddccba65c9d2be2aa69ccfec4ed21984f7c16e91af14e676e6807026fba7689febf5848b04f70fba90be04b9d89e171d255b7f24015cedd341a5f1963f537cc24ae26915000595721c4c6605687a5dbdcfdbbdbe7c816bdbfbbc5bf73e872da97f6f899a22ecef9b97259cca54144e80f97bf181114d9bece26e96230f764588252b7548bfc71b128fd4d13e89bd2b60ab4135dd615649b0a9c2688ecab470fd04a8949985149e43485076fde9d4bdb67a4581d003d1cc115c08eda4de83d70db8e2c20328439936fa396f3ca4c8e15c714e7edbacf06fea008a3fb2183a931ef2b7ddb9be6093b85f7f2b8e7dfecb82bd7238112826493088f8fdeaae3d3bc2f14351f33fe710d0757dfade277caa3b5311e45f36108515ad8651a1b8eea50e63accc5e886711b70f247ed8bbd203e5e0baef4e3966fae02dd5282e721332ce8925843e1c0953ad94501e4e75ab0b040788258500be601239164f3550a21b5a53726e0584a422857317f4c26051368ee9b16529fa3db3c4dbea57db8b9e8f2ad9cda5be1ae04ca2be216574d44e7ff9f9ea2ba78ec7dfda0b54a395bda02d22aa7fdac584a20fb791c00787f5c2f99c8d27ee385df83fcfca415f925ca521a5b0b8eb68b3a830c326b51744fc8f67f4f2fb4eae56e6ead613654ad98e4a6037f8bbf818adf9fe1e3c7bad3cc98f1b69779e2d02f85522a199b42daa591c0055f571ceef81f214e78de5f0c2a25b5000a7e2b09b09a97d5ecd98012d6762c4ff17923424aaccd88e26bb21d58c7cea2f5cbfee1b61185527189f709e9357d5a269c548a6c7fd8ab808156d574eea5a3c41d9ea092c9c03b82f842ac4bf429ae8d1c2eeee57bfe806ae09039e086a27131cc2041e196a1a0905e43eef6ac8f121846e3c692009f74383dfa42f79a3bbb48658f1a61a07b48e47b0b8a5c75110cadc63002cac233afc26715a0c101b5dfcfe683e5746ef7d0a73ecb8450f226c780b16c110254d93d6f5660cb3a7ab261a20a239fcb54e951332bdd926ba41188d1f68430d7671f87aabe5a3d497b9aa0b782e99596ef7a9a8e1a40977f0398d20110b37b21796996af20fb2167f17d37b9b7642d2c04e0470f07b8acf46796809e36ae6d8dfa3e077973dd4a5f649bf354d966de01419b6d919666e39101f9bdce63979ad7cf4d0b5a7442ded9d5fd99215a2d771cd112d13b106001b958aad4b8093cc29f03d6c783529635241697dedfab52224ffddd4958d00abbc8cae788abfe8208c852a22292d84bcf9c16dadd1dc74bc76d01bea2419ac0e1743ab7145d90a960eb06db449df65ff2e51d255185301e800ea0d36741276a7abae2b76b06f6d6dc2fb6875f02167af189745b155297140bc4dd8126fc14c41985236d6ffe8c66053dd02f053359831ad753a3b11784a0fd1d4554b03cf4e7b6174c4dc558b52f31dfb7dae3a68e82cfe39e9d61a47ff4495ab566663ac51a20fbca1bc843386def57bf1122b2607bf865eae6d5b0432183cbec979f4dde11662f05680b7f145ae1bd91338f254c6a237c92b88127b133c71039e966969d4ef870a9db4cf03e4915963e1f9bbf8a1c8a277e68b542d302fd6d36e9b3a113657cbb4066995802edaccf0d86bfb51aed5373876ddd44aae0482a4db513bc99e22505097101797241a84745bd3f33a86035d029de8b31ec414c3abb425e3ce092abe70ebbb26db41f03fc0d313e57d1614b015d63e9272748c862c15717ad45f5719e0886735c466db60c6441c954e667cbb3c0deb5c57da6d7a5a91913704ed3df9fe850417757876bcf50f5272752a5b8b7cd1c1dabdc9aa390d79882227202e3b21a562e23109106ae33f2d5bcab80549bae2bbdd266c829444100544e8ff2e7ac7763b8cc4473f8eadb64425d980b6ad1c9b62f9e58a9e1d1383bb19975e3d9371574b9a1eb2c653089c0988791ceb6e9fde184f4546b652a8"}) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) bind$alg(r1, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_hmac_sha384\x00'}, 0x58) 14:59:42 executing program 3: r0 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$rxrpc(0x21, 0x2, 0xa) 14:59:42 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) socketpair(0x11, 0x0, 0x6db, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000040)={{{@in=@multicast1, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@remote}}, &(0x7f0000000200)=0xe8) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000240)={r2, 0x1, 0x6, @dev={[], 0x17}}, 0x10) 14:59:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, 0x0, 0x0) [ 997.978233] binder: 15267:15272 unknown command 536872576 [ 997.988914] binder: 15267:15272 ioctl c0306201 20008fd0 returned -22 [ 997.995908] binder: undelivered death notification, 0000000000000000 14:59:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40086602, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:42 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$SG_GET_NUM_WAITING(r0, 0x227d, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0xffffffffffffff07, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_group_source_req(r0, 0x29, 0x2c, &(0x7f0000000140)={0x3, {{0xa, 0x4e23, 0x9, @rand_addr="97baf7efe0fa85a98dec9be4054e53d5", 0x8}}, {{0xa, 0x4e23, 0xfffffffffffffffc, @ipv4={[], [], @rand_addr=0x100000000}, 0x6}}}, 0x108) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000002c0)={{{@in, @in6=@ipv4={[], [], @empty}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@remote}}, &(0x7f0000000100)=0xfffffffffffffd2d) setsockopt$inet6_IPV6_PKTINFO(r0, 0x29, 0x32, &(0x7f0000000280)={@dev={0xfe, 0x80, [], 0x2b}, r2}, 0x14) 14:59:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, 0x0, 0x0) 14:59:42 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000380)={0x5, 0x203, 0x6, 0x547b, 0x0}, &(0x7f00000003c0)=0x10) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000400)={r1, @in6={{0xa, 0x4e23, 0x468, @mcast1, 0xce9a}}}, 0x84) preadv(r0, &(0x7f0000000300)=[{&(0x7f0000000100)=""/190, 0xbe}, {&(0x7f00000001c0)=""/14, 0xe}, {&(0x7f0000000200)=""/230, 0xe6}], 0x3, 0x0) [ 998.203206] binder: 15291:15292 ioctl 40086602 200003c0 returned -22 14:59:42 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x7f, 0x410000) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80100000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000200)={0xc4, r2, 0x100, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x80}]}, @TIPC_NLA_SOCK={0x3c, 0x2, [@TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x90}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x89e1}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8000}]}, @TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_NODE={0x30, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x20}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfc000000}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x10}, 0x40000) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 998.250818] binder: 15291:15292 tried to acquire reference to desc 0, got 1 instead 14:59:42 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x8000, 0x0) [ 998.343439] binder: 15291:15294 unknown command 536872576 [ 998.365260] binder: 15291:15294 ioctl c0306201 20008fd0 returned -22 14:59:42 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r0, 0x110, 0x4, &(0x7f0000000040)=0x1, 0x4) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e24, 0x6, @empty, 0x3}}}, &(0x7f0000000140)=0x84) setsockopt$inet_sctp6_SCTP_SET_PEER_PRIMARY_ADDR(r0, 0x84, 0x5, &(0x7f0000000180)={r2, @in6={{0xa, 0x4e24, 0x1, @loopback, 0x9}}}, 0x84) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b02000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 998.400331] binder: 15291:15307 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 998.452614] binder: undelivered death notification, 0000000000000000 14:59:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, 0x0, 0x0) 14:59:42 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40087602, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:42 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in={0x2, 0x4e24, @remote}, @in={0x2, 0x4e21, @multicast2}, @in6={0xa, 0x4e22, 0xc29, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @in6={0xa, 0x4e23, 0x1, @rand_addr="f65793e5d8fd4eb7d2f35253f26b10e9", 0x5}, @in={0x2, 0x4e22, @broadcast}, @in6={0xa, 0x4e21, 0x9, @local, 0x4}], 0x84) 14:59:42 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') syz_emit_ethernet(0x2a, &(0x7f0000000100)={@local, @local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x0, 0x0, 0x0, 0x73, 0x0, @initdev, @local}, @igmp}}}}, 0x0) preadv(r0, &(0x7f0000000600)=[{&(0x7f0000000000)=""/183, 0xb7}, {&(0x7f00000000c0)=""/48, 0x30}, {&(0x7f0000000100)=""/139, 0x8b}, {&(0x7f00000001c0)=""/130, 0x82}, {&(0x7f0000000280)=""/138, 0x8a}, {&(0x7f0000000380)=""/198, 0xc6}, {&(0x7f0000000480)=""/251, 0xfb}, {&(0x7f0000000680)=""/113, 0x71}], 0x8, 0x0) sendfile(r0, r0, 0x0, 0x4) 14:59:42 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) write$eventfd(r0, &(0x7f0000000040)=0x3, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 998.732601] binder: 15326:15328 ioctl 40087602 200003c0 returned -22 [ 998.765551] binder: 15326:15328 tried to acquire reference to desc 0, got 1 instead 14:59:42 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) [ 998.792083] binder: 15326:15337 unknown command 536872576 [ 998.826127] binder: 15326:15346 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 998.826461] binder: 15326:15337 ioctl c0306201 20008fd0 returned -22 14:59:42 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f0000006280)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)=""/25, 0x19}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000000140)=""/116, 0x74}, {&(0x7f00000001c0)=""/42, 0x2a}], 0x4, &(0x7f0000000240)=""/237, 0xed}, 0x30f4979b}, {{&(0x7f0000001380)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000001400)=""/147, 0x93}, {&(0x7f00000014c0)=""/72, 0x48}, {&(0x7f0000001540)=""/110, 0x6e}, {&(0x7f00000015c0)=""/218, 0xda}, {&(0x7f00000016c0)=""/167, 0xa7}, {&(0x7f0000001780)=""/98, 0x31}], 0x6, &(0x7f0000001880)=""/59, 0xe7}, 0x1f}, {{0x0, 0x0, &(0x7f0000001f40)=[{&(0x7f00000018c0)=""/59, 0x3b}, {&(0x7f0000001900)=""/215, 0xd7}, {&(0x7f0000001a00)=""/216, 0xd8}, {&(0x7f0000001b00)=""/195, 0xc3}, {&(0x7f0000001c00)=""/72, 0x48}, {&(0x7f0000002bc0)=""/4096, 0x1000}, {&(0x7f0000001c80)=""/251, 0xfb}, {&(0x7f0000001d80)=""/233, 0xe9}, {&(0x7f0000001e80)=""/153, 0x99}], 0x9}, 0x2}, {{&(0x7f0000002000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast2}}}, 0x80, &(0x7f0000002400)=[{&(0x7f0000002080)=""/30, 0x1e}, {&(0x7f00000020c0)=""/250, 0xfa}, {&(0x7f00000021c0)=""/126, 0x7e}, {&(0x7f0000003bc0)=""/4096, 0x1000}, {&(0x7f0000002240)=""/10, 0xa}, {&(0x7f0000002280)=""/249, 0xf9}, {&(0x7f0000002380)=""/93, 0x5d}], 0x7}, 0x2}, {{&(0x7f0000002480)=@generic, 0x80, &(0x7f0000002680)=[{&(0x7f0000002500)=""/82, 0x52}, {&(0x7f0000002580)=""/101, 0x65}, {&(0x7f0000002600)=""/114, 0x72}], 0x3, &(0x7f00000026c0)=""/228, 0xe4}, 0xbc}, {{&(0x7f00000027c0)=@nl=@unspec, 0x80, &(0x7f0000005cc0)=[{&(0x7f0000002840)=""/171, 0xab}, {&(0x7f0000002900)=""/22, 0x16}, {&(0x7f0000006480)=""/4096, 0x1000}, {&(0x7f0000002940)=""/62, 0x3e}, {&(0x7f0000002980)=""/169, 0xa9}, {&(0x7f0000002a40)=""/165, 0xa5}, {&(0x7f0000005bc0)=""/195, 0xc3}, {&(0x7f0000002b00)=""/7, 0x7}], 0x8, &(0x7f0000005d40)=""/188, 0xbc}, 0x101}, {{&(0x7f0000005e00)=@isdn, 0x80, &(0x7f0000002b40)=[{&(0x7f0000005e80)=""/242, 0xf2}], 0x1, &(0x7f0000005f80)=""/194, 0xc2}, 0x8}, {{&(0x7f0000006080)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000006140)=[{&(0x7f0000006100)}], 0x1, &(0x7f0000000000)=""/234, 0xea}, 0x200}], 0x8, 0x10000, 0x0) mkdir(&(0x7f0000d90ff8)='./file0\x00', 0x0) mount(&(0x7f0000000080)=ANY=[], &(0x7f000078eff8)='./file0\x00', &(0x7f0000000100)='mqueue\x00', 0x0, &(0x7f0000653fff)) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getflags(r1, 0xb) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000100)={0xffffffffffffffff}) r3 = syz_open_dev$ndb(&(0x7f0000000240)='/dev/nbd#\x00', 0x0, 0x101) setsockopt$bt_BT_RCVMTU(r2, 0x112, 0xd, &(0x7f00000002c0)=0x9, 0x2) recvmmsg(0xffffffffffffffff, &(0x7f0000004540)=[{{0x0, 0x0, &(0x7f0000000400), 0x0, &(0x7f0000002e00)=""/58, 0x3a}}], 0x1, 0x0, &(0x7f0000004640)={0x0, 0x989680}) r4 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f000088cff6)='/dev/ptmx\x00', 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000600)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r6 = dup2(r4, r5) pwrite64(r5, &(0x7f0000000940)="ee535cdcc7c02f7470391de9d5efcf54844b0e1e99e75ac37954d6218248b1017b90cfb79844a0aab58b9d7f6663e0c2344e3d45696a4ba8d9ec294c3e9d925e231eba13bb7c81005df8288b8fcb0975d4b92b502df41ae3c52c754e45304bfeb271052c5ffe87653769d702310f5a9fd4bc8b1b2f011f590c3afcaf49d94a809722ee5508cb8100bc3749cec47e7cb82cfc79ac4b56fdf73e3cf9f9ece9a670432eccd91aaff6641cc4b71838a0a9d51e38261eb45216bb6f9148ae2dd284675ecf86f9ba1cd88a5e7675ba5733775d71f0459f7f24b6c3b75b4bc0a5059ccc73723631dc3d734e115f581c51f46061cc3587da1918aae88efc73bbe96df3fae871f292ebfdbe81964f2e37b539e49de5bc799bbfe7c5a2457b9d4a278b6d7a5baa14583a43709a8cb4488ead15e9f2c730987d7c7a38303c23451797e582d4d3a040ff2def757f832cd4a82984f81ea6183a2465bf9b0e86029c567f7eb6264f79a96129b23d418cfb53defce6c42526ef57cabdfc0e5c74c65323a41ef0c6f4db921d3c48b643d6ea90356828a94627830914687544eff35259582249f8267a955e27eeefa36b379c73dd5f1d27cec9ec349c5b98892ad44a4846f4029bf8ad06217912f78cd5216d9167db011dedf3584dae31d420d6dc9fed973f8632650e14b9692112f9953a2f2bcdfcd64a494556fbd3a84bd7c15ca67e25cf092922e3f29445a820835b1846791b53957b38dc2858f471a3f53e58b4b8d9aab4cc1c1af7b8feed66f1d3663e652ea94c29db8017c3f2cebc6b5fb87d09a14324be20e86ee1c20426539af9b6f54857ed559d134082f3d0298b98d00a69b71258cae67203f402e595340c48a3ec72454ed23a725d9743498475b695621cd626ade740b6f6a6f00f5ea7c4e81245ba8785e124153121fc8788f08f2f0037ced3fb87cd65e297c490e976a2e71bdee8232cbecde0a5e58b1b09d26897adebb90daa1bda3fce19939be3fec093ab4c7a554fa270b53921507b3250990f1e1cda402682b40fe2ad567ab2d4dc0d266eb216bb3f5e6187c104c01e0937d1332917b7a2468d77113016829fb0f48614bfb6c678df485b0a114998bedbf2ec60f4a6eed7fcda0763211311492d53b5ce6f100c22113e0c5f963723a42aa92fb1fe0a3346189c4db6499f2f420a7dbf10995a96a4868b557049fadaaf0ee1966c72deb64be73e0e06d36df08eab21e7fe411ef0f6f5b0a2eb9eb3e9aa387987e5ee13feb3c92ee487b6d186b91e026addf0caeb0fa0ae714e73236b478ee3e72d2adc9f0959b4c555314febfd0773bc04a86052cc1a2de59f06fc842cf8fca484725d67d9520e4689060f3d584b5f63ea8be79fd2cf42c99799d790aa3f7287e7cff1994515964c48565e99317627839f548502ea6caa3819f616ccbfa1c72e667e90fb0ee1b9f4bfaeb0f3638941d444118835de710f7aacae8baf0cc9843ece5ab4b961718d4e7c8424402594fd5f7dc8d0a80bc4f033551252e7311f0af2a265af963f872053c6c9b7491c3964d95a7ffbe07d8f5df2488af2eb070367233e366864bfc66a7eeab6f21b5d0a26281088c5743283c46667fb4410e5cd03d6a0d8ebd3bd130fa75bea8c1ada7e9eb8ed13985f278e4945a879848ef119d77f747f34efaa2f891d52107849bee2879add7681caf5a66df4474801797796d77d25bbbbb81db28c31d9a1eb92b83940a091f6b7ac3a13c56bddcc4f93b30ee0c180c1b195871285387088a835386f2785cca156767a6a2bc86e44dee689c1a528bb6e278189b7d18ccfdd8700436189e30c4fa2bcbadbc15ed94bc9b9c6cc20eebffd1e3350b8b0de943f4a6fadcd5d308a49b0035bd127c770cdff5791bea41c7b5808f62bc0d4d2e0ac8c05bb0e2d3060547c6ad69ee8a714ca8ad553530b980272369e270b076f225f0d919cfb8a7be3f4fce1440722748f334fb0f650f6871db6779c700c8b27887a0c8d3d3882d146b1e50ee4fc1f6f3d920d304483ad50b6f746de77c4db008f48a9c6996ed8e818ce15d8763584f9674ceb2758a079f40cbb2dcdb133b574c7b4399024997ed6bf43acb2aecd5578cf8d8a96cb32c0258ea4f56a7568f84c22af5209b2b579beb24bacc0353684d4ab93f3f0c41c5655afa9415fd02f2f81f9bd30dbeefd7daad11bc1f39bb79c7093cc62b4f840060e556ab67b0fc8214b65e889220425300b79a79df102928247786bd0f4ae205444ff7be2f619f11e6f1dcf6630cdb9424370015bf362d5f8edc9f7794ba6833c94aff1508a4b8f92a856c5beee5f952750a98ba7140f3786b31eae0e195b203a59d697ae5e53d1569ef9b4747445f4af7450ed5f8261613fe139da613ead472b2537f5482495044fe539f5dc2969a95c08cfb2d8c46ed5b6248a8133b0ca0092161e8133d49ee0b36fb0596749317fc9897cd22f5f51759a1d6f0cc51e5e276f1eafaa1669c5bd74b0625ba765156aebae3926041cf8beaea1c5a63d44228935ed3de63a57f0bf54d6e524ddb1d34bb634cc317336063e2476cafb36a772c67ba2658cd4dfa628e876117f5e1aed39e097050d16f18fd434ff17b47c3c31e5e7b1cc2b3c240488caf2cf21a10863d6a520e556f25c6044ba8cb3fcb5f0f173e2fdb29882e5aa3461c7cb50f8bcac306749e351ad0a660dee6cf3207f85ba7f83e74ec8bef8cdbf151af3681dbbe7b851c5a2869b09307a98c76bf80b0633e9102bcd58e48a433533208dc6df1d4cdb788c7ab35f1ec27dac64b0c3cb307d75415f7b065000d07644d9839813d0ac547b760b1b6377dcc05543a2ff0a5e992806e640f36ea06cdc9d22987b990357e0f9b6d094b9fb65e42db2436f8cece9c3bba2a580057ce0d4be3ee96f6dd6b2fb724dbc53beb08d75b9bb23d04c36524c40c3eff9fe256abcb2eb2b038b5b40f09c3ae6113e82acfca0b8039c162a4dae5e6e3cfa778b59882056af6abe2ef2aaa49afc79ec725a885d7686c3116525ba2b55ca26b5c28c90c6b349e3d8a4ed6f1db319748c1d9c47a4f5932d05f1fcb23ebdb49acdbcd3885853557c4283abeb8bfd8eebb9c18a4f078d86c35dccdc3bfc5141847cb4fb4eeab696d129d9bf752d812c284c475f3b23fd18061186a1896f287dcb3eabae552603296eb12bc5a4c5eaeb221a5f37562a638792b26ef0e6ad510db979b749335f4ef716745053499d56d4a076cf01abbdd7fdf9ba474b830630ab18b84e00b4ca66a81f99f59545cc8a547e44745197f849bf1d2038d6441290cff0275d9141e469158b1a7db51bd6bd951f594f9a04d921f8f022e983b00e4be5fd7b044021ad0314ab012b94385c979540176f4a0729e6fdecaee0b82798e28037d0dc32ae5e429b6375e5b1dceff7863d5dbc00b00790ae808b4a6a69118240ed53334685bdb674f248f22adc4a43caca8b5d9108887008d1b97369929d5828cb0fbd4a5542d7ae28ccc1a2815ce2a733e1ddf9b6da9eb24cc21b4ca172df19ae0df67bc103ee4d10c2bdb708d353792ad5a5b99cc11924a8f46cab488c13b2aa1ae81e4c711ecba54e992742ab50d8a9c3a931e1facb47031da73963756aafb82ab90535cc4b9ddd170722c30f81e40b377bccad197a2a744f166bd6a54791a47f15ea96717ce2d3edcc8c52bb1dab3367041ee684866920eab4a6bc0117b104c0c52c3827719d91f47aca7c66dfe09ef8e0e86ed3f073a097eaef4fda02179bbcf744094512566bc361dc2a7554353fe75e51eb6a8212e799c732f19fdff18562c778b29c32933adbcc3a07a3f7947f6fff2fe73ec1528a1d96a0894b863e4155e5e5b25e37dac600ab1e0d2d99d1143e6a46a7cbc89ac08df27ccdd726095df66d6dbf6923828bf0af8a69558b53a6ccaa3d1fb6971c5201bf70f6c587ed47e7a92d11f01796672c9f5836451afe6c6ca53726daf8e128712ad42394ecd4555dbff71b97919d71dcdc1d67e5a192fcff8af52832e451ae63b89192eb8c4c22b7e5d1f2b142e9dc9f15bb30c1916aac03b66c15f9f80e9441deb33aa4c9d724eab0387d347c9dde703dfe4313d6b727d3c271e90f246b57d93ffdd1ad12f798ecf995b3d47c100c962d30bcda2e815c0f0d8f3c52052f76a39aa6eebb44455c9c799f3555800d2d644fe209ae35fe4ad4fdcc52d49423b6245e7c495389f41083b020ddea526c54b6b1cefd21e1c655b1a0ed0e995c2489a6b9d2b6efadd1a2f17019a5e9662c0fa53ece6bc55d64661af71d744f18a40dd65b199bec9579a6d91330fbd62a8a64452b9bba398f5279a478b1b681f8e94fda9632f58e6ee60e2ab6fa7afd8920aeea13ac30063c20b6325675d1ba4add5f8c287e8f46ff50a0f27a4bf81680f4146c1bc164e565b722c77082920bd5ebdd484a5d4844733b85942203dd33c59e5d2d68205f8a7c729bcd1c9233487c80ba85aaa173aec38ee2e1d8f73d35ac01835ffc030c52911e2e14b9a7ae2efff060230104d6036bd30072faa400b934d81c4330ed610c6677ac61bb5f24bcbea0f8e10b0be4205f39bf100135f3c471261730efdbe3283327edf06c1ef4cd5df2043ea601a9ff387c824df5a93321efc7e7ea83e4470b24edb800425c8427fc4dc6d7d8306e4ab6e2c62e93aab9a7e3537fd91063bc938114e9a609fa6fbc29b5a7fae6b5e74178d1a75e892a10ed5cbeeafbf9a45f8f5f822579705ec642984aada066e183560f9a1723a015dff53cd6ce0f1791d31b9aa51d4b309a028f32d3f6d3dd1187ecd3ac9ecbf58272aaa23c177ca180a36342e0a82acc49ded515ed0f87028cb54c5fd2cf5bc5382ac4e5ed5c97a211861541bf8e6cd6012a22865b653cf08fee999fb3d513e5ab58f117db8f75df31c5676e17d7b6de0f9df9c8c91afaf76b912ae48b625d993993a1599d1135df4f1ebad8870d8181eb451730c9ff562ec088f620cc14e7861ff370de6a88316f62dbd880958c90dc32fc3851666a8291719f8c508189319f78b1043529b215b9e1dea34801b7c4fae67e4dca9977de565ab74588919799c7e6e4c1297d6c59c9e3d6c807cd83474b98c36c12e665a3ceb0940c600273959215482c6fa8f0ec6fd1a6e1ba75b40e411564f89a49ac2a28b37e6994417f307b2b712d1a9718226f984b173e4c51177dab036a93f217aeae960f1149510a5e25464667f6c3d822343292f16c160526d096f275a2457a851632588565e1b109b8cf17ab179bc880fd55745450c17b469678b72dddf424dad3277639a3f3abf9b9bc42629725f6831b56f50e9c7f597ef0cd8210211423bbd652fde149bb68e679bf20f119b428fc593b1319144ee1cd8e354df2613f8d8a35456647ab80078635dcec31116ea99b6ff27e0604fde34591c3346fa52d0bbe219e013edd0712b8faeeaaef73e2ca66b93983eb6d768103b8bcb441b42ebb125a73e30f448a1a78f17ebab334fad0e88815bcb8f91902b6f1163d447a357fc81cdd1b5dc481a348b8fbbc484b1a22bd8ee446ff7d7de8882aeae89ae2c192ffd756d9c3e8e6abda418d9960287ded10520e256f946eca7abdeb89dfb2a3643e03b789a18b8339a53bb08c2e4b71549117e94ef32b832de2a4ba5f4a7e0d6fa59184414801ee8d70c80822596af571c55b768ab8194b1e784298915750a7adf90fd0a255e16cdb1eb61a9167fd7eabc6cc5c673fa0d7283fe7a3e1a64d7ef0188b48d4b2cdea62c679e62765cef1b46dbcfbadd45e8237e696d2d6b5fa2c68a106011c6392665b7d7e25648e", 0x1000, 0xc) writev(r5, &(0x7f00000023c0), 0x1000000000000252) ioctl$VIDIOC_S_PARM(r6, 0xc0cc5616, &(0x7f0000000300)={0x7, @raw_data="eb604f108597371d684fb408eed4adfe3dcabd2c13ba719b217a100573467d8823128d65c81f22c95b98521de4f498099f1b64c2d467a3976348bfa469264ae0bfe97a290b0fee9f27aed863709bc3233a4024b519ccf49856a967ec546613f07ee625b351d8a10e20d33c53eba2b653034a681bf5e2ea005b1590dfa5a9c87e0bf8fd371c103cb23fd4ccc8f3dadfc35e7117e150c59b684697004bbea78669bdf36339b3cb10e83954f7f79e6dd408f9b6351f363db3d12a44c4234c34bac0f07aaf0832ca5e46"}) readahead(r5, 0x800000000, 0x0) eventfd2(0xfff, 0x80001) getsockopt$inet_sctp_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f00000008c0)={0x0, 0x0, 0x3, 0x3f}, &(0x7f0000000900)=0x10) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x10000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) getpgid(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r6, 0x29, 0x22, 0x0, &(0x7f0000000500)) getsockopt$IPT_SO_GET_REVISION_MATCH(r6, 0x0, 0x42, &(0x7f0000000180)={'icmp\x00'}, &(0x7f0000000200)=0x1e) write$binfmt_elf32(r3, 0x0, 0x0) fstat(r0, &(0x7f0000004bc0)) r7 = creat(&(0x7f0000000140)='./file0/bus\x00', 0x0) mq_getsetattr(r7, &(0x7f0000000040)={0x800}, &(0x7f0000000080)) r8 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r8, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:42 executing program 3: syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:42 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd02000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:43 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) eventfd2(0x4, 0x1) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x169000, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:43 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) 14:59:43 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000540)='/dev/cec#\x00', 0x2, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000680)={0x6c, 0x0, &(0x7f00000005c0)=[@enter_looper, @increfs={0x40046304, 0x3}, @release={0x40046306, 0x3}, @reply_sg={0x40486312, {{0x2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, &(0x7f0000000000), &(0x7f0000000580)=[0x78, 0x78, 0x0, 0x0, 0x28, 0x28]}, 0x4}}, @enter_looper, @acquire={0x40046305, 0x2}], 0x1b, 0x0, &(0x7f0000000640)="a001d6440c6d6422874e784ea4b26c43f93e03ca85643d9c877b70"}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000200)={0x0}) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000000)) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f00000004c0)={0x3, 0xa, "5d42fe09a052a665b6fe"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000480)={0xec, 0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="11634840000000000000000001000000000000000000000011000000000000000000000040000000000000001800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="852a646600000000", @ANYRES32=r1, @ANYBLOB="000000000200000000000000852a747001000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000000900000000000000"], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB='p\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="020000000000000001634040000000000000000001000000000000000000000010000000000000000000000048000000000000001800000000000000", @ANYPTR=&(0x7f0000000140)=ANY=[@ANYBLOB="85616466000000000a0000000000000000000000000000002d00000000000000852a747000000000", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000001a00000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB='x\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="046304400400000000634040040000000000000003000000000000000000000011000000000000000000000058000000000000004800000000000000", @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="85616466000000000100000000000000000000000000000030000000000000008561646600000000020000000000000001000000000000001e00000000000000852a6a770b000000", @ANYRES64=r2, @ANYBLOB="0300000000000000"], @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB='H\x00\x00\x00\x00\x00\x00\x00(\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0e630c40010000000100000000000000"], 0x18, 0x0, &(0x7f0000000440)="da48c6a856c3b6dc5b70aade1396b9f08cef0bf250b84682"}) [ 999.049986] binder: undelivered death notification, 0000000000000000 14:59:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:43 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000200)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @ib={0x1b, 0xffffffffffff8ffc, 0x3, {"dfce9e9715ff9fb81b5c2e1fc376a7ef"}, 0x7ff, 0x10000, 0x7f}}}, 0xdb) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/lblc_expiration\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000140)=@assoc_value, &(0x7f0000000180)=0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x106}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000080)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}, {0xa, 0x4e24, 0x63bf, @remote, 0xfffffffffffffc01}, r2, 0xc2d}}, 0x48) sendmsg$nl_netfilter(r1, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2002}, 0xc, &(0x7f00000003c0)={&(0x7f00000002c0)={0x84, 0xb, 0xf, 0x100, 0x70bd27, 0x25dfdbfe, {0x7, 0x0, 0x1}, [@generic="101d43e807f7f5e4ad6d36178a0ca61001d3e5cdbdc2fcb53e73e9faaf1240c6eca1fad1573155430f9f5c9e874a6ce576d6494d3e3f9b91f90112c7129c4dacf09d3086f8405dfc2d26cc40d39d4ae544e705fef15de604e4b510df15dc5886d9b701c5e23df00fa7ccf1f13176"]}, 0x84}, 0x1, 0x0, 0x0, 0x20000000}, 0x24040004) 14:59:43 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) socketpair(0x10, 0x7, 0x47, &(0x7f0000000100)={0xffffffffffffffff}) recvmmsg(r0, &(0x7f00000023c0)=[{{&(0x7f0000000140)=@in6={0xa, 0x0, 0x0, @ipv4={[], [], @broadcast}}, 0x80, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/137, 0x89}, {&(0x7f0000000280)=""/185, 0xb9}], 0x2}, 0x656}, {{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000003c0)=""/59, 0x3b}, {&(0x7f0000000400)=""/253, 0xfd}, {&(0x7f0000000500)=""/25, 0x19}], 0x3}, 0x9}, {{&(0x7f0000000580)=@hci, 0x80, &(0x7f0000000740)=[{&(0x7f0000000600)=""/29, 0x1d}, {&(0x7f0000000640)=""/56, 0x38}, {&(0x7f0000000680)=""/136, 0x88}], 0x3, &(0x7f0000000780)=""/92, 0x5c}, 0x7f}, {{&(0x7f0000000800)=@generic, 0x80, &(0x7f0000000b40)=[{&(0x7f0000000880)=""/180, 0xb4}, {&(0x7f0000000940)=""/192, 0xc0}, {&(0x7f0000000a00)=""/97, 0x61}, {&(0x7f0000000a80)=""/148, 0x94}], 0x4, &(0x7f0000000b80)=""/250, 0xfa}, 0x3}, {{&(0x7f0000000c80)=@vsock, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000d00)=""/35, 0x23}, {&(0x7f0000000d40)=""/17, 0x11}, {&(0x7f0000000d80)=""/72, 0x48}, {&(0x7f0000000e00)=""/243, 0xf3}], 0x4, &(0x7f0000000f40)=""/122, 0x7a}, 0x38}, {{0x0, 0x0, &(0x7f0000002240)=[{&(0x7f0000000fc0)=""/8, 0x8}, {&(0x7f0000001000)=""/27, 0x1b}, {&(0x7f0000001040)=""/4096, 0x1000}, {&(0x7f0000002040)=""/226, 0xe2}, {&(0x7f0000002140)=""/218, 0xda}], 0x5, &(0x7f00000022c0)=""/253, 0xfd}, 0x8}], 0x6, 0x20, &(0x7f0000002540)={0x0, 0x1c9c380}) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:43 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, 0x0}, 0x0) 14:59:43 executing program 3: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0xffffffffffffff7d) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 999.318136] binder: 15374:15375 tried to acquire reference to desc 0, got 1 instead 14:59:43 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe403000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 999.393984] binder: 15374:15376 unknown command 536872576 [ 999.395683] binder: 15374:15388 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:43 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f0000000280)=[{&(0x7f0000000100)=""/87}, {&(0x7f0000000180)=""/249}], 0x1000000000000011, 0x0) 14:59:43 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x1, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x24b, 0x0, 0x0}) ioctl$TCSETAW(r0, 0x5407, &(0x7f0000000040)={0x5, 0x76, 0x380000000000000, 0x6, 0x14, 0xffffffffffffff7f, 0x9, 0x2, 0x0, 0x1}) [ 999.445083] binder: 15374:15376 ioctl c0306201 20008fd0 returned -22 14:59:43 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000140)='/dev/btrfs-control\x00', 0x840, 0x0) ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r1, 0x4008240b, &(0x7f00000001c0)={0x7, 0x70, 0xde, 0x7ff, 0x676, 0x6, 0x0, 0x9, 0x10000, 0x4, 0xf22, 0x3ff, 0x1, 0x100, 0x0, 0x0, 0x5, 0xfffffffffffffffb, 0x2, 0xfffffffffffffffb, 0x8, 0xd4bc, 0xffff, 0xfa6, 0x3, 0x8, 0x10000, 0x4, 0x10001, 0x62, 0x2, 0x5, 0x6, 0x5, 0xfb0, 0xffffffffffff1952, 0x5, 0x5, 0x0, 0x100000000, 0x4, @perf_bp={&(0x7f0000000180), 0x6}, 0x1000, 0x2, 0x4, 0x0, 0x200, 0x339467fd, 0x3}) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000240)={0x8, 0x4}) r2 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x6, 0x2) openat(r2, &(0x7f00000000c0)='./file0\x00', 0xc00, 0x100) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000280)='/dev/rfkill\x00', 0x1019c0, 0x0) bind$bt_sco(r3, &(0x7f0000000000)={0x1f, {0x9, 0xfffffffffffffeff, 0x800, 0x6c, 0x5, 0x9}}, 0x8) socket$caif_stream(0x25, 0x1, 0x3) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000040)=0x1, 0x4) dup3(r0, r3, 0x80000) fsetxattr$trusted_overlay_origin(r1, &(0x7f0000000100)='trusted.overlay.origin\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x3) 14:59:43 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) 14:59:43 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x80086601, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:43 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCRMFF(r0, 0x40044581, &(0x7f0000000040)=0xffffffffffff8000) 14:59:43 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x6, 0x0, 0x8, 0xda, 0x18000000000000}, &(0x7f0000000140)=0x14) ioctl$SIOCAX25DELFWD(r0, 0x89eb, &(0x7f0000000200)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r0, 0x84, 0x6d, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYBLOB="50000000b4a583dc9724c324d3cfacedd454f44bf7382f8dd726f5ae5d58f4dbeb613593df2ae23af5c10014af7bef1481ca0e48abfadc6f734260ee7ad7c28a63aff2e02cf594698af1668e843561839a7b6b5d"], &(0x7f00000002c0)=0x58) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000300)={r2, 0x1253}, 0xc) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r0, 0x84, 0x73, &(0x7f0000000180)={r1, 0x6, 0x30, 0x7, 0x4941}, &(0x7f00000001c0)=0x18) setsockopt$RXRPC_EXCLUSIVE_CONNECTION(r0, 0x110, 0x3) [ 999.745151] binder: 15410:15414 ioctl 80086601 200003c0 returned -22 [ 999.771302] binder: 15410:15414 tried to acquire reference to desc 0, got 1 instead 14:59:43 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x101000, 0x0) setsockopt$IP_VS_SO_SET_DEL(r1, 0x0, 0x484, &(0x7f0000000040)={0x11, @multicast1, 0x4e22, 0x0, 'lblcr\x00', 0x0, 0x3, 0x2f}, 0x2c) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x30, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:43 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr(r0, &(0x7f0000000100)=@random={'security.', '/dev/cec#\x00'}, &(0x7f0000000140)='/dev/cec#\x00', 0xa, 0x2) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0x14, &(0x7f0000000040)=@assoc_value, &(0x7f00000000c0)=0x8) [ 999.807659] binder: 15410:15418 unknown command 536872576 [ 999.833305] binder: 15410:15423 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:43 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) [ 999.900270] binder: 15410:15418 ioctl c0306201 20008fd0 returned -22 14:59:44 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f0000005b80)=[{{&(0x7f0000000040)=@ipx, 0x80, &(0x7f0000000600)=[{&(0x7f00000000c0)=""/80, 0x50}, {&(0x7f0000000140)=""/83, 0x53}, {&(0x7f00000001c0)=""/157, 0x9d}, {&(0x7f0000000380)=""/208, 0xd0}, {&(0x7f0000000280)}, {&(0x7f00000002c0)=""/117, 0x75}, {&(0x7f0000000480)=""/45, 0x2d}, {&(0x7f00000004c0)=""/103, 0x67}, {&(0x7f0000000540)=""/169, 0xa9}], 0x9, &(0x7f00000006c0)=""/227, 0xe3}, 0x2}, {{&(0x7f00000007c0)=@nfc_llcp, 0x80, &(0x7f0000000b80)=[{&(0x7f0000000840)=""/251, 0xfb}, {&(0x7f0000000940)=""/54, 0x36}, {&(0x7f0000000980)=""/80, 0x50}, {&(0x7f0000000a00)=""/70, 0x46}, {&(0x7f0000000a80)=""/216, 0xd8}], 0x5, &(0x7f0000000c00)=""/237, 0xed}, 0x2}, {{&(0x7f0000000d00)=@caif, 0x80, &(0x7f0000000e80)=[{&(0x7f0000000d80)=""/239, 0xef}], 0x1}, 0x3}, {{&(0x7f0000000ec0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @loopback}}}, 0x80, &(0x7f00000010c0)=[{&(0x7f0000000f40)=""/238, 0xee}, {&(0x7f0000001040)=""/59, 0x3b}, {&(0x7f0000001080)=""/24, 0x18}], 0x3, &(0x7f0000001100)=""/109, 0x6d}, 0x5}, {{&(0x7f0000001180), 0x80, &(0x7f00000016c0)=[{&(0x7f0000001200)=""/183, 0xb7}, {&(0x7f00000012c0)=""/40, 0x28}, {&(0x7f0000001300)=""/63, 0x3f}, {&(0x7f0000001340)=""/217, 0xd9}, {&(0x7f0000001440)=""/190, 0xbe}, {&(0x7f0000001500)=""/190, 0xbe}, {&(0x7f00000015c0)=""/196, 0xc4}], 0x7}, 0xffff}, {{&(0x7f0000001740)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000002c80)=[{&(0x7f00000017c0)=""/114, 0x72}, {&(0x7f0000001840)=""/250, 0xfa}, {&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000002940)=""/157, 0x9d}, {&(0x7f0000002a00)=""/121, 0x79}, {&(0x7f0000002a80)=""/72, 0x48}, {&(0x7f0000002b00)=""/176, 0xb0}, {&(0x7f0000002bc0)=""/163, 0xa3}], 0x8, &(0x7f0000002d00)=""/150, 0x96}, 0x8}, {{&(0x7f0000002dc0)=@alg, 0x80, &(0x7f0000004000)=[{&(0x7f0000002e40)=""/19, 0x13}, {&(0x7f0000002e80)=""/113, 0x71}, {&(0x7f0000002f00)=""/97, 0x61}, {&(0x7f0000002f80)=""/4096, 0x1000}, {&(0x7f0000003f80)=""/89, 0x59}], 0x5, &(0x7f0000004080)=""/170, 0xaa}, 0xa000}, {{&(0x7f0000004140)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000005400)=[{&(0x7f00000041c0)=""/204, 0xcc}, {&(0x7f00000042c0)=""/4096, 0x1000}, {&(0x7f00000052c0)=""/89, 0x59}, {&(0x7f0000005340)=""/31, 0x1f}, {&(0x7f0000005380)=""/105, 0x69}], 0x5}, 0x7}, {{&(0x7f0000005480)=@vsock={0x28, 0x0, 0x0, @host}, 0x80, &(0x7f0000005a40)=[{&(0x7f0000005500)=""/81, 0x51}, {&(0x7f0000005580)=""/80, 0x50}, {&(0x7f0000005600)=""/34, 0x22}, {&(0x7f0000005640)=""/92, 0x5c}, {&(0x7f00000056c0)=""/44, 0x2c}, {&(0x7f0000005700)=""/98, 0x62}, {&(0x7f0000005780)=""/187, 0xbb}, {&(0x7f0000005840)=""/224, 0xe0}, {&(0x7f0000005940)=""/174, 0xae}, {&(0x7f0000005a00)=""/32, 0x20}], 0xa, &(0x7f0000005b00)=""/114, 0x72}, 0xffffffff00000000}], 0x9, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1000000000000266, 0x0) write$P9_RFSYNC(r0, &(0x7f0000000000)={0x7, 0x33, 0x1}, 0x7) 14:59:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe602000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x80087601, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:44 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x4000, 0x0) r2 = inotify_add_watch(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x20) inotify_rm_watch(r1, r2) ioctl$VIDIOC_QUERYSTD(r1, 0x8008563f, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:44 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000080)={{{@in=@multicast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@initdev}}, &(0x7f0000000700)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@local}}, &(0x7f00000002c0)=0xe8) r4 = geteuid() r5 = getgid() write$P9_RGETATTR(r0, &(0x7f0000000640)={0xa0, 0x19, 0x2, {0x1901, {0x60675da2c7d979b9, 0x0, 0x2}, 0xe, r4, r5, 0x5, 0x7, 0xfff, 0x40, 0xa7, 0x2, 0xea, 0xffffffff, 0x8, 0x6d, 0x9, 0xffffffffffffff4c, 0x1f, 0x6, 0x3f7}}, 0xa0) r6 = getegid() getgroups(0x1, &(0x7f0000000300)=[0xee01]) r8 = getgid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000340)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) getresgid(&(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)=0x0) lstat(&(0x7f0000000480)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, &(0x7f00000004c0), 0x4) fsetxattr$system_posix_acl(r1, &(0x7f0000000040)='system.posix_acl_access\x00', &(0x7f00000005c0)=ANY=[@ANYBLOB="02000000010004000000000002000600", @ANYRES32=r2, @ANYBLOB="02000100", @ANYRES32=r3, @ANYBLOB="02000500", @ANYRES32=r4, @ANYBLOB="040007000000000008000000", @ANYRES32=r6, @ANYBLOB="08000300", @ANYRES32=r7, @ANYBLOB="08000400", @ANYRES32=r8, @ANYBLOB='\b\x00i1', @ANYRES32=r9, @ANYBLOB="08000100", @ANYRES32=r10, @ANYBLOB="08000200", @ANYRES32=r11, @ANYBLOB="a7ed8000000000002000000000000000"], 0x6c, 0x1) 14:59:44 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)}, 0x0) [ 1000.184647] binder: 15443:15447 ioctl 80087601 200003c0 returned -22 14:59:44 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0xfffffdc8, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x100000000000004a}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf403000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1000.278988] binder: 15443:15447 tried to acquire reference to desc 0, got 1 instead [ 1000.300249] binder: 15443:15457 unknown command 536872576 14:59:44 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1000.339054] binder: 15443:15464 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:44 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x101080, 0x0) [ 1000.394329] binder: 15443:15457 ioctl c0306201 20008fd0 returned -22 [ 1000.434410] binder_release_work: 2 callbacks suppressed 14:59:44 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[]}}, 0x0) [ 1000.434417] binder: undelivered death notification, 0000000000000000 14:59:44 executing program 3: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$DRM_IOCTL_SET_VERSION(r0, 0xc0106407, &(0x7f00000001c0)={0x4, 0x100000002, 0x1f, 0x5}) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r0, 0x84, 0x6e, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0x6, @mcast2, 0x80000000}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @multicast1}, @in6={0xa, 0x4e20, 0x3, @empty, 0xd3}, @in={0x2, 0x4e22, @multicast2}], 0x68) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0xfffffffffffffff9, 0x1000, 0x2, 0x5}) syz_open_dev$cec(&(0x7f0000000200)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) futex(&(0x7f0000000100)=0x2, 0x0, 0x2, &(0x7f0000000140), &(0x7f0000000180), 0x0) 14:59:44 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:44 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x44000, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x7, 0x8, '9P2000.u'}, 0x15) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:44 executing program 0: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000200)={0x6, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}]}) r1 = syz_open_dev$adsp(&(0x7f0000000100)='/dev/adsp#\x00', 0x8, 0x0) ioctl$SG_SET_COMMAND_Q(r1, 0x2271, &(0x7f0000000140)) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x1fd, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0x75}], 0x2ec, 0x0, 0xfffffffffffffcf7}, 0x80000000}], 0x40000000000007f, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r2, &(0x7f0000001b00)=[{&(0x7f0000001940)=""/52, 0x344}, {&(0x7f0000001980)=""/123}, {&(0x7f0000001b40)=""/79, 0xff97}, {&(0x7f0000001a80)=""/112, 0x323}], 0x20b, 0x0) recvmsg$kcm(r0, &(0x7f0000001900)={&(0x7f0000000240)=@hci, 0x80, &(0x7f0000001800)=[{&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/241, 0xf1}, {&(0x7f00000002c0)=""/112, 0x70}, {&(0x7f0000001480)=""/213, 0xd5}, {&(0x7f0000001580)=""/166, 0xa6}, {&(0x7f0000001640)=""/251, 0xfb}, {&(0x7f0000001740)=""/174, 0xae}], 0x7, &(0x7f0000001880)=""/77, 0x4d}, 0x40000000) 14:59:44 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[]}}, 0x0) [ 1000.693223] binder: 15484:15486 tried to acquire reference to desc 0, got 1 instead [ 1000.756173] binder: 15484:15496 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:44 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x86, 0x10000) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f0000000080)={0x1, r0}) [ 1000.798767] binder: 15484:15495 unknown command 536872576 [ 1000.815685] binder: 15484:15495 ioctl c0306201 20008fd0 returned -22 14:59:44 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1000.845777] binder: undelivered death notification, 0000000000000000 14:59:44 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) fallocate(r0, 0x8, 0x6, 0xf26) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x100080000000002, &(0x7f0000000080)={0xffffffffffffffff}, 0x13e, 0x7}}, 0x5f) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0xffffffffffffff19) r2 = socket$inet_dccp(0x2, 0x6, 0x0) ioctl$sock_inet_SIOCGARP(r2, 0x8954, &(0x7f00000000c0)={{0x2, 0x4e20, @multicast1}, {0x306, @random="7cf7c14a572c"}, 0x20, {0x2, 0x4e22, @empty}, 'tunl0\x00'}) 14:59:44 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = getpgid(0xffffffffffffffff) r1 = syz_open_procfs(r0, &(0x7f0000000180)='\x00\x00\x00\x80\x00\x0e\xd8\x84\xf0]\xc0\xa5\xaaQ\xe8$X\x9c\xfb\xa9T\x96RoR=G\x1f\x00\x00\x00*}`Qk\xd5\fiS\x87\xccD\xbbK&\x7f>\x8b\xa2T\x1c\xf6\xdb\xeb%\xfe\xa7\xc0\xc3\xf3I\xf6\x97_#^\xce\xf8\xe7f5\b\xcd~\xf0\xdf\xaa\xe4P0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:45 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = gettid() r1 = syz_open_procfs(r0, &(0x7f0000000340)='net/wireless\x00') setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000100)=0x2, 0x4) syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x9, 0x40) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:45 executing program 3: syz_open_dev$sndctrl(&(0x7f0000000640)='/dev/snd/controlC#\x00', 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) syz_mount_image$msdos(&(0x7f0000000500)='msdos\x00', &(0x7f0000000340)='./file0\x00', 0xe800, 0x1, &(0x7f0000000540)=[{&(0x7f0000000000)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, 0x0) r0 = open(&(0x7f0000000800)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000200)='./bus\x00', 0x141042, 0x0) write$UHID_INPUT(r1, &(0x7f0000000980)={0x8, "7c70ee3800d5ab5f2036f872e0ac57cbd592bca0d671633f50a3102066d6e765f5a64731e3fb8d90d250eda2cc33b60a7ff98074cdc3f1dd1a2df26a381d95974e0925d521c6b48c3dee0d430d398884316091aff6adb6153dc3c92549957d3488efc02d6f6fb172524b095c30c1bd35aae04236bdd42694d613eb54c0b65a338c48dc4c8bad70754fc81d9928e4a1b81f9c77075258a0805b4494867247966b24a023311fd91ef3754b98d3acde6f2ef0617f123c22fccb81c11389fdfa2e21c2365aabfc8916e02151d8643ae21cab7fcbec6142186d3bb57546c106484bc4c28a48da2b75dd82aabe99464558e60cd101f6b65856fabee614d271741a68dd550c8772f06a93cf8e5c0de549c3b75a72f8a590bd50b2af5f64009c969ed7596f0192b0f98b1afac0e8c5f4c653f611b4a71776400a9ae3f18e75f856788c97195749042510735880b9bb0ccb23210832a4f1c6f134d68f8e299837c426e0c9a45d5d2c959446cc363f370c67cd01a063c91254d692fe35abee92fabda4f66d93228c979ebe036c5c2e0028ec76562d67d0919ca28258fec0ed60603142b5c57c4cfb1ea1e892d0fd2f33970142b179c415d6bea344fbcc82d133052e848a885160737c69eb02ca9f544831c8e3ffcf40cb7b415d24795fc8aaeb8e76bec262aea5e28fe5d6495c4b5895a612b1cc2122286add66356f3ecd309f970634f1b09da1507964d35575167317f13c7fd9f11af27ceea86e9a5b3494a27ba98ba38dd1fb72ef2c6163664fd8f7c946935cd4833121f505ff277c03d959d9a12f3389e9eb6701a8b29f72c20c6abb7bd8349dd2e120bdd59dca9f1a2a877f1677b59d7920ddf29b9d94f7c6879b78e31cf1b65b60fe349ef9d4976f46609ee34e33f647aafbf64f6323d18598905f2e73af75661397595b8f9c1e9a4e993946820da5378ca5b363560e95edce316e99bac6e6250efcf1cb58fdcf94c7557c2d7f763a688543462d54b64e178c2e64c6ebba356894973051907fd8de8ba908e822168b171c1707efcd9ac827e64313721876e2ff26ac34e88557a4a0dfde08eda81cf0c1465a89b68429e48966044c767563e1121db48c9b619fd7362afd15ec6aa19b28759d7977be4fbcad0cf8dd5dc5362259bd5cb5089a9d18db969afe1192571f5fcc0c4d6be281d23b9c1f9f32873c058adfa1bf57a3718686957edfd6e4b58aa959541127696d59fb2810d042ced227961eb19a424e4cf45bc6243217bb7561b7ee11f8c0b8f39480343a26f2da5fe79d5e213c01ea47155ffa91e7d7ba0bc8ccb018bd69cfe71dd8565a645d678b404a295397e83ae69dbf8505f6947a836b44823a92861124330fccd4bc4a2e20d9047bd919d82c89623caa87eb09bd584d58f42b35ef55fddc06dfb3957f3f507e5ca9b8b98947cc5bb68846755527ddf32ffa444e1c7a5654d4d377e04a9f22e1069804fdcdb251acb6bd6b32d100feb44286991d779d2b3e2b7f5cc5f8eb3ae166a3b6fb9df11e1867989a6f9b2028e4c73b4d418b51f6e870713cadafddb47a48c9a97283da214f02db3326d42438d9a7db580693ad1887f99d86bb5fafd6d07c2647fc80c2c5a1ed9ea3b95be65ca422080ddefca5b49ccd538f6bc67390f892d9e416f7e835f76dd90edc56256348d20560caeea05c0922cab60dbf0b57ddaaed6ded5a336e01485fd571dc12050461271cee347c31ac245bfee9128630dfcc43b6d88b5ba9937a6f6ab70b7d256784ff72297cfcfd0ffacd09b55fb832bf60f04d87c48c74972b9f18fa178ce4880b025d1c1097ddb929e8f7e02f1c0e03012bec0fa61a49eb1c2a50a45fc0d98b6649de325184006938e421321e8b366649d9b6ebadf77509c9d48844e80f7752fd7daaa5c938b946feaaac0d871203270a747035c7e2f697c84e792a55cbce76c0a25360f7acbeaab60627aa9c37064af75b67f46732844eb2f6b37226004afe451a9fbfbbcf7e72ade67b017e9209b5627fbe16789abd90326751a1fd1d93efc59f2650f979ba71938d784064922bee2874c4b76d5f26e39ea0a98cf175950137feff9456c88c6a295830183fae3a9c2312c25f3d81708d73488d15a587e7e7cdde3b77917eef29c8b5965c916a65c3c5a53b7313c3115d0a8bb4e16f6b80ff6f78adb756aba94ced86047562a2cd2fb25e9a4656f6359c3f2fde8b5ab38852853cbd7221cb4d59b7f0e79bd37f9ade073f62b75edbe63c13c0d02bf076d88f5b750ea640aad47ce97d6a0783398dd3fbb63734ed969470cf45200235650532224fc28caf1e36ca6b402ec4c978add40fc59f2113485875682139f8aa9aeb48d09178de919370b0cd0ebcab5e60e1b0a2fc153db0dae8e50b48561622a677d0f1afc149676f832e016e14007fb298dcb96f11a92a1ac8bd4cc7b34d659d6cd2c9817b586585e72080255b083bc84512277ffb7f561c6a7a08cd128bfe9b525da531f0bf04f11d3de102b3538835807ac0b2f4325fc6765d02d692ec82f5b338c8257029136fcd3427c09874ecc7492becdd6608eac4adf1abc3f7e08868a72e57ce4dcfc288a25af73d19f1118a9254963c1548cdca5fc7c921a7f218f8e71edd7969dfb35beae1091d7530e32236397fa9fcd232b441ff1b0177829468c198d659d247ccca4fbd58c625501e4368075d0e5e69a6f90952f5bbe48e85a303131dedf7f1a513b291598a545784e1013521877c25d6069d3a855652a4bad5b2df2e4da2de756a20e790b756dd2925ce824561e5892b5e064c7c7b996acc4e29597e0cd00956e9c57ec374714f846be7632d3075e38bead499163498810886c78a2cc73fb64fd48e186083ce911e0751b4dc63476859c2824fa532a4b1711c244619e702eeab19380aeb7b17f67fade3dcad8ddddd893a526cd5d04d8ae982c88029ec71bdd0772fd74adbdb378fc204ca411a2d8a50331516a28552be78f9725f32d1b3a6c7bdf3277c5f7e385c7ebbacc419ec7ca3c5b8f46dbefee59b6422a6b22d60527edc012f852077d925619874f7709f283e01678fed36528003a696ee431a817f34f453c143dc56b70e1f810a5380a555cc8c4fc6522ab544ce5d715caa302ebdd0aa8286b7ef5dd6dd48a8ad9566818f7509daf02db0b98b432f57f1d107ee95a86228728cab4062e27922381e1e2ee351af5e2ea0fd6d1cea70b3b8f4a50f0776fc9aa2a7d2dff6e1ea3769864104f09137b99960b69af13895d842649eacaed8ddf183beba3323640af8deb52b902c0974d685d19fc87c93eb80ad5d28e54363705ad39231d989522e94f000256bc8d93af138a45d67dad3e21fa9fb31d9327c6e71f61956d9daf4f97333112704136d3d1bf6fe0e4c002e10b684d2344300ec70fae0b50532ebace58f0e8318354a172cceacf27d01ff41cc8fef42443f62b0e15b5fcc0728630b96fb2c2b59634f4993bb1ce2eace6fb0f53e5f84bc5f58b1b66d59e3c75a98670496f105a703607211aa9e882e72f13e9fe07f0767ad4e5ac5c732b65301d8ceab36b5ff2f71958fb1b51d2e703ac506e68d4026160fd3f60440b8b8f554f1feeba5d53f71cbe60d143620f8fa779acb94c965b729207a5ab11f4a51b694c31606171da44a28d80cde296dff5724ff718d6377eb8534e616cff39af943ee4ce87b4fadded30c702d370a71072ab3e20f19b8c1b73fdbbb9c675352bb73ee85e22597fc0c439a33f5febe1629bd084af7193f8d1a1415b02ca54706711505cbae11ec6411b012cc3a3eddcfb002901b6e7565b9fbf4d605c147031888ceb590c14697d00970ce9095c6f7fee41ec6a15d7ef52dfedfff2a0d3dbb387b61232aee6ca202787038021e6aabda18e2adf6fd89aa491e65f9813d73412fbfff089752d713d7efa690ec4fc254b56908d3057f65997acf81aea589e272f8fa852849e488f1e0c0cb6cdb5f46ca92e36d39224e704850056d2e9b91909aed0f55d054e274415ecc39b8958335a14cfb0a42d7f26ef8e82592dfd03b3550b5193fba077994c682951968869574fd94976760d9bd9b334353eeda836cc8dab244e72095cc46833f02bb2f6df35601b3085664261abb67fc9ab9f27210e6827cd15ce16c55f0f7f5b8ab401f24032b19a53a9299b62ebf4a8cf7f4753d95126f008a8ce349036666de66bcaf40b27fa875efa98873e1ef9302e2a24bfe07bd1054bdf9ba9ad1b1075402f26d682833b947c762513ba5f07537bb712473184a60e04ace5adb8d982d6153b011ae0b2034adc0ff4a64e2c6561c2e0840cdab2120bc916cde9b7a92c4d332d0f83945fe55e3c8f4d93f22e7759c20241d92cca0ae5a3d06a127e5614df708cea1ad3b2f231c81460ff4c3f349c67a87135a4b67589ffce311832923f71796276e81f0537e265404c0ee06d5ed98a5ec5f8ad62db589eb585fc4627173b51fd4e897a3e8d2acbb82ec2996ac3a6823368a1e12a0536a9d1a7b2d31d80c46c292ff51395481d4f65c53fab867e27bec9156ee189d245d94877a1405dc9e1e996822ad47071a9ab36c9bfd02c41ea5ba21591793053b1b64758bae0addfcd69d169849bc1ee6ce5c08f0d3da5ecc1b6ab31e13af2fa5ce4d921163270901264a88ac6350e8fb6371663dd04146932238597258b123a8036250c190fbb3cfc6ebbf9e06c4a9053e8332c95c91a890a3d35ddd35f47e7ab606f3e345e12560e6d52243883da7b8910834042ad12e7fb3f08a0b14ef6aee22251999e6079be2ef5666d7d5ae00d161720262761da3f378c63cb151f4e94d034e9de949dfe796b905804ca555691023c30ea7cf0cb276e1e3ba65793291f8287d1064606bf5787421b9b9bfc05e9c5eac750de92519fe9e2592cd34a2ef6ec18efed5e7c13bfcfce47327cbecac358bbe6d44164849308cf91cd5ea87fa4b02ba4939e28141c7dad42714b019470d91808a8f46150677b6c90f267ecb39ef42afc95de0cbd016775c89d8213ec9d4e061e6493f237296f91abfc64176c0e885ef54af4136a724fadfe89a25d7599998acebc4a27f8fb5b26936bda5c3d5fec3373dcd9a0e99fc939641c50669adc54119582e8835575d1c57fa955cd29d870360620f91c3ff90d264013816352317ae226f7d7bad5db711f8973382f6cebd63cd519ddd08e1772649be75f64f4acc15f828dc0b305584b6dd2213194603c44e2964358d305aa97fb08568a0a955ad7a6f8d042754b4bbf2fb3414052719fd9841bef8360d1d3195c69414be882115c2c64fecdcbdaed3a2e943fdfef9a13520e41d32a787bcfe4f61e2b378d35aa70784a772cf8ebcaaeb105e4627516db2ababfcb8c11f224c3a48c86160d34d0ee59f02c31648ae4b0309b378f0bf63266967dcfb4f1cc1902f613c6d0d48915a9cf28a52b106544cde1b38ff2e2a1275fd0d3899ce7f7c6653c9017f7ac4aaa35bcb2811a8f9dbb56746b45475350e7c13d42abb5692377da7a4045ee644ce00f8699e3251d75621c82cd659ea3add277affe3ff792f7d24a3d0979ef82cfc0d409697ae2e8598854a8327f46974c901d309dc6dbe31913c59d821aa50c0fe95cc822e8f07bbb00e9a09bc9a570b9778d29308740bc336a41258d209c206f87a709aa43415da0096f7d177e509a7d625645fb098ccc45367d82235e952670ac5f82f8ced3f59fd9ee20ac75be609cc832417e807ddc40630cba4c91e0785edcb5f20b9e6dedb1ec172cd16fc034f410e9ce375ea855144aa3076317f649cf4efe4d7abf244984c4e", 0xff54}, 0x1006) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f00000000c0), 0x8080ffffff10) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x0, 0x0, 0x0) mincore(&(0x7f0000ffe000/0x2000)=nil, 0x2000, &(0x7f0000000580)=""/46) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$VIDIOC_TRY_EXT_CTRLS(r2, 0xc0205649, &(0x7f0000000140)={0x9f0004, 0x8, 0x401, [], &(0x7f0000000100)={0x980903, 0xc3, [], @string=&(0x7f00000000c0)=0x8}}) r3 = syz_open_dev$binder(0x0, 0x0, 0x2) ioctl$BINDER_WRITE_READ(r3, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$security_capability(r2, &(0x7f0000000040)='security.capability\x00', &(0x7f0000000080)=@v1={0x1000000, [{0x4, 0x10000}]}, 0xc, 0x3) 14:59:45 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB]}}, 0x0) [ 1001.567811] binder: 15553:15554 tried to acquire reference to desc 0, got 1 instead [ 1001.590654] binder: 15553:15554 unknown command 536872576 14:59:45 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1001.616273] binder: 15553:15554 ioctl c0306201 20008fd0 returned -22 14:59:45 executing program 0: r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x602, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000180)=0xc) ioctl$KVM_GET_PIT2(r0, 0x8070ae9f, &(0x7f0000000380)) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r0, 0xc1105511, &(0x7f0000000200)={{0x8, 0x7, 0xb2e0, 0x0, '\x00', 0x1}, 0x1, 0x10000000, 0x0, r1, 0x3, 0x200, 'syz1\x00', &(0x7f00000001c0)=['net/wireless\x00', 'net/wireless\x00', 'net/wireless\x00'], 0x27, [], [0x3, 0x400, 0xb90, 0x9]}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r2, &(0x7f00000017c0), 0x1d0, 0x0) [ 1001.689004] binder: 15553:15570 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:45 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB]}}, 0x0) [ 1001.784748] binder: undelivered death notification, 0000000000000000 14:59:45 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000200)='/dev/vfio/vfio\x00', 0x101000, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e20, 0x7, @mcast1, 0x2f}, @in={0x2, 0x4e23, @loopback}], 0x2c) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r2 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x10400, 0x0) ioctl$EVIOCGKEY(r2, 0x80404518, &(0x7f0000000080)=""/51) ioctl$IMDELTIMER(r2, 0x80044941, &(0x7f00000000c0)) 14:59:45 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') bind(r0, &(0x7f0000000100)=@pppol2tpin6={0x18, 0x1, {0x0, r0, 0x0, 0x4, 0x2, 0x3, {0xa, 0x4e24, 0x0, @mcast2}}}, 0x80) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000180)=0x5) 14:59:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1002.096827] binder: 15592:15596 tried to acquire reference to desc 0, got 1 instead [ 1002.136431] binder: 15592:15601 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1002.137309] binder: 15592:15598 unknown command 536872576 14:59:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe800000"], 0x4c}}, 0x0) 14:59:46 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @ib={0x1b, 0x0, 0x8, {"61e5f002cd6fa94b6676ce698320339b"}, 0xced5, 0x8, 0x3}}}, 0x8b) 14:59:46 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000540)={0x0, @in={{0x2, 0x4e20, @empty}}, 0x5, 0x0, 0x1000, 0x3, 0x4}, &(0x7f0000000600)=0x98) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000640)={0x4, 0x200, 0x71b, 0x5, r1}, 0x10) mq_timedsend(r0, &(0x7f0000000100)="5e6222514350170e277633f7b7c476acae945ca7eabb79755b99232c597eeab5fb3d8a00feca63e28b0e1e7960e5bc36dfec6d23a6df525cf8cd4323d690c3fbcf00af0b066a4a6d79a0500c18fc", 0x4e, 0x7f, &(0x7f0000000180)={0x77359400}) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000380)={{{@in=@initdev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@mcast2}}, &(0x7f0000000480)=0xe8) ioctl$EVIOCGABS3F(r0, 0x8018457f, &(0x7f0000000680)=""/86) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1f, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x9}, [@generic={0x2, 0x71, 0x3, 0x40, 0x6ad1}]}, &(0x7f0000000200)='GPL\x00', 0x2, 0xfc, &(0x7f0000000240)=""/252, 0x41f00, 0x1, [], r2, 0x8}, 0x48) ioctl$SG_GET_TIMEOUT(r0, 0x2202, 0x0) [ 1002.260603] binder: 15592:15598 ioctl c0306201 20008fd0 returned -22 [ 1002.308898] binder: undelivered death notification, 0000000000000000 14:59:46 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) fallocate(r0, 0x31, 0x4, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:46 executing program 5: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x200, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x0, 0xf}}, 0x20) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000880)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x5, &(0x7f0000000180)={0xffffffffffffffff}, 0x117, 0xb}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000200), 0x13f, 0x9}}, 0x20) sendmsg$unix(r0, &(0x7f0000000700)={&(0x7f00000002c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000006c0)=[{&(0x7f0000000340)="5a961092320a8628d3bbf24456be9333c22c1ffc08a843d6d2ee443af676bb2649b5a48b581b123c8c4d8ff231d174fdb7d3ebd4a0d32fbfc5cee66717de5b88b6668a355aeebd433feb06b42569b65707c35fba4d4c816a0a443fa3751d41c71365bf458344a4139a352075a1976044e169d4477c9fa10c517eaa8ffa3ed03b647c4781ed24b779331c2cc7145bcc71dad21b3cc0e1ed878e5fc89d1bc4655553d0cb99f8e4cd9950c2120f67ebcb59121541b837c3b31b746c20eed016ceb7336ef5053681a373cddef133b9607bde0f3d30be23c3f1e13e7c6318", 0xdc}, {&(0x7f0000000440)="4a880e1ea2c23da513438a40353421756d58651c2b467bc70a4d78e9b3d4fa6d69aa2ab2bed2342aceaa4c0009f8de91fb9f1e5769e53dc2c55403e8205dc4dddebe450c6267", 0x46}, {&(0x7f00000004c0)="2c2fdcadc725d535ce731757e45ae1bfa3f8bc8bdd55436dd0adfec6b3fc8f85d2aca561ed0c24651283d7ef3806cab7ec2c1570150a59b924766cab21c41bebee2b77dbe3445b9d47d0507b84f8aec69d32ce8b983b518619eb46895f4830a0a468483930b0710907fa46c68d8c3ee999e1ccc11c286fff7d055b29b5a8785474cef19ab6b16c9869315e06df48af3e8888ad0220f669722b90f4a0c499a75814fc42841242394ba017604f5c084fc6f669e761f8e5d306fee4dc32814fac42e765", 0xc2}, {&(0x7f00000005c0)="4f602c291c6f532cdec03f6f4c23f9a28bb9f66432b3d6a3cd4c2fe419e68472738651eaaf2d6002be9333b8f7d3805cf7b9653c8e0af0f114f4f24aaafae7a073aa4394405c9691a541e00d2efb0e68303125cf420d3106a2916e2479f72938670c36828ccd76d125d76301a566118898e87efb221609fabe2e9d72de716b2ea93e1ce544737554649aedda32656d529e6aa552ec5ba99697353b132d25ff5c0c38085a04bfe65d8f07f66e8acf5f188b382770912fa1b44ad07dd5a095f22ad28076c2ddc0a97536128398b47267b7f7787ffd2976e24b845c4974a9fd4f9a803b4bdbffd8713f66a5f8d7bf8c3dc2e37e9dc8e7984d74148283e3", 0xfc}], 0x4, 0x0, 0x0, 0x20004800}, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000080)={0x14, 0x88, 0xfa00, {r2, 0x10, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:46 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:46 executing program 0: r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cachefiles\x00', 0x0, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000300)) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vga_arbiter\x00', 0x400, 0x0) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0xf) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$rose(r2, 0x104, 0x7, &(0x7f0000000200), &(0x7f0000000240)=0x4) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r3, &(0x7f00000017c0), 0x1d0, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r3, 0x0, 0x483, &(0x7f0000000100), &(0x7f0000000180)=0x68) 14:59:46 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe800000"], 0x4c}}, 0x0) [ 1002.745913] binder: 15622 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 1002.745931] binder: 15622:15627 ioctl c018620c 200003c0 returned -22 14:59:46 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) fsetxattr$trusted_overlay_origin(r0, &(0x7f00000000c0)='trusted.overlay.origin\x00', &(0x7f0000000000)='y\x00', 0xfffffffffffffd81, 0x3) r1 = dup2(r0, r0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_GET(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f00000003c0)={0x20c, r2, 0x120, 0x70bd2a, 0x25dfdbfb, {}, [@TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xf5}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}]}, @TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x401}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffff}]}, @TIPC_NLA_NODE={0x34, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x80000001}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffffffffffe0}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}]}, @TIPC_NLA_SOCK={0x3c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1f}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x404}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_LINK={0x1c, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_BEARER={0x11c, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x6200, @remote, 0x40}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x3, @remote, 0x9bc}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz1\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x1f, @mcast1, 0xff}}, {0x14, 0x2, @in={0x2, 0x4e20, @empty}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @multicast2}}, {0x14, 0x2, @in={0x2, 0x4e23, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_NAME={0xc, 0x1, @l2={'ib', 0x3a, 'yam0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'ip6erspan0\x00'}}]}, @TIPC_NLA_MEDIA={0x4}]}, 0x20c}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) 14:59:46 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe800000"], 0x4c}}, 0x0) 14:59:46 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x200000, 0x0) openat$cgroup_ro(r0, &(0x7f0000000240)='cpuacciLu<\x91\x8e\x89\xc8\x1a{\xd0\xbd.usage_percpu_user\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:46 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000300)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) stat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) preadv(r0, &(0x7f00000004c0)=[{&(0x7f0000000340)=""/183, 0xb7}, {&(0x7f0000000000)=""/16, 0x10}, {&(0x7f00000002c0)}, {&(0x7f0000000400)=""/176, 0xb0}], 0x4, 0x0) fchown(r0, r1, r2) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f00000001c0)={0x6, 0x2719, 0x7, 0x0, 0x0, [{r3, 0x0, 0x3}, {r3, 0x0, 0x80}, {r0, 0x0, 0x9}, {r0, 0x0, 0x8000}, {r0, 0x0, 0x7149}, {r0, 0x0, 0x2}, {r0, 0x0, 0x8}]}) ioctl$BINDER_WRITE_READ(r3, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1002.866476] binder: 15622:15627 unknown command 536872576 [ 1002.902934] binder: 15622:15644 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1002.953998] binder: 15622:15627 ioctl c0306201 20008fd0 returned -22 [ 1002.988811] binder: undelivered death notification, 0000000000000000 14:59:47 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d000000000500"], 0x72}}, 0x0) 14:59:47 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f0000000280)=[{&(0x7f0000000100)=""/166, 0xa6}, {&(0x7f00000001c0)=""/156, 0x9c}, {&(0x7f0000000380)=""/4096, 0x970}], 0x3, 0x0) 14:59:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:47 executing program 3: r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000540)='/dev/sequencer\x00', 0x3, 0x0) getsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffff9c, 0x84, 0x77, &(0x7f0000000580)={0x0, 0x537, 0x6, [0x6, 0x9, 0x1, 0x1, 0x80, 0xffffffff]}, &(0x7f00000005c0)=0x14) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r0, 0x84, 0x1a, &(0x7f0000000600)={r1, 0xea, "73d9fc1e8b72e1302d3b2471169095d0178b8725e7f37965dbd2981cb344e9bb7f881d1bb35641c0c54f28ec019fdbd36cb7a1ce8a9194269d4fc921e60c7209f7b9769c4e8d9915d7e1166c8318f7075d6f346dbab66e9c715a16d3fb8db921f911533a9323e3659fede59dab60052b950e28ec5b0c3a20f29d0fd73f63a8b5335a53d975728d37892b0d57a1e7977c69abe1a4bfa5456c06a6083ae92e01514e3d20c9549d2d0e3182fcd8f55b3c6afd286320fe78ea69cbe113d2c17137a4cfa66bf20fc9ed52ec9a88834a6746093d71f4247f61681b8b991446f7c4c03827bcf907ced02acd4780"}, &(0x7f0000000700)=0xf2) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) fcntl$notify(r2, 0x402, 0x2) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:47 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x110], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:47 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x207, 0x0, 0x0}) ioctl$sock_rose_SIOCDELRT(r0, 0x890c, &(0x7f00000000c0)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x7, @bcast, @rose={'rose', 0x0}, 0x0, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) r1 = gettid() ptrace$getenv(0x4201, r1, 0x6, &(0x7f0000000140)) openat$uhid(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uhid\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS(r0, 0x80605414, &(0x7f0000000040)=""/17) [ 1003.245258] binder_thread_write: 1 callbacks suppressed [ 1003.245312] binder: 15667:15669 tried to acquire reference to desc 0, got 1 instead 14:59:47 executing program 0: r0 = socket$inet_smc(0x2b, 0x1, 0x0) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'L+', 0x7}, 0x28, 0x2) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) [ 1003.308500] binder: 15667:15676 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1003.319033] binder: 15667:15675 unknown command 536872576 [ 1003.325836] binder: 15667:15675 ioctl c0306201 20008fd0 returned -22 [ 1003.335889] binder: undelivered death notification, 0000000000000000 14:59:47 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x200200, 0x0) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000040)=0xffffffffffffffff) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x1c, 0x0, @ib={0x1b, 0x6, 0x800, {"b5e0a9a72a5b6809bb9996ff842ce169"}, 0x7, 0x2, 0xffffffffa22392f7}}}, 0x90) r2 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x5, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f0000000100)={0x0, 0x9, 0x3, 0x240000000000000}, &(0x7f0000000200)=0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={r3, 0x2c, &(0x7f0000000240)=[@in={0x2, 0x4e22, @local}, @in6={0xa, 0x4e23, 0x9, @mcast1, 0x4}]}, &(0x7f00000002c0)=0x10) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f0000000300)={0x0, 'bridge_slave_1\x00', 0x2}, 0x18) 14:59:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:47 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d000000000500"], 0x72}}, 0x0) 14:59:47 executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="74180000", @ANYRES16=r1, @ANYBLOB="020028bd7000fbdbdf250a0000003000060004000200080001007f0000000400020004000200080001000200000004000200040002000400020004000200200002000400040008000100018000000800020007000000080002007b080000e40005003c0002000800040000000000080001000e000000080001000e000000080003000800000008000100020000000800030009000000080002000800000008000100657468000c000200080002000700000008000100756470000800010069620000080001007564700008000100696200003c000200080002000400000008000200000800000800020006000000080004007f00000008000400060000000800030057340000080001000900000034000200080003000200000008000100130000000800010017000000080001001d0000000800010019000000080003008986a92c2c0007000c0003000100010000000000080002000900000008000200b1d400000c0003000101000000000000ec0001002c0004001400010002004e24ac1414bb00000000000000001400020002004e24e000000100000000000000003400020008000400020000000800030008000000080001000200000008000300db000000080001001000000008000400000000002c0002000800010007000000080004000500000008000200ffff0000080002000000000008000400070000002c0004001400010002004e21ac1414bb00000000000000001400020002004e2300000000000000000000000014000200080003000000000008000300000000001c0002000800020001000080080002000010000008000300010100000c00090008000200a60c00001800070008000200ff0300000c000400f605000000000000900004001400010062726f6164636173742d6c696e6b00003400070008000300010000000800010019000000080004000000000008000200000000010800020003000000080002002d0000000c00010073797a30000000000c00010073797a31000000000c00010073797a31000000001400010062726f6164636173742d6c696e6b00000c00010073797a31000000002c0007000c000400000400000000000008000200ffffff7f08000100080000000c0003000600000000000000340001002400020008000300c50000000800020001000000080002000100010008000400030000000c0002000800020080000000"], 0x374}, 0x1, 0x0, 0x0, 0x24044040}, 0x8000) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x507141, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000180)=[@window={0x3, 0xb46, 0x1}, @mss={0x2, 0x9}, @sack_perm, @sack_perm, @sack_perm, @sack_perm], 0x6) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x2, 0x0) recvmmsg(r3, &(0x7f0000000100), 0x1, 0x0, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r4, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:47 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000040)={0x200, 0x7}) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SIOCRSGCAUSE(r0, 0x89e0, &(0x7f0000000080)) [ 1003.572245] binder: 15694:15696 tried to acquire reference to desc 0, got 1 instead [ 1003.616484] binder: 15694:15699 unknown command 536872576 14:59:47 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d000000000500"], 0x72}}, 0x0) [ 1003.662617] binder: 15694:15699 ioctl c0306201 20008fd0 returned -22 [ 1003.663307] binder: 15694:15708 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:47 executing program 5: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x3, 0x100) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000040)={0x0, 0x0}) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x3, r1}) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:47 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x135, 0x0, 0x0}) 14:59:47 executing program 0: r0 = socket$inet(0x2, 0x200000002, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4004e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @remote}, 0x10) syz_emit_ethernet(0x3f6, &(0x7f0000000000)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414bb, @multicast1}, @udp={0x4e21, 0x4e21, 0x8}}}}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000100)=""/245, 0xf5}, {&(0x7f0000000200)=""/209, 0xd1}], 0x1, 0x0) [ 1003.773892] binder: undelivered death notification, 0000000000000000 14:59:47 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27b], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:47 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x1000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:48 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) r0 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket$inet_icmp_raw(0x2, 0x3, 0x1) 14:59:48 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000"], 0x85}}, 0x0) [ 1003.966333] binder: 15728:15729 tried to acquire reference to desc 0, got 1 instead 14:59:48 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) 14:59:48 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f0000000100), 0x0, 0x0) [ 1004.029790] binder: 15728:15734 unknown command 536872576 [ 1004.081102] binder: 15728:15734 ioctl c0306201 20008fd0 returned -22 14:59:48 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000040)={0xffffffffffffff4c, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1004.132483] binder: undelivered death notification, 0000000000000000 14:59:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0xfdfdffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:48 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000"], 0x85}}, 0x0) 14:59:48 executing program 5: prctl$PR_SET_FPEMU(0xa, 0x3) pipe(&(0x7f0000000100)={0xffffffffffffffff}) fstat(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SIOCAX25ADDUID(r0, 0x89e1, &(0x7f00000001c0)={0x3, @null, r1}) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f0000000040)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3b, 0x0, @in={0x2, 0x4e22, @rand_addr=0x2}}}, 0x133) 14:59:48 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$sg(&(0x7f0000000180)='/dev/sg#\x00', 0x1, 0x800) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000001c0)) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$GIO_SCRNMAP(r1, 0x4b40, &(0x7f0000000100)=""/65) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) [ 1004.329352] binder: 15756:15757 tried to acquire reference to desc 0, got 1 instead 14:59:48 executing program 3: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20ncci\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r0, 0xc0145401, &(0x7f0000000080)={0x0, 0x3, 0x10000}) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1004.407805] binder: 15756:15765 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1004.431823] binder: 15756:15764 unknown command 536872576 [ 1004.445013] binder: 15756:15764 ioctl c0306201 20008fd0 returned -22 14:59:48 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2cd], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:48 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000"], 0x85}}, 0x0) [ 1004.493190] binder: undelivered death notification, 0000000000000000 14:59:48 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) r1 = accept(r0, &(0x7f0000000100)=@ethernet={0x0, @link_local}, &(0x7f0000000180)=0x80) getsockopt$netrom_NETROM_N2(r1, 0x103, 0x3, &(0x7f0000000300)=0x200, &(0x7f0000000380)=0x4) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000001c0)={{{@in6=@empty, @in6=@mcast1}}, {{@in=@multicast1}, 0x0, @in=@empty}}, &(0x7f00000002c0)=0xe8) 14:59:48 executing program 5: write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:48 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0xfffffdfd, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:48 executing program 3: pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f00000000c0)={0xe4, 0x6, 0x7, 0x1, 0x6668}, 0x14) accept(r1, &(0x7f0000000140)=@nfc, &(0x7f00000001c0)=0x80) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SCSI_IOCTL_PROBE_HOST(r0, 0x5385, &(0x7f0000000200)={0x1000, ""/4096}) openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000100)='/proc/capi/capi20\x00', 0x2, 0x0) 14:59:48 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000"], 0x8f}}, 0x0) 14:59:48 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000200)='/dev/radio#\x00', 0x0, 0x2) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000280)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DEST(r1, &(0x7f0000000300)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80002000}, 0xc, &(0x7f00000002c0)={&(0x7f00000008c0)={0x118, r2, 0x400, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x24, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_DEST={0x6c, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x6}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x100000000}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xb8}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x8}]}, @IPVS_CMD_ATTR_DAEMON={0x14, 0x3, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0xfffffffffffffffb}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e21}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x3d6}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x10}}]}]}, 0x118}, 0x1, 0x0, 0x0, 0x24000004}, 0x41) r3 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x1, 0x2) ioctl$VIDIOC_G_FBUF(r3, 0x8030560a, &(0x7f00000000c0)={0x2, 0x10, &(0x7f0000000040)="d557783a1a8d006cd89ada2640763d292fa79c7b54b111e0f058ae9c180679771f197d006f3436d7cc2d5fa762b8673b60c68316c3ff21a2dc33525787e208ef07af00b19ae85d62d42fd9f0e75ffb6dca6206defbfd0b1852fa9b", {0xffff, 0x13a, 0x7776724f, 0x4, 0x80000001, 0x2, 0x6}}) r4 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x4, 0x2000) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r4, 0xc4c85512, &(0x7f00000003c0)={{0x3, 0x0, 0x1, 0x1, '\x00', 0x8}, 0x1, [0x2b80, 0x7, 0x1, 0x3ff, 0x7, 0x0, 0x3, 0x6, 0x7fff, 0x8, 0x5, 0x7, 0x1106e630, 0x8, 0x3, 0x4b00, 0x1, 0x1, 0xf39b, 0x4, 0x1f, 0x4, 0x9, 0x68, 0x5, 0x80000000, 0x3, 0x6, 0x1, 0x3, 0x40, 0x7, 0xdc8, 0x8000, 0x4, 0x400, 0xffffffff, 0x9, 0x100, 0x2, 0x8, 0x3, 0x30000000000000, 0x0, 0x7, 0x7, 0x20, 0x2, 0x3, 0xf4f8, 0x100000000000, 0xffff, 0xf8, 0x3, 0x8001, 0x26f6, 0x401, 0xffff, 0x8b0, 0x3, 0x200, 0x9, 0x81, 0x8, 0x8, 0x400, 0x7fff, 0xfffffffffffffffb, 0x4, 0x9, 0x3, 0xffffffff, 0x2, 0x5, 0x4, 0x8, 0x3, 0x7, 0xe0, 0x3ff, 0xf8, 0x5, 0x6, 0x9, 0x8, 0x4, 0xfffffffffffffffd, 0xffffffffffffffff, 0x2, 0x6, 0x8b, 0xf5, 0x6, 0x1ff, 0xffffffffffffffff, 0x4, 0x7fffffff, 0x6, 0x6, 0x2, 0x1f, 0x44fc, 0x2, 0x1, 0x4, 0x5, 0x0, 0x3ff, 0x1, 0x99, 0x0, 0x9, 0x3, 0x100, 0x5, 0x2, 0x3ff, 0x1, 0x80000001, 0x1, 0x4, 0x8001, 0x61ad, 0xfffffffffffffffc, 0x5, 0xa43, 0x4, 0x3], {0x77359400}}) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1004.771638] binder: 15786:15787 tried to acquire reference to desc 0, got 1 instead 14:59:48 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$KVM_SET_FPU(r0, 0x41a0ae8d, &(0x7f0000000100)={[], 0x5, 0x100000000, 0x9, 0x0, 0x4, 0x4000, 0x0, [], 0x10000}) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) [ 1004.832996] binder: 15786:15798 unknown command 536872576 14:59:48 executing program 3: r0 = syz_open_dev$radio(&(0x7f0000000500)='/dev/radio#\x00', 0x0, 0x2) ioctl$UFFDIO_WAKE(r0, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ffe000/0x2000)=nil, 0x2000}) write$P9_RCLUNK(r0, &(0x7f0000000640)={0x397, 0x79, 0x2}, 0xffffff15) openat$audio(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/audio\x00', 0x501400, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2) sendmsg$nfc_llcp(r0, &(0x7f00000004c0)={&(0x7f0000000040)={0x27, 0x1, 0x0, 0x5, 0x3, 0x200, "7026c1742fe9310bdb20da008f8847b57bd3e826ba2b86d1df4169a0f9218685977e2967781d72f07fba8fecd3aab80b619ad5951c27ed746d4aabd3e3f360", 0x33}, 0x60, &(0x7f0000000440), 0x0, &(0x7f0000000540)={0xf8, 0x11c, 0xffffffff, "6d1cc8da69762118c68312b8fc2e7f477879a32bbdf2b1d7a5b6b8b8e2e08a35abadb95bcf2da6e9bd6a882f4cc025610c2c8235aa826174dc3dcdbf2e0e4ee7a0fa467907a55d818f26ceb3758d81de3780686f33f84632ffc5fad45f8a03f951ab2f72bc8d0d4210fea8774a88d76369debaa42573e9af76db28b9065212f8de928c851ca4e516e09b1cbe4f6e2ddad27850652f99f18e08d3fcfe0f9ac42b1cf343623692df2e32c52453f695ff9890cd9dd72615bf65740fa956e682884338f6d3b527745129605a60d80a2f474ebb0c660bfb57177d5affc69f4b51c61dec"}, 0xf8, 0x10}, 0x1) syz_open_dev$binder(0x0, 0x0, 0x80200000800) [ 1004.937320] binder: 15786:15798 ioctl c0306201 20008fd0 returned -22 14:59:49 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000"], 0x8f}}, 0x0) 14:59:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e6], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x100000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:49 executing program 5: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/sync_sock_size\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000340)={0x0, 0xdc, &(0x7f0000000240)=[@in6={0xa, 0x4e22, 0x9, @local, 0x7}, @in={0x2, 0x4e21, @rand_addr=0x7}, @in6={0xa, 0x4e22, 0x0, @remote, 0x3}, @in={0x2, 0x4e22, @empty}, @in6={0xa, 0x4e22, 0x0, @mcast1, 0x8}, @in={0x2, 0x4e24, @multicast1}, @in6={0xa, 0x4e22, 0x3, @dev={0xfe, 0x80, [], 0x23}, 0x8}, @in={0x2, 0x4e22, @rand_addr=0xfffffffffffff6b1}, @in6={0xa, 0x4e23, 0x1f, @dev={0xfe, 0x80, [], 0xf}, 0x7fffffff}, @in={0x2, 0x4e20, @local}]}, &(0x7f0000000380)=0x10) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000003c0)={r1, @in6={{0xa, 0x4e22, 0xcc0, @dev={0xfe, 0x80, [], 0x1f}, 0xffff}}}, 0x84) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm_plock\x00', 0x80000, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000040)={0x1, {{0x2, 0x4e21, @remote}}}, 0x88) socket$pppoe(0x18, 0x1, 0x0) 14:59:49 executing program 3: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) openat$cgroup_procs(r0, &(0x7f0000000080)='tasks\x00', 0x2, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r2 = syz_open_dev$binder(0x0, 0x0, 0x4000802) bpf$OBJ_PIN_MAP(0x6, &(0x7f0000000140)={&(0x7f0000000100)='./file0\x00', r1}, 0x10) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$packet_int(r0, 0x107, 0x13, &(0x7f00000000c0)=0xe173, 0x4) 14:59:49 executing program 0: r0 = accept4(0xffffffffffffffff, &(0x7f0000000180)=@l2, &(0x7f0000000200)=0x80, 0x800) recvmmsg(r0, &(0x7f0000000240)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000280)=""/190, 0xfffffffffffffe18}]}}], 0x1, 0x3, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x100, 0x0) write$P9_ROPEN(r1, &(0x7f0000000140)={0x18, 0x71, 0x4, {{0x3, 0x1, 0x6}, 0x1}}, 0x18) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r2, &(0x7f00000017c0), 0x1d0, 0x0) read(r2, &(0x7f0000000380)=""/4096, 0x1000) [ 1005.227253] binder: 15822:15823 tried to acquire reference to desc 0, got 1 instead [ 1005.275577] binder: 15822:15825 unknown command 536872576 [ 1005.280547] binder: 15822:15837 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1005.302089] binder: 15822:15825 ioctl c0306201 20008fd0 returned -22 14:59:49 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000"], 0x8f}}, 0x0) 14:59:49 executing program 5: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x80000, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x4}, &(0x7f0000000080)=0x8) r2 = fcntl$getown(r0, 0x9) write$FUSE_LK(r0, &(0x7f0000000100)={0x28, 0x0, 0x5, {{0xfffffffffffffffb, 0xfffffffffffffff7, 0x3, r2}}}, 0x28) setsockopt$inet_sctp_SCTP_AUTH_DEACTIVATE_KEY(r0, 0x84, 0x23, &(0x7f0000000240)={r1, 0x7f}, 0x8) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r0, 0x2) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) msgget$private(0x0, 0x32) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) 14:59:49 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0xfffffffffffffe54, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:49 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x0, 0x0, 0xfffffffffffffde4}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000100)={0xfffffffffffff031, 0x1, 0x2, 0x0, 0x8000, 0xfff, 0x5, 0x3, 0x0}, &(0x7f0000000140)=0x20) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r0, 0x84, 0x71, &(0x7f0000002540)={r1, 0x6}, &(0x7f0000002580)=0x8) r2 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000002640)='/proc/capi/capi20ncci\x00', 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f00000026c0), &(0x7f0000002680)=0x27c) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r3, 0x28, 0x6, &(0x7f00000025c0), 0x10) syz_kvm_setup_cpu$x86(r2, r5, &(0x7f000000e000/0x18000)=nil, 0x0, 0x399, 0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000001c0)={r1, 0x2c, &(0x7f0000000180)=[@in={0x2, 0x4e20, @remote}, @in6={0xa, 0x4e21, 0x7, @mcast2, 0x11ba}]}, &(0x7f0000000200)=0x10) preadv(r0, &(0x7f00000024c0)=[{&(0x7f0000000240)=""/13, 0xd}, {&(0x7f0000000280)=""/145, 0x91}, {&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000001380)=""/103, 0x67}, {&(0x7f0000001400)=""/4096, 0x1000}, {&(0x7f0000002400)=""/36, 0x24}, {&(0x7f0000002440)=""/111, 0x6f}], 0x7, 0x0) 14:59:49 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0xfdfdffff00000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:49 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000080)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000540)}, 0x0) preadv(r1, &(0x7f00000017c0), 0x1fe, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000000)) r2 = syz_open_dev$binder(0x0, 0x0, 0x2000000004) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:49 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x356], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:49 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') openat$cgroup_int(r0, &(0x7f0000000400)='rdma.max\x00', 0x2, 0x0) preadv(r0, &(0x7f0000000500)=[{&(0x7f0000000100)=""/158}, {&(0x7f00000004c0)=""/9}, {&(0x7f0000000200)=""/25}, {&(0x7f0000000240)=""/8}, {&(0x7f0000000280)=""/186}, {&(0x7f0000000380)=""/117}], 0x1000000000000057, 0x0) 14:59:49 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000006195000000000000000100000000"], 0x94}}, 0x0) [ 1005.641061] binder: 15857:15858 tried to acquire reference to desc 0, got 1 instead 14:59:49 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x76, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0xfffffc18) [ 1005.747277] binder: 15857:15869 unknown command 536872576 [ 1005.747544] binder: 15857:15870 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1005.796113] binder: 15857:15869 ioctl c0306201 20008fd0 returned -22 14:59:49 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) getsockopt$inet_sctp_SCTP_AUTO_ASCONF(r0, 0x84, 0x1e, &(0x7f0000000040), &(0x7f0000000080)=0x4) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1005.870019] binder_release_work: 2 callbacks suppressed [ 1005.870028] binder: undelivered death notification, 0000000000000000 14:59:49 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x1, 0x0) write$P9_RLOCK(r0, &(0x7f0000000180)={0x8, 0x35, 0x1, 0x1}, 0x8) accept4$tipc(r0, 0x0, &(0x7f0000000140), 0x80000) r1 = getpid() r2 = syz_open_procfs(r1, &(0x7f0000000200)='net/ip6_tables_names\x00') preadv(r2, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:50 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x5, 0x2) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000040)={0x8, 0x6, 0x2, 0x7ff}) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:50 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e4], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000006195000000000000000100000000"], 0x94}}, 0x0) 14:59:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\vc\x00\x00'], 0x0, 0xfdfdffff, 0x0}) 14:59:50 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$SIOCGETLINKNAME(r0, 0x89e0, &(0x7f0000000080)={0x3, 0x2}) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000040)={0x0, 0x0, 0x0, 0xfffffdaa, 0x0, 0x0}) 14:59:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000006195000000000000000100000000"], 0x94}}, 0x0) 14:59:50 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x7fffffff, 0x200000) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000000040)=0x3ff, 0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x1000}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r2, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x2ef) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000100)={0x18, 0x14, 0x10, 0x17, 0x9, 0x6, 0x2, 0x161}) [ 1006.160721] binder: 15898:15900 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER 14:59:50 executing program 0: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000540)='/proc/capi/capi20ncci\x00', 0x4000, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000005c0)='TIPC\x00') sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)={0x34, r1, 0x100, 0x70bd25, 0x25dfdbfd, {{}, 0x0, 0x4101, 0x0, {0x18, 0x17, {0xd, 0x100, @l2={'ib', 0x3a, 'hwsim0\x00'}}}}, ["", "", "", "", "", ""]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) uselib(&(0x7f0000000100)='./file0\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000140)='net/wireless\x00') preadv(r2, &(0x7f00000003c0)=[{&(0x7f0000000400)=""/145, 0x41}, {&(0x7f0000000240)=""/167, 0xa7}, {&(0x7f0000000300)=""/139, 0x8b}], 0x3, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000500)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80004}, 0xc, &(0x7f00000004c0)={&(0x7f0000000200)={0x1c, r3, 0x200, 0x70bd28, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x80) [ 1006.265578] binder: 15898:15900 tried to acquire reference to desc 0, got 1 instead [ 1006.304896] binder: 15898:15905 unknown command 536872576 14:59:50 executing program 3: ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000080)={0x0, 0x9, 0x4, 0xe000, {0x0, 0x2710}, {0x2, 0x8, 0xffffffffffffff80, 0x1, 0x8, 0x200000, "b8c151ef"}, 0x8, 0x4, @fd=0xffffffffffffffff, 0x4}) fsetxattr$security_ima(r0, &(0x7f0000000000)='security.ima\x00', &(0x7f0000000100)=@ng={0x4, 0x7, "2f997104e5601142ddc39bb2526e772421d925"}, 0x15, 0x0) syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1006.333071] binder: 15898:15913 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1006.367971] binder: 15898:15905 ioctl c0306201 20008fd0 returned -22 14:59:50 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x20040, 0x0) ioctl$sock_inet_SIOCDARP(r1, 0x8953, &(0x7f0000000080)={{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x27}}, {0x6, @local}, 0x0, {0x2, 0x4e20, @local}, 'lo\x00'}) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e20, @remote}}}, &(0x7f00000002c0)=0x84) setsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000300)={r2, 0x3}, 0x8) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) setsockopt$RDS_FREE_MR(r1, 0x114, 0x3, &(0x7f0000000100)={{0x60000000000000, 0x7}, 0x40}, 0x10) 14:59:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff020000000061950000000000000001000000000000"], 0x96}}, 0x0) [ 1006.416683] binder: 15898:15900 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER 14:59:50 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f4], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1006.474645] binder: undelivered death notification, 0000000000000000 14:59:50 executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uinput\x00', 0x2, 0x0) fremovexattr(r0, &(0x7f0000000080)=@random={'osx.', '.\x00'}) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\fc\x00\x00'], 0x0, 0xfdfdffff, 0x0}) 14:59:50 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000100)={0xa, 0x0, 0x0, @initdev}, &(0x7f0000000140)=0x1c) r1 = request_key(&(0x7f00000001c0)='rxrpc\x00', &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000240)='bond_slave_0\x00', 0xfffffffffffffff8) keyctl$set_timeout(0xf, r1, 0xbeb) ioctl$sock_inet_SIOCGIFADDR(r0, 0x8915, &(0x7f0000000180)={'bond_slave_0\x00', {0x2, 0x4e21, @local}}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r2, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:50 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84000) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x24002, 0x0) ioctl$KVM_CREATE_DEVICE(r1, 0xc00caee0, &(0x7f0000000080)={0x3, r2, 0x1}) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:50 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff020000000061950000000000000001000000000000"], 0x96}}, 0x0) [ 1006.738393] binder: 15938:15941 tried to acquire reference to desc 0, got 1 instead [ 1006.743119] binder: 15938:15943 unknown command 536872576 [ 1006.804685] binder: 15938:15943 ioctl c0306201 20008fd0 returned -22 [ 1006.825250] binder: undelivered death notification, 0000000000000000 14:59:50 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001440)={{{@in6=@mcast1, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@loopback}}, &(0x7f0000001540)=0xe8) sendmmsg(r0, &(0x7f0000001d00)=[{{&(0x7f00000002c0)=@rxrpc=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e23, 0x1, @remote, 0x7}}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000380)="bc100a50587a975751e4a75fcbd6b48f38aed3b637bac3", 0x17}], 0x1, &(0x7f0000000400)=[{0x1010, 0x102, 0x6, "a759ffd5236853331ec1c0519557e8321b64ffd9ec9b5d696838adb6e9cbb8c010a8750b5c8d7a39863f847ceea8e31e7412a281ecd8eed21d704dbf02bd30cfcfedf843185200761d8c93c0d6175724f8ea83eebb56a7202a9c0b460073a6c59d84a65520e6c8c2e3c548d1de2690adc65dff093e219e67843dc4845d7bc6c721a2c9655091c4ff441af5c43997e3956d82b2b4eb40fe3a912eb18d2a209e39292796c7d22f7f45e2136848a227a237a77e9c605260d33b104004a63af5cacee2248357e315ea954f4747116ec29db33cb9e5d0aafb305252ef930b0d7d863c912fa76b261605477d40238241229b9bef1431249a88eb399ad9803dac58b0b232d99190a5ab99d9f9cfefd983dba1d25a0375fd70ae8c1eedc19052a1aaffc5ffa64d1aca2c6c22bbb5660e5e16293846a9da700393c6e8ce4374fe5e84b47222b27001093b9f87a358fd7611232476e59a77df62210537a213cb467fad2adbd26716188ade4e61a7216cb2c834113b2c6a91a0eafc8b007e3084b28ab910a5f9271c0a2a5cf54adc9c5f7e91e006e91dff7477c64f6890cc73bcdabfc44299bc9fafd35be5698f7a24cc38fc869ecdd720a126e9fd14f8de3ebb7b3eb940efde3d34359bc3c3ca5287f05e32789ffec1d4d6c05bd9d3b9703e97d69f217509077bea518b789bc43ca9f420215deb68e80cdd7ba26dfc2f07b492c049c26cd81a73bc9a347945f6ede992427b19af3801b41029abe9e2cc050fca982f6f58ce3179d326d5679aedeec53dd91380183a6ba97747421004cd15b3d47dcb6e207a91c14131c2e73b25b3a5f803370c586ba9dc762ab31e8007b42e42d679c75dcbd0e46f9a48b65523f86365619e67e0463fd14003b4e748b79a55d7557e80f522e3a175ed2e6535113f03ad735a6dd884b89ca908e2192f13bb295c623bc2afd6d616428dcac7c6861c603492f217e93a84408e6b2a0206932c856accaba34b3c527e76c10db1c0f8bd270f9aa1ce66064ddd467257392b4807160c4ed9f93fc0a08a3927521fd818d46502d16d83b7e28cba30d59189b32cf2ed371f40bf9715907ed3afab22b3de4270fd34e7ebf91356b7d40ffb07b45636f18fcd3746e7915d850cf33e957e31144d21395bcc239587164a7e2105b9ecdd82d14b5699bdaa6a13149e5d4858810e393615a0660a0f8ec2e6dbbaae21d6ff33e3a45ce7be8b453a6c1bd64cf879d7a307c6b21a99b8cf45e1df49d4d443e489b5070b9e2de0ed8cec0a30200a036d0063366ca7b93bcbbe117880f44d0454b4020cf80fdffa37289db34381a1d36cb8a06d855f3894704ef5a5afcfff689ae8a7b4401df2bba19b59194a7863adb498383201bdde78a6e31f61be98b23e2842da9a54b274602d69e871cf4c8407e567959e2fe0e35cc015020076bbafa58b9040c196af1d73823c8d8bbafb192d50be2634a5de8d6f3631a5bcacbf1a911dfeec3bee27dad8518bed70d2bed207dd2750c245d744a965344667cd124fee6fac23c05bd0d62b107168d5f6bdcaf696d1a2f2a94202a5b6478fb70b5a786036a0f97fd70c3f25834b5d1a54ffa40ebf91755ebe0b20c03f55631704b818fd89a23b36350ae9cb31a26bb747e4c2c3082262c98723d8988965d42f1b34ee1fb7427e2fa48c214bfd0cf0d460bc1901a94cb73918507a89d6ad5250d1c4895501ae8f1935e22b0879dfe93d5b05f2f8ccff49451c2064328de29e0d00922ffe038ceeb6b3f6dfc2191bd04dc6f3aaf242d6b634082c372cfcd772ca8bfe60403141c9d060dfb6b97203a3ccc83d41cb06c02333d87feaa1b410a7b78dc08e45b3bb8bd2d7f11ae0edacf3b26e6cb7d8b92d988e0a542e27b598fe44aafd07da1eea762abc8497e4349f5c9986a62a2354727e914412b262e54147fa5ea9eabce3cef1e2b14058922489f63ad9be39bad133d5e16ad12096dc575a58220855dbff4e5fada4a59c7e464b49a2ad83e92d4aaadc9703599f70e17b208dbd01d19f45d96eb96344ce42ac9e03317873b5fc59ed571f96af9cb00ee3e8aa82819218358cf11420d7dcc0c343c9299dca3e61f808744234ce9afa4d5abf33122f48d781820655e4490051bf79ecce2d0b959dff67c25a5d6d32ab802b94514114f7ffa644e2ae43e7266e549a8ab54b2cd2ccf9d1af4f2f9874270868a8539cc7a6dbb4ad746350cb3b8c3d0d29f130f16e43deebee8c8fb569c0c30d0db14b20abe01b93c7ed407eb45c919d0acd912e05ec41b388a60a9fe158fa37a0d254364bb6b4953314416186359e73cc01f578d73b7a0a0297c13fb08ec4c946a3faf45056b8bd6fc30945aa7121cac72c17f40f33034f11a484e94f02b28cb216b4fc7259d96e6b3767d984b0e24951174b87f76771e8cb17fc65ea848a3b550e8cf0d3ec9d536c2f2bd5d41ffb6bfe3ca9278f51aaabebaf1f40981b15275acee1b6c7c703343faa4d1d9acc9db9120717d4f351fae44b8e79bce28ab693a808031c2b4cdf7d9667e77fb92fb770fff40d5b16a14c5e7dfbffbe71fd1ca7eb5c7ad581d37a89ebe4325ba0ed07f1a603588ebf72dbfdf39084b4fdc86edc1a2a8360ef71cfcda1a2826e7783dc935ad4a5f513eeb7d1c8cf1977aab133036895ccf16f372d0b83e885c159545c9e03681096015176d7c80c932b033a45462b5ac183be8af606dcd988dc1f9e3bb77cb410b1cd0983514b7918386d5f0a200e712a1ece2d1e7a79cd291cce84a20e2539bcde20c7cb58ffaf491a3c6af22944b0c13543db3662cb7d5854f80f0d80752fcdc5aaa4207334d7014c6bb17756c42045ff038fa00a589055bcbede665fc90851cbe31271dfcb4204ed8e7b48be46cf08e873392b689daed347ff8e28b9c5207bb8188439379c2c16842fc713a01a8275a0744b2e3e739dd2db7e3440e5d08826b8367adcefcb20b3cc55ee48c724b833a16640f4e253d7d98406bd415baa483519fdeed89228ff0fb419f8ae70e59be99df5ba3299800cb740e5ff4cbdb9b4c19ebd6808dd5ab381f9e961bc04f19f30b672b6ffea3b19d8ceb840476f375c4c2fc79c75e4926b8ff29ce2ab4969c7d5bc92e89d4b3e8cf7cd94fefd14ed9fa0300a0fe1a620846d0a75c8bb42e17a6f0894d45cff6c4110d04fdadebe2b39289871bee538f98cbd08e3bcd953246f231e1b63628f373e1cabbe8d7b3f83db15543307deb1aedd79a5bf716a18757d05c324bd80dd17331b899d71c599d592560050e521f6809a14bdcb89c97ec851114ea5b6d7a667c802eba42b3311dcc4aa05f21ff619ed92de6bf6945c9bb4b13eed7f39ae1b9a183d4d99f3a75ace3c8c27f261254070cc94bb0ebc50ea63ad646065dc6c6ff90f7fc8e4d168ae64f3f7ff3e4118af947fca283d02a638193389427238f1f4c18c0e21e6f05362084a2ef0284db3f37abfced697271c6299bbbc3ca1966a178615da07757876051d0fbde8aa4aba651a5803a27ec80266a9ba910f67371b648fa646c65ed166beabf110715a0aac250c006d140a95200919edbde62368c4c1128268dca61e7455083421f0279fb5ad094f76890bc8ad8ab1aef9e3825181587fd7fa472961809052325b268af015808c604d58f38f9b094a97c899dc8647ec74d8ee0dccd90a3fad9516bbf3c5290c7d68156d9d1b82f73221c4ae9492294faa434f9d495df325a3057c2200f1197a5d9f05ccc9e2b1ee29d72400601dc9c2ef4413934a3776160bdf667de59f14099b1094af90f7718330da936b4a6d7f8b4d675b495d7de876c13febc0bd4e28bc14755964102fb8771b3ceb95311d3007ca5344d493d983c7aaced4ba2b7a29921796caf3ff23e85ca107acb2a2dce33a71d298e9a2cb85bb1a6a594e7770147518109f2f281ad6585edca8822759f4e73fe4cf255552045865651c8483984c572da27405bf5167de1cddf1b4d9c5eaf439011c0a8809dc9b2a51de03f363f7a2ddede27010e4a4620ac13af0fae7ef82c29d319d32d24ec643722f3958c1bf417931e1d2caa62d2eaed1b4321f5555604a9914d3fb195b05d24776f7b57344d72c23e80f0eb47669a2a9c9a1df81ce30ae7928a33d8e7c878080d875e58214495c0401df1c14b53e671c2e0c33bc457bd29dfc38dbc3094e48dbdf858a41876d1e2cd252deb9189c28002d6bfa6b69c2d552c2f357b78986b3a763def6565ea1d35e0f5291e4c3e7750f2f3a9697e923a2975faec568d24d4f9807eaf4bb8c78ba3cfbd5eb48039feea4adcb866964d602273286207b7ddea28dccd0d0db4c6fa70dba674d71b49d1422a1be1bedb0d36d07a9e97d365785eddac69bfe932a054c3da39bd28a6f8655bb61453b0ec8874823b4404176a34f541b3294fba60dfc832fb13b3253dc67b3005952a11d83d1c4e10e87f03ffb3563d0c2dcd1d5035eb0c023209ba8a30cb3cc2af84837cbc4af276a11708e45c89bfecf5491f5025a91fcd11c33d898c61e491ab4fb2d6f89224b11ceb9265363d47dd821d15cc9c2e4e80b99545dbb3c6f0c897418b39031b06ec91cafd1dfbba2a5222d5c13e6c762db1e8bd508a6b35ed8a8c4fbc0184de5e7f15a8907facfc6dc8c14d9aaa185343646f0a637ec0328e30452587447dae016855852d3bfc5dfda646a19af26794b5c8b42b5d8f3981b8e22fdee00e217c3ebe24e40d0395f6ce8dccc394480c86a37fba90d6692f98d998c6978e2cd9bd8e426466758458af1af0ad9b65084e097e853dc5b17cf022bfc9d5aeeef8e4ce05355068d37ac42ccd085dcebee75b07338e7ced9581d181354849ba1bcc93d5fcdcbab2a7843ce5e92d01e5c3fd9a9b191977af614f04f89d6efc93c8178c4f8c29904ee819fdb394d827275ba6fe9bb031ddc74e654023588b0f87727bd135cf8bb06b3af638d83e6033fe75d8bbd54997dd7d0263b82646c4602af2a4494418a7e5c1a518f2633364d8e47100a7552e7c70e6e3f4661ecf4e8c0d11f257423306e22b3b08534de07698f93dfe26506b36864126a70e8c50c455ed68372fbcb0e4fe3fa3f5fa7407e6c19534ca1b575d23d733204b7af6e9c2373642367225fcae6c012dfb4e29294848024045b88d8d3b9128f6bf7342e9e7a90421a278608ca6e7358d8f6718ff8cd6d353b5f355a9bbaa27841d5c0646d8fa0ca9cc2e2b71d22650431de0bf2d9ef832ecbc2157a03689d359afe998abfd70c2c24c622cc65d2d9f19964456abc6bea70497dfcf3a9fecc58cbe953db92a0248ff98c34cbc98b0e1b6f1bb8d2f76482cd7a856dd47f1957af57bc175aaede4b76b3213ae4bfabee6616eed68133c0d8f8b185d69013a6b135b218ad6f4deb49bcb7992cc164b58034c1a31bdfc416ba1c9ae10a5c2fcac37f6eecf541677c8242231093d4d0cf1836f226128de83aa171bd4bd4d6e99a25eca0f2bd7fe94368d96c9a879d672dc77b2cd37d8cfab0fc1e05a99b59a6ba8df7ffe2dcc696e6dcf56bdf3b9e5e2c0ce64e30d60e92099440689473e3930c244b4b7111ffb2f5bb6e185222213ceafa72b2a141a94139c8e54b652c1ab3c730cb972a6ba57e426766fc679af9a149d0f67a24ef4894998e5db0055e0a1f422df0c09c9041081759daff965e4f49b08c03040db523606f8c1204aa006cb297656738882f0c5792063e96b7e53b9f2a44cff2251aa92acc3a8b505cd2cc7c3aa103576578ac70fdfd5a70757d992a189533d48d51fbf2bf61032ca05430de40296689c4d8a48fbc8de2daae3d0217367d72e3"}], 0x1010}, 0x1}, {{&(0x7f0000001580)=@hci={0x1f, r1, 0x1}, 0x80, &(0x7f0000001740)=[{&(0x7f0000001600)="f4cc778b78e3e1ec6e64759b07c18ebf7275bb811b4479cdccc8c96e3d7d34c1e42f2579bb", 0x25}, {&(0x7f0000001640)="ef06c23f775637f6e353f0e018b2645f8133770763abf2b2906ccb490810cdc8f45eaf1cff2a610fdeccb49deb4c6dc5f60173d910807abcff29ff676cc184406db3b3d83bedae538ec225dba884370d2878939a06e7322b880e764c953935f0fa09eb29ced8c57123b3013a28d5e7621d8f179c9745447a09fcdbc1d200ab32e9a43d5fdecd8cafda8136f95f527228389e552c3b679cd035185b6e46d76c692797f771601c2769e39c174f5a90606b1ebced5b99824197d009128a07674883bd1c6ee5d42ffa561eba911d160009c524d7400fb62d47f5bf3fade39b528ce2a105067b67", 0xe5}], 0x2, &(0x7f0000001780)=[{0x68, 0x112, 0x3, "23e4aa5dabdd6e84882fd81cfd4ed6fc978b49dc2972752960b2689dcc6aa5b6be1ff8319e69c5de1df5629d64863b491c5863a75568719bd4d4a5b5a2976b3022262a49d2a8ee0a8ec8d2a394e8c76bb1"}, {0xe8, 0x1, 0x10000, "4bfd229e99bf99276cc4bde5975765443cf71ba1359ddfe578f832de7ecae464e85b562ce4045edb6f1a6eb25d7be6858d010115e5c0e334c1b0e9f94c6441bd3a9aa5d3337434da03bcd443730f93aa64b17c487acc46edd7f8ded94c71356ddd36bcb2d723fa766dd24bca53282a530490cd1db622549422b14eee620f5020bf4d8323e7613ed8fa49a481ebf41c6d72d3d5425f7843661ca5f466bd3c075310cf250dba9b3a4ff5e1252931401960e2674182914d4a34218382fe411612b2ca3b51ee3214fd2cd9994ebad0c491367e3196"}, {0xa0, 0xff, 0x800, "8fd1d0df6e7a5d3e125f4d89978f05cfa6bd2eecd8921a63c510e4161d62b58f351fcbe90db44170795fc2cca531ec2960d836f05f62a711d6786f17a99c794e183d008ad82a889faac7d2f432b150b5dc0103893d7ef83b67fb6733f352f80289bed063ae7eb013f9b3d103417a0858870cb02189564b97684fb818e271daf5dc14d32d1f0381ed4f98076ea2cd30c5"}, {0x48, 0x13b, 0x6, "53b999d89cba4bca23e151cbf236276147400b64a92426b7e4546fe09b0b74988bb4aa03edda0cc12b83dfc079f7bd042bfb56775e"}, {0x80, 0x116, 0x40, "ece7cd76b8538b10cb1d79fb4ef86d5d18e92d2730b8084beddb913f44566e376d158bb19be92747aca214a5d293ea970a386008a5ec3d5447a1609a3ae029b4511bd9ca4617a3939d2ce264f35e4c1a7efcf55c82dda222e1fd8e364be7ab485909d4592440c5063815d39de4e695"}, {0x88, 0x116, 0x7, "4f7c748b9ee172db074ad6312b898703399efc1cbabea990f497c3c1efd29619ee871d016418a11721341ce6463ce3efcd94f510fd121092bbfa4b2552e2ffb733fdefcaf8fa14cafcdc60eeaa92527ab213de013c7b931d18877b4ac29606b00be11cec71c66a9c952143c839ed98354b8fb8"}, {0xb8, 0x114, 0x6, "e2c6267ef79860157c2ccfe0ffa16928c32918e96ad49f3a8e6c3d20c481097fc4a7b69b60ecddc77e71e0cf9bf0e377cbb1a3fd685b4e651586b5e77ad43230a602a6644fffb3e3cbe04d85d15a2e412ecf1e7d6ea884c8dcbc7276ff853c5d4c4458b9a550f71db5e2916118aad58eaa3dad66b3177bbfcd42460aa6c3affe41be0acdc85105c582747566775a53d05089d8bcc1d91404916d88300af423694c8e4e"}, {0xf0, 0x109, 0x2, "a477025f4bf6dbba2c4eee8e797a4e11937f8e57135b5ee53d92894b2a4d9245d276aef18cc6892730a01aadd716ce851adfe6e5f94ee1e50631fa3f0452ed7c36fafad58fba810f2296f4c94d764cb7aa9a13d156e8ee647129fb52c09a140b988f24cf15bf85663b2e4542cad0d2d3dd491ec1f5a63a6a0f06e9eba190da5d5aa6391071da7db2b8cffda6d2270fa6558d9bf1698851d83be970891e419b25d81f0ab3c4d1e82ec02ddb88e4798128d18d06ef109f191969d24eda2c5f5eccfbf5b1d85424d71e4b4516233fa94b45d20546b3889a424557bf163c7ab3"}, {0x80, 0x110, 0x0, "dcf7d7586d0c809fd863f9bd8ddd1f5e22734ee4ba21d94be4bf6981ef21ecc4cab4b0bc1f6472c5513a2754a5822cf369f1773699d7d284236bb7c0535e4c71328222781ff2a631e8381c3b0c65dc43fdb3ce828d89de61a5b645686ee933edde02c1f0a4cff9eab03d25cc91ee7d41"}], 0x568}, 0x200}], 0x2, 0x0) preadv(r0, &(0x7f0000001d80)=[{&(0x7f0000000100)=""/189, 0xbd}, {&(0x7f00000001c0)=""/78, 0x4e}, {&(0x7f0000000240)=""/61, 0x3d}], 0x3, 0x0) 14:59:50 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0x0, 0x200) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:50 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\rc\x00\x00'], 0x0, 0xfdfdffff, 0x0}) 14:59:51 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = getpgrp(0xffffffffffffffff) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x2080, 0x0) recvfrom$netrom(r1, &(0x7f00000001c0)=""/83, 0x53, 0x10162, &(0x7f0000000240)={{0x3, @null, 0x3}, [@null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @bcast]}, 0x48) r2 = syz_open_procfs(r0, &(0x7f0000000180)='attr/exec\x00') preadv(r2, &(0x7f00000003c0), 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r1, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r3, 0x20, 0x70bd27, 0x25dfdbfd, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x400}}, ["", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4000) [ 1007.041380] binder: 15962:15965 tried to acquire reference to desc 0, got 1 instead [ 1007.078866] binder: 15962:15969 unknown command 536872576 14:59:51 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff020000000061950000000000000001000000000000"], 0x96}}, 0x0) 14:59:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1001], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:51 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000040)={0xffffffffffffffff}, 0x2}}, 0x20) r2 = accept4$x25(0xffffffffffffff9c, &(0x7f00000000c0), &(0x7f0000000100)=0x12, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000540)) sendmsg(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f00000002c0)="8eca7160103c6294cda54c60391b04c4a6c3a19d7b51384b0e07396f1d91ec00b29097a6b8504f671579030cea954eb5a7ddc96a01b581951b0472f4a158534c78f8713a63561c0c0015667b287a12c5c8b9de54046000eb8724ac5cbb8d6d0a2580f807214fa76dc562c5f31d3b0559c929b4607c39f6acd1331bd62b8339b7501252757310c4ea07cc41f062c484bc336412a71fc6ea8742eb7d885a611b7c60802a0f9ede40f7b6cf8f5df9837cd43d2063fec2f7498d", 0xb8}, {&(0x7f00000003c0)="81e03d83a26c099d2aeb6080", 0xc}, {&(0x7f0000000400)="f7108ea0da", 0x5}], 0x3, &(0x7f0000000480)=[{0x58, 0x118, 0x4, "6203f4a6c20e8c20f15b5c334f670f21d39547336f4c28935e5d20a253333ca6332d8beb4544d316e686a1e47a2c01dd068f38db23622ecaa5b090f30e2fd5b6a4f90f4119"}], 0x58}, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000200)={0x14, 0x88, 0xfa00, {r1, 0x30, 0x0, @in6={0xa, 0x4e24, 0x627, @dev={0xfe, 0x80, [], 0x14}, 0xb8}}}, 0x90) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) sysfs$1(0x1, &(0x7f0000000000)='eth1proc\x00') [ 1007.109479] binder: 15962:15971 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:51 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x34e, 0x0, 0x0}) setsockopt$netlink_NETLINK_PKTINFO(r0, 0x10e, 0x3, &(0x7f0000000040)=0xfffffffffffffffe, 0x4) [ 1007.167260] binder: 15962:15969 ioctl c0306201 20008fd0 returned -22 [ 1007.216085] binder: undelivered death notification, 0000000000000000 14:59:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="02630440"], 0x0, 0xfdfdffff, 0x0}) 14:59:51 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) write$binfmt_elf32(r0, &(0x7f0000000540)={{0x7f, 0x45, 0x4c, 0x46, 0x80, 0x20aa, 0x0, 0x5, 0x5, 0x2, 0x3, 0xa49, 0xbd, 0x38, 0x4c, 0x7, 0x8, 0x20, 0x1, 0x6, 0x10001, 0x4}, [{0x0, 0x99, 0x8, 0x2, 0x2, 0x3, 0xfff, 0xfffffffffffffffd}, {0x60000000, 0x200, 0x4, 0x1, 0x9d1a, 0x13588a8d, 0x10001, 0xfffffffffffffffb}], "050891325daaf7f32b33872cdb17dfeafea7ee8640e3f2b02a6dcfd62a190f52e597b2cfdfb7f8d3edd4ba28c899898cfe00e22ab84962ae61c9ec5d02ac05b14b75191fcbc0a03b9a911a88603e0f3664057062077325daa6b3db3fa0bee7199b1ee4adb7ca75b6", [[], [], [], []]}, 0x4e0) getsockname$llc(r0, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, &(0x7f0000000080)=0x10) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$SG_GET_REQUEST_TABLE(r0, 0x2286, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x341, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:51 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000006195000000000000000100000000000000"], 0x97}}, 0x0) 14:59:51 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000280)='/dev/vcs#\x00', 0x2, 0x80000) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000000380)={0x0, 0x2, 0x1, 0x6, 0x6, 0x9, 0x40, 0x4, {0x0, @in={{0x2, 0x4e23, @empty}}, 0x6, 0x1000, 0x5, 0x4, 0x2400000}}, &(0x7f00000002c0)=0xb0) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000300)={r1, 0x95}, &(0x7f0000000440)=0x8) r2 = syz_open_dev$amidi(&(0x7f0000000100)='/dev/amidi#\x00', 0x1000, 0x200000) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x10, &(0x7f0000000180)=[@in={0x2, 0x4e23, @empty}]}, &(0x7f0000000200)=0x10) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f0000000240)={r3, 0x100000001, 0x2}, 0x8) r4 = socket$bt_cmtp(0x1f, 0x3, 0x5) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000000140)={r4}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0xfffffffffffffef6, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}, 0x100}], 0x400000000000379, 0x0, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r5, &(0x7f00000017c0), 0x1d0, 0x0) [ 1007.425126] binder: BC_ACQUIRE_RESULT not supported [ 1007.440841] binder: 15993:15994 ioctl c0306201 200003c0 returned -22 14:59:51 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x900, 0x0) [ 1007.487483] binder: 15993:15994 unknown command 536872576 [ 1007.504261] binder: 15993:16000 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:51 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000140)=@get={0x1, &(0x7f0000000040)=""/230, 0xffffffff}) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1007.576448] binder: 15993:15994 ioctl c0306201 20008fd0 returned -22 [ 1007.609083] binder: undelivered death notification, 0000000000000000 14:59:51 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) write$P9_RXATTRCREATE(r0, &(0x7f0000000140)={0x7, 0x21, 0x1}, 0x7) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000180)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:51 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40008000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x509, 0x70bd27, 0x25dfdbfe, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000) munlock(&(0x7f0000ffd000/0x2000)=nil, 0x2000) 14:59:51 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="04630440"], 0x0, 0xfdfdffff, 0x0}) 14:59:51 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c00], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:51 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000006195000000000000000100000000000000"], 0x97}}, 0x0) [ 1007.833614] binder: 16020:16022 unknown command 536872576 14:59:51 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0x0, 0xfffffffffffffffe) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:51 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x200000, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@ipv4={[], [], @initdev}, @in=@broadcast}}, {{@in6=@loopback}, 0x0, @in6=@initdev}}, &(0x7f0000000240)=0xe8) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') llistxattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000380)=""/128, 0x80) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) mknodat(r1, &(0x7f0000000280)='./file0\x00', 0x8000, 0x8) [ 1007.877873] binder: 16020:16022 ioctl c0306201 20008fd0 returned -22 [ 1007.878796] binder: 16020:16029 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:52 executing program 5: openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x200000, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) setsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000040)="b735aa82092e4f6a2f", 0x9) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0xfffffffffffffc44, 0xfa00, {0xffffffffffffffff, 0xffffffffffffffbd, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x8d) 14:59:52 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff02000000006195000000000000000100000000000000"], 0x97}}, 0x0) [ 1008.027041] binder: undelivered death notification, 0000000000000000 14:59:52 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="07630440"], 0x0, 0xfdfdffff, 0x0}) 14:59:52 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000140)={{{@in=@remote, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @multicast1}}, 0x0, @in=@loopback}}, &(0x7f0000000300)=0xe8) ioctl$DRM_IOCTL_GET_CLIENT(r0, 0xc0286405, &(0x7f0000000280)={0x5, 0x7, r1, 0x0, r2, 0x0, 0x4}) syz_open_dev$mice(&(0x7f0000000380)='/dev/input/mice\x00', 0x0, 0x4000) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) setsockopt$inet6_int(r0, 0x29, 0x1e, &(0x7f0000000240)=0xfffffffffffff000, 0x455) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) 14:59:52 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$NBD_CLEAR_QUE(r0, 0xab05) [ 1008.229482] binder: 16049 invalid dec weak, ref 374 desc 0 s 1 w 0 [ 1008.247394] binder: 16049:16055 unknown command 536872576 14:59:52 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r0 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x0, 0xa801) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000040)={{}, {{@in6=@mcast2}, 0x0, @in=@initdev}}, &(0x7f0000000140)=0xe8) [ 1008.281817] binder: 16049:16060 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:52 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="21000000030000000000000000000000510900000000000000000000e900000000"], 0x21) connect$rxrpc(r0, &(0x7f0000000140)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e23, 0x7ff, @mcast2, 0xf69}}, 0x24) [ 1008.389347] binder: 16049:16055 ioctl c0306201 20008fd0 returned -22 [ 1008.416136] binder: undelivered death notification, 0000000000000000 14:59:52 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:52 executing program 1: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff020000000061950000000000000001000000000000"], 0x96}}, 0x0) 14:59:52 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="03630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:52 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000180)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r2, 0x400, 0x70bd29, 0x25dfdbfc, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0x1000}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x48000) 14:59:52 executing program 5: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x40800, 0x0) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000280)={{{@in=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) r4 = geteuid() mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='9p\x00', 0x380031, &(0x7f00000003c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@dfltgid={'dfltgid', 0x3d, r2}}, {@debug={'debug', 0x3d, 0x1}}, {@uname={'uname'}}, {@access_any='access=any'}, {@cache_none='cache=none'}, {@access_client='access=client'}, {@aname={'aname', 0x3d, '%bdev\\md5summime_type&*em0securityeth1$/-&vboxnet1'}}], [{@appraise_type='appraise_type=imasig'}, {@audit='audit'}, {@euid_lt={'euid<', r3}}, {@dont_hash='dont_hash'}, {@defcontext={'defcontext', 0x3d, 'user_u'}}, {@seclabel='seclabel'}, {@pcr={'pcr', 0x3d, 0x2e}}, {@fowner_gt={'fowner>', r4}}]}}) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r5, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1008.585946] binder: 16078:16079 BC_FREE_BUFFER u0000000000000000 no match 14:59:52 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x3, 0x8840) ioctl$IMCLEAR_L2(r0, 0x80044946, &(0x7f0000000140)=0xfffffffffffffff9) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:52 executing program 1: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000000)='/dev/dsp#\x00', 0x5, 0x2) ioctl$IOC_PR_PREEMPT_ABORT(r1, 0x401870cc, &(0x7f0000000040)={0x8, 0x6, 0x2, 0x7ff}) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1008.652945] binder_thread_write: 3 callbacks suppressed [ 1008.652975] binder: 16078:16079 tried to acquire reference to desc 0, got 1 instead [ 1008.735287] binder: 16078:16095 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:52 executing program 3: syz_open_dev$cec(&(0x7f00000001c0)='/dev/cec#\x00', 0x0, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000140)={&(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff5000/0x4000)=nil, &(0x7f0000ff3000/0x3000)=nil, &(0x7f0000000040)="a2645f005819e7248fbe7b8fb0379628ad2dee235df2d5f885367ff8e0f0431c1414309be95dd1a018140d4c747d28da729ceb83302bfb9fc1ca9372d88dc1101403ee0f599b495e61e9fcdbc1b64592f105d057661d37ce1f2d75925c7e0c29cdf5b49b388949c92e10b50dd6bf4c78f6549bcd38fd17d03ff1143e484e8cf9234b20fb03b24ea42131c6c1ed514a6869bf75ca07454fccc1da79d0cfceabee261a7df36b4ba9c9d686fa563bef6b1cefee2b555fa3e62659047d68545e10f7803024776b5ca3e4100e7dc8cb9532c6b7", 0xd1, r0}, 0x68) [ 1008.776403] binder: 16078:16094 unknown command 536872576 [ 1008.812598] binder: 16078:16084 BC_FREE_BUFFER u0000000000000000 no match 14:59:52 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000380)='/dev/vga_arbiter\x00', 0x40080, 0x0) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x7fff) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x200400, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNINFO(r1, 0x800443d3, &(0x7f0000000140)={{0x1, 0x66, 0x3ff, 0x4, 0xfffffffffffffcc9, 0x5}, 0x99, 0x4, 0xffffffffffffffff}) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r2, &(0x7f00000017c0), 0x1d0, 0x0) syz_mount_image$nfs4(&(0x7f0000000180)='nfs4\x00', &(0x7f00000001c0)='./file0\x00', 0x7, 0x1, &(0x7f00000002c0)=[{&(0x7f0000000200)="06e1321b288b5638648c1e77875948ceb3fa34bcaa82abd09b7b063a03d4c6dfe72eb0cb40fe546f8bb2d75946ce8c161c1c25fa1fb39c439db9a0556736ee8221ece6a1b0e13f77b75bc989e1d0847b994817c1d518dcba99e4fe2a410e5a4273dd09a9cdef133fb8b3d8a3a06b1c9cd1a45190b7ef6e765132cec0ef393295c898bd066e3b749df70bd5e2fb76d0", 0x8f, 0x9}], 0x264c0, &(0x7f0000000300)='system/.#)(^\x00') [ 1008.821903] binder: 16078:16094 ioctl c0306201 20008fd0 returned -22 14:59:52 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000040)=r0) [ 1008.876403] binder: undelivered death notification, 0000000000000000 14:59:53 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x0, 0x100) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(r1, 0xc10c5541, &(0x7f0000000200)={0x6, 0x100000001, 0x1f, 0x0, 0x0, [], [], [], 0x3, 0x100}) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0xfdfdffff, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\nc\b@'], 0x0, 0xfdfdffff, 0x0}) 14:59:53 executing program 0: r0 = syz_open_dev$mice(&(0x7f0000000300)='/dev/input/mice\x00', 0x0, 0x20000) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x0, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x10000, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000140)='/dev/input/mouse#\x00', 0xfffffffffffffffb, 0x102) ioctl$VIDIOC_EXPBUF(r1, 0xc0405610, &(0x7f0000000180)={0x3, 0x7fff, 0x400, 0x4000, r2}) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r2, &(0x7f0000000200)=[{&(0x7f0000000000)=""/213, 0xd5}], 0x1, 0x0) preadv(r3, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:53 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x40) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_INFO(r0, 0x40bc5311, &(0x7f0000000080)={0xe7, 0x2, 'client0\x00', 0x4, "2db05711e7fa202e", "fb29ea831255b3e92479f53bc5ebc4bd1ab43a8572ba151e0224976ddb3ea5d1", 0xfffffffffffffff7, 0xc2}) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000040)=r0) [ 1009.116829] binder: undelivered death notification, 0000000000000000 [ 1009.188094] binder: BC_ATTEMPT_ACQUIRE not supported 14:59:53 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x220800, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) syz_kvm_setup_cpu$x86(r0, r1, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f00000000c0)="ea00002e00660f383f4ce6b85c008ee0f3a766b9ed09000066b8f400000066ba000000000f30677b0d260f01f63e660f72f0440fc7994c0f0f015800", 0x3c}], 0x1, 0x8, &(0x7f0000000200), 0x0) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:53 executing program 1: r0 = socket$inet(0x2, 0x200000002, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4004e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e21, @remote}, 0x10) syz_emit_ethernet(0x3f6, &(0x7f0000000000)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x11, 0x0, @empty=0xac1414bb, @multicast1}, @udp={0x4e21, 0x4e21, 0x8}}}}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f0000000300)=[{&(0x7f0000000100)=""/245, 0xf5}, {&(0x7f0000000200)=""/209, 0xd1}], 0x1, 0x0) [ 1009.219812] binder: 16125:16126 ioctl c0306201 200003c0 returned -22 14:59:53 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000100)='net/wireless\x00'}, 0x30) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000180)={0x0, 0x0}) r1 = syz_open_procfs(r0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) [ 1009.307445] binder: 16125:16126 tried to acquire reference to desc 0, got 1 instead 14:59:53 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000040)={0x0, 0x1ff}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_AUTH_DELETE_KEY(r0, 0x84, 0x19, &(0x7f00000000c0)={r1, 0x8}, 0x8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1009.387531] binder: 16125:16146 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1009.432827] binder: 16125:16145 unknown command 536872576 [ 1009.448917] binder: 16125:16145 ioctl c0306201 20008fd0 returned -22 14:59:53 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f0000000100)='/dev/sg#\x00', 0x9, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = accept$inet6(0xffffffffffffff9c, &(0x7f0000000200)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000240)=0x1c) connect(r0, &(0x7f0000000140)=@tipc=@name={0x1e, 0x2, 0x1, {{0x43, 0x1}, 0x2}}, 0x80) getsockopt$inet_sctp_SCTP_ASSOCINFO(r1, 0x84, 0x1, &(0x7f0000000300)={0x0, 0xdc6d, 0x2, 0x0, 0x4b4, 0x8}, &(0x7f0000000340)=0x14) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r3, 0x84, 0x10, &(0x7f0000000380)=@assoc_value={r4, 0x6}, &(0x7f00000003c0)=0x8) ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f0000000280)={0x77, 0x0, [0x140]}) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1d0, 0x0) [ 1009.476159] binder: undelivered death notification, 0000000000000000 14:59:53 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) clock_gettime(0x0, &(0x7f000000a140)={0x0, 0x0}) recvmmsg(0xffffffffffffff9c, &(0x7f0000009ec0)=[{{&(0x7f0000000040)=@in={0x2, 0x0, @empty}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000200)=""/250, 0xfa}, {&(0x7f0000000300)=""/165, 0xa5}, {&(0x7f00000003c0)=""/146, 0x92}, {&(0x7f00000000c0)=""/46, 0x2e}, {&(0x7f0000000480)=""/76, 0x4c}], 0x5, &(0x7f0000000580)=""/4096, 0x1000}, 0x80}, {{&(0x7f0000001580)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000001b00)=[{&(0x7f0000001600)=""/140, 0x8c}, {&(0x7f00000016c0)=""/213, 0xd5}, {&(0x7f00000017c0)=""/167, 0xa7}, {&(0x7f0000001880)=""/246, 0xf6}, {&(0x7f0000001980)=""/177, 0xb1}, {&(0x7f0000001a40)=""/183, 0xb7}], 0x6, &(0x7f0000001b80)=""/183, 0xb7}, 0x6}, {{&(0x7f0000001c40)=@rc, 0x80, &(0x7f0000000100)=[{&(0x7f0000001cc0)=""/112, 0x70}, {&(0x7f0000001d40)=""/140, 0x8c}, {&(0x7f0000001e00)=""/106, 0x6a}], 0x3, &(0x7f0000001e80)=""/26, 0x1a}, 0x5}, {{&(0x7f0000001ec0)=@can, 0x80, &(0x7f0000004040)=[{&(0x7f0000001f40)=""/63, 0x3f}, {&(0x7f0000001f80)=""/4096, 0x1000}, {&(0x7f0000002f80)=""/4096, 0x1000}, {&(0x7f0000003f80)=""/148, 0x94}], 0x4, &(0x7f0000004080)=""/116, 0x74}}, {{&(0x7f0000004100)=@alg, 0x80, &(0x7f0000004200)=[{&(0x7f0000004180)=""/76, 0x4c}], 0x1, &(0x7f0000004240)=""/209, 0xd1}, 0xfffffffffffffffb}, {{&(0x7f0000004340)=@ipx, 0x80, &(0x7f0000004840)=[{&(0x7f00000043c0)=""/169, 0xa9}, {&(0x7f0000004480)=""/38, 0x26}, {&(0x7f00000044c0)=""/186, 0xba}, {&(0x7f0000004580)}, {&(0x7f00000045c0)=""/220, 0xdc}, {&(0x7f00000046c0)=""/62, 0x3e}, {&(0x7f0000004700)=""/90, 0x5a}, {&(0x7f0000004780)=""/15, 0xf}, {&(0x7f00000047c0)=""/90, 0x5a}], 0x9, &(0x7f0000004900)=""/204, 0xcc}, 0x6}, {{&(0x7f0000004a00)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000004dc0)=[{&(0x7f0000004a80)=""/120, 0x78}, {&(0x7f0000004b00)=""/167, 0xa7}, {&(0x7f0000004bc0)=""/105, 0x69}, {&(0x7f0000004c40)=""/137, 0x89}, {&(0x7f0000004d00)=""/168, 0xa8}], 0x5, &(0x7f0000004e40)=""/33, 0x21}, 0xffffffffffffff81}, {{&(0x7f0000004e80)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f0000007240)=[{&(0x7f0000004f00)=""/34, 0x22}, {&(0x7f0000004f40)=""/225, 0xe1}, {&(0x7f0000005040)=""/221, 0xdd}, {&(0x7f0000005140)=""/4096, 0x1000}, {&(0x7f0000006140)=""/4096, 0x1000}, {&(0x7f0000007140)=""/215, 0xd7}], 0x6, &(0x7f00000072c0)=""/200, 0xc8}, 0x2}, {{&(0x7f00000073c0)=@un=@abs, 0x80, &(0x7f0000008940)=[{&(0x7f0000007440)=""/194, 0xc2}, {&(0x7f0000007540)=""/186, 0xba}, {&(0x7f0000007600)}, {&(0x7f0000007640)=""/45, 0x2d}, {&(0x7f0000007680)=""/225, 0xe1}, {&(0x7f0000007780)=""/254, 0xfe}, {&(0x7f0000007880)=""/4096, 0x1000}, {&(0x7f0000008880)=""/179, 0xb3}], 0x8, &(0x7f00000089c0)=""/180, 0xb4}, 0xfff}, {{&(0x7f0000008a80)=@nfc, 0x80, &(0x7f0000009dc0)=[{&(0x7f0000008b00)=""/131, 0x83}, {&(0x7f0000008bc0)=""/108, 0x6c}, {&(0x7f0000008c40)=""/198, 0xc6}, {&(0x7f0000008d40)=""/55, 0x37}, {&(0x7f0000008d80)=""/4096, 0x1000}, {&(0x7f0000009d80)=""/34, 0x22}], 0x6, &(0x7f0000009e40)=""/110, 0x6e}, 0xbf}], 0xa, 0x2000, &(0x7f000000a180)={r1, r2+30000000}) bind$vsock_stream(r3, &(0x7f000000a1c0)={0x28, 0x0, 0x0, @my=0x0}, 0x10) 14:59:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:53 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:53 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) readv(r0, &(0x7f0000000080)=[{&(0x7f0000000040)=""/25, 0x19}], 0x1) ioctl$RTC_RD_TIME(r0, 0x80247009, &(0x7f00000000c0)) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x301800, 0x0) poll(&(0x7f0000000140)=[{r2, 0x4}, {r1}, {r1, 0x11}, {r0, 0x8001}, {r2, 0x20}], 0x5, 0x4) 14:59:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:53 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$void(r0, 0x5450) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:53 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1009.776837] binder: 16169:16178 unknown command 1074291474 [ 1009.815690] binder: 16169:16178 ioctl c0306201 200003c0 returned -22 14:59:53 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = creat(&(0x7f0000000000)='./file0\x00', 0x144) ioctl$VIDIOC_G_INPUT(r1, 0x80045626, &(0x7f0000000040)) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1009.869396] binder: 16169:16178 tried to acquire reference to desc 0, got 1 instead 14:59:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1009.908661] binder: 16169:16182 unknown command 536872576 [ 1009.944085] binder: 16169:16192 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1009.954462] binder: 16169:16182 ioctl c0306201 20008fd0 returned -22 14:59:54 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0xfffffffffffffffe) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1009.994400] binder: 16169:16186 unknown command 1074291474 [ 1010.027609] binder: 16169:16186 ioctl c0306201 200003c0 returned -22 14:59:54 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x21b, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x8e) r1 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x9, 0x20a003) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') ioctl$VIDIOC_G_STD(r2, 0x80085617, &(0x7f0000000040)) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000200)=0x0) ptrace$setregs(0xd, r3, 0x7fff, &(0x7f0000000240)="72d6238a5dc22e47be3f83977e9362fb4427b80895bc17c6577298c6ab066125bb596e0ba6395868fc6dcfaba8602bdca8afd4be17d4374453e970b8379f4f1175b457cbf13879751ea92d6a45c47bbcbef1d49c04e47d426c3cbf0c5b9bd257d3c21f4d89a017fae141e2497999498ea837d46cf9be0ac1222dbfa9a813d1b93ffa24f562260591b05d4d5cda6375123be1dd98abf192ec8c9d042c2884f0515752d87468db38b86213dddde3f27ad3d8b6e6e08e6ec91384bd710eb6664c08694bbb05607016c800") 14:59:54 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000100)=0x4, 0x4) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0e630c40"], 0x0, 0xfdfdffff, 0x0}) 14:59:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5603], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:54 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:54 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x80, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r1, 0x84, 0x15, &(0x7f0000000200)={0x8001}, 0x1) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) fcntl$setownex(r0, 0xf, &(0x7f0000000080)={0x2, r2}) 14:59:54 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f0000001580)=[{&(0x7f0000000100)=""/200, 0xc8}, {&(0x7f0000000200)=""/165, 0xa5}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f0000001380)=""/193, 0xfffffce0}, {&(0x7f00000002c0)=""/78, 0xffffffffffffff68}, {&(0x7f00000026c0)=""/143, 0xfffffffffffffead}, {&(0x7f0000001540)=""/61, 0x3d}], 0x7, 0x0) 14:59:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1010.400130] binder: 16222:16224 tried to acquire reference to desc 0, got 1 instead [ 1010.508860] binder: 16222:16225 unknown command 536872576 [ 1010.515639] binder: 16222:16225 ioctl c0306201 20008fd0 returned -22 14:59:54 executing program 0: r0 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000100), 0x80000) fsetxattr$security_ima(r0, &(0x7f0000000240)='security.ima\x00', &(0x7f0000000280)=@v2={0x5, 0x2, 0x13, 0x100000001, 0x5f, "a9fe60fcd933aeab9d2d0f6d937e64455d83cfa9cf1ec340b234c1e7608a16c6875abe64a74fa8257550101e7a7e88329850f3030a4019238e7077222a6bc2e244a5a4acb5f80b300ed7eff36231a74321890c34e0f8b201b481a656d7c726"}, 0x69, 0x3) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000300)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x28, r2, 0x400, 0x70bd25, 0x25dfdbfc, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4040}, 0x8000) 14:59:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0xfdfdffff, 0x0}) 14:59:54 executing program 3: r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dsp\x00', 0x206000, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f00000000c0), 0x2, {0xa, 0x4e22, 0xdba, @loopback, 0xffffffff}, r1}}, 0x38) mlockall(0x80000000006) mmap(&(0x7f0000000000/0xb000)=nil, 0xb000, 0x3, 0x32, 0xffffffffffffffff, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000fe3)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) munlockall() syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc05c6104, &(0x7f0000000080)={0x28b, 0x0, 0x0, 0x0, 0x0, 0x0}) chmod(&(0x7f0000000280)='./file0\x00', 0x40) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0106426, &(0x7f0000000200)={0x5, &(0x7f00000001c0)=[{}, {0x0}, {}, {}, {}]}) ioctl$VIDIOC_SUBSCRIBE_EVENT(r0, 0x4020565a, &(0x7f00000002c0)={0x4, 0xb9d8}) ioctl$DRM_IOCTL_GET_CTX(r2, 0xc0086423, &(0x7f0000000240)={r4, 0x1}) 14:59:54 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b02], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:54 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x425) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video36\x00', 0x2, 0x0) [ 1010.759955] binder: 16247:16251 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:54 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) sendmsg$alg(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="b5ec24c6770560496c52bd3ac4b8d3c6240676adb40e2355101399f79d3eca48bb0b31b060d96e6adc2592e41183629d86ece6cda3bc", 0x36}, {&(0x7f0000000080)="da1fabaeb1b0839f8ab66a63264b4518d75d39e21d628027a2944d8f36ca000b22cac2a015e4fbbd54c850e7779adedc6be7ad97f458a294fa384f8bff6af6accc9217e26837d59d96287007e666bb4bdd7962eaa95dc27858e3ddd6ebb39d4463732ecb623572d00e7b98545500636533e5ce5e5f065bc8f68125f69fb166d0", 0x80}, {&(0x7f0000000100)="0c33764479eaacf0e4a049ab7d5d6aa498d2f78cf5272f8395da3b1560fd9b106acfcc391609af8707bc080122e857e4444195bf5a62c04b12fd9d40d5f12de6860f50bb73564c4d358d6beb96af43440d767129", 0x54}], 0x3, &(0x7f00000001c0), 0x0, 0x8000}, 0x24008810) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:54 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000100)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000340)='net/snmp\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) signalfd4(r1, &(0x7f0000000140)={0x8}, 0x8, 0x80800) accept$packet(r1, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000001c0)=0x14) 14:59:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1010.871628] binder: 16247:16263 unknown command 536872576 [ 1010.873633] binder: 16247:16251 tried to acquire reference to desc 0, got 1 instead [ 1010.889812] binder: 16247:16265 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1010.956209] binder: 16247:16263 ioctl c0306201 20008fd0 returned -22 [ 1011.040683] binder_release_work: 6 callbacks suppressed [ 1011.040691] binder: undelivered death notification, 0000000000000000 14:59:55 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x101000, 0x0) getsockname$netrom(r0, &(0x7f0000000140)={{0x3, @default}, [@rose, @remote, @null, @null, @bcast, @remote, @null, @netrom]}, &(0x7f00000001c0)=0x48) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="08631040"], 0x0, 0xfdfdffff, 0x0}) 14:59:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:55 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f0000000040)) 14:59:55 executing program 5: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getpeername$netrom(r0, &(0x7f0000000000)={{0x3, @netrom}, [@remote, @netrom, @netrom, @bcast, @netrom, @remote, @bcast, @netrom]}, &(0x7f0000000080)=0x48) fsetxattr$trusted_overlay_origin(r0, &(0x7f00000003c0)='trusted.overlay.origin\x00', &(0x7f00000005c0)='y\x00', 0x2, 0x2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0xc0480, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000580)={0x0, 0x0}) lstat(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r1, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$KDMKTONE(r2, 0x4b30, 0x3f) ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f0000000540)=0x0) lstat(&(0x7f00000008c0)='./file0\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000640)='./file0\x00', &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$unix(r2, &(0x7f0000000740)=[{&(0x7f0000000200)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000000100)=[{&(0x7f0000000280)="c56d84244d490e4c2eb5cb7c958838cc04bb0634020467d599018694a0cff42190aee29d8f8419958dd8afdd9f6d82e7fd38fb5c7c6492be3d78051d82582835d55270", 0x43}, {&(0x7f0000000300)="74094d8ce3d9730cbcc8d963d0c1cb895636d8372f88601b2d7f428fb425395dc2e428be34d7f3444c61f510e1b15e0acc41b2a2a4d415232c7a09ddef95f02a3beb881f2453209a541815c930bd6124987832fb14c862070bf605402e424b1e13b4f002cfd9", 0x66}], 0x2, &(0x7f0000000700)=[@cred={0x20, 0x1, 0x2, r3, r4, r5}, @cred={0x20, 0x1, 0x2, r6, r7, r8}], 0x40, 0x20000000}], 0x1, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0xff4d, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:55 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd02], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1011.323839] binder: 16291:16301 BC_INCREFS_DONE u0000000000000000 no match 14:59:55 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000240)='/dev/cec#\x00', 0x1, 0x2) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000100)=0x10, 0xffffffffffffffdc) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @empty}, 0x10) accept$inet(r0, 0x0, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:55 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) stat(&(0x7f0000000b00)='./file0\x00', &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$ntfs(&(0x7f0000000100)='ntfs\x00', &(0x7f0000000140)='./file0\x00', 0x2, 0xa, &(0x7f0000000a00)=[{&(0x7f0000000180)="7426a352374ba510367654fa3049dc3e79a19957f92dedf38210e8260444fa9a1be71aefaf0109b64ee267de902779f9fd1776e9a9a5a76fda86caa9a7cbc92b389f97b856f97d02c16df1b26f7225a4d65b8aa2d8b00ce72563e840d46909a5d52f4244c88948c038ae7dcc0891eada53ce827f02f48d1af0fa5fa2c916240ae5dd06895716d189d15835a265fd82647bb863387cd5d9cb58a21fcf4abda478a3f490fa2f2e59a673a56b1c3747e6ed256a12f6f93564dd445e9923e75a0faca46fccfa9362ea30c8a06d8a9f78b43b5c85846048672f8568b0115f4cf83f", 0xdf, 0x6d41}, {&(0x7f0000000280)="05606baff093d57ac97e244e5307bd7fda3617f4e89dc3e8cdef8a0f153713d20ebb610fc8b7bd75dc2e78252287e4d404a0d6230eef821949d52f39c98ffaf27a2f7ad2be8a59cbbc40a5eed4234829db747fce470f1d3c906e4953a4076bb3b9795544f8d999cb1efcfeb47c4dac908cb5f321a6e68c37e6a0685f0bca4bccb390664aba19c44f", 0x88, 0x3}, {&(0x7f0000000380)="42ef96f0970261fd7e394561479a32c6a6f26ad2d8ee13fd470faecc78a0ddbeb250e8a41a7f29bb527f8a8dbe4015aabe20108481da954438504907c377408d67c850e8326e24c79f6e7a69e7644727506e865f5d7f5e21c52d4f0f65cb6c82b08715261bc08e6bff2c8c0ae3ddf11ca16518987b369684691bdd1edaa596590d7f4b241d3e2b105ba16b4a36378aa7d8c2797ee87cb23172043ae5fa8a7b56dfa8f8c1612efcbb129a12df874ef467efb6813a5e8895b586713c5490bc5ec9cf8a45", 0xc3, 0x6}, {&(0x7f0000000480)="e41a94f9e545c602d2c5e78a7354f9feed2e8aa4fe2d4a418166e4236cff3c1e5648a3c4b2c4008bbcfecf601f87268edfce55", 0x33, 0x6}, {&(0x7f00000004c0)="61e4d501de3f5dcd7f17281e2a217fbd699100797468e3ea08b674b8915099359b0326b3950065a74a7b614baf65c05ac9bf568545f4573b99a5667992fff57a8e27afc4877c19d34f83afee0b33d1e2d20dc1f3491e706ff602554186f2389d8467643c284e8466e0ef9cc4b853ed12a8803b46cf38a962e4ae36933b71b0d63df4da8a15634a0b7781183cc52ab7920b0a649522519ba1af147be841fbaad48d942122fd6d989dcf2b531bc36a4770769c8a823f72e37a0f0db6a5784f03797acbc3684cc308d25f4738e7cf30f5f5661a2bf57d", 0xd5, 0x8001}, {&(0x7f00000005c0)="1ac6ad854d5b21e988fd44c1b7d03c06a3912f9ce1e1dc6a967b6a2aa887c8a161e00dbfe339d1fbbe1897e54d7f55636e8a93eb3ea0be1fe44ca1a25f52f99fa14e0578ae3d0ae2b1368e102228720aa5de2e759cf2d292fe19249828f2d76558e201b04b8d6be55cb64664f0332d22653f34a7ecff7253f279ae8a47f2dea12468e5340a3f2c8e80b70929c9fb34f1c5108b9865ac4bd71bfd06bead4f15a0f70892d13b8ec55ac567a3fa58f5b44bf632b0d23812db5f6b0e82b80f7f041612e9002fd203049dba8305f63ccc57c75b0753ecb6e64f4d7cfe683cad03a3d9906231050889aecc7dc6580129580b91e87eb0104f2d842ae1e278f6a1", 0xfd, 0x2}, {&(0x7f00000006c0)="2b8696e9a38d6af8438f27997b034360b6c0605cce8388bf18977834c704bf2c58f37cef4a1eca5f92983e49dcbf69a2756aab0e504ed5f6ae1d0a9bd9f5e00e9f19d4a23a784587e82554cc6488d879cda83bf7113cda8c3d6c69f3718a029b75d91028daa1ddd75d297d936327422138721b4ab3b209d43f2526e6f8c72409a9cb3ecf207291d6a972145d5f8df9e5ad", 0x91, 0xff}, {&(0x7f0000000780)="4cce276114b14cfaacb17f667968095db4d6fac1c7e85780821d965f0d0974ebf4a9c5845a6097c08ff432ba9232a71ab3d5f8e5f6c2221b22740cb1855a38c2bf8f64e06eb828de35d3b35ded0500665691ec39e36d4bd8c157", 0x5a, 0x6}, {&(0x7f0000000800)="bb6725738b9b6590cf3559649033676f1eac5f1d98274dd8318a52a2e5e1848bd16d08976582b42df9f99eaedbdbdc02c0a53ea149ae98655f6a5a2b80040be741c3568a2c0ac22db3e1b0960ddd7d4d00903f100c031d722bd5a914fcec07236f93120d25d5ee91c4f556fe925d79720d84a026e47d5243a7a445cb865f25cade7471e7265a0a6ed9634b985754958994708cb262aa67ea231bc115f128a211b5ab6506a822b7625947069a90a65464f1ad55d6b1a31e8daacaa3fea15ae0c20cb8fc721375c266df", 0xc9, 0xb55}, {&(0x7f0000000900)="2c465f0a13816ee045d92585bbd73edd1901014fa9a32c15db4e566cb484a0ef78d36574b650d1ba1b9a5416064e997e0a1efb113387bfd15bce8448b0c0ed18f8ac9d76c4fbddb811730f387d8207ad8fef9b2bea92b49049deb2394be7d9c1f44d4cd101aaf761da5cdf7eb59223d643aad35d64e325c25b54d80f9ccfc07467da598fec0f9659a737534598a112c4d13b92990616b940a1578c13a19e72d672c4e5354a60477d16162ad6ae3a1243cc7fd7f9418ec56ea45d1e9d6fa69edd135c900619be28384146745e31628a519a527c7e09259b6149fd177d6f763e83ded3515eaf73962293d8fd0f47d67caff04c8ab347674ba87b5b", 0xfa, 0x5}], 0x0, &(0x7f0000000bc0)={[{@errors_remount='errors=remount-ro'}], [{@fowner_gt={'fowner>', r1}}, {@subj_user={'subj_user', 0x3d, 'net/wireless\x00'}}]}) 14:59:55 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000040)={0x29, 0x4, 0x0, {0x1, 0x38, 0x1, 0x0, [0x0]}}, 0x29) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) fcntl$getflags(r1, 0x408) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) [ 1011.377166] binder: 16291:16301 tried to acquire reference to desc 0, got 1 instead 14:59:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1011.494046] binder: undelivered death notification, 0000000000000000 [ 1011.521487] binder: undelivered death notification, 0000000000000000 14:59:55 executing program 3: syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x3, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="09631040"], 0x0, 0xfdfdffff, 0x0}) 14:59:55 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f00000000c0)=0x0) r2 = open(&(0x7f0000000100)='./file0\x00', 0x400000, 0x8) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x20, 0x3, 0x85f, 0x7f, 0x0, 0x8, 0x20, 0xa, 0x800, 0x7, 0x401, 0xfffffffffffeffff, 0x2, 0x4, 0x4, 0x4, 0x101, 0x4b756a09, 0x0, 0x100000000, 0x7f, 0x1ff, 0x800, 0x3eb, 0x6, 0xfffffffffffffff8, 0x7, 0x9, 0x0, 0x4, 0x0, 0x100000000, 0x4, 0x20, 0x4, 0x7, 0x0, 0x5d5, 0x1, @perf_bp={&(0x7f0000000000), 0xc}, 0x4080, 0xfff, 0x8, 0x8, 0x7, 0x54, 0x1}, r1, 0xd, r2, 0x9) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:55 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/wireless\x00') preadv(r0, &(0x7f0000000700)=[{&(0x7f0000000240)=""/19}, {&(0x7f0000000280)=""/255}, {&(0x7f0000000380)=""/241, 0xe2}, {&(0x7f0000000480)=""/150}, {&(0x7f0000000780)=""/179}, {&(0x7f0000000600)=""/23, 0xfffffd7a}, {&(0x7f0000000640)=""/171}], 0x10000437, 0x3) ioctl$SNDRV_SEQ_IOCTL_RUNNING_MODE(r0, 0xc0105303, &(0x7f0000000140)={0x1000, 0x3, 0x800}) connect$caif(r0, &(0x7f0000000180)=@dgm={0x25, 0x3, 0x8}, 0x13) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r0, 0xc04c5349, &(0x7f00000001c0)={0x9c, 0x6, 0x5}) socket$inet_tcp(0x2, 0x1, 0x0) 14:59:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1011.738431] binder: 16324:16327 BC_ACQUIRE_DONE u0000000000000000 no match 14:59:55 executing program 0: r0 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x5, 0x80080) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000140)={0x0, 0x81, "96b6e9971b2178b6f36b71652a350698acf9f992d46fae3cfcc1f5f609f0e0915def8d806be0e57ee203a729c72b39110d93e731bc6645e35bbcf0d9b5ec7c05ba16a4fd8373dc24055d03a6aaca1871c7d3da70708ed89a80aed8d8fb49103e499a4c5381ff7202b562cd0d1f8840ee55f66aa0401bde92e3d2776f2380bcf2c9"}, &(0x7f0000000300)=0x89) getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000240)=@assoc_id=r1, &(0x7f0000000280)=0x4) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r2, &(0x7f00000017c0), 0x1d0, 0x0) getresgid(&(0x7f0000000200), &(0x7f0000000380), &(0x7f00000003c0)) faccessat(r2, &(0x7f00000002c0)='./file0\x00', 0x100, 0x400) [ 1011.819400] binder: 16324:16327 tried to acquire reference to desc 0, got 1 instead [ 1011.841429] binder: 16324:16341 unknown command 536872576 [ 1011.857196] binder: 16324:16343 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:55 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0x0, 0x800) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000080)={0xf9, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x9, 0xfffffffffffffffd, 0x7, 0x495, 0x8001}, 0xc) ioctl$KVM_SET_NESTED_STATE(r0, 0x4080aebf, &(0x7f0000000200)={0x2, 0x0, 0x2080, {0x0, 0x3000, 0x2}, [], "b73da30a6942bca428fc628a2e27a46533594a8ac28dcf4f0712cc3ebc911a2084b3480bfb0a7694b3d26a4b7ffc7bca74468dfe41acba8c0581c7e900ff5b6af4cc9cb8eceb6be7c19d7430bc9e3f0a333eeb8baec59056150a1e09d256aacc26a2186f4bedcd2017faf4c41dcd820610a80714ecc8e0e847f340a40dc50da73ff6bbd93696b55d9b66b2690f17f41bbbd22f61cf750d2889d415cab0113e16792f20c5ef3d5a72c051c2a5b55f1830ecd9f619239ee520d0e5652e3f110aac17787411a964faa711b3f295d67b7acc69f71ef2e07a090a731476733ebd8ca1e2db430d2f39ea110fd69f7f56b6223824dc0d7d15befa166f6ffe4db5851bb8a098d7a3c00c428dd38f35e990a2c45d38f2d03bb29fc19980d1d199c0cc1fb93df770bb74cfba47c209924f26b20df7e9196535d823a7d0205378bf14dbb5ec47080a13cd7217bde01eb1e9e3aed2868a9b975889ab46c48dc8991afa0227eba30d7dd9d046623ffc0780974d94a07bf7cf1dfb444c5311559778e61d1d80277e2aeef67ab07d7937961563938f0c424e9f41134be508c7d2612ba4dc8833509e0eac575afd1a10602cea1f9703d5f6858bb9943b2c777d7cd1d14bc44841f6d5cb52eeeb904d840b748ec5090182a209eb5342d086da6abbca5c3905b2e240c953821a155b13f97ef41a0a54ea9224efb03e8b3f7276a6fa79769d9aeb93915f71c795598607d7be95aded6f0ab94feb1c82e03ba8d1e382cb25db733024356dda17d7ee71c4a0828724f8771f6aed86d9fdbee14900ae383b6c5b3e6166c4986b81dd47adc3f1ddba167224f0d166fb01671754a8d633200da64be801ef8ac32da6009a45506ec0f052c7419f675a45ed9840679f956952c9453d2868b4252e40da1906bae107e4bfe2f7e298e8f46d0c2930a3353d82faff7f1562eff9000feb582effb6ccca654691e8431c93678e89995a1deb542f1b7e36bd7641d0fb999efa0581084d8e787195ef19464e529edddf3eb6cb7894774c189b8b17a8c199c4c58ad986e476d16e346c50facd9d13f9b5518f23839ccd93beca1b92010b5310752dc99ae436f8bd1f2cfdb31c7f6a568aeb343fa7d8bc24c4ecfe79b7d1c85f2e2c453550e3967460fc56edfd8d2c8ccdf852f87b38b5f9fb63b503c04cc9c9e62cf7cc5b1084d7bac21261998ba1a5e9969b42c33260dc08ccf73fa872fed2a528239636a9c255f737eeac5f287c9469599f5cdfd03f918a13946158a552b6a80c0f22e75873e4186cf0365f9e3e9476b33dae8a015a5c7ff6d398852ffc7820f6a3bbf21da0ace862c43575849ca743e1d9457a5a92ff608bea6a0836750c6369a17f2a51369b16845117bcc8cab79a3e51d519a226f057b30c996dcd7d8dd45aef3345b02a8cafac2b975af660dad8106fe24db6d7fd1310f5844a6cacbf50104fa934e3c9b8b356cef08987970ca5b05940186107ca09e3743fa9f24abd45767b81c3b34c4be9cded801cc0bc1ca2feb31fa00caef3ad66ae382ec6e1aea6e25365f1fa2ccf044f4e4727b0fc0754269e6e73558afa7554aea5f3f9fd683b421da31982c80ec977d6b18f938e81b3e0d0f579b874e8306a6813e1cd03946b58ca64fc615864890132fe4fde7e4f748a5610d01f93df4056cd56fbf70ac072bd60009f68bc70cea3e6a4fe80306390749f79ee122b47f7d064b4c038b142a7dd2729b33a4ae5c6a22b52c54d240d4cca0937e87c1a7cd93eec063ceb08a5d0a0f933dcfd6109e8394bf48edbdaa6bd778f2cb540afaaa2129b259869e2b808d7c73bacb3fd68e5562d88ebd9f5461a6dfba4d94f62007529989eec2225921226b9a6cf90d29db9232ac39148cf2afcfb41f4153aff65e775e59641b58582a67b849795717ae260fe617cd642bf96003505d702be8eeb9a1fe250537bc072351dc083a46b12a9267208ca245e5087536f81c57bd6a68cfbc8f18e8257f2bcadf81621d9102dd5e4865865a10e59d08cbd50469cb15b53c73f04f34a18a7657b6c56b12054f74da152b867e29c9df3570dff24330045c43cc6e38f17fc53d68bb30ad522b167227fe67dc4dc3ccd1a9c473a06f9f3ccd5f95b0384f71803cc1a5cecf08f5c6033e8c9754ba57b7f7e580d4e8435365ae1ffbbd1d1248a53fa9d6133814a56ec970c664811a934102599e11d41963fb25df4cfc135bf60e558b0bbec25f610eb7884c7415466b7d9bfd063fcd349f5812950c5bc97910ed6a384eb2f86a440c7ae11130d3f8da28f5e92155ed24d6d6e8df35582ace8830110a650df3abacb77424168106bd7eb8865238e5ed8e4ac351c8d9bb1b2bc6f1b95fecff14578c722905ae9490d4f3f7494bb6018b62d8704da3b93bf862b83bcffb2e0234141c9805fa216872ca3471ffc8c1adac907aa4f6ca250f7ab60df05d83574b119a7fb0e0f3c13777223a67d07b75ca9848e9799978ce7fa5f91dfd1387267ac3667515756d62b59526276677857716dbc10233ba08ab6207042af3cf13cb90deeedf1a72884e660cf5154eee36f3cda2193759ee468711a084a5b77b803c00bd07ce12479ff1f218782e36e3223b9f2d5a1118cc4b770cd7d406f5caa60ca97d8d1abfe69629cba4b736bb5941b1318e5c653ea69c0ad38a5a96f5a983659510a854ad553e420de6d85dec91c7da2f5b8891dccec6cd907fc8efd7d9a8cdc352d69b64aef3fb75e43fb8b9a18903fc3077f782d0a053f7f8bc2d4c11a1040f7ae27a76a64d99d0f95c9eb1abd35b8b72600cfb41a7e8466dba863b9551a4d9e7e351a5475deab1a1c09b1675848b73a2cf04d880ad72da2faca15622bffcd7d8295bb6c7d1ee44c9b6debb05ef6c3ad49e8c3a41f95da1fa46a0adbe3e4ad238d110771ddf2421d020de0a293ff3bdd40ee32b6e4ef687677cca52b7a977a12fcd2fb971ecae536f744177513003dc604c449b61dd403a3189f86af888f0faa82310244758e2dbc73f9bfedb4b7af4fcc0f2b8cfe24346dded6c76652f54e95623cb3ebf7d009bee2d9b994f479539be84938a8c922a5559dcd6b3779d76ac7ebc9749550b3ad2e6eb368bd4efe88b07e23eae09ab4fc4fef52d12f1e03c0c6674747273e1d127f0c2d523354306e13451b96345dba5b49f719cbfbc10e15f372f27711f5838ff03dc631c8dce47926832b6b36e211905dd78b254665283afcb3f413dee3f3213af1393eaa1e8b1884ab0a9996a811dd6b781e29ea633e1a05ee12682247351d07c2eb8a0767febe772a386073132deaed7ee212b9d808b055843cfc41f2f867db991d4aace2d740ffa1936c932305c444c8d71650e87aac742e561b9f8c492e55068f07ff06fafcccbaa56da3ce2bae9dfe2235b1296dc49d3dbeb65410e58504bf33c4abd58fd06f29d7da975468ea11083d517298b5852418c96eb1a8e9442dd8813b9e5a33ca4069fd55394dc1812b6edd0f121d189661812a225342376f47c35b07664a321ba58cbb31b0e8ec56b8287b88ea69ad82799990f0e9187d99c9cfd6e2e7796303ce7c8fbe647dcf8a8b7e3a43cc54b91aa78f3a755a759970d35963253dd6a4eb417c2b211de42372acfdc6fa59bb5f83c6ac5274fe70452073346338e7201cf64006bec683a1cc9cf8b025a5df22b49c3dad448cd652bf4806f72f496b019042dd46d2c506191f9a61a6af8075acb055c3945c00eab1085260b2b3877447ac28f65cf1fb3b356768d3c0116aebe3b41d8adec2164a961148b1abdfc4c8b0654a058c70749b43795bfdd0645e3f424fa1cc42246ef8623a9fe25520b36472d67b89e8617f8b86ab8d5dcd5f30c42d6add4c726c41cbc77a7df4242dcbc4c9cd686270acb6207877a44d1d8ac15a5c98c77de140a72881f1ab3892e1107c64bc496ac3d139ba0cbed337963a0d5cbee42aef97f1250f172bfdf93fe6f791cbdd6999ca791a100f71e960252b924440976a5289c353603af7a27fda4ff94f8a2972c9e24287d1b8cb8e188dff5ff9f5350f68327dd0bc0730bcd9bfe1ee81c49bda2069187b6ee7e21d20911c75ae943c8df5d159b0a8fa3a5a8c9be55a9f01c43400cd2df3a8fb8f74cb7edb9eeab261b11708c5144271536f2bbe4a18d2e9a22c48c23e362a7780fec793be989dd061bacf4288b26793ab54f51b1b114116834f4260aeb792fe267f67b96c709cdf1e4aaae004000cd5b50093ecd55e37bf2a3698f1df0f10f676187c1659dff5318e6ba5202700c706fd7b6481e23597e92c08f054bbd7fb916c02b475e353a932e9e161333183e1a451ecacb8d2d8678f892594eced2a72d199566bd74ef915aa613eeac3edcd5d477eb9acbb2c91dd765c3cf70eba743b4c90afcafb623963fd0ca30c59d32ca04f52945dee6fe6d95df8038bf7f0e24e8b92bc3b1402ae433bde436a5ade73f00857b57683b7594c537f7e0921f37695cc6de75752953e15ff848be053422b63ed1b03a82eb7c3be06a9a1b7d6cf48b50e0d4b1f51632a3a8786e0d98d4f1488e9c086f6f6dd2a9a2d133e00a1088fcb872e0cfaa49b91bdf16b46e39f6098699a5187311b40e0b7480815a69cdb4036733e88c1a456c042ecddb4155a082aa5213f28c35bdb228f5a7c94f71595c3444061fb4cc9df2178e78bf94a15c3b43935314e58d42847c67fae73c9c2b2bd0a8d31aeb90be99706d16cd597002eb8f1ed4e8d7a99a213c2e312c4af97790d45d4ecccd6377d86ed763ed91d38b5e3f62df8c941ab0cdf9e1f467666de928d395f22892b98fbcca5bd88e89b7c1c00f979888bfb220c937920a5770ee375ee8262f2b7daa116fb99e3bed207cd7453b18c6eecc1a74ce5c83f714d6d23da13e42f7c3490a88eb1b8f41511d435a68c4fe6cbe70a013fe5eed662a749f209befc6b07e018126b8bbed6ba08105a52b18906e1baa7e0fe3b9281256c1410930993f80e1c060db92b9318f91f1e6bb01eb189e269470bbd29aae5182676539132a1262007bc82f378f3f1154cd780c7fc56ef95561667da2138fb36cd59f9cc55b360b49907c444c527e5c95853cec3bf92bf8ec59a8e6a2057300805c7770f3eaf6805cba4d4789744514eb8e4d79840134350504db96c14701a7e2f2ed90fb175622fac3e24ffb5118700a8a9976174318a4bce41fe71635b2ee21cd488a78fd193cff4624a1b213eda5f903afbb0d236011c9f730733f472f61fb6e0c242b0a0413c38e824e0afe2d4e27ea7414f7b6237c4da22008f670eb1f8a109c517f417e1a206fb0daf8321cc19cc012865fac753217d64d06bb7df3d54c42903d0e77df7ed390d3d1e143a170d06bf563cf7f7affcb74bbdd078313cbab0f5edb4662dbed502baab36f8b131c5f2b3c668191c62ad16fd99ac8da6062f16eddf10938384fc90fbb2f89712a342196dba9235f004e7e5b448a5fc0d2ffa70f52f0efa32d0474f6af14fad0d34e41d5fd0a1b560ef90c92780f608f2c1e546cd7a9adc80753e9c1a2ddae4fbfb13c944f18e48e6a7b08880676cc535bffaca6a5c546b01633805da2a967734c8047a1c0241997c20204a8d045dde05519e0f27b309f6a722cef2d6f08e216ab1d03dee96a638dd980b7de4f4047ecf284b485c3ace89db85c0ef721ecd3424969a931e25c5116ea06d9d2807a128a3c64327b07617e85cb90bfb1f7bcc059b9d0f5b929e578174ebe3afe05922e753ac647b2a9a6a212673e38d60d96e896d474d8fe69c7a044cf8a6df03f99125ce13d80fe4bc8464852342c62868256a", "407040909a99653fa370f9ed8b19380f562a01c4262efe20edf26e733815064f18dba54ebf8315398f5b271bfa92265a5b71f00243dc80f64c4b1af8eaf9070dbcc79576f1cc15cc5504f44e13e031c96cc2114641a99b40b84dc52c94abff184e982e1be62b9028d394444beda83ccdccf22c41f00181ebc51e069ca22f540983e6bff31c3af7731cac4204fe3be8e0fe17fd471b9a0d4549a2e4a91506d0d1f4e0beaf0013265301eee381296307b36e1cc5b597a43d95cfe84429df0303577e2261494dea79587e03526f3ffbba53f01dd44ef7c3b023cbd3c10904bc362a0cbc7a15cd58ea4d068eef407d3b65e85754fd9092e6eefea1edb37db2f1e7e0da374ab64cb8a6a1a696942004a8b825384340280d91879e4ce18f0e28a2263fcfad67f8bbd52bb66babc3e7a575d0b74506900b7b7e5817f33a911fcc2b58180e22d90a1fa58997f3e5f7a89ff0291dfb9bd828f976c8a5c707fd8b61b7224b3727544636469080f500f2c239c4a56f0d7ea7284eb772df93c4e3f258218d5a2d9c94e2a1e0924a1245150e8e64159ad7fd819c749279938d49862700fa4eb225f0a5462dc24b95c6b10fa9dfd5009a3c513429b1644c2c2e2b845bb5f26882d0715d5e31b7c58822d445222e30a2127e312b58f06fb86b2f6f9274d9f0cbf84287c40d2b90ce2e08c0d740d82d077e87478b03f15219dabf245b246514d5f9067c1a0fff32538c27a98edb2079350f90504e321305c4a2c0216399bba1b814b8d79bc29df975367ea6047661d407a2696918891e2eb9b816451a4c54ecc35f9de18094577324381aedcbb6eedf0467fccaa73e8f42e84fc05c0a620c00ff6a8e3c2c72c25eb56c16c1f488a599c7787538eb7b7535677e7363742bd74013bd4bb3cc67ac63f0023abbe0de847f7be9cb1e9fd7be22d7de952d3eff089571d2626c7372688a5ece988198990732c3bb743637e7efc90303e28bdea354deee4f336a6c1b55418d1fc072767104f2bf3475fcb24e60b3a38aa62970e852823a25f83e254892e7e2d417717490afc2d0ca0f3fcedfa839d518d1ec69ed46a9fefc5f45f68c1617a61ac8a3a584876dc74415cc31b1b33cc823746cd36ddf23d0b432f19a9b1c8c5e43a51391a29576f5a8328d2592864e1c41093fb0083397ff135ee37fe5e1097cbf4605869788bad51ab49b72127a4672c626cd6a7da8d5bfde9f4681f3f736e48fe6557d0e0ac52638aecf65390449fd024da5cf1c2acbd89626dd30a650a1ecd329364b19a0a7f859c3dbbe47e6057ae43ccbdaac09dc978a0ba429be7d47b9cac48dd6ddef32b36d6e3a956de9303025d5950dfa50297dfae3c97d6e2e8049f804d54e1867fa4dfbcdda93bad2c82020e4a465cf93914cedd009df532ff2feb5d0bb37ff4c681d112379da99da0b7b701e9e99748bfd74f5bab486fca2f3ce9bc9e09649c347433a4d946fa7f06244d4464dff5b76f0f097b5732a636979c5eaf7ba8f019e81364fe55d498a0bd5f88eb238876a92606e3730f69a5123557c2501e18089363a16865beae67038fae33ce3a229ebab5db3db97cfaa7145ced29a70b4a98bf7dee5502fee7995f9bbd8a4b149ee39b0c2d9de0f49910232797f7ba9511c31f1326e42ff3e664fd5095902184383a0056306963a437016bb0b3e95d20782c98b0e449454b3e3b90165977a27cfefe3deef9c41aa9aad57cc9e9c46e7ca1eb29317a2f332ce44f2a495febd5c780025587bb799ae99423f1dc3ca5bdbc482e94e0f7b170b6fe19d7506d094e30ebb4095be3a7f7e97ec432439da13f2b738a0a64eb9e92cf19c75c5a6f7b127a884eb27b19677a5b9afc4e97d820447bdbe034d3624659467c28a160c046b1468a2e184d8a72e8e0ba6dc71eea910ff27c8372c632a7d77fed6428af96d4e116bcec632353776cb5176fc88df15acdf8926b15973a2c9a7c9805eae0df14706432289afc7921742c98a962158ff7eb842ec84afa56b0b6b35dc18504fba89bb595a4fc8f046cc257f24485851c9a0089edb0c5ada7dbb31ac56eb5c2ed164633d852a9e4bece4dbd6a6daefe5f47ecfa5def9a804274b110fd4b1a1c9a1eaebb6e7497e6caec8d063759593906828f4a791a0cc51d47b756de1284498a80627b6708cc6e69986bc352e5ee52fd19521b9ecab73482ba8ba1305d574545fafa9ffb189ca24499cb2a960caf50f9efb8675c0ece575ad63523874828c099d66a9ac8c51949a24f56e73bbf17d14c2d4274b67ef49a2eacba869a581e8ec5ec8af999b5435a159e532fdfb79355995372ea7b4920e7670840a3bf9665fccb35bf9dee49da1490a573dd22cead773f8e9019645c00ae51777758c53956b1ae6b2b640ac7ee41edd9b020586ff6dcd75bc6a3be2918adf76a1b70bef5c433c8dad43328a876a0eb6148adc1e9bb92fc942180cc97c08849c1cd2546ba096c78aa5c8bede8ebb81e33794a311072b20454a3b07e7d87becaead0737b24b9fed93806c78479704d3e70fbfe5839d33822d7b0da97ffc9a0b7aee3aa0ee2fc47daaf864109dcb9a108ad543676bd174119a467ac8b245a16c177c6bf79b045ff4ccfa73869b18679d0e5bfd947892465665792b2b96db610fb22f654f1131f74ea8a5e3e28cfdad8421686295acc9bac200517fe73942a2ee8a85d7cf72c01f2d0abddfb392db43a4ed163ebaffe2e4e1d1fb18b8e132d3c6ae9ebf005d43f6dcdf0c51a477c999b214a5831b68c584152ae6d97f77d9e20f9c549ad84811f9db1b8627390215c6c15542f22d08783b58e86d366ae4e3fa0cd85ede0b3bcda8aa76d0853a9578449a9bdee65ceb8df8964642e8b4428e34278d4e6c70bb6157e6aa00a49657b0c9c1b9d42d2b7f0b9d688e9c1f4784a271828e19bc15d0e0cc04e690b893d41e4887ef55c4e17bdd15b9fb7a9d420a45cfc15b9be517190d9b15fb86fd611131b24f35e8dfe18d2f94c81cc1a2052767693c1884c9dfbcbd2bef5d8c2f9cb75dc1fa966f6593aef661c8e3ca5fd08dff45d92ddc7c686a211d1972a95131710366ec8b3d2e379968d0bd2890339f9f7851f008404fb33d8cec82487aa8a50a76cdf7bb1d117af1da58b8b00658b993c16b837ebd0e289c50b1e3deda7f74d3ac7b3bf4cf5195517e6b8e134a2edbcb108b3745607dec936844efb4e24c1b07852d046415310af51340a1947866cafba05e5c12106a3af256a7df48fc82943227ac12c29054f370292fcca2143c8727e190406370e01c88c2472b15d1cea9ceeeb0289718f6dab18a109547ff9d820fdca2e4a3c1aa308111a59f5fc3397cd1c6c7b3f9ef3ff61e442ee060378ee53a8d1e60fd3c20922c2c1c27498839e99c2b3a514bd8694d7cef40596a6a36af9852683ce8d00f53c372740bc148dbfd9b2810d0af7044e83adf32b860ec71037612707e68f635ca3bf95d9cb89c17ceb80615604c06d4c74583e251fb73a63e816b867f27206c22ace928015e94e9e4b640468debe152bbf15712b2345ec2b9b7769b05c1cc9ec45570ab754bf2fdc0b70eb5794d831a7dce784a16eacd9b2e4edb4cdba223158e4debef1fade61cde9495537301952cd3ff766cd2c5217bfa6e153749665c689d0469044a52c94e3f9ceea2e682569ee994c41b30984c3bb28dc8fb8887752331a759348665cc3a33fa53773ec3891e95bd7aa7ebe147777c0a06ed55026560fa58752bd8e105cde596044fd8352a689f9dca94abc468d0be8b0eadc96a07ed3a2d48f427ea23fd0acde1d95791acb18a30d82c6f865f8be5426bea6b6c94875df5d5f52d3e5d4e83352862a56747d7c2f9cfc27a5d5aa23e3522432ee415e5918571733fde2b0f5d9b42651cee8cb41b190db20ccbbe6477e4fc1a736a6849bddc0f70845b858f33bd1d622642f003382d262ed4067e929c3808ffbeb99c375709bbfa92909273a5a41bd307f8b49e0769a6a49f26059fafa00019d23010bec923b1594aac45964fa6e9512c18b8f1ba1b6ff7179580a519502825e84600423251d9b3cf13e5674238bacc5f9eb87f1844e8fbc9ffcb9736d459b0894f2dc410ec6559f0e764dcaaa3b718b0e55658d1238741cded1e8df4c62644b2491546f062e4f5aa7c92129eac3c3745e160e29ec43ede3b2687a50de670c57c193cdc339cd5788b33bfdb5dac091ee35bab8aa6a223b65565cc43891154895fe287da04ee16f70b0397433e6a70738e064e626281c5caddaa14daa8b0047f4eedfedf778d8d197354a6bbff9ff5cdc9e3ae50839c0fc7d171cd8905462d9cca1c78ba3e328ac2e6701d4d4ba34e684bc48e647cdbeb0cf50536d1f4112a9bfa2865d74bf092a7033410ea56f0e68e05b382ccaf2036638ea86efe4ec542ef12f8b67c472bc7e5430a92415c2805a2736c607d10aa9bef9e9dae13b61e85966f83b447cd043308a8af1ba92ccb28ccb11f7b01c38658371f12635e4bc0da007f0d4ef45d3a28d294973b5d2ae2690cc708e7fedbb47e158ef6b8459f67a8c4beba05928af8f9c5430860bba0615eae880637d29aad44c15ad3ab3be563995f2048bca6e31bcefb975b32b1d98d602cbe894b2777ce83c1bb74d355cf4d183ade96f48890ab76ecb401a81ea789895c10fb9f881050bafd9fd3e08cfe6b89603a5e6b0c4559913d052fbf51bf2ea8d30312f43ab40ef4042040125c836de67c4c61aa1fe9ed4e2beb2015946c3777478987dc80f158a39f72c29887cf530a59f86dfc40a9bf91bbbf1338a2bb6b27683202fbefa96d599bebc29d2f7a6527c35b0fa3b786cba42e80301054b8d1f18c8f2422bbb173a9d32fae4eca492ce4fafdc2dd452574e0a3e464a8b2053511071837fe090fcd324067143c55ad52085153c74b1950b4684e28735efb7e5a340862763a1ed672f3c2c40fa09790f911e7fdb6ca48beff0734a8beaf56de9d7c4a4477a18dc96a5d9be8b6e8277800d11375d4d03c895cc32d3e4e8672020b845d1b3f78934dce89b2133ca6b605174f06754dd7d325e6c845315eae3d3808896dbce5e911af680fe7a2d272496213b807b68becf829ca06ff07b88451c6f3e175839ac30da0aeb82cd6fffabd4471b6c5358867530e7e7216f4197d9827c420d43da7bd80dcb886622c8d9d3de8e808f285aabd3a2133303f0c090fe8d2c8ce7388e974209372d89934b6020565e36decb4f4fb6eac431aac073f99a5ba30bbe9ad7f8f8d655bd86e4c5362f677472424ffcfb44634d6b2754af956997db3f47bbdb3455bc3eca406ebd686141903f1a38c16be08220a7b9c71dfb8cc62b9c6c30779b78ecf173726460c1cfa16b99dfb57936bfec7f23df13224141209e10c981c5dd3acf107715124f69426d9aad0421821d1038c4794cdba74f7461763c6d70dad1f728069a72218dc9a94a1d267aab5788bcc2d7d64a742d4844bd6c340779101b264c6ac8cc274db0d539edf2ec00c782354b8179b6c2d7e1da247cecdc7c0d51078a4c87c11e9d4a57c03b1255a32a8b402d96df58c91ecde5c6c90bc0c047ae571491538517f1e669256b9451bd432095d0ee19ec3ba494b6f3cdc2af6739075edc64fe28d6e9fc668f9c58ab456aac0384cf717978284f51d629fb05627fbbe5db48d729e38e829d0fea576508a606bcc27681a2437fc2b3fe60a9080c8aed26f7ccbddaa4ac0aa02f947b3c385e5bfdc03afbb1b8aefbe212f27c0b633569c7bccfa32a4066e79c265113260606776246159559ac582f212810db332b9523f"}) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f0000000000), &(0x7f00000000c0)=0x4) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000140), &(0x7f0000000180)=0xc) mknod(&(0x7f00000001c0)='./file0\x00', 0x8, 0x1) [ 1011.877059] binder: 16324:16341 ioctl c0306201 20008fd0 returned -22 [ 1011.890614] binder: undelivered death notification, 0000000000000000 14:59:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe403], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:56 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpu.stat\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r1, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="a4010600", @ANYRES16=r2, @ANYBLOB="000129bd7000fddbdf250200000030000200040004000400040008000200080000000400040008000100800000000800020009000000080002007fffffffd8000100180001006574683a7465616d5f736c6176655f300000000044000400200001000a004e2100000004fe8000000000000000000000000000aa00000080200002000a004e220000000343696e63ceb1bb42bf9cdee3cf31462c02000000080003000700000044000400200001000a004e21000010000000000000000000000000000000000002000000200002000a004e2400010000c15a30f3721c7328910bcd8818466a970300000008000300090000000800030067e600001c000200080001001d00000008000200ff0000000800040008000000180007000c0003000800000000000000080002000800000014000500080001006962000008000100696200005c0004004c000700080003000080000008000300ee0a000008000200ff0f000008000400feffffff080003000700000008000400ca168d6408000100080000000800020000000000080001001f0000000c00010073797a3000000000"], 0x1a4}, 0x1, 0x0, 0x0, 0x1}, 0x20000004) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000040)) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r5 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0xffffffffffffffff, 0x2) bind$bt_sco(r4, &(0x7f0000000040), 0x8) listen(r4, 0x0) dup2(r5, r4) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x14, r6, 0x200, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x80) 14:59:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00c@@'], 0x0, 0xfdfdffff, 0x0}) 14:59:56 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) preadv(0xffffffffffffffff, &(0x7f00000017c0), 0x1d0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) 14:59:56 executing program 3: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000180)='/dev/autofs\x00', 0x8000, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r0, 0x0, 0x3, &(0x7f00000001c0)=0x6, 0x4) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000200)={{0x87, @rand_addr=0x3, 0x4e20, 0x1, 'sed\x00', 0x4, 0x3, 0x6d}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e23, 0x0, 0xdc0000000000, 0x1716, 0x3}}, 0x44) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x1, 0x2) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r1, 0x84, 0x77, &(0x7f0000000080)={0x0, 0x1}, &(0x7f00000000c0)=0x8) ioctl$TCSBRK(r0, 0x5409, 0x6) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r1, 0x84, 0x1a, &(0x7f0000000100)={r2, 0x14, "98a8365e6c0ead709811de848d1ee2401cba646b"}, &(0x7f0000000140)=0x1c) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCSABS0(r1, 0x401845c0, &(0x7f0000000040)={0x8, 0x2, 0x9, 0x4, 0x7f, 0x3}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000300)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000002c0)={0xffffffffffffffff}, 0x106, 0x829fea5d83dd47c}}, 0x20) write$RDMA_USER_CM_CMD_MIGRATE_ID(r0, &(0x7f0000000340)={0x12, 0x10, 0xfa00, {&(0x7f0000000280), r4, r1}}, 0x18) [ 1012.197110] binder: 16364:16365 transaction failed 29189/-22, size 0-0 line 2896 14:59:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1012.247440] binder: undelivered TRANSACTION_ERROR: 29189 [ 1012.254643] binder: undelivered death notification, 0000000000000000 14:59:56 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000000)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000100), &(0x7f0000000140)=0x4) 14:59:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="01634040"], 0x0, 0xfdfdffff, 0x0}) 14:59:56 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x2, {0x7, 0x1c, 0x8000, 0x20000, 0x3, 0x8, 0x401, 0x2}}, 0x50) 14:59:56 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$video4linux(&(0x7f0000000040)='/dev/v4l-subdev#\x00', 0x6, 0x10000) 14:59:56 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe602], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1012.510604] binder: 16382:16387 got reply transaction with no transaction stack [ 1012.547245] binder: 16382:16387 transaction failed 29201/-71, size 0-0 line 2801 14:59:56 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000000)={0x0, 0x80000000000000}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000080)={r1, 0x100000001, 0x4, [0x1, 0x4, 0x7, 0xd504]}, &(0x7f00000000c0)=0x10) [ 1012.644593] binder: 16382:16399 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:56 executing program 0: r0 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x5, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000000140)='trusted.overlay.redirect\x00', &(0x7f0000000200)='./file0\x00', 0x8, 0x2) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) syz_open_dev$media(&(0x7f0000000180)='/dev/media#\x00', 0xfe, 0x4001) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f00000001c0)=0x1) 14:59:56 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000040)={0x7d, 0x0, 0x0, 0xfffffffffffffe0f, 0x0, 0x0}) [ 1012.686408] binder: undelivered TRANSACTION_ERROR: 29201 [ 1012.699010] binder: undelivered death notification, 0000000000000000 14:59:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="11634840"], 0x0, 0xfdfdffff, 0x0}) 14:59:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:56 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x0, 0x1000000000000) 14:59:57 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) 14:59:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf403], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:57 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x3, 0x2) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = semget(0x3, 0x7, 0x3) semop(r1, &(0x7f00000000c0)=[{0x7, 0xfffffffffffffffe, 0x800}], 0x1) getsockopt$bt_BT_CHANNEL_POLICY(r0, 0x112, 0xa, &(0x7f0000000000)=0x6, &(0x7f0000000040)=0x4) ioctl$sock_inet_tcp_SIOCATMARK(r0, 0x8905, &(0x7f0000000080)) ioctl$DRM_IOCTL_SET_MASTER(r0, 0x641e) [ 1012.937766] binder_alloc: 16418: binder_alloc_buf, no vma [ 1012.974846] binder: 16416:16419 transaction failed 29189/-3, size 0-0 line 3035 [ 1013.027623] binder: 16416:16426 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1013.079145] binder: undelivered TRANSACTION_ERROR: 29189 [ 1013.085986] binder: undelivered death notification, 0000000000000000 14:59:57 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000200)={'raw\x00'}, &(0x7f0000000280)=0x54) ioctl$VIDIOC_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000100)={0x0, @bt={0x3, 0x1, 0x1, 0x3, 0x4, 0x80000000, 0x1000, 0x200000000000, 0x4, 0xfffffffffffffff8, 0x44f80000, 0x8, 0x7500, 0x7ff, 0x10, 0x24}}) ioctl$SIOCAX25NOUID(r0, 0x89e3, &(0x7f00000001c0)) prctl$PR_GET_SECUREBITS(0x1b) fcntl$getownex(r0, 0x10, &(0x7f0000000300)={0x0, 0x0}) perf_event_open(&(0x7f0000000380)={0x1, 0x70, 0x6, 0x100000001, 0x1, 0xdae, 0x0, 0x75, 0x8040, 0x1, 0x1f, 0x5, 0xe6, 0x5814, 0x7f, 0x2, 0x9, 0x1, 0x4, 0x4, 0x59, 0x1000, 0x80, 0x7, 0x89e, 0x9, 0x3, 0x2, 0x2, 0x2, 0x7000000000000, 0x400, 0x1, 0xc3, 0x1, 0xe6, 0xfffffffffffffff8, 0x5, 0x0, 0xf0, 0x4, @perf_bp={&(0x7f00000002c0)}, 0x80, 0x9, 0x7, 0x0, 0x3, 0x9, 0xfffffffffffffff9}, r1, 0xb, r0, 0x8) socket$l2tp(0x18, 0x1, 0x1) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="12634840"], 0x0, 0xfdfdffff, 0x0}) 14:59:57 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x80000, 0x0) read$FUSE(r1, &(0x7f00000007c0), 0x1000) fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000080)) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x2102, 0x0) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000003c0)={"6c192a0a6e823145a6739ba83a33be7b73e0c481cc85eeea66352c1b08c54c2c79f7dafd9b1605bbadb76c2b027b5a9a4b46f0201267a71369f88f72983da8ff5c1bbb3869b399d3d1af2044d04996af76428f7c2845fc2f43d2a48da795114af96ecc81a3b2434f07754f40303d62802d85d2ede1820c8ee5032133a1b679bfb252261a0ebf0950413e3660f8151348b80afb64ff7f880da9f9ceb5bf82fb3f4eb12862f0f383390221f8bdf21c450b67635774e42edb8471ef455b076614bc03fa155345f7d662e40fb4cf0d83d87de80123d8cad8b835133f724df48dbdf4178c92f471112fe238bd7d0c38bffe3acdb3225a44232ace907470be7bd6b11c8c23d77981ad40398f1a75512a04b9886528cd9489d15d366b798e641a959a56ea6389664d0b22b1a3cd9308aee7ce47218d0a60a95ea952fea5465edc413db4ca3fb90c933af9b3e0f110d5dd30546a0144a9c2531e6f33d7f6d2b370056124a857cb4afca9e3e7d3c914af529f26987140829bbd645695b326bfe8b9f27b10dec0aa112ec9fdaaa7615b0cb48ad4e0d2643cdfbba09d3e0ebdb84eb12bbe2d0daf10aef8376f0e9e2e536378bcb4affdfc72133ba158b5ac700a43267f8560f0884201d9dc7ee65dedb452dfac4a554e5d95bc282fa8021d4925b304d3a9db050123af0c453b74b2f229f3d750057d31aa62b8940d35823f3af7e1ed5cd1b5e68c7296d6ab6edfc2683103db4974021cc80fda1547bdb20431e5da9dc7e3b318f978f997461e476ceca27082c97dd53fb19c545ddbcbcb96b08f086d3fe48f8c71ce464bed2b7a441b37e0d9bf8af71ddff1b4918b0b774a4e4de3493983c0832b4e1745846415a6729e0de72f81d5056dd897cfea94491d00e41c759ecca0904c3e1eb1c31f044d2052c164138dc657cfe1bd79d6dc66a336d3f44a5d8930fb8e9ca59255746fee2e02889748db356f9c2c39f4f466b3e142bcfbf88a07ad1eca7d15c57ff15f2bfcb03a808900b3e6c3762383e56b63ea7f205609586bfca77477a47b3280e94154a91dc9171c62e50166222e9452e46d80a8e976d38f532f5a0c52ac184637a338f7eafd326739183d0157c4b230dfce07c3386af00577fd321b54d2eca9a2c2b900f35d7644cbb43bd242d14f7b3286df3996fd40bd9461d1a50d668cbe048813bcc8c86b7ab242aecb126975bbbbeeb4dab3b78adb171af5597262d1c59a91bfa078e802c1e9e950c0d8e8a3bacf8e35d6b9a381856b388ed326a3f19b3717b009920443e5ee2d9bace87d5b151da9947e2e03a1c7570510db74f77289bd58b40cb1249ec78a74a550f0c401884b65c1e2728ef96d838c3ae628e3d8db3a7df5f20e9b1f2278eea1653b791c15a486eae4692dfb9adf7490d5a4ec809012c4468bd5e0dd383e61e453334519708ea6faa25b49884429"}) 14:59:57 executing program 1: dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:57 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000140)='/dev/bus/usb/00#/00#\x00', 0x9, 0x101000) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) getsockopt$nfc_llcp(0xffffffffffffffff, 0x118, 0x0, &(0x7f0000001380)=""/4096, 0x1000) 14:59:57 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) bind$llc(r0, &(0x7f0000000340)={0x1a, 0x307, 0x79, 0x0, 0x9, 0x1000, @broadcast}, 0x10) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000300)={0x53b77e98, 0x0, 0x0, 0x85, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0x4c, 0x0, &(0x7f0000000180)=[@reply_sg={0x40486312, {{0x2, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x50, 0x40, &(0x7f00000000c0)=[@ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x1, 0x21}, @ptr={0x70742a85, 0x1, &(0x7f0000000080), 0x1, 0x0, 0x32}], &(0x7f0000000140)=[0x18, 0x28, 0x78, 0x18, 0x28, 0x0, 0x20, 0x40]}, 0xffde}}], 0x2f, 0x0, &(0x7f0000000200)="285b75d144fcb9e6127cb03e5671efbd835ed0cc975a2b60222073fb1eeec368df9bb4dc66e78bb28416c495942383"}) ioctl$VIDIOC_G_MODULATOR(r0, 0xc0445636, &(0x7f0000000280)={0x0, "cf0a0a41500d3b5f5ee4a79d8671ed6855ee528771a0b788310eadc946ba6d1d", 0x400, 0xfffffffffffffff9, 0x2, 0xd, 0x3}) [ 1013.344443] binder: 16449:16450 got reply transaction with no transaction stack [ 1013.377290] binder: 16449:16450 transaction failed 29201/-71, size 0-0 line 2801 [ 1013.457988] binder: undelivered TRANSACTION_ERROR: 29201 [ 1013.465176] binder: undelivered death notification, 0000000000000000 14:59:57 executing program 1: dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:57 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:57 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(0xffffffffffffffff, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 14:59:57 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='memory.events\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_MAXSEG(0xffffffffffffff9c, 0x84, 0xd, &(0x7f0000000200)=@assoc_value={0x0, 0x400}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000280)={r1, 0x1}, &(0x7f00000002c0)=0x8) ioctl$SIOCRSSL2CALL(r0, 0x89e2, &(0x7f0000000300)=@default) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r2, &(0x7f0000000080), 0x1c) r3 = dup2(r2, r2) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r3, 0x6, 0x16, &(0x7f0000000440), 0x132224) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = gettid() setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000040)={@mcast1}, 0x20) ptrace$setopts(0x4206, r4, 0x0, 0x0) tkill(r4, 0x3c) fcntl$setstatus(r2, 0x4, 0x42803) ioctl$SNDRV_TIMER_IOCTL_GINFO(0xffffffffffffffff, 0xc0f85403, &(0x7f0000000040)={{}, 0x0, 0x0, 'id1\x00', 'timer0\x00'}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r5 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000180)='/proc/capi/capi20\x00', 0x1, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r5, 0x0, 0xb, &(0x7f00000001c0)='net/wireless\x00', 0xffffffffffffffff}, 0x30) r7 = syz_open_procfs(r6, &(0x7f0000000340)='net/wireless\x00') preadv(r7, &(0x7f00000017c0), 0x1d0, 0x0) 14:59:57 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) write$P9_RSTATFS(r0, &(0x7f00000001c0)={0x43, 0x9, 0x1, {0x1, 0x120000000, 0x5, 0x5, 0x9, 0x80000001, 0x8, 0x2, 0x3}}, 0x43) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000040)={0x3, 0x4, 0xd, 0x7fff, 0x3f, 0x5, 0x8, 0x100, 0x0}, &(0x7f0000000080)=0x20) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r0, 0x84, 0xf, &(0x7f00000000c0)={r2, @in6={{0xa, 0x4e21, 0x8001, @local, 0xfffffffffffffe01}}, 0x200, 0x6c68, 0x16, 0xb16, 0x8}, &(0x7f0000000180)=0x98) 14:59:57 executing program 1: dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1013.774435] binder: 16472:16477 ioctl c0306201 200003c0 returned -14 [ 1013.831175] binder: 16472:16477 tried to acquire reference to desc 0, got 1 instead 14:59:57 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000040)=0x7) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x600400, 0x0) ioctl$PPPIOCDISCONN(r1, 0x7439) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:57 executing program 3: r0 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x0) ioctl$UI_SET_PHYS(r0, 0x4008556c, &(0x7f00000000c0)='syz0\x00') r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) getpgrp(r2) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0xfffffffffffffec6, 0x0, 0x0}) [ 1013.880662] binder: 16472:16488 unknown command 536872576 [ 1013.895125] binder: 16472:16488 ioctl c0306201 20008fd0 returned -22 [ 1013.934422] binder: 16472:16493 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:58 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0xfdfdffff, 0xfdfdffff, 0x0}) 14:59:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b6b6b], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:58 executing program 3: r0 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/context\x00', 0x2, 0x0) fcntl$addseals(r0, 0x409, 0x7) r1 = syz_open_dev$cec(&(0x7f0000000040)='/dev/cec#\x00', 0x0, 0x2) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000100)={0x320, 0x0, 0xdf01, 0x100000001, 0x0}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_id=r2, &(0x7f00000001c0)=0x4) r3 = syz_open_dev$cec(&(0x7f00000000c0)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r3, 0xc05c6104, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$VIDIOC_LOG_STATUS(r3, 0x5646, 0x0) 14:59:58 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) write$RDMA_USER_CM_CMD_GET_EVENT(r0, &(0x7f0000000000)={0xc, 0x8, 0xfa00, {&(0x7f0000000200)}}, 0x10) 14:59:58 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1014.228295] binder: 16507:16510 tried to acquire reference to desc 0, got 1 instead [ 1014.312495] binder: 16507:16517 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1014.367479] binder: undelivered death notification, 0000000000000000 14:59:58 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000040)=0x7, 0x4) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:58 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000140)=0x7c) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000100)) 14:59:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0xfffffdfd, 0xfdfdffff, 0x0}) 14:59:58 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:58 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$nfc_llcp_NFC_LLCP_MIUX(r0, 0x118, 0x1, &(0x7f0000000040)=0xffffffffffffa1a0, 0x4) 14:59:58 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1014.763046] binder: 16531:16537 ioctl c0306201 200003c0 returned -14 14:59:58 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) ioctl$sock_rose_SIOCADDRT(r0, 0x890b, &(0x7f0000000040)={@dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x3ff, @default, @bpq0='bpq0\x00', 0x6, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @null]}) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0, 0x0}, &(0x7f0000000140)=0xc) getgroups(0x1, &(0x7f0000000180)=[0xee01]) write$P9_RGETATTR(r1, &(0x7f00000001c0)={0xa0, 0x19, 0x1, {0x2200, {0x80, 0x2, 0x7}, 0x1b1, r2, r3, 0x0, 0x15, 0xa81c0000000, 0x3, 0x4d2, 0x7, 0x0, 0x6, 0x5, 0x6, 0x6, 0x1, 0x80000000, 0x2, 0x80000001}}, 0xa0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0xfffffe7e, 0x0, 0x0}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000015c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000001580)={0xffffffffffffffff}, 0x111, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f0000000300)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e21, 0x100000001, @mcast1, 0xfffffffffffffff7}, r4}}, 0x30) r5 = add_key$user(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x2}, &(0x7f00000003c0)="8aab008a548f9c29cac0e8b2916382379d22b7d109700a593c127d33d09df7c3eb3e7526a19da3f9389a1a8c3f59c179137226b5789eb111e06cc902dabcd85a35f31402eb350f8c13e38ef43337d28df25eae425a98f1bb7857d69eb4468526f9a76d0ecfcad2a121865c25c08f94cf49de6f29428024e46d3ca5174a2e75e06b87e7b4b5ebb649bce166ce0de3296b6c040d3ce5638ddad34be821c49858301d1dd3512ea9c9a1c6640b99bed0245c26bece814bd31c986a121edcdaf67892d78faebe90f5c95cab5561f2fb35e314f335eb9a7c6361480e7bb32480265fa9045005f1524f04e2b68fa2748f586e158b2427378b81e7cd5346742ccdd7f2812913b6069b30f988c672224d84ca40bbf2fc19bbddd66ac34fce96a30f6d56a47d8e28cf608ad05ae94e615d6792219cfd53a1ae950e7976425e57864e5fa6fb8eaf93958bbcc7740ee311452324f30463d6a5652ccb61e0441b1d1419bb7813b19e0e762f6bc1ad19c4af002cc8223b72dae041c2b2cc804aca6c1ba2809c9f6fe63ed1e01693a21c7a40afb2fa407593aad7dd46902b6ed9b081ee30813419a2cf89dcd02737290e54d8bb458d024f3c17c024a635d0338528d3ab3f23ea6f3e56ccb6a2bdb81ad11e4c79e57cb7464547ac6a71b10eb7920a13cb625b822842d19b415ed9a10573ddf5927149c4ddfd3ea435221d9f618db485f4beb0c5a2479145e02cd28dce18d3a1051a40f69898f0d41d2980309bb3aeba668ca3d8c7328bfee7779e1639df464b73f94e11926757d6f78c7eef164318c9788580576d8b46357f107805e89c9f6518f718e4abbb236c7a19d2dbca3a9d77379257c57daf6460faf5c9f52ca02cceae789bf31636697017e739c5fdc097f77f9e238c0e7ae70181de66ac041b6557ab7564faaf11969cb76f9227730fe57c1a6c8a557668a8acc313561c3e5268a5b526020e26775011e475c2e3af80e5f28c02cab3fbf7aa2690ee78d7f2b9e14e943ad3f2344dae7f0f37c6a22556763696a85a5d22ce2dfc615528facb99f8d921af8cc7ef2c4f0d80a4ebb474505bfeb92ac979e1fad08fd2deebbf65c6994e44c5e30dec60161390b4496bf7e137af7cfc92d2cd2746af6412f3dddcf114a0b59c70b8ccfc1e257b4ad9e624b5936bcc9a58f816e36c4828469161a5a6e68d59d1f396e392b37dc000f845592f10cc32efe9990ebf722908ab125aa13c5ceafc02d312b879c81f3ed05f8c45fa37d0de1ccf3f71a45e38d1a2b794ae4c21f45f12c0c089611b95968f57dcee6372eba60b1c60895fa52b277336063557202ba03f5f8eb94c0e0dd98f7436605a707dbe709e15c0c586c740503670fc7330e61f54240626d6d7ebe943baf922bc26fdf015d773621b8c7f6025ca68bea09726e890e9cff0cda50b43f18196d47b1ae709a3e4a569beb62cdea8db14c2c9281744462c19b6f9bbf43608ae1e448e99458d67b0524c422dccb54e6d633c162db094f9b3d91814d4b0211521ab6fe604e003111f98fa9e975f8454ebde5a02aa25dc155e36f55587a26b46e6f2ef592bdb4b0a9696dd75d794aa938dc65d2cd016e673e58132ff938f5388dcae0d50f7c377a0db9a454478b097dce7996c8c46abca2c2e61a7c87a55c44f91ced8c715997adf6a2e4ccf969aa60e9540798ec88ae2beefc71baccc2045f94e0141d2cf58bef705dd3d1dad0802a285a1d68d281ff55a64b44b29369eaf7a153430936ab08443e132800ed758c94fefbf148714d27255108685f8b844eef24d3e77a41db29272e65f389879691e990dbfe93d21cf0d0bb20b1db9d09ba1a18b8a95a8bcb4190ffa2811601f4be2afdfa0d825dc2e7f615ae4a0fac13c047bf193bab34dc358ef56d6a7461135064910ec4468bf26908fd80fc549ab18036f09602fb601634fa58f3f30c5e55a8057054bb989a870a02e1782f7f3886848f4fe85a894dc4c127945b2a978aff8a24666b89f22f0ad60e758a896636af3fb71c30c4efff71245222445451311a39c55b03674bf556f6b6e754dc0ff4d579a9f53ee6f895afb7acc58fd868ed6d4cb5853f03d9dbdcb5b910abe57063cebd8622eca9b0d5d063bc499d559aa610740670ec4805288cac245036a949ca46de8212cde238773badd8eb599e62a23dfb725f9829598cfbdf1f2009fac46a652f893d06e1959badf40ab2172d0a48110ebd71188fec58edb093e1520fee94c088e9da8025dfe23cd4356d5bd002c7a2261cee4af3351d9355442be46a34d51542687e0e5685f4fc8c9743541cd7b7589c0df84cc2a57cd45aa7cbf4538ebba1b622f754ada53ce35d8508164c524c03db7b5583a9cd5457045c5535ec77d29d00ec4f2d69ea403f4be7f8052462ec3ee48e74f1e0ef825d328a458199acdb57cea8248a090a09aa179010453c29893f7ea2866b11a40a0416e5f4d8bfd1a1d295da70661403561346b362b4f02cfb6d4c8c0fb9b57e1b927336a26409ed3002657d235e68c96eb03a92c734f392b364a7c7d62a56ceb125579cc56d146b24a68d906263b5564f18db4f7d03ebc594ea8f57d34a7fb4278b039a5606d9b0742308b010b421c6976131fea71962ed64216587e5dbd8a72d0952354dd5ab5b8706915ae0c5c5350036ca73aa2f6df1db66fee3447c9228a2e5cd47c7f53fb9e16172b4b691a74e70ce754a5a4d0a658379ccb42d04e6fb7814d973235215f8660c4b9a84812ede9989e609b9bfba4d8b32f1a1fb1363e5ecb9384978e459cf146c75e51477ed40f5c7579b8e489df802736d3f0ce012938103bd09184fc474a01dcebe9ad0e46f68db2bbb412f704ac13c070c360a68331e2c11bc3dec2b36cc3b1458bcc4a9b4ff4fe4a57af6c54af779c7c0808a9a6e10557711f7a344e8783d1e9cf6bd22fc7e78d21d2cadd5f1c8616c12df764d8122f4c1ebfb52744f945270b2448cfb55849b475d37bb917fd0f82979ac68c94a533385822540532d2442a38845c8045fd2cae24d8edc384d998288e0e31a1f5230df55fa8d94e3d8570ae02bea26123dd696f08f5ee50f77cae02ee3cd468e002c315266ac6a3b9f360c63a73442e4d9284c5a46cf0364dd9a9c2929e587c64c71eede01fe23e48f52ddab7fa0419968e279508b9d95cc1127b06a6e31e72d6a15507f138fe1d75999c8966493aa854f76ee88b51f549200788b89243234ae38b67d3780e12da752d7d2284629afe4a8726a1419b1624f0775a0b9995a9da43c0231da2a3714a390a2c611ec4a8994a40827e5976723ccde27e6df94f818612cf0855ed6f5dc8f77c46e3bec78f379a3a469b83490eb7f7fbcd0de707bf9fb16e807c1e9c14198d17246654cc81522280a8dd65cc718e31691dc0a89a29c96c5753a67a7ba93375cf42722fb5498706e6b0c2ed2fe796a88b2e652c36669ea39b8da31469628a5839ad3a04fa7ef0d15615e2009700f57afc0ab8449730cea01e28a81981c6a5eebe42be719ffaaccd6833c6278216c25cff651c0efec327a3c5eafb11880cd4fad829a65210fd9259e289aaad9609a575ac3667cb3798a960d645061bc17254d081cc4260db5611337c29c76f130ab7b3285d97413599d85d151baa39d0e1b316373eb95de0137deaa0359cd6872c51ca61410051edc6d1d25b7b530fdd73ba87cebe6a57a75ec77da082c309ff6761740b3db6a71e6d13697dfb625f610cc124baad1398b3525aefa66ccad4cd0869c904b3a06e5d76273427d71afcdf01c016b43b0790146c599053e575784558084ffbe603a0261a229a3633cf81a2562c8fedb33a8974061bf7ed4f02778f227a8867bc44d4ca861295058f6e04559d33c8be26423da11875cccdcc4d8006454b7f87e7d1cda241f0cfdb5d936f01d15347ccae67dab160e7040d34f3f1ffd80451a9db18e32678dd951df8af14733ac398d67270da1066e53ce59bea720bf7c02d79435ee0b857bad952690ae7515253ace0021591464f306684aa2364122da3c5913ee59c7b53ea1f40a827d5d4a4a1ea66eba74a8b961bc9414307a4052793c1108650ae7bf24153e473fad21cd9dc8ff12dc119411db89a8f1e3dfe7586fc387ec646a8428d951b12c30f6e46184273f666d26417f7c167b7a630916f1ccea394223557119a7f2898a9d2e5d60d508595dfa4cb2f5eb45ce1d1b619905a4e275dfa9a414814b789776a6e9e8ca9b091accd1011551ca9923ee2f43b76e3cf9ce57ecfdc676a84cd1f7347c82a3aba1bc1fa1687162a47d6809d4bc2569779de7631da9d414f038292b1495c548a303dfee4df1362174a34aafff8471568b4bfa28fb7080bdf0604658db46c39b1e67f7038b4fedb6424220d19918dfd14ae5211fc1113556df3f5517fbbab71e7287bef3891f69a0dadcca9ea55bddf79194e21ceb7dfe335f6f10f475fc81759f8148d52e62b058d26be7cace20eddd38c04ec886ff7b3197acdb53a580de0299c3477382327bcc0783651af99969a97e2a3b4f7b8c02be9c91ce30ab60e0429a49c62ff79ddb5d9181faa5cb3d14c38825bc34c86c33942c7315844301825527e08d470934d94a3035ef6423e3ca7f572b4454c3c6e887d50d16a58dfd33c37fa83d7ed0fe349c0fad7b395ec8d20338ab601c49a3ca139c57e094f1fed1983276691b0ba4fa45c47f1d29529d97fce1298f943b8a99a75ad4fc319044de4483073e6e5cc582081abd3d0b20dbbb184306e664105573fcb33ff80a089925e505b7b0079d7c2733c7201294571bb847538d156071cb86f78a2cac559ffc8f7a312f0c192a9c745c972db8cf9b96bc0d7877258ec329f83bf6678278794346130806d070119b547e380fe78d99f6a3a83ee2e735cd49f7aa6e0b8de78856e3b3c81498e5c41445646b30b60eaaebb3697ebb423b3aef4cff72cfd93a52fcfab28c773888465c7e0f1dd57509542a69e228afdcf1a19d6db29bf162106b18454e969691b18b0546549e407779aea4ff00adb8fa50c44207dc9e99380857ac29a70b92096a690c99b5596a64fc068af4767aa85612cf203645be6be5b4034b5822f60be650a540ec64308eb32b8547b31b3e516f2b5c233c3a44fcb47187a38f56c9ff2687cc81b8287a1b49dcb62df2ad72fd2acdb17181277be05b373a1c645b5b336b6361b7ecfb9ac4dcabda01431ac63b57f789ab4a64bcdd8694165f31da756f7aa0cea0d04a7e27492b91491481082916a18156e233bd8d27e3385105162ffde6704526eac287389a2333564e8558ba317453b257a4d38c252c0b3c5152eac790709dfb381f5b5a9a976b30ca3382db3fcf87c19e15bbf9291a8a322cf3b560235f241d596546010c5bb9d4b1b368c1d60d3d8dc3d2f66c7112ea9ee7894a73d8e1feafafa95e894f03357c6fa1ccc7c6c1c69c90c6287eeea80d88d01c6707ff6f47a86a767b9dc01997cdbaaf5e4a60aa279dd8b17147244118c91b22b37bd0301990bf4bd7c026033a59b6b7f23a0b702b96a554705ab03bcb97c63523ec183672abb755968919adc4c2195574dac7a6edfb5f37d097067ce0a855c611f499a4cd1ba36521f9e8a77fc17774e15bd39af642ad838a762141b4c73e1a48b830b41db89ab953c0217f0ef0986893455e683bcc2e74ff238e2a2fc2d07fa454c35c10d81eeec29c5bb0c2b739d9ca0046539a96273e86edd303eab153d23a634b515adc3fc6259376b3012dea5be6ac95f0991bc7b770c3e894a2ad8889d801b7aa2172f23f03ac6b2c0eadf866449ca", 0x1000, 0xffffffffffffffff) r6 = add_key(&(0x7f0000001440)='cifs.spnego\x00', &(0x7f0000001480)={'syz', 0x0}, &(0x7f00000014c0)="0fca56b0677edbe3b21ed1c5135effbebbf7de27701e8c0d2e607c9c8dbaddca482217d5dd50fd87daf63f0c249fb94647cc54bfebed556b6c6c00e30dd79fed756b8e175b18c4d2ce91ce50f516b3b7ce7da5f8fb693c28bc493b39427811ff5d80945f851d67b605aff28317407d3a01cbe6b17aec442e77fb764a1077375e225aee016a9aef75b9b634bf39c0ea8c01018c7b939dbcf583", 0x99, 0xfffffffffffffffe) keyctl$search(0xa, r5, &(0x7f00000013c0)='user\x00', &(0x7f0000001400)={'syz', 0x0}, r6) close(r0) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x5) 14:59:58 executing program 1: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1014.806132] binder: 16531:16537 tried to acquire reference to desc 0, got 1 instead [ 1014.806783] binder: 16531:16542 unknown command 536872576 [ 1014.844560] binder: 16531:16546 BC_CLEAR_DEATH_NOTIFICATION death notification not active 14:59:58 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) timer_create(0xffbffffffffffff1, &(0x7f0000000380)={0x0, 0x20, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000400)) r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) clock_getres(0x0, &(0x7f0000000080)={0x0, 0x0}) timer_settime(0x0, 0xffffffffffffffff, &(0x7f00009bc000)={{0x0, 0x1c9c380}, {0x0, r2}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r3, &(0x7f00000017c0), 0x1d0, 0x0) arch_prctl$ARCH_GET_CPUID(0x1011) [ 1014.900002] binder: 16531:16543 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1014.981455] binder: 16531:16542 ioctl c0306201 20008fd0 returned -22 14:59:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 14:59:59 executing program 5: r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) setsockopt$inet6_MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x9, 0x1, 0x8, 0x1, 0x1}, 0xfe82) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$KDSKBLED(r0, 0x4b65, 0x1) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000080)) sendto$rose(r0, &(0x7f00000000c0)="fe992063c4d9ac497dbac2f1ae554d4e7ac8e63348983a", 0x17, 0x44000, 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 14:59:59 executing program 1: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x100000000000000, 0xfdfdffff, 0x0}) 14:59:59 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r0, 0x84, 0x8, &(0x7f0000000040)=0x7, 0x4) getsockopt$TIPC_DEST_DROPPABLE(r0, 0x10f, 0x81, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14:59:59 executing program 0: r0 = inotify_init1(0x80000) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/wireless\x00') getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000014c0)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@empty}}, &(0x7f00000015c0)=0xe8) getgroups(0xa, &(0x7f0000001600)=[0xffffffffffffffff, 0xee00, 0xffffffffffffffff, 0xee00, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xee01, 0xee00, 0x0]) write$FUSE_ATTR(r1, &(0x7f0000001640)={0x78, 0x0, 0x3, {0x3, 0x100000001, 0x0, {0x0, 0x80, 0xca6, 0x1ff, 0x8, 0xff, 0x1, 0x4, 0x1000, 0x294e, 0xc0, r2, r3, 0xf1, 0x74}}}, 0x78) accept4(r1, &(0x7f0000000100)=@sco, &(0x7f0000000180)=0x80, 0x80000) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) syz_mount_image$minix(&(0x7f0000000200)='minix\x00', &(0x7f0000000240)='./file0\x00', 0x5, 0x4, &(0x7f0000001440)=[{&(0x7f0000000280)="5d0d41b6136486bdbd756501a8c5dffaeb75e14b7fbfbd3df3c22b869c5c16e659861b27eeada2735dc0131a7e23e17a57abaca5c5d7e5516dea558a6e7d3ad4134738d42b79d50877e3b46f2c8b8de5762b63aa337027cbdca1954dce19e042e6dfcd1cf42cc85cd3fe7c5b408dc057f63c480fb0ba0191f32eb4a75cc4b39540f450c5ad73a6534080366b0a70a2b055fa7589903cc05010568f059d968bd02b4bcd8580156be6a255fa4a8f257e04cc7acfadebb5fe82817706a82658cd15f620b18604d10dd5ce7ba816edfebbbd9b16", 0xd2, 0x8ee}, {&(0x7f0000000380)="7718a77fb5e90bb9c8d5229195298a8a26c92699d126244f8a3d6ef5aa04ffa1d9edb5da8ffc15495357b8e62017c037ecc543bad0f5c20bf40deddccf715a8cfa7465612f60161ed6", 0x49, 0x6}, {&(0x7f0000000400)="bbaf8309805c93fa62330db6121b732ec65a7a6bc353ba0476b9d9beafe3dd9820a41b0f6b0ace56499e3b6b1b20673fd056ae6b5788e00117809db48b9fb240460ca7d08336a88bb2b3157c2da17b43c300d26aee363000c78378f94e1776d72e0548540dc008597aeebbf7b9a4494a912e53e926278a5f9545ba1b4be731481c895ae8010fd74ea11478ee70c4e7a3a08020f5ecbd208857e8cf3df7b1c368c43612d8200e2532eda9023ed95d0251a021f1576808d3d0186cefaa8132c202bcb7d5db7fc2ae4d8cbaa10547894bcbdac2c15c88657e61ecca71c3ca123ae067cdbc8a22391e476d9d5c8bb042db538fc4b26ddcc41b863b4dc7ab314bab497cc5e66e25b3e1e590adfb1cdfaf128b2c92a5175b7662a8475dbf60acb207dbc8dd4bc07dad681a9fa827ad361ab824fc9977791cadc0e1bacf5cf8e081221005af5199e139d35fc1d5be9076b7254f9d5df300579e5d96395427733c41bcfa66a57b29169bdbf6d8acd5e6e3a4a1e55568da5b9b469534d34ff732da6e1375d51e13c91589d2bdd0bd1096bde134ff61fccb41c8ce2ccb7a6a714beded1f283161d7173235ccd1425879c26cac58202c78cc52cd71d4d2a694fd42bf0fc80cc242d14751dd91640cd9bd000011385f99488801274c482e62f8a1445b42d3dbf058c78dd757126a17ea4df33bd1ba613935e2b2abd3bf22187a722b065858c9524b824e8496c843c0712816d6ed94236224459b58316da9bab23f91466a393854532c773d7fc6ede5b5526a65ac53e0c97eb7dbbc92f7bb72588f48c4f651a4ea4054476edfb8b5efa8ab2b6a3a0d1c846b1080faf857aafdb7da86afccb1e0fe2067735cea98c0ca470b398eaf6f8254e0103f7dd19f52b0b16b85cac03cc289717746656a9cded30ebb125342ade4cc838a6b52f58be93e6d719c356f217a0c08cc4e77705ade7e90e69fed6831e32803ccc64d62359355bb51c8dae383872675ccd913d5ca4ec1618bb7e608595a3b152cf86edc3d27a9c6f509e7325954e9f4318910fe9be942dae6120842e6745b114db34bf8df6953e62845a5fe397f984b0e03c1d006adcc1bb94b8808aaf8ea43a2ea575866e1b0b01baa4998ef51db3800c45d067ef9645cb8871a923514fb15b0b4dcbce1b2b857781d7c9f8dbbae8508d914dbda6459cee33f8aa049e1689dae310c8966f402b654dc7716848ae26ad93634dbdde857f9d4ba36c257de73a437c2e9bf92df1e89a8b7ec968b375fa0a18dede5eb3ffbd75ea1a082e5395c00ea94f3264b57ad2f069c947653b2941d1d6ba426554cbffcfee8535abebfd7ff0923ecd5079333a60323e0a9629888a42ce26129590d402aa1356c7bc8d8ef00d0681fa80a9d9eb8946625fa7d2f794edf418241990de4ba5db2ea1c32ba51b435f9573dca1653b325d4ff286a17d533287fe917c921c2cca994f1fe1f66f7649edb7496a3ac42ca5d785b51156c3bbc8af4c7e9bc72ba6eb01cbb81f7899963392811a535e1f105a013c9ee6d266cc3a3870cef27f89d054ab3ef3701c6f09138b3add4fef3dfcbfaea98e36a9c2ceaeb33c7d4cd26652bcc2aca0b39e6ae28053168a185979a968a1a246ffaac319f1b7542b0ad789571f30d643f7655b6177b5e20e4a15d978a1f2397f226cf7ab0485874abdb3a00595a71d6a193d71da59d1764fcd052049982aeb5043bbddf3f72650e8596d1db3edf92d34f2cb77999e3aab3017b09beabb06bf6a93e5149674636d2bc86ddac59cbe8a8d2de49b303ba31370e2ad77a565692210c973ec31e03ad6ab21c49a63a53123c310b931ba1fa76e21eab1edc14948377748546dbc33db1b03fe4640ecd814381b4ab518267b5f9d104106639af77984f14d6e07dcaec4a27ad8f77bcd817a855af62c937ba76ee7feb597adfc54af0b229b69a12fe94fa84b382ca0e991782f242dc55dfcfd5428c2eb67dd781d515c2b95d141eafed6338e79ae9f4531da5ac5a84f6c2e254f731236265cf0e8f70adf2fb25dabef18f39fb49fa2c7bc9aac4e1d38e6c29e254e2daa0def15436d2875b2c7642f7dbd1f341e5274bd853b8700de3af6117015c25a165b45a83f6cb285e878c571a27d08f9f4177e11d4c50eddbe39a5233fb395d1d13340db3f55f5ffc857266d06f5e588c5aead4793eaaede0cb6f3dcc41f08271464fefaa5d33bc9ec9943747845c9f3c2ceb497e4901ff404d7446ac2b5d59bbdc821da233a63dfee4249f62a9373a6a11f521966262b581cf2795b3c44487f1c3e32be2ac17d0c0c738fd603a6006490d1b47885a3beed28fadfeb0da08902760c4946c1272d408af18116ac49c2b49a071ec879d9197ba43f67858d7fe086dc88cef9466e7931a80f0b9666960e6581cff6a1ac27ea8aeb9ebb613729e6337ef29c62665628e2e7e0079585ca929af01050abe7e00ddc142db9e4829437279d97fbdd6f377286bb9144e7c8c440cd319fa254e905b0b9fb33da3d27948b531fdd8010040e44214ab5d4b9b8c6fe53958138d6824cc01f2d4a31704e8d35b28df5f835627f3af299eabaeb03250751842218ecf3d3083e856422d1bf2385d1b46ea97faea40ab3d9297db8de3fd1ae09989dce88adc791c4897285a94e14565428c4b7829836f4cbf934599602ef6a43a6a1d7ef5e948dc53e2d9f7d61c7eb168ea30db0cd2b073186b713c618b47758c6e9115b093277f59317fc66495a13cafda216420eda66d9bc1c164a2feac98e58565063dbc96f6e3b8ab3055e94b40d3fcc5b50a74a75f48cbea4a0ef752e602fec2dea958a46a835ecf4e9be8d7e02dd887dfd440b93bd5618a8bab612b0d63cdd3db7ba0d2ac617cf6a374be686f38e908b4bf3d4d06c58efc9462b243fe2b2953cbab04c616a317862eef6e4a86174968c33aac272e68169af3d6db15404f2b37d70f970092d800c2b00d58f2dacd9da4859a668f0b74ad5d55ec81d79e922707e34ad71b8ed8e4cbd7c7411b2d14a63cd248e9d8ff8faf6898b8ec6ea04f17058a2216643bbcfd608789e3a03cf32a157bb2b18811718b2a5e547659aa9db2687add0b13fee85f189d9abb4624f8a910c5bcee920ba4f99329fe9e00b332d07083c6d56e7694307485a82af0707b1167111d0e7d5e2ee119e5905c33585b1a8520f1f847370d477bc4539f1eb3aa976ad5507d60538295c894ebc7317851196025716bfbfd324db9618ab4cef39a52613ac20eba529d1be360035b17846ea303ca3367ec06f27ba26f33c6ea3227f150b92d393244161c70e3d8191d4b8c2108e6c3186d6909075ec3374954eec00d012b4f3802baa6277d4ef41a2b0bd4f3ec35e0a60543491780d69da1b2d477932848c88decc6ec24805746ac7a7441a10e619e4adcada2a6b4506c14144dffd36d2c7dd14003e76aae92d8fffce35d82f952ac3599de539fa61c96b1919f9534ac52ba8849a595c3ecfc9ab49bdfadd5929ba2350adaa3cd53270b4304433f7d499a0636212e09dacad4b49ece2bda998f5cfb65ead04008d9ef020f0e9c428cf691f3a16c5fa37e83dd4f9a15ab213cad1a6978fdba85025c2c298c03e153727d801217d896bef3b25b60364cb378ff589ff759059e0b484b384a4f9bea8034580e3fdac635d2ddc6b16686acec31eacff911d2a4b6a2e66b0bccb0f94a241301dc277d5342cb93930a246257b8bc94e87ccb21e464379dcaf10c5c8963f5dda8ab722daccad245ace289e0a0defecb5fd34c8ea48fde73526fc6913291bea964480dc67845c33c9a8b2c8155647837ab7dc47e631803a91bbbeacad9c980010794b83c400e8bb1f4939e6e5023c69d18f72ad617218a609bb33db6e2b085eaa7da857b34998a0b650c1479e4545a45086bb16b72de2c696153b755dac255f015420d83775c5b6b662d655bb9ab4eab06d39c069f54bfbb1b1d9896bf0d5532026908fb84a1b4182c5bcb2a3f35b2c4f54455808d6dc732795a8550a7c8c4e01176ad74b73380242edb947ea8f704055449078611d37c4da21950853957849bc020767225274c6b7a56d2fd284a6484387247227a859084f51dbef356f10a1eceaa8b8674827f1afecd4d23e1f807f9a8db135f349f4675b4dfa97413c8d04e848c0c7fd3baab4e572a89e4dcbeb3c69028607a30814c2200d2d4817016717a62fab5c6390a3f80f80fd615d6aebc6d36e73bbe7f89260b8791355042c8b7eee5e084169d04460ab8e260b72a2351944b46246228d7403e5bd22128c6e427c872853df16e5948dafc3952b33838444f43c177a761cafb0287fcdff7fa4fe0fafdc15ce6ab3418abb8b6d234756ce2e7cea49f13d6276f0740379fd06d7fb3fb5efc7b77af974891072ef9547b8261543c0cdb9745f83b591330eba21aeb83fb9747eb73e6b452002bf2b465305b9331b62999742daa29a998a4e3d5df7cbde1054a8a20b8397942df56540ba7cff162bdc50491247fcbca53491ce80e622c6007e7b5da94067c0d261b65566145b3a047965eb13676a1175923da832f01d2b4a2b7a5b4bdfb15df2c25342c392daa5af72e1b9a2b70a80972056c6079cb8c6518a915e78952cfd2ee1172d52f409317c2316f28a57c77987a7e739349e8cdb6dd580c9ca7ec14dac98754768c3f1bd2453604a00972036396e6042c7db9394ce4fcfeb8b6ec7bf095266a301ac1ecf8f1289773073695b35ff56db4e4fb5689c25320d4ac6033d51454b08324c7c4bb660f68ed55db00a9e4be83d416d17277964a8f52f4a063a186798ba54e68968ace344d8bc8a5706e1ec3887373868d959abf251e16e1c3560464ce220b9140b2265acb188e7f6bf29d65a6fbd36caf03d96a3abbc4a4a3f9a6e7c7c4e0136881aa0f6ec7ae11541e2777a09fade5e073c1be0884d883e11c6e2c2003cd93850a27ead91f394e7f0bfdea188b1e434b780583b4901daa8ba7d7bf294d5980c434402c094a87d0c784b29885869eff8f18a3cfb143e351cacec304625052fcaf5ede3dd33d1ef40e14ac9e09c58cfeb97ecdfbfd3eab49f3fc736dfcdada392670331fba7e42dcf80381ca77adf8d2b0d2d9763e34774d414d95c0ad98d8368fa2d0e7b649abec9f8fa7357d77674c8f3641a300d7479eb6fce33772bb0c5b20b5390ef1f11defa3eb9e657086f42e63944b2a1af9bfe0512825f0f8fde0566e5c3a39d2fb4585e8048da3343ca1bf8c9eaea1d27aafd610722097ba217e35c1eb0fb5027fb400feb729918ae1af640effc99583557b01127f10dbddd0fa4116979d5a33362f022c79c05101ff7f8b758a54b20b9258b2915f6151f6c05a0fa6093e0914d90fe874def0f3a838af86e1cc1cf6079d5003dded9f18eee6cb519fd7ae0280e7b9856824f19d87925124b1511583f2903934d43a3ae1ca42f23658b1ace99528af54526601dfcd76a5679f3f1a490744d011aee714f4a0a6ee8ce97203489fe3b0efe6bccc0953f680a6ec6cfadc845d35bfc76816fcac0ab6821ed56c46440a494a024ce3e763ef7546a705b137c6a7de99df391109958b47e12754bce39e22305594b01e92a5dcf937df30b05b0d7f5c795bfd583e275803667af3ad178f2755af80f531a36bd0f3f0ac58359f08f62017a28431b536d94a45eedd3317204bfaec6f3143984f505788d7b056c2784917f25831de8f740d91bf3d9be51fca9912c4a52ec5074dc92c0a127f7478c4d97eb3e11bc6b8b8894b17078bdc8bbdb5afa52205643fb79bcbacc56095b787586a9aa1d7", 0x1000, 0x81}, {&(0x7f0000001400)="efa32bdeb93fd125526de8853eaf5e346079b2d23afb2a262b2d26f76a9bdf6c23938e159796617f9a7b3fa57da48d42b58c83357bbda9c02f59a6", 0x3b, 0x5}], 0x40000, 0x0) 14:59:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10010000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1015.345050] binder: 16566:16570 ioctl c0306201 200003c0 returned -14 14:59:59 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) [ 1015.394511] binder: 16566:16570 unknown command 536872576 [ 1015.433534] binder: 16566:16570 ioctl c0306201 20008fd0 returned -22 14:59:59 executing program 5: r0 = dup(0xffffffffffffff9c) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000800}, 0xc, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="58b5b796c2e249bdc0734545a46e81e24c9a15202a0e4b0000000000", @ANYRES16=r1, @ANYBLOB="000025bd7000ffdbdf250d000000080004003f0000002400020008000b000a0000000800090001040000080002004e21000008000600c1ffffff08000500000000005000010008000b0073697000080008001f000000080006006c63000014000300ff0200000000000000000000000000010800060072720000080001000a00000008000b0073697000080006006f766600100001000c0006006c626c6372000000"], 0xa8}, 0x1, 0x0, 0x0, 0x20000084}, 0x40) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r2, &(0x7f0000000040)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x830, 0x0, @ib={0x1b, 0x9, 0xd449, {"14b7c9f74308afea4512c7028aca45c1"}, 0x80, 0x1, 0x6}}}, 0x90) 14:59:59 executing program 0: r0 = syz_open_dev$dmmidi(&(0x7f0000000400)='/dev/dmmidi#\x00', 0x200, 0x40) r1 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x8, 0x810, 0xffffffffffffff9c, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0xa) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000480)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffff9c, 0xc018620b, &(0x7f00000005c0)={0x0}) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r0, 0x28, 0x1, &(0x7f0000000600)=0x59, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000980)={0x120, 0x0, &(0x7f0000000780)=[@exit_looper, @request_death={0x400c630e, 0x4, 0x1}, @acquire_done={0x40106309, r1, 0x4}, @reply_sg={0x40486312, {{0x1, 0x0, 0x2, 0x0, 0xea270c1a57aa90d1, 0x0, 0x0, 0x58, 0x50, &(0x7f00000004c0)=[@fd={0x66642a85, 0x0, r2, 0x0, 0x1}, @ptr={0x70742a85, 0x0, &(0x7f0000000440), 0x1, 0x3, 0x18}, @flat={0x776a2a85, 0x100, r3, 0x1}], &(0x7f0000000540)=[0x48, 0x0, 0x78, 0x30, 0x38, 0x18, 0x28, 0x0, 0x0, 0x30]}, 0xa84}}, @acquire_done={0x40106309, r4, 0x4}, @reply_sg={0x40486312, {{0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x18, &(0x7f0000000600), &(0x7f0000000640)=[0x0, 0x18, 0x48]}, 0xfffffffffffffc01}}, @reply_sg={0x40486312, {{0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x48, 0x20, &(0x7f00000006c0)=[@fda={0x66646185, 0x7, 0x3, 0x40}, @ptr={0x70742a85, 0x1, &(0x7f0000000680), 0x1, 0x2, 0xb}], &(0x7f0000000740)=[0x38, 0x38, 0x78, 0x28]}, 0x4}}], 0xa7, 0x0, &(0x7f00000008c0)="3f151d4da86a3fc017e9dd12af397387cc0b74673d12700ecebd7074ae3dc5d23553455c27009e000e8c7cc030ce9036bcdfb3d8ea6d0052442b193f360dfa11b11315402c3025d98b0f631903aabaf1a2a5fcd555440dc9a87d306290ac53526254db94bdeb3efd0e329287163e98f822d6263abb15a3635f392d1ec57cc2e4f2e1059f989f05bdb32bc23f0a72ff3dce51b6f849655fd13ce32ec72ddf325fa5fb35a6890f30"}) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000a00)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r0, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x24, r5, 0x100, 0x70bd25, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x10, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}]}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4000000) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') getpeername(r0, &(0x7f0000000b00)=@ethernet={0x0, @dev}, &(0x7f0000000b80)=0x80) preadv(r6, &(0x7f00000017c0), 0x1d0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000380)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x113}}, 0x20) write$RDMA_USER_CM_CMD_QUERY(r6, &(0x7f00000003c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000100), r7, 0x2}}, 0x18) 14:59:59 executing program 1: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0x40046208, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 14:59:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0xfdfdffff00000000, 0xfdfdffff, 0x0}) 14:59:59 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1015.693108] binder: 16600:16606 ioctl c0306201 200003c0 returned -14 14:59:59 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TIOCSBRK(r0, 0x5427) 14:59:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 14:59:59 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x30, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x200, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r1, 0x80046402, &(0x7f0000000040)=0xfffffffffffffffe) [ 1015.752881] binder: 16600:16609 unknown command 536872576 [ 1015.813312] binder: 16600:16606 tried to acquire reference to desc 0, got 1 instead 14:59:59 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') sendmsg(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000100)="fe3ca174874cfec084a006bb11b117b09299c67574864a45d36976585086040e7da5cda529d4e7777a396efec135e1481d32c3fd672b0f13c3aabeeb2a47795f2b0f06459dd2cc2305867329c36d5566a2d4a19e665149bbadd923c1", 0x5c}, {&(0x7f0000000180)="aa076c6c811b62941d34e4073a5896236ee3dcbcf3c6c023b332756afe2a0b03eebc9c708c2f72d44c0e3ede2df743ce61b396b0eef88e75f3ee1ca077357736424af35a23ea213f566cc71cfef2072716b308beee1d99c0d0df94c6fe762968e7fe3aa378eb9ab72a225ee51faf2b4c045e8ba3b55dbdbff47453c00112310f66d0c3ef85530d891b3c11e3272700b18c5c3eb4180acbbf611c7d8c10fba127d53530d247b831da1a4a0c073d072c323ebec2f68965a70c54cfd3b96b2a5182e02314471347b52e913a8c233d75011a415a4e89a2c7e7aa", 0xd8}, {&(0x7f0000000280)="2782438435cfe6aa9d79d98ff6b0b56be9d30878efe49eec27f022b08205978d537f9e2aaa67d6b0a35f0edb008680800f76077e41d848087bf8fddb9262ae6aa1e7ee3180916e3521e80c05f731ae44", 0x50}], 0x3}, 0x0) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000003c0)=0x0) fcntl$setownex(r0, 0xf, &(0x7f0000000400)={0x3, r1}) [ 1015.865937] binder: 16600:16609 ioctl c0306201 20008fd0 returned -22 15:00:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x70, 0x0, &(0x7f0000000200), 0xfffffffffffffe56, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:00 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000040)={0x0, @in={{0x2, 0x4e24, @rand_addr=0x2}}, 0x9, 0x8, 0x1, 0x10001, 0x9a}, &(0x7f0000000100)=0x98) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x18, &(0x7f0000000140)={r1, 0xff}, 0x8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:00:00 executing program 0: fstat(0xffffffffffffff9c, &(0x7f0000001740)={0x0, 0x0, 0x0, 0x0, 0x0}) syz_mount_image$btrfs(&(0x7f0000000100)='btrfs\x00', &(0x7f0000000140)='./file0\x00', 0xffffffffffffff9f, 0x8, &(0x7f0000001680)=[{&(0x7f0000000180)="bbeece3a2ba529295f2d37d6a875b26330c887e425ea9e27d4f8bc36b9ba1f960f01358e5f920e8d60dec35bd5e88ab7e2219a4641851f15154a02aff0adc5190a3b4fc89cafe31fd6faafeb2de24dfd334da89d9fb433f318aa6e18b17d7078fa73a1384fafac4bf02a6ff717e728ed2766febc3ff91005ed6b1f3428f77d0547e1d4d535d010efb566ff0fa3d5ee204060af3c217107a69d486531b5db3d019c2617e65821d4f0f7d860fd0b8dbf7d16ada4cde5520c9b1d69621dcf799ec3313288131c19badb6d2f51c58dc964431adcc552bb6c7b057a29a3f07f343be8101ba67f6716cdfc6a02a00e2b", 0xed, 0xffffffffffffff08}, {&(0x7f0000000280)="62f6a04289489ba61a760a2eb83eef91b1fcc2b0b307037fa35d481e410f78b368088d257ba5092948141ec1165918d9bbc74b2e336dfb0513f132ec57cdb5ffd5a95ed1cb82eb9c9376d13e33061165b3db13c02c18d8ac00bc8327ea7fc6d14204f6aadb383141d8a1e8ab65", 0x6d, 0x1}, {&(0x7f0000000380)="a028184e336880c7afc26aecbe2e175270a9a34466a23f70c97ba1168e91fd67c05bfe2daed78e9a06b0501b1cf6f36d2b41e193b117cac656487640da5f0972b6b396fe5148b06dcd14ea5b6013344d61184de70d06b9758c777a365dc39fade6529f604861ab0b180acdce26c44037cab57168506b0aff75d5c1030858fac7ce9be60aeb8b7029817fee974d0be1091e5003bd440ae5c7f981ac3dd804dd8e730ad90adb3b5e1634af709ed5d87ad61beb3b1716cbdd3867b68d7fb3", 0xbd, 0x1}, {&(0x7f0000000440)="a688423c1c357b5f1a39bb9ef9688f7c4d167ee85e904ba465bf9d83fe8ec0a5b3fb6eec7a9143a3293a8317d5ef1fc567ee8bbe538fa9f031703ccc5251ea9571a028ccd04ffbbbfe807051765b48af5d359d0f2642d0f84c9df2722759335b27883c86b24f9bb62cd894ad576e201737e9275637b5936ff1", 0x79, 0x2}, {&(0x7f00000004c0)="c6ffc067650b7c6a5985ce222434230ef9c5eae9bd7cc1354c8b832b6449403a0f740576b486887f23c8e3d4d5ded0a4a72a358141e81abc838cc350db9fa492a8b11a4620e6dc67a151bd2b7da9d8e8a712a35682a253de8e256bde14ab0f81d4f2aeb2ad4c8e485a4266fa5deda99d3b0dc471334d6a4b0b042a4063e54f7f32f29030f3d43292faddec7c36264fa18ac22ec1a4330277c91ddac9c96da41e6917346d31eefdae9a050127cc9a34da1bbd2a262b6a22f5a0eceb361fd96fc323af0ccccdcb4311f8be95b7725c7a33a990623f26e829b68249afa4be7260", 0xdf, 0x1}, {&(0x7f00000005c0)="41a6a1aa6ebef513f5c7d1f8c66f8cc3b54f924099c1c5301a21d4ba1111d6fe87d674e7c28117cc506780afaa25c4f935041e73436e4b3c8256767a8c99ab2869806463ddf3d5078da7dc4fe5cef1559d1610212fa330d40b7e7b35c53c31910337b277faef91bc3355aa7377708f9727b7c7abc474de13a82931587f706b6cfeb4f1c272ccf762931d888d673b2a2783ec0cfaef4d4dfc4df2fee719dd7c001c90104c3cf5f6d54da0ea3cf10605b5d83bebf4a5ba171d313b2cfaebb04093ca4f83aa27f919cd2be9284edf2defde2bd6b377937532a6a40f1679d45fd69b08f8cd1bc206225bf1858e00e774835b4bf65a847688cc2bd521bbeccd7e74a14843f03de8a90c4deeae721f787f842980a6653f2e6c4cb5b9a8c340e54101cf67df8915576fb1e5f5820f5f7964a180eeb946b0b415d20162c208a97b7a75bfb433858ec4b9c993ece08c148ab3db7c20b51d57d6054d0963b42f18d5971e8d0cc9efa5ce871251ec4368a28cfcf1c501f54f585595fd209cf9556adadd7b0c01803d95cde8a80122a2ef1b413ded2da24a3f75eed616389ca3918d031cc1b3a6a6b4efcec52b1da1f41c34685bc597bca01cd49c17949a68f651048311ece21d7a8ca9202264f006d94dd0516d5293715875ee893ca5294fffdbd7018c797e2686181971f162db43e01ddbeb07ac40e713fcf85b25eb71da23771f30db49b6ed46d44600acaf1ccc60e4eaad71b277181161ca06b217b16b58c5a68caa6d82d81bab6766fa068090d566ed6711ab24c407cb754c774820a819321c2c4630e492e778dc6826714d350c526ae8a2639e76367d3433822c2af08c70ad08678f1c22c2608b15cb1942d034adf688625ad4dc9e09886693b72d72c0fd7ab463fa799b75dd11d96d614e871ca9ff8f9fd6b1101ff3800319252b58981d7bb5ed6656ad07ae1d69c3dea3e079f2765cf5725fcab7c8e493fe99379c1c29e2709aedc9ce6f1716c32dd4c8f01269c97513a91399e525511dfe360d1a3731cd41bcda5147631be7bb809e3846d88c43122cb3fc6a33810866beeeafcd41c737b86807c9d0f75f39ed51fb3912c55f6825369121f1d93b790118cae157f95acf9aee047dc79cbc88c32080429b93a6a5d37c8899598b923fdd98a0ab90a74e3a4d3dadb31c92228d7b6ed239a5371a1a90b0a17cdbec6bee643451476ff1f81fe95d43ace2677465dd3fd01bd862abe92c8d9010c388018ef86281d2eb937592378931c1b466b461f81778adaf812077de55e3e932e2269126ac6fc41090c6257a055f8be495aeb739cdac120be4aca72e9069860ccb5e8422b6cc41580f91c80d7b827e28b95c966ba54f857a05bfb6df625feebf1ec86dabc14e71c2457c44a6f11faa93d67af239c60058af0953720b2fea7c9c87d80abed1b93adcd765905fd4df5aa31f224fce92dc8fa4ea7630927effc469edcbfb5182ec642f64cae37a1218af9b7d825b9b6609d0baa5c9ab3ded8276d63c8b45c56849cf41766ba8314dfbaf2072a404303f73e48bad833a42f97d94c7198b7eb367e0ac5d1d574bf6d9668fc2af336c9b14511da753dba6919bd55cbd43317b17f4f13b739e0838939a10682b6fef6889fee311a75281dca3e3aef6c87fdc01d8403821c6e29e4cbd0f3976d0abbf8eb798f9a4d062faafc7dea4d6c261cae13a66f79d9e7c91b50ebead8b496c5674503bf99d7606061a2a684f5f1d3242c32a23d2c146787f7419d9dcfb639c2fa2da0d0fd68d6b450ce47da22fca87567e0b5ff158f0cc84085f718697834aa442ce9d7599b3ce4ec286d133a9116c03b54e68ca78accdcce7ca7f48ce3380038f29264add76992d3ff62326b194c0cea059d1732308eb730b68183ecadaf12447c663a190a7ceb97dd4e44a65e2a17a0bc21eef412653e43ca249c34e8c265278d0afa0f372bd867c8187fb5768fd28348565f5a8170222759496189cf87accf59b98378ccf1a43dcb51c3369f3beaecd002aa973b9f68cce195097ca89eb0d576faa7ade58e0fc2ffc5f8b14623c9923c308df6895c982e30c0a8a863d36c7a8210a81d0ff4a65be439ece70144afb4ed6d10ee531eb993da45c2903c6d2933adaa3d0824366ef5ec9fdc30fde892d564e49d220665490c012430987c5793f904cb871fd3d9d73b398c9f89262e2cec7f89adecea845965b3d094f5c636e026f5a9eee447d6c83ab492a6d07ecfcedaf5177970c23f3ddd43116ceba880fb308675a29222d5b5e7f3a5294da51b3fce3187f9e7d680d5f1852b43fee8505f1499e9ead932b9c8377baa10e2c3b5822a4fabd13d0573ca0018f993796d5eb58c49a8f36af4ee0ae6062160deed983bf915de56779033ac2742ab0cc54db98c2df0c740e35213c31cfc897e55ee3146ac1bf5057d8fbb02bf20962ee4dc496a93538142687bb7070137ee16748ca6eb1df9d1346f46e0883f9595407fae003b3854db9e3b537b2c73d205252f283a2d36c7b12c49664e2b3ad6d037393ba9d18e4ee47eda2826003579eb619cbe88f5b7af644561079cf538271465441ffb9561f02f23855d4ae60c0c38d686d8ea5312d922d6034bcfce09d852626d1a31b9ec8bd614d257768ffc152d3459841df8ebf6859b21aefb163bdf0c0ea1824f6f5ca808e18524cb6d0e5ea855e505a89ba40b168175961f8834ef6037042ad3fe74bca459a8a69857c9725b54bcb57a48cb2950eb23e9ac2eb1678a0e0e7e0feca86f5ff760f47bcb897597415aff556a384fdfcb535880679d4198be57185368c3a716043ca95822dad7a04ba574beccb2f9a2dbd3d89dee604aa977e5fc296634d77d4a0160eb2e538168cbdfab98ed1b4aff72d9cacc481e18eb71ddcde91fa4317f6f01d776011af0cf918d6d054c1dcedceb0836c05431061293c5602af387c847814555bdf8d962140b7698cfb082df010d769406dec051ced912f3f22e00cd062b0a49aac5baa9a4835045bd072ec118f81b479072811055b5a0a118170db78da56efb76365fc87e8534dfbf3bded655f5dc198e2120dee3ae2c2be5df815de9fad94c6e5a3cd79630a5c3e9bee39c36251bd7d475aadadf370d4db0badf30dbf30df99f84226680d7b329adce1e306937cde1da7d50a4c98639bb4e6a04223ab8fe1d10c7d347627b821c9a7da87f784309a063584bc46b19b8f43a4b166bed1dc0c1e373e481bb78658e38228c133de4da350d1260fe8e2e199937b6ddd28be2c4ed9dd934a78731600f04852ba936eceeccda3531a12fb47dc6c7a89f9f113556cf4dc19c2f1c87206c5b48fd590cb6c825edfd8e6ea283b976d3f8055e6d3c60e1c08aa0d576fdf15d1128e5b1f95f914864d59c9ad0ddcefa274b56034ff3204147d5fc7c71e27439a6cfb671fceebcfbf0ae5d643dc2a52065112c0e09db43170f8a3d59b57a77067f08a8b433fd36a91a68229f39f35ad78dc63ac9a1187c9267d09ac81f38cb1b36acb164cbfda2091fdb632e65326a0288fa661721ee5c994ed8cbf90abe9bd246f2651aa3a05f0d9555a7437e6696560b1f3a5cd920f9a2082cda972927df334cf574674700f77cf0a4eb7e9fc9e6656ae091dc0aaee956009698083fe92d6f037006bdadef4b45553b1acd65ee59b377d82c41ad638636ffa50cd1ecc5392c937a92427ae51df4adae1c35a7028349d280206aa31e17b344317ef73a823f4263ef3304c147072d29dea38c5744bbea6cc55a5520fb3717597fd66c2c5e3ad446350a22ee5839e09588dc1f004752af3d2e97fdf332447ae4ca10617fa45b64d0f7f03d1b706f59f5dfdc0c32d86e69348fc5beef3e36e16ed501c7129a3907deac9743b1bc501d14e8f0f08dcfd9d32234543f0a2af9183f6fa3e1b3aa02194e67d0cc0cfe07eaba6fb7bfa726da71b1c8505f158cfcbd67d23d4d84142a8004feab7071e4f8ce27a2f7a9de26659fee1c36406a550a9701130b7c4652e384337920fb03d880b3c3513b519e69946bd9079231769c0c6c0d38727d38e80ae4311057a484b713f99f3b7977fba5c96367a9e67f503bb6f178923fc7ae0c80cb7c5ea36e5f8d4324c5b5200d25442b66f941b1cef79634a5066e863acdb753c06f986e91420fc8014c9b20f6109a25027cd5d41b68451777a221b7f89620b3ade82a77a4b4bb6832687338c2f5292b2f6ce6466d797c522fd496a5530a34258f921a41bf1e7086abc6fb6fd2a4e194604334bfe736d1fda7e3016572e301f98092e8a6412dc726e9c69cd3d1a468ca673a7a65da9740051764f7c96d2a1e2d598a5a8c844c5c2617258a617730defba8563fb84c88fe8760aec26b06d299419c3c9f71024e0c5e2a62744170aeb0557c8ea98042e96061df8c9f5a36102a4bdb6e3e2245e1d5a991b1b47be0d3df4e16036b7d20c57e691c1669c2929fcad90668ec112d8047b8a7965410df919471ebac1e2abe0d38d343bb6dcd6ff642b32ed7000f5fbe32db89d0212bec19177acba88bda0bf4d846b7b6496d0dcb49c6c88d0f184f007649c525ce575efb297a863e18852ab2cc6eac63e77a7345246b8f0e9feb17a470a98c0e7822fca7c61e9244fc7f62ba4597e01b9d578c30efb5daa55d57ae3f60b28320bf1075ba35a136af3ae6997372321bb3e70e4385ffcdab6f2aa7714b06aa0ae74103fc45988751d940196bc2833d84ec2751840179d6da54ed837a08e90bac499fb2f8c6bc6c73d080de8b2d37248d9a1656051aa0c993d46f659d30f14b2c3f444ef15ceaabfda3be9d37c2ee830163ff01f0050e5f4304aedbef15ce4c80bf1e1390b8f55ab7229f2c8b729aeec9ca91c067228528b564cd093e868dfca6a4e6bf5bd99abe8c36794175fbba9ee8b2429e64c423fbabebf0206ec318d1d5e33fc158b394bd3e72637e688ac767b2676586056b7be4f6e4e176e4a7f5e1346193f49fb7609b64d0c06ed2add925afea84a2e0b3fb867e2ab38dc1627256d47b4c93781665e222a07968bfe356e864b4e8a7b6a67de3995126df9b54dba49a9eeca9f36cb11f2a81a58810fdad367e919ca40e206b18197c1aff27ec592ef4804c09f665a5da2a0f04d4ca4bf680eebdbf0295fac04d0f5c86d20c425420fb2a7df7fa6de518040e4a4a0ced4608b02408b1691f8a4426582042e983e8f5a89bd56632cef0b6a582ccfb64ddad2eeb432a24e62a0a918756a3916a97c0b5513e1c126f1777f1b75ee50ff29ef86d89360f2cdf7625761cca58bf234ba54c50ad3e337244123a0f075920f5ed2c24e83fb5c251238cab161a9380feb0437f0e1678352799ed6791050f9f841d7b499c922ef3ead27a9f7264d0201d058962f5d11670cbf82eb73ef9f4bf8299a93a0d2de85a6ec1ed3e6f21c8c879362d1c0e230c47a2e0110421a1e6418257c3881872096fff17d8302dca7ccd3c91973934f6b4994bd44f0d6d05fb7db96d74494a91e7c84ad61b707f7756a3142b0e89b1adde24ccdb9bf6ec4a3320458e847fe4d228b17dfa3b90773ea5bb85038750f0012804f70196ec1d66619c056cc17dd1dfed5977bca5cb1b930646f44de949787b0622fba2967e7218352ecea1bc5e5f6794112d0fe11bd616c48240e3da249ccd850089ba121329cb57908211dea6b04faf2e388093554eade34836b429ace40643568b567e43ddb5371f03899f0d39afd6df57acc2a2cc5e1e3e26121a21fe83518add8580f6d5ebb6462bc7947225486f8b34eff3daa32f2a6372ab7b7f2d3cef410e037f1ba", 0x1000, 0x1f}, {&(0x7f0000000300)="3b911b31ec517e90328caf98848f7f9ac76a9276fb34d10ee294f6b15b74723c9a9954d476abd281093bce03bb458c487255feea0c84", 0x36}, {&(0x7f00000015c0)="3733e9a5594cb3abf35581319ce8521331f0ed18c1c2e2f1966121cc6c6a93239f5e28ca536256219a058386599786e8bb5fe2dd9d3bf1d96cfca1067c082faded7f7278d9c1dbbefa5caf8ea417122d2b778cd5f9e8f1217e51a1050c16f96fc9a48a57eee1003fe487b5a1e31147b07774285b5e1fd293748e81ba95825d3d314f01e2b398085e8059a7156a1b6c44ee04b45b235f6dfae7a01b16e00cd1e7f93580db020f0f2fbadb12eaad981c103f", 0xb1, 0x2}], 0x0, &(0x7f00000017c0)={[{@rescan_uuid_tree='rescan_uuid_tree'}, {@subvolid={'subvolid', 0x3d, 0xffffffff}}, {@compress_algo={'compress', 0x3d, 'zlib'}}, {@noacl='noacl'}, {@noflushoncommit='noflushoncommit'}, {@noinode_cache='noinode_cache'}], [{@permit_directio='permit_directio'}, {@fowner_gt={'fowner>', r0}}, {@measure='measure'}, {@smackfstransmute={'smackfstransmute', 0x3d, 'net/wireless\x00'}}, {@seclabel='seclabel'}]}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) ioctl$DRM_IOCTL_AGP_ACQUIRE(r1, 0x6430) 15:00:00 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x7273, 0xfa00, {0x4000000001, &(0x7f0000000080), 0x116, 0x1000}}, 0xfffffffffffffdb8) [ 1016.122282] binder: 16632:16634 unknown command 0 [ 1016.166496] binder: 16632:16634 ioctl c0306201 20008fd0 returned -22 [ 1016.220899] binder: 16632:16634 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1016.226195] binder: 16636:16641 ioctl c0306201 200003c0 returned -14 15:00:00 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:00 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') ioctl$FIBMAP(r0, 0x1, &(0x7f0000000100)=0x81) preadv(r0, &(0x7f0000000300), 0x1000000000000530, 0x0) [ 1016.280196] binder: 16632:16637 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:00 executing program 3: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys0netBipv4/ws\x0fschedule_i\b\x13\x8e\xf9\xb8\xb0\x98\xb0C\xc0R)T/f;\xd7K\xc8Z\xfb\xc7\xeeu\xfa\x83U\x8at_\x8e\xd7\'\xe4Qn\xec\xb6\fs`vYn7\xb6~\xa5 n\x99\xb2\xd9#\x9c\xad\x17C\x8a~2c}\x1d\x83\x00z\x9d\x02j\xca\xe2P+\xa2\xfbA\xe8(\xfe\xb1\xe8|\x93\x06\xf5\xb6\x1c\xd0\xef\x02\xc4\x98`\xd8\xb7O\x01\x8d\xc2Y\x87\xd8\x88m\xaca\xe9\xc6\xba%IS', 0x2, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(r0, 0x4018aee3, &(0x7f0000000140)={0x0, 0x3, 0x4, &(0x7f0000000100)}) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) getsockopt$inet_int(r1, 0x0, 0x31, &(0x7f0000000040), &(0x7f0000000080)=0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f00000001c0), 0x4) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000540)={0xe, 0xa, 0x1, 0x8000, 0x1000, "aafb8a9426dd5fbdad7974ac1bcd7c206f5022345bdc4d0ed379db9a7adcae30e98a214ecac435b03e52a3d90f59919bae401160fe3f4c482b0c1b0c915c6ee8d76ba029bf700a18f42b602ecd045e902b41a3c09c09d711aff072c12cc1d53b4155070ab4a7922be93124541056b8f5bc8ed8aeebcfc65b2c9ad1f6e6e8165903c10fe8a2e2ad175599012b4d047f8fba00ae6086845616f0f32c941d67089bc621bc382645cf2204724337279098fbf41730f84893d22b3cb9d91d19454a91272a80f39ef627cb40bd5dd71cd9bdf8479a53ee9fa17b027d4fd967c1c03cd4879b1921ce62287b4216d8d6da5077a5a2d61bace28b77a61cd9127c2d988edb1eac29797b20ca809f453fbda08755f46db18b82c602c2c067bdf1b8449cccb728c282e006f274821d60b20c5530f988422d556a4a7e06515dfcc3e40aeefa83f787e11e36ae50260073e7f3e2d556ddaf2bf86dbd266c1d0fc5647b8c1cae9b5460dec416ccb5e0cebc5d200fe00fd1a2b255831d4d10077dc5b9a2ef6bf7d4676345d02edf3be789e3c0c1f8cddb75228c9209872bbf7d5fbf9536f80fdfcb1bc7e6e9baf23b4b2075f731201d701b2abfd6074abcd07a29f1cc93402ac8109325c8fef3bd0ef211ee714a39fcfdfa2ad86d4045c74a57327c95a8a076d485e6bd95d6432915da915577bdb930adf2e1fbfc8f7a3d99def9e836476f8c2a9a41500d5e3760bedb24395d12f7cb9af8a600fd541b7661b3a99ef62839348e4bab89827a858a9a22991f0df24506f55390b1302e42f0b82fa866b49dfdfac69dc69d3c11f05bec3a949d366e453fd08a36e4b583fdf1a91ce9719346f9df9000d939c01e4b1ce4199684728048093c1eeb769439a064db885aaa56d8fdbe11f95cc3001f4753fd4e59209ec8fb8107a51479c3440f7b2867f4a4ef521e66b5b3e0c2b651799144b4a9c0ed623b569f0a0dbf8883f39104ea3c923723f3f559b27132ca8aaedde8b9ac4d45dceaf920859e6cd4b4ceba193b8de3e55732505600bb39c11023f3dea0f134a8e3ad20058f86951e1c5b9a4006cebee99525c1cc73149d3422d54a5f9e513d1f5ed808881fb1724955f2098cfb94fd577757425cc22226f39b4a4242a27006751302f72cd6e5fe77211b008d18727286cfb381db7defa9d2ff906b6bfb45813c8eee759f6873e1491f9d67010814a61a6406d31bee36605e31a3c8724862292f33ce4fd4fdb264bc86210ddd4cd7883cb61d14c165e16d579a2b14e6f9e90cb7ab09f7465327b22e4b9e4ea45a4b1d04a9b7f604fe2df598faf360a228dbdb98d127744465dfd9307378e6ae53790d3b7a7fe9f1f46aeb839f50a872d3a799b3460303c7fc64c7b5e8d8bfe4657f65f03448e1cd88e8e43c02930aa1a21e4ea5dd250ec5788d4e43483ce3703e5f866ba0f28ceb21576c7ed90e97e6607bc5f009b295ddf733eaa57edfa5c5888f1dd16089a0181b447a703d1301fc9de905489073553c869a90673962959a751f06af1689d77c12937ad4bb4b31db1f6dea303fff6074bc78eb394d3c2a4965e37cc9ac1a180fe1b9804080805b42254271b9112fa1cbc1ef33b47aa8057b1be6595168685c9a7f8634de4111bc2f766be57b81bd13685116119b998ae4438e5f9daab5a6cf940cf063c41ea68a8839f7828b4ae888803be3e27995eb9c7c8b9a6e2292b1b7751d9e9ff77b905c0045d7eb8e8383bc08dd6afe2423032c31cc7efe72b00414fc23c065e6fc3bd60e3d861e2eecb64f87e102ac284c7ebc7195470ea0c344dbc1a63a43a0bdda809719fe4de9a6f69296f8e0dff0716a138222f3b3e8e3ff0c474e29fe75535bc75f71d6d5fabb5aa926b688182e3ff72c3c8981cf5d7be1c956f8c05ba08a2c41358ba9c7e95c368f6603a7b29630558c37a9dd577f5500ccd3885aac0e0e979cc89ba203daa1b5a338c05303d6338a0c56d72399e810548b63eee8e3cfffbdeaa7eb225c6c536094327f7dfe56fa429ed4a2e9f1b42f03989057fbe8102c04f5df88109c2c982a463807ee3a826186a8929ddf12e6921d0377b69b41131c5d5de5deb4c9a2f0e185b427815a2519886ea8d7ce13a2ab984521e94ac1985038ea251bd936aa7ca74b6723d6eeb0844be031595a8ac7e5e2ba4eb4d79aa71cac20e44d71dfdfc7378840a07f6bb718a489d3112739c76890e88600e4637e401adde729bca6faece6c608ab15dee74d13402dded6c709439d27320e9ac41bc24999cf5bd726ac8289a642e34704a4dc6d9d7f95111467dbe821b0bd6f268ba5c73bedb36fcd6032eaddc30773ff2bedb45c2558b873646342cebf7c3ac440e93486aa40dd6c2a5c669012fd7e4f1c31955760c6f2d173f52bdda7c6fa52baa12c1dbe428c1a30b48f7855084334354c564e5ac305d94946b13927f2882ebb02bdc9ced50e99231533e9c566ea50bcbc22d979cb3806310a4d7b053b5c609c37d5b8e513bd4a9560be009637fbe65b23347c7985b983eb504c3b5758879a0c570ed41929dbe6d4af6e63f63297503092b929ac7ebb9372907fada5de4077e64875a4cfaafcb6bd4b2598c5f1fe0887826d4ca965282e56ff00e3eac811fcdb2223217db3fc05b3bf92240934bbc3109a7ebb2f166977e9f15e4b4c7c27e7c17f5d04b67de2fbbb5e6e7f1a919d6098f6b94a5de06758b0603e312cec05e85387b413cdfb2db22fbe0d6884479569033816710f2b0f3ae70b26bc89d3591fd94973cbe2098edb2ea98591e04f799083102d64c79b990c6f31806301afb55143cde91fe9fdc7df7afee9e9fa7af55e61450f13a0f26ff7a978a196d7ad49b95079a7cac59b28a45a929f80fb833ab25aded5aa5ace05717998f94e5791200b13601914048922e51c16978543459309fb9300a171f93bc178f2b3e51a9274ab6d8ef09e0861475e84541634d5263965906fb61d7c9ebe9f615590478210b39758bf6c9267839bd2abfd4a6807c0b6c2812603557bd83dc4eb967ae1d9e0ce62e0bdbb6208a0f6493f21799eeccbe7df0065083015deb7aa644b47f47ffff51ba0b3d3a07319866144972647dd42cbec3566c7e1f2a4c237f5cce63f761f0bb12c4dd1e6cde751bcbd71b268a0d0d7fefc46e6f260f41ef5b716cb354f4f7504364b4b1b183668fa3e5a0f436a74afe03ff7290e78a2712b42bccca966353f364896cbb9547d5e9a531008b49456fc66ebe5d00790b76d9b9a856f4647f6d6f45486fc93ece7e8352509114e579bc6565869ae73d80a626b2bce4fbe77cb744e0cb95cce7780935fd7abdb784b04e230678f67696a40677968d2d01c6f3186d59c65279b3139e853002055277e7df70eba8d3be51820078723f739a1c18e5ac31990fb1d7e56be127359f971137031fef599e667e1c33469dabece1f7d2c42ce27750ad8db129475f689e40de57e077c9d0d007d069b48dd60457b100fee3ea60f59884494efaa76f788f0ef7332e31c4caa0800fd365f3bad1bbdfee5c7b7987d594b9d7043efd9542595e6c6ecaf0efbef95a9fb7f8e195a7c8c3b30705c0267f40bf70aa654a0ea4f2451f0fc9e426e5f07dbe564b846a57acc9287ed75d6b05fb0b3111f929b451f174f95c087590482eac32f85f35867a66c12fe0ded0923418998719fe9dc6915b74a396d2ad6931bccfdc1e6773dd77841b32695be32a90e592c0592e4c10b0853cb9fa9e4e1b47210826a36aa62ecf96fadb89f890a6ed3a1406e3a06239dba7c7ce7549856561a326c17b9183604273e1303871b9e8ce537eec92822b9bdf0f2a345b792d33dde92867699b2f6ca87d0661d9816603c0aa06800a26ef3dbaaae82d0c6b0c0cd13ae031dd2b3950c716acad04294c3da080d10a1f4809e5c27baaacacda7b7fe8589607c28ee53249b1a15e5bb0850c1cf9009c382e0d3b181c4697dfb5d92682fd6fe9cccdd4a6cd08f9b71fcaecb903f45d5c3362075b858e26c625eec721c975210a72f1549b21055669f0bc5bda5509d02fa978031b276e9d786adee2c014d4f023ae2cb2c9836be1e7f78a4736c5ed5217b1f80ca4de02cd50a23fcaa187915eae3732e7f477b4e9ac1759e3967b006fc6a536cd06bfe48c7497ff5e1741d47794ad0a632f2ed78f4485ca2a40fb3e8a9ecaa18efe2e09f8a18e6b7822ef44fa12f30a28b8c8d0c62d5cc8d2f38657ac4c05fedb21620ae4fe414a7d0ee78f0b889082991eb144c6f112b8aca50c9302c59dbe527ee05e37d3a01418a5cc170efd4d55d5a5d2a4637d70c9cce2d085e6573119de4dd08a80093ed38a65ec24c97a40c6041182c91d458bca26cebf0736bed4643d4d35dc002cd5418fa759840420b2272ce917556c8341af769cb6834c2549609696f48f61b534f19c1ad3afa998289b1daae3fb11a47e3af55200d4459a88f82b57cbd88af1a1ebb12d2743aba85346626441972b4c37ff9ad09c82c2609750e739e5ecae45b48cfa3bc527436825dacd376d81047d436881922fdb5b91934ad1048a937b162723236c0dcb1a98f64e7f0682394c620d61961908720553414f2ad93df59ac0cbaae41a249e7e5fb6ac1daac85ce67ef6d1e16a48fb95ef38f2cc74b679034c4a981e1e4833648e67212ea4e2d19e60556a0ce6f94b03917f68f1a4a50ce8cee69dfd9adc08fd4ff2507686cad6fc699aa4e74b0fe2a4d3913003becc6af629a097d70809af4913da1db50463d2790456218f30383a8e1378bc1cef64b1f2095dbd2f5ef55c8b1eb42ea2d05895ddbd75ba0db903e43bd1b635c625c73a82f15a4751884f60be12685d9ee860b58f9abc9e94b521849fdf1a6a91e7e2786d512aff216445bd9d4551ebfc184f3c46aef210674f359556ecd028f5e4a60af97f4c2628a667200f09be460454606c7b62a06e59e9495fd2dc9102e34d095f99ee91d8131daa67203c863933a28e2791a21aaf316f1a9455138673b2dd8f44c17e6e44e9233ec09032f99c11eb4c45cd890674e9094cd2c22f3ff62f4caeeb831ccbdd8cec2bf35df69ba811ba857b2a3597b99183f27844f33edd81e881bfd53db407a3ceda0b7b35563a4eb4f3936c08e24d4ce39b1c64d6d22c9ca5629bb629286ed75b473727db694e51ff93d83f72d31aafffe4dba3cc28827c736ae89f1c91001fe9dddd5e8ca7ba4758fed4701ecb8116009f861f9276a5aad4c460e264ec3c45fe3925a552063753b94d5efbbef0919bd7e791e2d6a5f882e097a0f17b909e2b4afeef3d7f87fdd3e9efc7af77aa4188298abcca87f1d9add02ceb6e2d5e519b813cf5083613036734e4249bd1ee2ca8afa07cc7c79d7d63298f3c6d563f14eb06866dfc8afe43bb205e93b214d6ffe7190e9a62238dca909c7eb76bf4bc39d0f6d4677bc87dbefcb185eb4d907e61e6956e2146af35c6715fa0103bf5e07bd3b61260d80baf5c784a35782ecc0f9571fcca6ffab42812af053e06dfa6a0f05b9516ff9adc07f0c17f86f0fc0b832545c0964ac8a7445af306fc7c971600d0b57c08d21ba61caf19375a675239b1785b2fdc72a0efccab6903c3f50e10b692891fafd8a9f9a03baa0ea73d6538966b7c7e28c7392e0e1316b86b4f58597c2ff0812462a0a70558d8eb86656e7735ae572f2f3ab0e3a55e23ab1472c909cefbd9c79a38cf32d590c20e85bc861abbe306cd05ccc41290a4eb49bd5175c6d10f80fe6d3db229a39985a265d5db5f66a66420abed5adcb3f438612b58030e3b0fa64e490da41079922f0108fa2a1c531"}, 0x100c) ioctl$KDSETMODE(r1, 0x4b3a, 0x2) r2 = syz_open_dev$binder(0x0, 0x0, 0xffffffffffffffff) openat$vfio(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vfio/vfio\x00', 0x40080, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:00:00 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x45, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in={0x2, 0x4e23, @local}}}, 0x90) 15:00:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1016.358832] binder: 16632:16634 tried to acquire reference to desc 0, got 1 instead [ 1016.466681] binder: 16632:16661 unknown command 0 [ 1016.499773] binder: 16632:16661 ioctl c0306201 20008fd0 returned -22 [ 1016.539457] binder: 16632:16645 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:00 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) fadvise64(r0, 0x53, 0x4, 0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') sendto$rose(r1, &(0x7f0000000100)="a75efb6f01bbeece623a", 0xa, 0x8000, &(0x7f0000000140)=@full={0xb, @dev={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x2, [@null, @default, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x40) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) syz_init_net_socket$ax25(0x3, 0x7, 0xcd) [ 1016.550383] binder: 16660:16666 ioctl c0306201 200003c0 returned -14 [ 1016.566004] binder: 16632:16637 BC_CLEAR_DEATH_NOTIFICATION death notification not active 15:00:00 executing program 3: r0 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r0, 0x84, 0x6c, &(0x7f0000000540)={0x0, 0x1000, "f7741c2569511dafe4a77845e7f522a078f06e69d10f8c8a0cd5aa2f4403a0deb5afb9fe61b9a09a867d92edac2274d706b1a0dc7e9100161c3f431644f5615787226b23edfa254a7f44dd55a73ae879ae72fa506316537253b57b8071a0b506ca73ffde06df386142c14bf7c263cd10c9a5d568d976dc6b3a55092a26c6002aa809ab23b741c2fe55cd83ed93981dc33c42571ff875598250c7dc768adfcb7227f8481849ad50c695db9cb45d88065867f78116256f1e14fe2ab1eca49e45e2898a90076586cd7688040146812368a1d5357517bfd81e1530fd95cd2ca97de1828dacfad5fb339210b138595fa17625bfc6727786dfe97501f5eed47102295e01aacf1b80c1131101dc445fb4a4b92f84bd498016b8028615c46f282a23a72889b411bcd9cf811d74b2f8e20cee0c68ca2c6e04c1fec80de1fe3a19c89bed8d36bb8aa8c39cfa57f830a93772ac0b5b588be1c92bab3687718cc4974a6ebe8cd0315fba4abb3620185360bd029c9108e6386d6aee0b9889d03c6f0b77cf7bc57fd9668d9b2ed2e5cfe6e07d70d6f770f2727b0c30c399828c7787e5b8842b926ab165f3377d27564a7ad5d840417007b178da5382713f4ac41f7a37b71728f1cc3d4a0a7ddc3600a072bd92ced60acc977f1027ca658ee0bdb30e729c0eb120082c1de871a44b1009db0cd0230ee32f28ae1e49e99298ac369ca466b26cc25e8087271e36b74bb9d1cd3617dfbfb7c43319063c2b78d1f9e5ddffdf984dffdf8ce17340ea7cfa0c44ea713a676ea9badd09e5f56cd43465ae4ef4ff7b2ede1df76ccd343523306d78543f06cfd85a4e9f33598131da950b20de0e77be093d02cf75b04b1b495a1b2eead2ac8d6d0e377d3f9b30cad74642f6c382a5c1a27a47b89f37cf248fa61f0763291b2eeca7827720b6e41e9b44ef2413fc2473d12d7f925d966906550e19c769cc2e1fa1fdda056401c9098bf07b0cc5fb4779f6483a7ab157e033bad3820c0f173d9b8428f297a1a6248059477156aa9de359ce01b2d542a2c7698d64e4ae40a1a10ab9d2ed63604c155dcb279bd7e65296afee800b2771c667f639592e87d35002eeb9c52955029e4d8e54cc4ae483badbb625a2414fc4216cc2f9ef5afee724810200eed51501f9321909922a09dab89de4e44f2c478a03baf09f664416e7a853a1f1549de36ae453141e9831636729b009f8365cf86f4fda4345ec97e7643dc31b7738c1c019f5c6031dcf70df9e12fcd0349598ec8efc75ff4bf4baf5eea58e93ce0a447327a4f8ceec9d871d417cf1b61b79dd3e01c8798119f33d1fcd4a6fd17e2c860a7327c1143cdd7fa58c00169ddd2dce0c641f4c8440ab08ce6c83fde30bfe2e72e81b45eccc43a4be7b1b8e0c164aa7ccfe2f4152533e175736280db9503ef325514ed28b020ff05b36255926364b3c9fc853839385217216adbe92d820f6328301c549d936841d4e020a081a17aa9167a00c1b29c5556dbda11588b1c0f239c15febecd251daac0d0d59c08fb421f60132e96bd765199c0615abdcacc71378da66d3ed4d894c9ce1bb4d5bbf6450d4250b891a0b60d86aff997e0970c0bd6a76ffab7b53143ed274e744d5101b56c4a3335adf43fd29145b50d9796b7aef73a1d183694933b1a209e9ee21bd72eb02b1405cda1cff5a16dc5c484bc9116a18119783fa541724131b2e4408790e81fcfbbabe420a6f570b6978398e83ac14ab0ea895e923ca83a1cc501244a05e52b7cea9b83fd592eb4b07e897497ab499c1c782e24edd9742632a545b9bdee7cfd051bbba5428991bd759276544fa241051a0a1925d0e83002d3711f53888205a71e3dbe2f903acb8912c653fa58c420942330dc58d757136ab175a846e57b373c87b63275479363588edafaf637962a284564d484736fe00f18258ac5bca2dd23beaa1cdca27a6b7d36f32be3c14858da6d6c358176fd7abbcedba75352f12020c2e976b6e74426e3db9986847d6fff06bc69d6673e8d52832ef13eebd5dbba637fda48c7409b078c789b13d90131110ce6d959470f9b531bd7d050d5144006e62876171c73f41ae0c7859f1607fb2d04116f081c160dadf37aa7b750ac3194400390b1d95351785789071dea612aba2c5de73a2862c721a088c83d94e65f491d7c390fc6468d0d4623074c42d1a0b6eda44787ccf910518c1645a3e022228f31db6c0ed169dba8cce9abb0fd843874fcd59ff21cec54750770d48f44cbcd7ead540624e17e0b4888ee23f683ebf96a79919ca36b257892690be1209d599c59f414daad1dbcc5870179e40eb847bc15f553cafeba600abc305d67a3ad854bf16f446e3de81dcc444695d034327f6214cc36b1a833dc04eee7c4a1358f8fbf7f6f19eaf083dd802722e489aef9a847134819dd192d9fd554d5983d70dfdf463e535daf6b0a0d1d1203157fc0f7d12016be46133dcc4db7d1422f3bd2f017bd677737570d0c4bf89ee3a8783f4e084b28ce6d2bd7467c9e6ba8e627f939b18fdad54063a4dbf868788f665d5cfa360cf0ca36e468a517b8ce4f090757d3e3c9c08699402bb873ee91182399de8c2af37d301c54ba910e1205c581eadffb036963e1d77113ff661b092585fa5926e005599b15823b02caf2317b2e33edb47268f67f854d41f5f4c726080b8235703f9aa1740e3df07e05ecc86a829947973a4d63242301ea9ee53b93df06b1520c61b5d0249020b7153f213705cc3e2729ada69e9c827936ffd73f5d7dc2cfa77d25a9e7b4d3fe6f73f3cd9f3f486f4f6bac756ac1e236b9bb97fb529bd8b41142282820abcf8320d20777c8d0debcc313e90140d997ccda250074abbcebb5b0405016b413d10dbe4b99ae7bcde4e7640529b2be98a8b5e327d1741ae4440a00fa6ac29cc1bea9bab4675b74505fc722613a4ce329405e00dc99329995c4982d6fcf00cde1f5a15c41b611d20bbfeafa7abdbf4370d0ce2e1de286699eccafd53125bd95c1d911a986b687bb91fdb39f3f762922c5c42558718fc83864727a86bf6529469ab71d1a3b0656534c5daf6267a2cecc7cd00d0f6a59aeb9a2163396cbdfbf3a48b4151ed6e36a4304a385f62dc9e053342ac512351077ba1539c2c213131810303925d46c6869a8695ee35cf1098f9e0c8f710c2c397acf092357178717b26ace9ce0e129c6443baff37c51a68e2997750a0d7b4eae5bce5ea102ff3275fdcd779b4000a629ff6c706e1145400fdf75de0ed1919bcbc0c1504783d10c5c4cfad875c1d3830d3659a311c4d9d040a925ea6119b3b7c1795e89c010bf038140fb394c8e1a5e947a74c8d19788452d2678053902bda84a45058a83ff38f2c5e68da0acb814aaac5e2f5fb6b5d996c10092e6257deda1ff3f1711ff4aadd53c76f369ba3cca702a5e17317bda4e6a7935bfefdae2c58e29a77e76d62c3b9d6b1ffee8c19a9e1d7c5f643b9ce63e9a35339111b9d80484e1fc9fc90efcace623137b78c655c7dd2751e2d8591787347c1987a58d7b1bd9238e71a3eb94638c9bbaf3ac3a8fff0218f1e551a26aee51d48ad69dd0877fd6556a2342615578c35c6e4e2795c112ba7fd5618a9cd82cace9149a5fe0d23fd7e5776d2f30058e6ae9e78449cc6e4595596af009cf86ff8d71c70eed0f2f7d6b8e5fc22257330702086144f57d91ebbb3f9a5a3d4693349804c22a92f616a31ad34027607e91e7e85be14a5912f74e5746c612ea61e80452b5848f36569fdfe61eb7327369b7b044695dd2418fd03254fd638f76e921bbe8122fa043b7bb1953b2b3f3dbd9994a0d7b4717a59137347baffbb32e61c0a6f95cae90dfb6ffa88093e5fe30db72176457daf56a23636ecb0cad9e9d7cae3c231f45e94f9e2ec757a56fb66542dfd6ec5dc2a44eb297b6222f76dacf535e0c165b5827c3a949ea48b0c2a3fb953936be011ec39ab2ff5e5330987ec6c8577342a3afa268eca806333229ea9b5d5eeb4fb4f944c385c53e98318de0cc129cf697ea87f413cad89a7f0028642350e71e074fec85abcde04943bfc9ffc5aeb8d9952b9fe65f02e8d09a16fdf8fb4035c5ba95d239c5d2f6ccdd1a3fc08571b3d1f7b7c1bf492ab4830a1818265a6e32f4509fa05cf4f82a12dd1c785a5438339800ed9f48335b438803ce5bfd5f9798253d391d58ecd1c219bdde378cc57361de6733f34c50a85edf7ec0a576472d9ac37cdfea5f3d87cbaa44eec335b4f6b508e864eac11ae811055dfa23cf8de82a7368aa12af938c58aee1b5bca1224f814a50221da28f217825dfd99dfda0eb9efb77264a40f95e476766a8150e30d1c3d37be1a2308d62b774405fd0517dc3754d96562f2878ceb4853d9524f233b2d49367594c9ec24ea19e6226a331dc6086198242de242e93b9daa370e57a169e4f48f292167a66233db6aeadd30c611b277c260369b78c2025a3406f788885d36cd2aecf30321aa812deb254775f008af02ecbef4c1b8bb76049ec751811e5e16dc07627ae8d5c247595a12cee9ab1874f3590723294c5d546feb79e188943e2cc302a0f63a04f0384eced0df5980b576b5a2a488e4c6f47e6a62634e38fd83f31ed78f16f10a5cd67a1c8fc11369f7ca6f97246373c40fb2a65f2c1899aa8af940295884a66575e95bc51a5a9988acb899eb59739b343c665f3d5db8ccc5f7192884815b719f7f8f6d7fb4c9645d9a2f9282b56e71c63f0c18280edee6dde2bffa85cec4f6eb697861c2aad4b9a451399c0f12a0d8b416a04d3cdd8f162853a6c9c74ea7aa1dd788e029b7614e10f4fd50d4a1165b12d558190f7371ca9d4b89e6a1fd5a5d2a4342658d56a5a13d5e4bebc97a81403b7efd6ab10403533619d81881943d35fd65441ef4a04d93b72dd0f650062ad4a5b4c7db9456b2ca4396a60e46120588197bea5d105b58713c989b876d60c39297345d051f71cce8b09cf395301fc07c77713daf0be3e6b3dfe1b23928d295e6408dfe034ce3156757ed304a7e7019e7a9794832e345ebed92240c4c14ba2e137381968538a99327f0bec99f0d2a8e38a6b92a5e4c47b51c3f9ea451f682274f4a1b3a34bb6ce824b4c8ebbe19d161801f474f62f8ca4ad6c45f8af68426f9bd2eb1f4677c1e74e7dd9c65de9e30edc9cbcc99fe4ad5bc6a25e1425d3b2cf2b740014dfe4aaa07455b2d31340feec51f313e4d9d1f0c7989a6d49f634c04efe1e9158b963edfa6c9dc6aa781615d436e642597e38d1b3720193e7b713daf777f1f3903ef5503f8effd9c216020726dd137d99032c6728678dcf50e696e7cae7d4b1bd51f6408e3e1ce7366c5746063e53d1861492a66e7bdf1609edf5325e17937ed75db765c650412f5beb99ba3bb6aa888e659161accc180cbe18a52a1996544fde834abc5cd802bbfe70fec0af43203acd06555180213dd66746c44950f552d25238cc29a80b39f32bd7be00c7431ac209656c47d80511b7e3882e27c44268fd1eeaf8e1064f560bda0b34f09cd5e32180cba82d7b7fd949636513812cc2105322bd65b02a282623f0ac7df979d9236d06ecdb3140f65e08bc0b4ea7d5f8b5e3e5775abfdf3566b66cf253110fadb4b62764e4013984a1a1506b6930136f8850572d3c11c326073c00842c0e4599457a8192ca6b65208e3faecf50236cd80a690f39fa5373c23c465dcaf67c9d9d8c08d81627609a921401a5f2f40f6a09e633a83134d2eba1ed6c9792074905bdfde7c0c6a7cc4f01d32e3ec0ebfc678601f70637bafc9e5105826d9279c572ab3e12f"}, &(0x7f0000000040)=0x1008) setsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000080)={r2, 0x258c0045}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:00:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/cache_bypass\x00', 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000400)=@mangle={'mangle\x00', 0x1f, 0x6, 0x570, 0x2a8, 0x390, 0x2a8, 0x1e8, 0x2a8, 0x4d8, 0x4d8, 0x4d8, 0x4d8, 0x4d8, 0x6, &(0x7f0000000240), {[{{@ip={@loopback, @multicast2, 0xffffff00, 0x0, 'batadv0\x00', 'ip6gre0\x00', {0xff}, {0xff}, 0x2e, 0x2, 0x9}, 0x0, 0xc0, 0x100, 0x0, {}, [@common=@ttl={0x28, 'ttl\x00', 0x0, {0x3, 0x5}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x100000001, 0xe47, @ipv4=@dev={0xac, 0x14, 0x14, 0x1b}, 0x4e24}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @broadcast, 0xffffffff, 0xff, 'ip_vti0\x00', 'hwsim0\x00', {0xff}, {0xff}, 0x33, 0x2, 0x4}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x2}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x3, 0x80000001}}}, {{@ip={@loopback, @multicast1, 0xff, 0xffffffff, 'veth1_to_bridge\x00', 'veth1_to_bridge\x00', {0xff}, {}, 0x84, 0x1, 0xc}, 0x0, 0x98, 0xc0}, @unspec=@CHECKSUM={0x28, 'CHECKSUM\x00'}}, {{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0xa}, 0xff, 0x0, 'sit0\x00', 'ifb0\x00', {}, {}, 0x67, 0x1, 0x8}, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x4}}]}, @ECN={0x28, 'ECN\x00', 0x0, {0x10, 0x5a, 0x3}}}, {{@ip={@broadcast, @broadcast, 0xffffffff, 0xffffffff, 'veth1_to_bond\x00', 'bpq0\x00', {0xff}, {0xff}, 0xde, 0x2, 0x2}, 0x0, 0xe8, 0x148, 0x0, {}, [@inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0xb}}, @inet=@rpfilter={0x28, 'rpfilter\x00', 0x0, {0x6}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x7ff0, [0x9, 0x4, 0x8, 0x1, 0x3, 0x2], 0x7cfd, 0x6}, {0x9, [0x8001, 0x9, 0x0, 0x800, 0x1, 0x7fff], 0x3f, 0x7}}}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x5d0) getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000140)={0x10, 0x8000, 0x7, 0x3, 0x0}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000200)={0x1, 0x0, 0x200, 0x200, 0x0, 0x1f, 0x800, 0x20, r3}, 0x20) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:00 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x100, 0x0) ioctl$KVM_SET_DEVICE_ATTR(r1, 0x4018aee1, &(0x7f00000000c0)={0x0, 0x2, 0x0, &(0x7f0000000040)=0x56}) 15:00:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1016.811994] binder: 16678:16680 ioctl c0306201 200003c0 returned -14 [ 1016.838436] binder: 16679:16685 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:00 executing program 0: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0xfffffffffffffffd}) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_SUBDEV_S_SELECTION(r1, 0xc040563e, &(0x7f0000000140)={0x0, 0x0, 0x103, 0x0, {0x9, 0xf668, 0x0, 0x9}}) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r2, &(0x7f00000017c0), 0x1d0, 0x0) 15:00:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1016.876860] binder: 16679:16685 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:01 executing program 5: syz_genetlink_get_family_id$fou(&(0x7f0000000000)='fou\x00') r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:01 executing program 3: openat$apparmor_task_current(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/attr/current\x00', 0x2, 0x0) syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000540)=ANY=[@ANYBLOB="73797a31d0fca48c041186c66ad52f70a84d5f95526be64e75f2b4bfab24e339d9e4d73f4cc9b6f3fc64ed9fd804d1f47afdf7196d0ab46d7d1c40e0c99d456315fea7bb5d36437bc64a72da2f90771e111fe1200690004906e7e8ad700429399b39c32dcb49d9854bfd7fd3ada04f40f6d3b7b5f55d544c2acd298c3fcaf36cb5fb76e77ff4a5e780ca02c51f03bca97e875841b61e436eb29b9995a4a664d7aefbae36152ffbe4c755febff42d12ac1fc1e3f864c928b357abc3ee4c24c0421cd2868ce89bc08d846405c4fb1e102e854ed45d523bb6cfeb107b19e26b616e75b3edb953430c802d97af3aafa22aed3642c105668f48a44bd575ceb64fc00274e5067d7e8cbbb5d296daa5c9aadc56bfdff2144eb04fca6d7d49743c464b8cd5ad6054530b068909e09b3da5043afd069b64a220d61b588c62a9eb880daf97c1fa29b7007cf7bf62b020edb02ef35e6629dc0e2fca7ad88b1b7897febb52119ec5be13de82710dbd38930844c7c8a7b9ec5442664e2c56ca718d51c15c2f5fa5eb347556a9ac5d1989004299fa4cca23b28f0c1dd02cb7b3a2d034f0f65fbf4b00e9974c7dfedb0c45d26904715978e713dc39f6ca19794452b43d1769d90f9f752c4ac789fb38ae32f726659a64d4da67ed9c929e2fc2c37cea0b36cee02d61e5c2956594fb9a287f6723320f1218c07e97e8a64946434dae3e402d4f486129590627e116f711b88195035019c5c9ab952520dcaeccb25671fa1529dcf70a11ddb6bc8d6e24df254d5cc680a7c3107df2df444162cbcc016a000ca020b304e216f38b7c487373833f43d947829db3cecb13effe55eca75def18819fa006155f1ad8ad0ad4567fea11e2e26d2e2bfa5ffd5a107fc4d0e70072f73f2c2700a28b902ca10c1d4128bab71066559350a95d9c04a27f0b172a7a5a6ac9e0df5d62c9cb6eed42614cf201267cffc4681470de2d21f0284dc704c3f4f2436e2eabf4b1ab41a783cf4f6477c42661de66aad0e3572b22a71cd52606d8bf37f0580619cf504e6d903786af8dc542090ef3785eb5ba2778b3a903ae35c2150cc997e7c1146eb4ad17a22e0d994c6e326e3ffc67220d516af10aca4ebc4112e227105be19c31210dbb9d3b50165c35f5343a0b7c59e53a08f7433d0ff0a0663f32e21538c46aab33884ee3f964b1a4b0aeca0ee946a41c591bc4edbe48f90efa2807841199d449927cba0bbf3e3795e12c7cf6c5f5522e265d5a9fc4fc33861e29b9ba01a7c052ae1c854dd9c79caf9d436724063df0334d772875cd8b63a39973052a12a38653051f76ca79db9a471af8d33dc48ba6d99eb7bd39d80e7abd7bbb167ab3359d41ff72995b853d56fd360a36d564e106eda7f6b02519d60516e8be0dc64fbc18cc81cb5479eeaf061b58313d2329cb5f5d6c3ebcee39525df933ff6db3c35f9f5173f6b18510f3082c197d2310ced4f0a8aa77301b735f4d8a859c474f9cdd4f5719f4ec437980b367777c8ce4364889cdb4aceb5fffcd00676cc414676d621b7ba09df3dd668f58c4994e44fad6b65c53527cce9131a7a2f1d100f72c38434cccfe6f12d56be2defc5e14edd130a6bef42640486c6130384cbebe248708a3ab0ebb95813ac41159f906c5ecc938f386049410e8524e43c8a850bef76b071c317baf95eb9bf90dce3dea1b11b9f9deb776525b0b1e2769f31ce7bbfee99dde6453e4720e3c24eaf15c2baae710dab190adc0c342805bf835962a5d0ad961f50ea8fac437d9e0d1e76b6c7b0fb724ecc1bb4b8de27ff34919d0fb378e9fecf43a4ca0cd8baff05fcf5dbd9b14de91f0818f7ac0beb64804e64b9a482918c27915972c79c795933786af69eb461833f30871ff35c91249513fea58d082a5b48697f75eec329bedc40f0a75603c731d2789942e4aa0a11328a5648e3035050e456a096af4abdb2b7e16d55f11fc5f4f4595b7bd083a6092adf5c0246f70cf6d62c8ccb0c37c9983bd662e81f8c9a0e0eeddb306fed2902a6577982ce8db248ea39fb98ce2f4e1b600e778571bcce1b1ac398b977383a9e4f21cc965f19f2252ce2749f20d66cb5d5ffed54863b2c4deef0d8ab03e12d33957700f85e465e8b89a03ff7f00001b48f7a8d3d99182111751285b1f223a0564447480df71a6215baa40c6dac2585c5a8e9034c8cf75532b93ced8045d0763be6a1d4a18d416c7142e328101131b43f49f021d55d11d8dfac967bc8ddd9fe16c984e6e6d77b296d44cbf8a3d53afb8c2506d981b95f3ab7114e303351adb6ced4abe4309e31300d3bc79fc8bdfcfb0951b54bfe2b14104dafeed14819b0f1e3b79089b71a761993c9e9dafaba94bb3e145156d3db054a618f7307c789b237b678425d3f295603602fc697e51f9dc3820822910e770e3b1dbeaf6f2365a74258959f1b9784e480425fe7837fba948ee8cc3ef7add53c2cfc911c24e893b79c8fc95acbc936ceaba6789fec8203178d7e4925177d572ae9ddc3e9e984fb298605f10a0f991d1fd8a2e48cdd7f10bbe331233815e9bf02ba00012219322e6e180c54eab77efc7b812328fe6b24b13992b4eafc748f400e4f078a4dcf2444394773b29352c7b60ab7e8208716181c5b67fb25304baea7d2ed68395070b171fd2a301db2168d0aa35e0a0ab6183d1c0cacccbbca77bde1ec1a4f1544bf3bd499617b57b66ef070bca037def961a8e4831a256c1297287b8c0948c44109ce575bc950420306d3dbf56082cafee8e69ab37103f778e9a342e087d5d8c9197c8f19bef61c5e7b7411d76f1f645f460e6e1359fa39f2e51cb75ad984abab5363f3509da9b818414e94d22303192dd731105d5fd8662c32db55d0dcba8453d04c7f2c2a33c5c2b7d60b0973c407cf82b7a43944f604789f7145eb3af3767d3644a74b5a3262efce6503b137d6e285b14a089b13edfc423f4dba18c97023f1a96f15de6d383bebf4d2c59e89c8a7ce3a638555fdd6fe3fd0fbefd71c2d0ab649184bbca1bc327d3e42c909e8981c35ce1ce6f7c2d329210ea3845fe60736e8366e1d9248836e906c050f4e5d6d323d54d07d98c8ab7b798bbc02499c5cce4ac24f72e2a9d3ba42f96e93a4f94e14cce4df0942d7ee671b94c02316bc71c10b323a94417245bfeba987e472fdc39d6891c7798a2310ab684c969822151f0e45a76fbf6ff7119ac3b9ff92d0ee936e76a61df8be8ea20b1eec1c43df33b27620f560f34813c81ab36b6c3159410c712c38efea32be326666c12ee43627227366e2f85ee691da8520102465d62d8adb09ece0d9363416616a9da39130adc8e3176e54f1a51aed38c80b661c55cf32100073ac86a34cb65d53694bfdaf6c5db29143359d1b5beed0fdd8ee1bc889f0b9d82559c42efdd4e44866ed457309f9ba2567ec8afef427bdd0a00b2f15830ef5a21ce797b057238fe31fbc034e55e7aaf151a909b51c8b4ece4131b6ca31bcd3e462deaaeadddf03f5f19131710d22ae858e66dc2382f5a08da89f737110b737e9485e47310e3e0037a99b63fec203085ca46660eb057ad71a58bd434869e4087ffe9bf2c995632421ec358b9c29b2e47834fd69b21ed0b511e2c801a4620ea16f078024645c0b410466ae5cc92f29c59aa8c809a938ca80d1eae2f653559b71c965410bb8e0cbdd6a4cd77f3f5ac9362e6de03176efec3eb2a93275c433c6e6ca487eb2517d81097b935146f9104385f05cf2c8b0d71279153964556173742d4558f77ed2016067707f2ed946bc006de02cdca51e6160c4b2bd6aae7d49ec7f6b7f6077aedcf069ed2e5a13e885a6f09f1132c5f4e8931f74b5e55a9d170da5e564e70f078c0acb1fca3118d2e73c732cfcae9b4c97104c3238baab2a0919586ca2655eaf06ac26af213cff598857af6e4755f09fc47cce7c3ca8e9c15bf4305d2d120f298670f452d66b06df95283edacf617e9c9d4fa62d907fda74ea3e8fc9573e3041a085ec49d215dece263319e3a99bc1a6ba0bf6ea8c4b114a8ccc82675212523cc9e432dd6883050b7263e1292924b102ca8b9f8769dfa86dd2c94fdc3c669ec028fafb2aceed11b976b9f7dc3b4bc6c629984474e7d4ba8805817fcee0473586e33d794a342daa8c93e6db003db7de00bc86807794d4f4f6d1870a4ad10612d934c2cb52565e9b4c463cf3ddb07115928c15b8731ad00ea3f6a451744b97d602bb45f678c0b394c6ead9aef91af1f26af66d08940dd5f9a2c39114a876b0cd99218b68a32f8e2da523c34ec0592d5452c6b48cc6aa404272587df9bc55df0657b3445fee284ff73fa906f5920636d71bb4c54f45949d25389c790c91a96a4c5c6ba14597ced1f0d79798b40e303361b347410394e95596ff755e1c5241f0dccfe4ba339085f049e34d852936cdc30d57b790fe8b8abbcb6eff7ae3dfb51bfe4675fe0cede2d09183c82818ff5c6fb012d16a9cbb13349de9a1db2c1896e9e06e51741f642d3a80f01805b040514970cedc89f0cd4f14145fc007a5682b127cf2c563856494dc12df133d074c5c62c2832395915bc6aa33c036a09604670458bd15245b3fed1625083b182ef7e089d3f3cb5ded87b2d72ca5a3318131752bdf2ef9e64e260dce0b7791933ebe30d0dc215320a1ab20ce38d829491d0aef1bd3eeead2c915d382dd1e4d5eec5a79053e63267fe51976bd601c751f96094044b6e36cb7e38e526a0bf9f0f00556739ed2786f6de034d1d8af1f5724bc63a84280914ca32670396fb1a5e78de25648dcec83d8bbf3d4f6919b60973e55a33133b89b861c1c4dfb875a65f0a08098b309e7c9438d37eef3c19eb7b6d21bc29b2e066a2ec8552906348f1ab634328e3ae926ba42844177f73235f363f93ed965125c3b4a6c115aace771e7190fd3e1cec9d2a5fdb09e4451a68589891b1942981338ec2b780a792081223951a67f764b9c9b4bfa9e6e8f5d87a2b8ff06286cbfce8a808a4bd5725cb7ddfe2cad7c623797f503f1b5389474a91a51b49570ff2f467358470b9604e5e0a1537dd0bd58a2c51e8f24d15b89d97849c7e7ec58075c6b6034d03f13e2ef706033ad89b81cca0dddd87ed55b130c701f2fcd4fb05e83c7e1992cec349a85145af78d40d11232be9a33e5ac915eb020af6abcdd1fe88d2ff8a15927f188622bda37d9a3cfff1d8d80243cdbb3db1fec6ef1feb4beb0cc24cd2f0a571211348ab11415d3245db367fdeb245258db294027cc9fdf6b00413840de4b411fdc33c2a1357e47c8f3f56358c239f7e7ce3028b992ae5a84ad87e7876393faae7124e32a4da1a20a65a248360a56b8232dbdbe6ac4047dbf16603c0aecc00a029bb9ee87bacebf4689b6208d571a7b1914966107adf5d215a774b49aba777719dd6087783d8ecbd1cd61f1c996edd8676caf29a0d80413e5246d0b7233b3801138a00e7074d016e43881206f2b82bdb6c6ca0c1603652ecb3d38993cc7cebcfb68e117f7b0b2fc0de13f5ff944b9de975558cdfc7440aa5bc02e169d7516aeb274d18d3eecc9993788fdcb831f214e317845d2384f477fbd1033d460fcdc205a06352be66ff1f41b224f9e9d2c9cea8bf3f9e3aa0838d236dc9034093a9e4ac2824aeaf60f4a8225b3dd3dcc298a3f16167dcf234863c3fb0a27bdfeeeee4635d3559a8eba432ee347b77fa0caf0cbe9a242c3aae12fbd649593b8b254c2abe129523cc910f8370bea0f86e65d711171f9cdffe1fbb40d88bb9c026bc7c32bd5c60c085810bdd9c3e471575"], 0x1004) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) prctl$PR_SVE_SET_VL(0x32, 0x338a6) stat(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getgid() stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setgroups(0x3, &(0x7f0000000200)=[r1, r2, r3]) [ 1016.951431] binder: BINDER_SET_CONTEXT_MGR already set [ 1017.029190] binder: 16679:16685 ioctl 40046207 0 returned -16 [ 1017.030602] binder: 16679:16699 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1017.039578] binder: BINDER_SET_CONTEXT_MGR already set 15:00:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1017.093782] binder: 16694:16696 ioctl 40046207 0 returned -16 15:00:01 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f00000001c0)=0xc) r1 = syz_open_procfs(r0, &(0x7f0000000340)='net/wireless\x00') ioctl$DRM_IOCTL_ADD_CTX(r1, 0xc0086420, &(0x7f0000000100)={0x0}) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000140)={r2, 0x3}) preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) 15:00:01 executing program 3: r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180)='/dev/rfkill\x00', 0x100ffe, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f00000000c0)=0x200040, 0x4) r1 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) r2 = request_key(&(0x7f0000000240)='dns_resolver\x00', &(0x7f0000000280)={'syz', 0x3}, &(0x7f00000002c0)='-nodev\x00', 0xfffffffffffffffa) keyctl$instantiate(0xc, r1, &(0x7f0000000300)=ANY=[@ANYBLOB="6e65772064656661756c7420747275737465643a2f8cafe731986f05eae43b2b35306465762f72666b696c6c0020303030303030303030303030303030303030303200"], 0x36, r2) r3 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x2, 0x2) ioctl$DRM_IOCTL_GET_CAP(r3, 0xc010640c, &(0x7f0000000080)={0x0, 0x731f8322}) r4 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, &(0x7f0000000540)) 15:00:01 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x0) 15:00:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1017.289487] binder: 16713:16716 tried to acquire reference to desc 0, got 1 instead [ 1017.309623] binder: 16713:16717 unknown command 536872576 [ 1017.316196] binder: 16713:16717 ioctl c0306201 20008fd0 returned -22 15:00:01 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') bind$vsock_stream(r0, &(0x7f0000000100)={0x28, 0x0, 0x2711, @reserved}, 0x10) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) 15:00:01 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) 15:00:01 executing program 3: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000080)) r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) syz_open_dev$ndb(&(0x7f0000000240)='/dev/nbd#\x00', 0x0, 0x4000) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2000000) ioctl$BINDER_WRITE_READ(r3, 0xc05c6104, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f00000000c0)={0x0, 0xeb, "96b14942cc5005ad96b9ccd80147e7e050eafad9381fef375e198a026eddf04c93bd1a4da128028af8e9d99a47b0fe1c70f4c13e3687e66e5006372f40d5a7a973e7c994406ecf8b4ae5c04a86671a6248e718a243f5df9a13b95ae06e701d71c10830b20bb5c16cc322179add1e57f8953fb2617147aee79ef60b4a75b84efa799243e87294c1dc3c2dbe58e4fb06d7ffe256e7a3ecb7cc3bbba6cbbd9b3f99f637027f89169747b67e09e6b784c1f699dae8c17898163295628e8ce7bc93f43c183b79d1e3c105c35e74a5678dedc96f3c9d8bafa6d01d8432a810258b8089b81807691e1e80ce6589e6"}, &(0x7f00000001c0)=0xf3) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000200)={r4, 0x81, 0x9, 0x1, 0xff, 0x7f}, 0x14) 15:00:01 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file0\x00', &(0x7f0000000580)='trusted.overlay.upper\x00', &(0x7f00000005c0)={0x0, 0xfb, 0xde, 0x1, 0x1, "a67f26a325a78978340082c55486fbe7", "8f25c944d2eb45d9dd5fbe3033490738a85268101808f7f36326329f990cdc5201995644170c82791c4801006fb02f681818e633cda3b62d758f1dc57fe0d642fa5d053ac7d06360b84108be2537d3092648444126a701da0ec81832821996e67024077e29842b44c99add809a254c334712920cb7b11b91665ba9ff0fd4e9618b74b95751a932a51d949b467d4217671d0020afd108c034d0773960208706e9cb8fe94b24b54e30437b181e19aa86eed1a7c5dc4b558fc5c80493b3d6449179e00ac9ebf3951ea911"}, 0xde, 0x2) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000006c0)={0x20, 0x0, &(0x7f0000000740)=ANY=[@ANYRESDEC=r1, @ANYRES64=r0, @ANYRES32=r0], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f0000000180), &(0x7f0000000380)=0x4) r3 = dup(r1) ioctl$FS_IOC_FIEMAP(r3, 0xc020660b, &(0x7f0000000200)={0x78, 0x40, 0x2, 0x1, 0x6, [{0x1000, 0xc0, 0x3, 0x0, 0x0, 0x8}, {0xffffffffffffff77, 0x9, 0x1, 0x0, 0x0, 0x80}, {0x1f, 0x6, 0xcd, 0x0, 0x0, 0x800}, {0x3f, 0x401, 0x7f, 0x0, 0x0, 0x210a}, {0x2d3, 0x1, 0x401}, {0xffffffff, 0x836e, 0x4, 0x0, 0x0, 0x1008}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) renameat2(r2, &(0x7f00000000c0)='./file0\x00', r2, &(0x7f0000000500)='./file0\x00', 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="107340eba0833cddc61b0f4a507406326f6c04f1c6499515bfe24272c14d2332725d46d551771f891c573ff658ea982e4b7b99fdf35fb792c45f932c3097bb5eb1f41529680c019f95bf8a853854269bc6995dde78745fabb96f1a997154b6c5289366b4c41afa9a4ef8672376111b0d917539a06bc5489e949b03da581fbf9651bcc4cfeef1131d4f5b57277e9932ea999fc9eabfbda17d77dba66f30b003ccae3d704200010000000000000f4612098c6b145c537f7f31c204bdf96a75091562281a9b2020d2f18ee811041b0ef452666d9940a1042098e8a9eabb312c8b2604167d470c"], 0x0, 0xfdfdffff, 0x0}) 15:00:01 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:01 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000014c0)=[{&(0x7f0000000180)=""/149}, {&(0x7f0000000240)=""/244}, {&(0x7f0000000380)=""/128}, {&(0x7f0000000400)=""/141}, {&(0x7f00000004c0)=""/4096}], 0x10000000000001a9, 0x2) 15:00:01 executing program 3: syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0xffffffffffffffff, 0x2) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc05c6104, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 15:00:01 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) mlock2(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1) r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x100, 0x200) ioctl$RTC_PIE_OFF(r1, 0x7006) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) getsockopt$IPT_SO_GET_REVISION_MATCH(r1, 0x0, 0x42, &(0x7f0000000040)={'ipvs\x00'}, &(0x7f0000000080)=0x1e) mlock2(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x1) [ 1017.691004] binder: 16746:16748 unknown command 808464432 [ 1017.719445] binder: 16746:16748 ioctl c0306201 200006c0 returned -22 15:00:01 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000140)={{{@in6=@mcast2, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@dev}}, &(0x7f0000000240)=0xe8) fsetxattr$security_capability(r0, &(0x7f0000000100)='security.capability\x00', &(0x7f0000000280)=@v3={0x3000000, [{0x7, 0xc01}, {0x100000001, 0x8667}], r1}, 0x18, 0x2) preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f00000002c0)) 15:00:01 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000000)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000100), &(0x7f0000000140)=0x4) 15:00:01 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) fsetxattr$security_evm(r0, &(0x7f0000000080)='security.evm\x00', &(0x7f00000000c0)=@md5={0x1, "5b86090912345d259ee1e1779b274e02"}, 0x11, 0x1) r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x400000, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x10, &(0x7f0000000200)=[@in={0x2, 0x4e22, @local}]}, &(0x7f0000000280)=0x10) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f00000002c0)=@sack_info={r2, 0x4, 0x7}, &(0x7f0000000300)=0xc) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000000)='trusted.overlay.origin\x00', &(0x7f0000000040)='y\x00', 0x2, 0x1) r3 = syz_open_dev$usbmon(&(0x7f0000000340)='/dev/usbmon#\x00', 0xfec, 0x8002) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000440)=ANY=[@ANYBLOB="03000000000000005714144d187b753b38798afc1a03000000000000d0427900ace91b3afb66f0cfc02ea51c0080000000002f8a7a4e000000000000020000000b1c0000e90d0000000000000000000000000000"]) 15:00:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:02 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_dev$dspn(&(0x7f0000000140)='/dev/dsp#\x00', 0xfffffffffffff705, 0x6000) ioctl$VIDIOC_STREAMOFF(r0, 0x40045613, &(0x7f0000000180)=0x3ff) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r1, &(0x7f00000017c0), 0x1d0, 0x0) times(&(0x7f0000000100)) 15:00:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56030000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:02 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpu.stat\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r1, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="a4010600", @ANYRES16=r2, @ANYBLOB="000129bd7000fddbdf250200000030000200040004000400040008000200080000000400040008000100800000000800020009000000080002007fffffffd8000100180001006574683a7465616d5f736c6176655f300000000044000400200001000a004e2100000004fe8000000000000000000000000000aa00000080200002000a004e220000000343696e63ceb1bb42bf9cdee3cf31462c02000000080003000700000044000400200001000a004e21000010000000000000000000000000000000000002000000200002000a004e2400010000c15a30f3721c7328910bcd8818466a970300000008000300090000000800030067e600001c000200080001001d00000008000200ff0000000800040008000000180007000c0003000800000000000000080002000800000014000500080001006962000008000100696200005c0004004c000700080003000080000008000300ee0a000008000200ff0f000008000400feffffff080003000700000008000400ca168d6408000100080000000800020000000000080001001f0000000c00010073797a3000000000"], 0x1a4}, 0x1, 0x0, 0x0, 0x1}, 0x20000004) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000040)) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r5 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0xffffffffffffffff, 0x2) bind$bt_sco(r4, &(0x7f0000000040), 0x8) listen(r4, 0x0) dup2(r5, r4) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x14, r6, 0x200, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x80) 15:00:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) open_by_handle_at(r1, &(0x7f0000000100)={0x87, 0x7, "860bf418f1d09aa95716f57d26c7cb5b6a46dd2a6d8add48fcb72f311b2a547f474d8a88fd9193f2bfaf3934919b9addc564f9a008829854b4f6accc0cdf559c289c364a8c46918c45df8613d1c7e6e4d48aa7743df79f293dffe1cafdaeb1a92b343652e19a9b81e5adebf0a06ea9ccf38ba1d82d382de9d76d1b97489324"}, 0x200000) 15:00:02 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x800, 0x0) ioctl$BLKIOOPT(r1, 0x1279, &(0x7f0000000040)) 15:00:02 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpu.stat\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r1, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="a4010600", @ANYRES16=r2, @ANYBLOB="000129bd7000fddbdf250200000030000200040004000400040008000200080000000400040008000100800000000800020009000000080002007fffffffd8000100180001006574683a7465616d5f736c6176655f300000000044000400200001000a004e2100000004fe8000000000000000000000000000aa00000080200002000a004e220000000343696e63ceb1bb42bf9cdee3cf31462c02000000080003000700000044000400200001000a004e21000010000000000000000000000000000000000002000000200002000a004e2400010000c15a30f3721c7328910bcd8818466a970300000008000300090000000800030067e600001c000200080001001d00000008000200ff0000000800040008000000180007000c0003000800000000000000080002000800000014000500080001006962000008000100696200005c0004004c000700080003000080000008000300ee0a000008000200ff0f000008000400feffffff080003000700000008000400ca168d6408000100080000000800020000000000080001001f0000000c00010073797a3000000000"], 0x1a4}, 0x1, 0x0, 0x0, 0x1}, 0x20000004) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000040)) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r5 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0xffffffffffffffff, 0x2) bind$bt_sco(r4, &(0x7f0000000040), 0x8) listen(r4, 0x0) dup2(r5, r4) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x14, r6, 0x200, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x80) 15:00:02 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(r0, 0xc040564b, &(0x7f0000000100)={0x8000, 0x0, 0x301b, 0x1, 0x748, {0x7fffffff}, 0x1}) [ 1018.487379] binder: 16746:16758 unknown command 808464432 [ 1018.493512] binder: 16746:16758 ioctl c0306201 200006c0 returned -22 15:00:02 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b6b6b00], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:02 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x200200, 0x0) ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, &(0x7f00000000c0)={0x1, 0x2, {0x0, 0x7, 0xffffffff, {0x0, 0x7}, {0x9, 0x3}, @period={0x5b, 0x200, 0x2, 0x7, 0x40, {0x3, 0x0, 0x81, 0x3f}, 0x7, &(0x7f0000000080)=[0x8, 0x9a, 0x9, 0x6, 0x3, 0x1ff, 0x0]}}, {0x55, 0x84b, 0x3f, {0x4ca5, 0x6995}, {0x81, 0x843}, @rumble={0x4}}}) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000480)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) syz_open_dev$ndb(&(0x7f0000000000)='/dev/nbd#\x00', 0x0, 0x181000) fcntl$dupfd(r0, 0x406, r0) 15:00:02 executing program 0: recvmmsg(0xffffffffffffffff, &(0x7f00000000c0)=[{{0x0, 0x0, &(0x7f0000002b80)=[{&(0x7f0000000000)=""/190, 0xbe}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') preadv(r0, &(0x7f00000017c0), 0x1d0, 0x0) ioctl$VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000100)={0x3, 0xb}) [ 1018.721434] binder: 16804:16806 tried to acquire reference to desc 0, got 1 instead 15:00:02 executing program 3: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='cpu.stat\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_DISABLE(r1, &(0x7f0000000580)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000540)={&(0x7f0000000380)=ANY=[@ANYBLOB="a4010600", @ANYRES16=r2, @ANYBLOB="000129bd7000fddbdf250200000030000200040004000400040008000200080000000400040008000100800000000800020009000000080002007fffffffd8000100180001006574683a7465616d5f736c6176655f300000000044000400200001000a004e2100000004fe8000000000000000000000000000aa00000080200002000a004e220000000343696e63ceb1bb42bf9cdee3cf31462c02000000080003000700000044000400200001000a004e21000010000000000000000000000000000000000002000000200002000a004e2400010000c15a30f3721c7328910bcd8818466a970300000008000300090000000800030067e600001c000200080001001d00000008000200ff0000000800040008000000180007000c0003000800000000000000080002000800000014000500080001006962000008000100696200005c0004004c000700080003000080000008000300ee0a000008000200ff0f000008000400feffffff080003000700000008000400ca168d6408000100080000000800020000000000080001001f0000000c00010073797a3000000000"], 0x1a4}, 0x1, 0x0, 0x0, 0x1}, 0x20000004) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ID(r3, 0x80082407, &(0x7f0000000040)) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r5 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0xffffffffffffffff, 0x2) bind$bt_sco(r4, &(0x7f0000000040), 0x8) listen(r4, 0x0) dup2(r5, r4) r6 = syz_genetlink_get_family_id$fou(&(0x7f00000000c0)='fou\x00') sendmsg$FOU_CMD_ADD(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x14, r6, 0x200, 0x70bd2d, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x80) [ 1018.788828] binder: 16804:16808 unknown command 536872576 [ 1018.795464] binder: 16804:16808 ioctl c0306201 20008fd0 returned -22 [ 1018.850546] binder: 16804:16812 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1018.900683] binder: undelivered death notification, 0000000000000000 15:00:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:03 executing program 0 (fault-call:2 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:03 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000000), 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0d6300001e4862ec6a11e3ad31d908cdf7aad72c27715fd3376a364b7653d26c3c06d928fc47e76b37151aaa0d87ef77e4ba9ad41c257a0648fdb1405cd89ef87eda3bd10bba33441481ed4076589cd72d7918eae6"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = syz_open_dev$vcsn(&(0x7f00000000c0)='/dev/vcs#\x00', 0x1, 0x280200) ioctl$DRM_IOCTL_GET_STATS(r2, 0x80f86406, &(0x7f0000000680)=""/125) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="03e03ce5f6dfc85145c45520f3000000"], 0x0, 0xfdfdffff, 0x0}) 15:00:03 executing program 3 (fault-call:5 fault-nth:0): r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1019.226013] binder: 16827:16832 unknown command 0 [ 1019.237172] binder: 16827:16832 ioctl c0306201 20012000 returned -22 15:00:03 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) socketpair(0x9, 0x6, 0x7, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000080)=0xfff0, 0x4) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x8cf8, 0x40000) ioctl$UI_SET_KEYBIT(r2, 0x40045565, 0x1b6) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1019.284685] binder: BINDER_SET_CONTEXT_MGR already set [ 1019.293493] binder: 16827:16832 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1019.297893] binder: 16840:16841 ioctl 40046207 0 returned -16 [ 1019.352810] binder: 16840:16841 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1019.370587] binder: 16827:16832 unknown command 0 [ 1019.387847] binder: 16827:16842 unknown command 536872576 [ 1019.395420] binder: 16827:16832 ioctl c0306201 20012000 returned -22 15:00:03 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000200)='trusted.overlay.origin\x00', &(0x7f0000000240)='y\x00', 0x2, 0x3) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) r2 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x6, 0x0) openat$cgroup_ro(r2, &(0x7f0000000140)='memory.swap.current\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) rt_sigsuspend(&(0x7f0000000180)={0x7fffffff}, 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1019.400796] binder: 16827:16842 ioctl c0306201 20008fd0 returned -22 [ 1019.440703] binder: 16840:16841 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:03 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:03 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:03 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:03 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x2, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:03 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) 15:00:03 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x2200) ioctl$BINDER_THREAD_EXIT(r1, 0x40046208, 0x0) ioctl$sock_SIOCGSKNS(r1, 0x894c, &(0x7f0000000040)) ioctl$sock_inet_udp_SIOCINQ(r1, 0x541b, &(0x7f0000000080)) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4030000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:04 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x3, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:04 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) dup(0xffffffffffffffff) 15:00:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/sequencer2\x00', 0x1, 0x0) ioctl$SG_GET_KEEP_ORPHAN(r2, 0x2288, &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$DRM_IOCTL_MAP_BUFS(r2, 0xc0186419, &(0x7f0000000400)={0x1, &(0x7f0000000200)=""/172, &(0x7f0000000180)=[{0xffff, 0xcb, 0x7, &(0x7f00000002c0)=""/203}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:04 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_NOTIFY(r0, &(0x7f0000000080)={0xf, 0x8, 0xfa00, {r1, 0x13}}, 0x10) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000200)={0x14, 0x88, 0xfa00, {r1, 0x1c, 0x0, @in6={0xa, 0x4e24, 0x5457, @dev={0xfe, 0x80, [], 0xd}, 0x8}}}, 0x90) 15:00:04 executing program 0: bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffff9c, 0x10, &(0x7f0000000080)={&(0x7f0000000040)=""/52, 0x34, 0x0}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000100)=r0, 0x4) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ubi_ctrl\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r1) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) 15:00:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:04 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x4, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1020.410384] binder: undelivered death notification, 0000000000000000 [ 1020.419057] binder: undelivered death notification, 0000000000000000 [ 1020.539775] binder: 16908:16915 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getresuid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)=0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000000)=0x1) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$usbmon(&(0x7f0000000300)='/dev/usbmon#\x00', 0x100000000, 0x80000) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x2, {0x410, {0x10, 0x0, 0x7}, 0x4, r2, r3, 0xffffffffffffffe1, 0x8, 0x22b, 0x23a, 0x7, 0x6, 0x24000000000, 0x1, 0x9, 0xffff, 0x0, 0xd07e, 0x0, 0x3, 0x1}}, 0xa0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$VIDIOC_G_SELECTION(r1, 0xc040565e, &(0x7f0000000040)={0x6, 0x1, 0x5, {0x81, 0x481, 0x0, 0x4}}) [ 1020.582706] binder: 16917:16922 tried to acquire reference to desc 0, got 1 instead [ 1020.611443] binder: 16917:16923 unknown command 536872576 15:00:04 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1020.636584] binder: 16917:16923 ioctl c0306201 20008fd0 returned -22 15:00:04 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x5, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="05630f400000000001405472d409978951da9cac2742865ae6ebe64af7b79955124ff261c40634e96f227876990b1f0f2e774878564be45ec8d84cd64368946b3aad85d674"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000200)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffee0, 0x0, &(0x7f0000000240)=[@acquire_done={0x40106309, r2, 0x3}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) memfd_create(&(0x7f0000000180)='\x00', 0x5) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:04 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) sendfile(r1, r0, &(0x7f0000000040)=0x31, 0x1) ioctl$KVM_DIRTY_TLB(r1, 0x4010aeaa, &(0x7f0000000080)={0x10000, 0x4}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) 15:00:04 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x200, 0x0) r2 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x1b76, 0x400400) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x0) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f00000000c0)={r2, 0xffffffffffffffc0, 0x100, r3}) 15:00:04 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4030000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1020.922134] binder: 16938:16942 unknown command 1074750213 [ 1020.967983] binder: 16938:16942 ioctl c0306201 20012000 returned -22 15:00:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:05 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x6, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getsockname$llc(r1, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000080)=0x10) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:05 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r1, 0x40, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$FUSE_NOTIFY_INVAL_ENTRY(r2, &(0x7f0000000200)=ANY=[@ANYBLOB="30ddb3d9000000030000000000000000000000eeff0000000025000f000000000000003a266b657972696e67766d9b4c5efd746e65f08ff54e0e1a5b818269ada8217a83f7e965a98a24798a8795e91373c5aeabd056491a3cfa408a4d22f42f9806c9d568e4b420a84618eb39b3af380dc8149cddd8930028e1bc04b1978dab643fb72414697d1357c4084f40fb22e5a27c9f5fbd2808b5c32a31ca5389df48cd103f25a583bacbd995b6"], 0x30) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-monitor\x00', 0x8000, 0x0) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000000c0)=0x400000) 15:00:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1021.321074] binder: undelivered death notification, 0000000000000000 15:00:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000080)=0x1) 15:00:05 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$vbi(&(0x7f00000006c0)='/dev/vbi#\x00', 0x1, 0x2) ioctl$KVM_SET_MP_STATE(r1, 0x4004ae99, &(0x7f0000000700)) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x30f000, 0x0) openat$selinux_access(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/access\x00', 0x2, 0x0) ioctl$KVM_CREATE_PIT2(r2, 0x4040ae77, &(0x7f0000000040)={0x4}) epoll_create(0x10000) write$UHID_INPUT2(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="0c00000004007623af537a9b43e054223519722a6dcbf2b5"], 0xa) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000200)={0x0, 0x4}, &(0x7f0000000240)=0x8) ioctl$BLKFLSBUF(r2, 0x1261, &(0x7f0000000340)=0x5) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r2, 0xc040564a, &(0x7f0000000680)={0x1, 0x0, 0x301b, 0x7, 0x10000, 0x1}) getsockopt$inet_sctp6_SCTP_RTOINFO(r2, 0x84, 0x0, &(0x7f0000000280)={r3, 0x4, 0x5, 0x1f}, &(0x7f00000002c0)=0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000880)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000840)={0xffffffffffffffff}, 0x13f, 0xf}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f00000008c0)={0x4, 0x8, 0xfa00, {r4, 0x3}}, 0x10) r5 = request_key(&(0x7f00000003c0)='trusted\x00', &(0x7f0000000400)={'syz', 0x2}, &(0x7f0000000440)='nodev(\x00', 0xffffffffffffffff) ioctl$sock_bt_bnep_BNEPCONNADD(r2, 0x400442c8, &(0x7f0000000740)={r1, 0xae, 0x0, "23c6773f4827837bccfdbfb766ee3b9802cd85d661ed1ae2f67506a0f0f80fe5e77d3b22fc8047900a99114d2f9e2408beea51d860367cf78a2f69b4d56a59807cc4b4c889e0682688f3296991be0b7d5ac4f6e9c38ce59dfb6f3bdb4bdf25a89548c71186a048f8666ead987a217752ec3fc7262d14babd878a27edbbdc7b8c01bd66b9fecc90d104933abb217fc01ec2509867e30f65a173e56bccecb754f5c818bc05d13077ed11bacecf1b097e194fe559ec54c85050433e69ab2441af8f50a546fe"}) keyctl$KEYCTL_PKEY_SIGN(0x1b, &(0x7f0000000480)={r5, 0xaceb, 0x4}, &(0x7f00000004c0)=ANY=[@ANYBLOB='enc=pkcs1 hash=sh\x00512-ssse3\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], &(0x7f0000000540)="bf1d45f4c9faa00ce1651b54b66086f2d01cb49813a58d372dc9cc76209f6cb56ce4969e4ebcd98f63a3df42223dd10f83e7bba946eb80a857766ece97d13e96ea730207fd3679027a6dc9acbb5a691ea4797cea5c0dcffa0656e5ad2168dbe4e1d7d36a39419c9192ed28ac1088ba0b1e63968a333153fdb9fefb76aa406940ebcf99929f2f55067364e880ece3c0cc6972662f2c42b1dc27ad966ef4bd32e7562da144fc43535fe92c9e7a282904a74931c0574ad1358ddd7b7aaec6149a33bd773887861f4285dcbdb3e1b108235cef0b6637e4db7026fb36df18df", &(0x7f0000000640)=""/23) connect$nfc_llcp(r2, &(0x7f0000000080)={0x27, 0x0, 0x2, 0x7, 0x9, 0x52f, "03c796fad04f5d5e72ac194ab9ac37d1549569fd212e530179f1aa5d77a9714abc4c3554b1103bcfa38fcedd1fe0fac94cf6e9f29183758b266a2a1248e800", 0x13}, 0x60) [ 1021.490511] binder: 16971:16973 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:05 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x7, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1021.696455] binder: 16938:16942 unknown command 1074750213 [ 1021.710944] binder: 16938:16942 ioctl c0306201 20012000 returned -22 15:00:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$FS_IOC_ENABLE_VERITY(r1, 0x6685) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:05 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0af51f023c123f3188a070") r2 = socket(0x10, 0x803, 0x0) connect$netlink(r2, &(0x7f0000000180)=@proc={0x10, 0x0, 0x0, 0x1000000}, 0xc) getsockopt$SO_BINDTODEVICE(r2, 0x1, 0x1c, &(0x7f0000000000), 0x20a154cc) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:05 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000080)={0x7, 0x8, 0xfa00, {0xffffffffffffffff, 0x2}}, 0x10) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$DRM_IOCTL_ADD_CTX(0xffffffffffffffff, 0xc0086420, &(0x7f0000000040)={0x0}) ioctl$DRM_IOCTL_GET_SAREA_CTX(r1, 0xc010641d, &(0x7f00000000c0)={r2, &(0x7f0000000200)=""/221}) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:05 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b6b6b00000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1021.967828] binder: 16999:17004 ioctl 6685 0 returned -22 [ 1022.004514] binder: 16999:17004 tried to acquire reference to desc 0, got 1 instead [ 1022.047619] binder: 16999:17008 ioctl 6685 0 returned -22 [ 1022.071290] binder: 16999:17008 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1022.080858] binder: undelivered death notification, 0000000000000000 15:00:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:06 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x8, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:06 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000040)={{{@in=@multicast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in6=@ipv4}}, &(0x7f0000000200)=0xe8) r3 = getegid() ioctl$KVM_SET_CPUID2(r1, 0x4008ae90, &(0x7f0000000300)={0x2, 0x0, [{0x80000001, 0x8, 0x4, 0x8, 0xffff, 0x4, 0xffffffffffffd507}, {0xa, 0x62a4, 0x6, 0x7, 0x0, 0x5, 0x4}]}) write$FUSE_ENTRY(r1, &(0x7f0000000240)={0x90, 0x0, 0x3, {0x0, 0x0, 0x6, 0x6, 0x9, 0xffffffffffffffc0, {0x0, 0x7, 0x8, 0x5, 0x3, 0xffff, 0xfffffffffffffdf6, 0x100000000, 0x200, 0x1000, 0x0, r2, r3, 0x7, 0x9}}}, 0x90) 15:00:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000140)='/dev/null\x00', 0xb0040, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000180)={0x2, 0x80000000000000, 0x0, 0x3, 0x10, 0x1000, 0x1cf1, 0xffff, 0x1, 0x7f, 0x4, 0xf32}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x20c00, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1022.282454] binder: undelivered death notification, 0000000000000000 15:00:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) epoll_create(0xfffffffffffffff8) [ 1022.431624] binder: 17017:17023 tried to acquire reference to desc 0, got 1 instead [ 1022.459790] binder: BINDER_SET_CONTEXT_MGR already set [ 1022.466151] binder: 17020:17030 ioctl 40046207 0 returned -16 15:00:06 executing program 5: r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x80000, 0x0) ioctl$BLKZEROOUT(r0, 0x127f, &(0x7f0000000040)={0x7, 0x1}) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1022.489470] binder: 17017:17033 unknown command 536872576 [ 1022.496806] binder: 17017:17033 ioctl c0306201 20008fd0 returned -22 [ 1022.539048] binder: 17020:17030 Acquire 1 refcount change on invalid ref 0 ret -22 15:00:06 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x10, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1022.585376] binder: 17020:17040 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$VIDIOC_DQBUF(r1, 0xc0585611, &(0x7f0000000140)={0x5, 0xe, 0x4, 0x100000, {}, {0x1, 0x0, 0xfff, 0x200, 0xfffffffffffffffd, 0x8d, "59114513"}, 0x80000001, 0x4, @planes=&(0x7f0000000100)={0x10000, 0x0, @mem_offset=0x45f4, 0x6}, 0x4}) ioctl$VIDIOC_G_SLICED_VBI_CAP(r1, 0xc0745645, &(0x7f0000000040)={0x1, [0x6, 0xff, 0x94a, 0x100000000000, 0x36b, 0x8, 0xff, 0x3, 0x5, 0x8, 0x100000000, 0x1ff, 0x558, 0x1, 0x0, 0x1, 0x1, 0x4f9, 0x8, 0x401, 0x7, 0x7f, 0x9, 0x3f, 0x80, 0x3, 0x8, 0x6, 0x1b5ad559, 0xb29, 0x1, 0xaf, 0xff, 0x2, 0x7, 0x2c1, 0x1, 0x100, 0x2, 0x8000, 0x0, 0xffffffff, 0xffff, 0x3, 0x100, 0xffffffffffffffde, 0x54, 0x3ff], 0xf}) ioctl$DRM_IOCTL_MARK_BUFS(r1, 0x40206417, &(0x7f00000000c0)={0x7, 0x40, 0x7fffffff, 0x2734, 0x2, 0x6}) 15:00:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) bind$rxrpc(r2, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0xffffffffffff8000}}, 0x24) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1022.631403] binder: 17020:17030 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1022.679038] binder: 17020:17040 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:06 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100)={0xffffffffffffffff}, 0x0, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r0, &(0x7f0000000200)={0x7, 0x0, 0xfa00, {r1, 0x200}}, 0x10) r2 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x1, 0x2) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000000c0), 0x4) 15:00:06 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/qat_adf_ctl\x00', 0x0, 0x0) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x42000, 0x0) connect$l2tp(r1, &(0x7f00000000c0)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x3, 0x4, 0x0, 0x1, {0xa, 0x4e24, 0x8, @dev={0xfe, 0x80, [], 0x14}, 0x8}}}, 0x32) socket$caif_seqpacket(0x25, 0x5, 0x4) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1022.806631] binder: 17051:17056 tried to acquire reference to desc 0, got 1 instead [ 1022.828435] binder: 17051:17057 unknown command 536872576 [ 1022.869775] binder: 17051:17062 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1022.929363] binder: 17051:17069 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1022.932812] binder: 17051:17057 ioctl c0306201 20008fd0 returned -22 [ 1022.952438] binder: undelivered death notification, 0000000000000000 15:00:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:07 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x300, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:07 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) timer_create(0x3, &(0x7f00000000c0)={0x0, 0x39, 0x3, @tid=0xffffffffffffffff}, &(0x7f0000000100)=0x0) timer_getoverrun(r1) r2 = accept(0xffffffffffffff9c, 0x0, &(0x7f0000000000)) getsockopt$bt_BT_DEFER_SETUP(r2, 0x112, 0x7, &(0x7f0000000040)=0x1, &(0x7f0000000080)=0x4) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000200)={0xffffffffffffffff}, 0x106, 0xc}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000280)={0x14, 0x88, 0xfa00, {r3, 0x30, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) signalfd(r1, &(0x7f0000000100)={0x1}, 0x8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x2c5, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0f63f938088d2f79470506d995f086620fe2b8a00aea8f73c60ec738d726ca81a0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x282, 0x0, &(0x7f0000000200)=ANY=[@ANYRES64=r0], 0x0, 0xfdfdffff, 0x0}) 15:00:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1001000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) syz_open_dev$sndmidi(&(0x7f0000000040)='/dev/snd/midiC#D#\x00', 0x6, 0x200000) [ 1023.309132] binder: 17078:17082 ioctl c0306201 20000140 returned -14 [ 1023.349018] binder: 17078:17082 unknown command 955867919 15:00:07 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) ioctl$LOOP_SET_CAPACITY(r1, 0x4c07) r2 = syz_open_dev$dmmidi(&(0x7f0000000000)='/dev/dmmidi#\x00', 0x101, 0x20000000002000) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f00000002c0)) ioctl$TUNSETVNETLE(r2, 0x400454dc, &(0x7f0000000080)=0x1) getpeername$llc(r1, &(0x7f0000000240)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, &(0x7f0000000280)=0x10) ioctl$sock_inet_SIOCSIFNETMASK(r2, 0x891c, &(0x7f00000000c0)={'vlan0\x00', {0x2, 0x4e20, @loopback}}) ioctl$VIDIOC_ENUM_FRAMESIZES(r2, 0xc02c564a, &(0x7f0000000040)={0x20, 0x584e4f53, 0x1, @discrete={0x9, 0x8}}) bind$bt_sco(r1, &(0x7f0000000200)={0x1f, {0x6, 0x5, 0x7, 0x4, 0x6, 0x1000}}, 0x8) listen(r2, 0xffff) [ 1023.369081] binder: 17078:17082 ioctl c0306201 20000040 returned -22 [ 1023.385047] binder: 17078:17082 unknown command 3 15:00:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x200400, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r1, 0x114, 0xa, &(0x7f0000000080), 0x1) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1023.410288] binder: 17087:17092 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1023.418776] binder: 17078:17082 ioctl c0306201 200003c0 returned -22 [ 1023.438082] binder: 17078:17093 tried to acquire reference to desc 0, got 1 instead 15:00:07 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x500, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1023.479590] binder: 17087:17096 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1023.526157] binder: 17078:17093 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 1023.557614] binder: 17078:17093 ioctl c0306201 20000140 returned -14 15:00:07 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$DRM_IOCTL_AGP_ALLOC(r1, 0xc0206434, &(0x7f0000000040)={0x6, 0x0, 0x2, 0xef9}) ioctl$DRM_IOCTL_AGP_UNBIND(r1, 0x40106437, &(0x7f0000000080)={r2, 0xfffffffffffff495}) [ 1023.573184] binder: 17078:17107 unknown command 955867919 [ 1023.601058] binder: 17078:17108 unknown command 5 15:00:07 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffff9c, 0x84, 0x75, &(0x7f0000000280)={0x0, 0x3}, &(0x7f00000002c0)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000300)={0x44d55639, 0x6, 0x2, 0x20, 0x8, 0x1000, 0x4, 0xfffffffffffffffd, r2}, &(0x7f0000000340)=0x20) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r3, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x24, r4, 0x11, 0x70bd29, 0x25dfdbfb, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x1}}, [""]}, 0x24}}, 0x0) 15:00:07 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c00000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1023.629864] binder: 17078:17108 ioctl c0306201 200003c0 returned -22 [ 1023.654000] binder: 17078:17107 ioctl c0306201 20000040 returned -22 15:00:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) syz_open_dev$video(&(0x7f0000000100)='/dev/video#\x00', 0x4000000000000003, 0x20400) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:08 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x600, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x200, 0x0) getdents64(r1, &(0x7f0000000200)=""/185, 0xb9) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0563040000449f2a10cf845470b29b2f58d8f70b000000840a1e06266b3a8aed03"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0xa41, 0x0) ioctl$BLKTRACESTOP(r3, 0x1275, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="10630840e1e6b07edba8eba0ca22e4ab76d3348e31a4ac25ef0c196c7cc63a4a396b1291958cc63fcbfb984bfca221ee054f70ea4e3bf1b70db6c9ea861bebb7179a"], 0x0, 0xfdfdffff, 0x0}) 15:00:08 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001640)='/dev/dlm_plock\x00', 0x0, 0x0) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r1, 0x28, 0x6, &(0x7f0000001680)={0x77359400}, 0x10) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:08 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1024.229785] binder: 17130:17134 unknown command 287493 [ 1024.246809] binder: 17130:17134 ioctl c0306201 20012000 returned -22 15:00:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000080)='syz1\x00') ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) r2 = semget(0x0, 0x0, 0x4) semctl$GETPID(r2, 0x0, 0xb, &(0x7f00000000c0)=""/134) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)) 15:00:08 executing program 5: openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) [ 1024.287551] binder: 17130:17134 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1024.349816] binder: 17142:17149 BC_CLEAR_DEATH_NOTIFICATION death notification not active 15:00:08 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x700, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1024.402992] binder: 17142:17152 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:08 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0xfffffffffffffff3, 0xfa00, {r1, 0x3c, 0x0, @in={0x2, 0x4e21, @multicast2}}}, 0x90) 15:00:08 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x20002, 0x0) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r1, 0x84, 0x4, &(0x7f00000000c0)=0x4b46, 0x4) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000100)={0x0, 0x13, "d1e842e20979abbfd0754441d372d2669d5bf6"}, &(0x7f0000000140)=0x1b) getsockopt$inet_sctp6_SCTP_MAXSEG(r1, 0x84, 0xd, &(0x7f0000000180)=@assoc_value={r2, 0x5}, &(0x7f00000001c0)=0x8) r3 = dup(0xffffffffffffffff) setsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000040)=[@in6={0xa, 0x4e23, 0x0, @dev={0xfe, 0x80, [], 0x14}, 0x1ff}, @in6={0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, [], 0xc}, 0x6}], 0x38) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) setsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000200)=@assoc_value={r2}, 0x8) 15:00:08 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x3f00, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1024.983431] binder: 17130:17150 unknown command 287493 [ 1024.990305] binder: 17130:17150 ioctl c0306201 20012000 returned -22 [ 1024.997585] binder: 17130:17176 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1024.998364] binder: 17130:17177 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1025.014702] binder: 17130:17150 BC_DEAD_BINDER_DONE a0eba8db7eb0e6e1 not found 15:00:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:09 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) socket$bt_bnep(0x1f, 0x3, 0x4) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x6, 0x10000) ioctl$sock_netrom_SIOCDELRT(r1, 0x890c, &(0x7f0000000080)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={'rose', 0x0}, 0x6, 'syz1\x00', @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x47, 0x6, [@default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}) r2 = dup(0xffffffffffffffff) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000100)={{{@in6=@empty, @in=@loopback}}, {{@in=@empty}, 0x0, @in6}}, &(0x7f0000000200)=0xe8) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000300)={0x9, 0x34, 0x14, 0x1c, 0x2, 0x2, 0x5, 0xf5, 0xffffffffffffffff}) fadvise64(r0, 0x0, 0x9, 0x0) fstat(r2, &(0x7f0000000240)) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f00000002c0)={0x30, 0x5, 0x0, {0x0, 0x4, 0x100000000, 0x7}}, 0x30) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f00000003c0)=[@text64={0x40, &(0x7f0000000340)="c4412f5ec1b95b0900000f32660f38812b6567410f00556e66baf80cb8bcc06383ef66bafc0c66ed420f08440f20c03508000000440f22c00f019ebd00000036654c0fc76dff0f35", 0x48}], 0x1, 0x82cc3cdc09d481be, &(0x7f0000000400)=[@vmwrite={0x8, 0x0, 0x9, 0x0, 0xfffffffffffffff7, 0x0, 0x3ff, 0x0, 0x7}], 0x1) 15:00:09 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x4000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xfffffffffffffef5, 0x0, &(0x7f0000000100)=ANY=[@ANYRESDEC=r1], 0x0, 0xfdfdffff, 0x0}) [ 1025.201902] binder: 17181:17190 tried to acquire reference to desc 0, got 1 instead [ 1025.237554] binder: BINDER_SET_CONTEXT_MGR already set 15:00:09 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x100000001, 0x101001) ioctl$VIDIOC_STREAMON(r1, 0x40045612, &(0x7f00000000c0)=0x40000000000002) set_tid_address(&(0x7f0000000000)) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1025.248209] binder: 17181:17195 unknown command 536872576 [ 1025.256870] binder: 17185:17197 ioctl 40046207 0 returned -16 [ 1025.278410] binder: 17181:17200 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1025.279787] binder: 17185:17197 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1025.292505] binder: 17181:17195 ioctl c0306201 20008fd0 returned -22 15:00:09 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1025.308242] binder: undelivered death notification, 0000000000000000 15:00:09 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x34000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000100)='/dev/snd/pcmC#D#p\x00', 0xfffffffffffffff8, 0x84002) ioctl$KVM_REINJECT_CONTROL(r2, 0xae71, &(0x7f0000000140)={0x2}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1025.387030] binder: 17185:17204 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1025.441498] binder: 17185:17197 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:09 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) ioctl$VT_RELDISP(r0, 0x5605) r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x28000) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(0xffffffffffffff9c, 0x84, 0x66, &(0x7f00000000c0)={0x0, 0x2}, &(0x7f0000000100)=0x8) getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000200)={r2, 0x6}, &(0x7f0000000240)=0x8) vmsplice(r0, &(0x7f0000000040)=[{&(0x7f0000000000)="19aa4dc6a480290f7cffa31dfa17476dfa50922c8a0bfbd4f84fca0e38e34fb2299ec82ed9513bbec3a30f50396cf6", 0x2f}], 0x1, 0x1) [ 1025.580886] binder: 17213:17216 tried to acquire reference to desc 0, got 1 instead [ 1025.624031] binder: 17213:17216 unknown command 536872576 [ 1025.624571] binder: 17213:17222 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1025.662608] binder: 17213:17216 ioctl c0306201 20008fd0 returned -22 [ 1025.687804] binder: 17213:17219 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1025.708991] binder: undelivered death notification, 0000000000000000 15:00:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) sendto$inet(r1, &(0x7f0000000040)="24cfad22f6bfaf6852805baa27f08924ca5ad799303da535761a2be89a0f70e194cb164431060c92d95e9532dbd787c1e8a1bd455d625849d7ea43227b90234fa051bcd797ec06aa4b0bc3082894b1e67ddb490c6996866eeff2119881c76798d587d7d8c9b30d1249e7999d2285219e0062106facbf41746cee2519971989a0a56b8ae6958569d7d7f1593e5e5c2a3ee31402841152121e45a4e20afa10b0571e90064d829fa7a5919cc936ac0ef5e697c1a2ac6f075b26b9de9dfb69f0e4f9b42a92ddfd", 0xc5, 0x4000040, &(0x7f0000000140)={0x2, 0x4e24, @multicast1}, 0x10) 15:00:10 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x400300, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) modify_ldt$read(0x0, &(0x7f0000000400)=""/4096, 0x1000) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:10 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5603000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:10 executing program 5: r0 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_PVERSION(r0, 0x80045400, &(0x7f0000000040)) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f00000000c0)={0x7, &(0x7f0000000080)=[{0xab34, 0xff80000000000000, 0x6, 0x4}, {0x7, 0x188c80000000000, 0x4, 0xcf45}, {0x7, 0xfff, 0xffffffffffffffff}, {0x6, 0x800, 0x40, 0x3f}, {0x4, 0x8, 0x20, 0x100000001}, {0x2, 0x8, 0x4000000000000000, 0x4}, {0x7, 0x3ff, 0x7, 0x400}]}, 0x10) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1026.144816] binder: 17237:17238 tried to acquire reference to desc 0, got 1 instead [ 1026.162666] binder: BINDER_SET_CONTEXT_MGR already set 15:00:10 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/mixer\x00', 0x400001, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(r1, 0x800442d2, &(0x7f0000001440)={0x2, &(0x7f0000001400)=[{}, {}]}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/qat_adf_ctl\x00', 0x8000, 0x0) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000100)) getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f00000003c0)={0x0, 0x1000, "e93baf3186c8538d662867b4d740d9409fee5402fed0096fdd77d4e3e6eafd1830063c19a3611dec996efdac7ea339e09b4d580021698996dc6858438c87d16233e68f1ee319b786b410aca62bf055463af1a09beea6a85ccf7c316aef29bdb543cebc6b7acee25e39a956eeddca663837ed0ea44aad3c0f5c57a231e8f2fca15f5d9839eaa6e6655331002501d59d69a996a17d04fa4c80d7eeac0d3c43d4da01074d9884b707358912aa74527c7cda843a0e4cafcbe62910b12169da54fe05896ca13900f9fdeaf36eb6b15880f234e9adc9a1d62a51350220a4635a18406ae5e141d282cf4eaaf12c5664afb307ad437377a7b8366139c35cbb6a644c6ffb66a4e6afbcc4a853869ae35e5bd41c905ddcd2e89317f86c37b3ee0b340150553f430c4f19453d04bf6fa35fefe2bff668fb1475fcf214468b619dd6fdba61fc83ab9e926d18f97a476caa9c1170ba24f9196ee2a87b2cc2e9d4ffc9b7c493f8f38597514a71b6718b5849543caa7587213a6a99471509f5a737b1c4e1f81e7df6c1238225b6ee572c01ef6a97ab6b8e2481c78a1d7a9784f26d692f8a910fb6b530df0656719d998e9af6f3b85a5007637a5b227ed992e597a9d0f5a192f156670f0b762c83b0fe0d80352738fb13bbba9ddb788b5c875bf1006dd0d1bda33c9539314017f1f1c706a5b4b73ea256eb3aa5d79add48406cf8d8894d3b03d83d8600858af5ac5618ea4b0e162d0f02fbf2c3aad88aa08251c72af13b8b82a90f65e77f9341c4b7d2d8b0272725d91575e507fc2bb490807878d67500cd9e47df0b58a74f18121b77840beaea70d61cdacd95d154667f0e8f0129c3c55c8063a360a84af5abfb0892ea5088d609900533e74888962154e194e8603b303f3ac3a58e5e540dfb6502a364a5e330681ad9bacb4ec144ebaf4dcbbf85447cf1680e9e74b39faba4d4014c959e14941fdfd749a755ccceadfecd6c16bf05e61d761094d51fe5d6f06037cc8fee98adbf07cb294376b4552468920d55b0b21d1a359c721952d7c51e72c2db8cf1256ea66f274dd337b6353a6372c8b5b2b2f0fa137d57f2873d5c52e57ec97ea24ddbcab8de5d77954d3455dbd667ca0cb4e96a2b158b6794fdaad1878b75c07edc4abb7db693bc2f8855bd92fabaf27d1481406644fb5726da7ffb023b72a5ce3b24b4d44c8a5382ff5f85794cdfd33f754e37e0d2827fb3458d180ed29529e5871f997811c0803291de0ca4674045d95cbcd759e64476f397a1db5f59a1048cbf2a12ff312ba1a2d3500010ac8d04027ce1eac9175c6669e02f5ce52994386a2256edac8d07b8e2964826d097ea209467cb59b3d8cbcf3ea71640646f59c56014429192fe31cf40b82decfa55df0441b379a6dd85c1ea66f8d90c12c0bf0e451a49c985c3c0f4e1ddf440b5f7b449f520afffb625dc7db33e0ca7d8fc0063aca66b4b4a1ae0d14eaabc36e4ca16724f98ef6ebb0f466c830c79b806dae4e70033ede47ee6cf29430c890759e27c762e4fae085fba4cccee6f9f47af59005fa734522496527ea02ec1b7c83b6e334a2e1c77288c12d38bd80cf50cdc92362ae256a35d39dbc545298bcf2e9b609abf1b2012a1438776a700c5d2a3c47640f06d018296edcfcb4c731f4b315cd8d178798c8dc959df3c8448f2eb631b873099efecedb806a4e4f237be47ae6b752bbdfb307ed75050edb003d842432f63813ba86b715c5ee6c01457d4c96b21f858b90190547c54388c8f234eb492ee9eb985e7711b947f98510facabe48859dd804453c10cb2d7233874948c81c941028c525d8a408fd7ffcc324a81ec0b744513c06893c3e15bdff0ffb7249a1c6db159040afc57f739e452bc20d930e24a132f949a1e4d2381f0002200092afbca356e6d9b9df51d2fac8e848224a902b9770fb311982e66a1ee4406de8b139c4604edd69809e63006e98a69d80d62d1e2435d43dfccc0ce72c4435a43d35d56ba1121199c66dc9058d644a52f5583659d7e69be05ee41e8dae826f226f21a4e6cce7da0b39d406216e432bf83a87865affa5b700f3d23cd8b88239737c5d75581009f10451ac9f6e811d02041e1e4e6ab6fa95b976543ca42a35db3abf9b029c4c2fce4792ba353ad7fd92f62734ec43e7ba3bb01c95be4abdcfebbf0db07cab1ee16ea67a9aeb840dfdc1a0bdcb352612c2221ba29e4f368a3cf0bda61c1507bce0a74d4aa2456df8dae31b8e41095724db59bb784a3357cfacfb9b5fae542a30a2174afe3e7d2e742e5e1fff549e0f37e7e648e4b9cab420b2a41c38fcb82ffb9dbbc597de3798082c093b09ac1f8665c773c6e8778a13f4d560d7552c568abc62b5d76cdb03fb542ee8666ccdbb73836874f684a6e3b4ba5a33215cf9d32be9edd11f25713d73a588955b3ddba56bca019abbc2bc6cd74e9700acc79b554f8e6253ec6b29b5ca950ce4c2306f372b61cc0bb3158bc0d7e5fb8d0e51485a95dec60165c19fb319a0ef0d0d2f72b0c01963b757107f5fd32ea0422214ed76a4c6f1492a8ee81628890cf3579378a733fdcac111ae580ff082d90dff24d20e2b5e367ca8c2b8643d928b727dfa4cce349d3880b052827788e6c1cd17f6d76ff332cd29d0cd21823cdce0a7b649a823f20234f7436bb96bff61fb6796e81be8be280d1dceecedb74ab0f3e74c3af9a40c71379434f1d5e3f58718277b74bb62faac0608239c67eb186920977e6a534107bda5bc57bc3f0322fb564ee8f91c8a5eca7a423ec5d679de7d9292556bfd156aace51efa921beb5c67f5f67e1c779015baa76b1b5a25bcdb7fe5248182e4a9798552a050a87800e21ecab1120815cad84d7355c210de814e3c305e82669792328c7aa65059d02d51ac00016c3ed4598da7e37ee13b1690be164a987cb9ab48765a7e023cfccbc0ceaab2706fa508d0b73deedf12ce4dc6810d94dd2c1d734cc525e3eff2fd0f6c8e737dc63208fcd91a645b70137a87bd5f8689b7f45ce31b57bd6e8d46668b7c300cc8afa576c64342e360eb61ee474d69fd23ac15521d320b805a28b06d3c144187b1a19d58500160ed1874eee74733ecc06a23b5cc8e0297c5f5b1706ddfbfbab554bbf71cce8d71a9d4f0aa96396d874159663e3d972bb246b0b336f8909aaa9121bedb52241d010858aab6c8d9a3f3786121001a2c0df5dd2e7e5392d439b1a0d0cc79bdd96f55dc3b3a0d2bbc635510f7311ddfb3895e40c269da68f4934b986f51ab7c39b38c105d89dbd18753d2ea316b4f37e440238f42af31ada7fdef5526f750180eeac6e8be6a6d56b28655db9f84b0ceec3432733991e49e8f25ac8c8aa33e6468192b8b2759a192b0190d6d708af5b4c9cce28e1bb28092ca6aebffc8bbdcd1c397d258f6890c2e7ca3f54cf020332e1dfa311da48299b9ee37d042fb12d0f760389031fd02eb78c169b6dcfa2f9bda26849e996dc8c7716ec02aae9d822a8d2c814554efc67ea1e00c9c9b6d1b059f40c08fb6a1285c53f228cf72b8e04e5a265543cf547fa014bfdb4bae786df9c4f6208e489c9dac9cbccf3b0b9feca5bb8d26aa0bd5520acb7deca2e2385f26dcfee11d0b8882e64c3edf6ebb5fe02a3a6a1253d883013fb0e2c300ee2ac4cd9881a450613f582be7bcd3bbc8d0af77c6d7f9fadafa5e09576a736dd489a87a44b1786029890f02e567a4a5108ca18cc699b481b5c90ba2c32fdd61dcdb1d19c5f69a95963177a381b001b50d7edcb9ca1e4774d5fd0cfda723887126984565781a39e2505b3385c7ff4b5eb7cd5fd54bfec5282fecb750e7707f35652017304444255e8411fffffad54fdd34933c3898a330e8ea1981434f3ebe56b45681df0d98843ea3e2362d0a1e2009654b1281cbd293a3f0a20306a3916c15e31ede426b8c21d59de814ecec38f1630d4005c649c6670d96bd8b84e3d0998fa53f45a933ce14ec9fbd55bfda7b28a1f79e3f7bf55a709af20c33292fa9b620b8119e1dc1561c59149bba09c04b9d6432acf616e1a592aca91bf620f59ba04c1cf9d0b9a3c4ddc729495de0dd911c144e91035643a417549b63863abf58bcb5ac41aa81405ff805441fa364a7566b65d13e7689438972baf3200d592ae582ebe678be14ae1a31d6b7852eaa95a512ed982df86d6452e12290bac89a385e4516ee3c7e2eb180314861b1d155e00d2cfbc0185e8b986d6fb085ddc382a003e2bd4dbf88e0f26595cf04acaa140daa1aae2f60236392a56add353cee54a9ae137cf9858e30afb613a148833bbcf4eb71af0105efc5a2a41c63d290d38dae45efce5d2cebefecde55006b6f74fce3b40b482d2759d2d5b50369dc663bf7afe717c40f1293cebcb5ea373c1a58871b487938d9a86fe8441699ebad944bdeb9ab973bdc9096cb1d0223db3946b882ddb4c6bbebf9af9c46ca7ed9ac7b44196eca43fe5cadb7d05534c122ed2e49d2699ec768058c7bd4eb52a3c088555f54577a674990960c0f1ae7d9e3fa4b4bf505fe915bcc95e084ec98051cc1058e86051902e76740983d1eecc31aabafbdadf1ed0355a39fb934b87601e7116d64a475bd6f09d6dd22248232f305f20d715532b1b8f03c2a7952ff49da7bbc01aa5147962b413674c5ab8ddc87cb3868b2b643f4fccb3a595aca2f74ee339e0fd4133d6420e6cf28363409c8029085c290ce62ee232461896584932dc74f29eca2c42b921abf9eaef6676b59e3b74c02933615dff07d1f11946f915059dad93f110c28776e6c47a7eadb7465ec37c3b2712807bb0e947be266e091841fba98c4cbac6377446beb31a2d35a5ba70e97023b2e94977c3b9c8c19bd2ad5cfb32f1047797c2fbf8f89a3aa3d2b07abc85c425f2fafe4de99e696bcfda4bd8482ffe07c4180b64abe459d5f8449ba6f3e562ef65c27212d51786aa6ebd136416e7e31da7d06be92bfa74e210984b07b5606b4d21bfad12330484d6675ae04fde635ff569c3ac59d9f68ea3f176d311081f0eaac4ff65a73c36f2ed239fe6eff2875f102fb14990beb07a8781c5a50bd5fe57f55c4205a6fe0ff2da3dea17988887e495540c245ab70d3ea7a67ea38eccbfbc400b07e46404a1fc202890cd63728e43a674ce4294cfa029d524425a501926e04fc05e79a266f62376d8d7f80c9ced897401f6df7796bc167d243bee6847b2a1db1af506ebf6183350478986dc57374d2f9eb15bc6b8b5e304ad663050d0bcd87a762b1e5588927f98bee53c4f3495c982118cb4720bb3a7d61d9ffd898cdd9b8734a06476226b7f539964eb8840bb9aa3855166b2f89ff303b0c1092593e8cc804440bce26a83c13130c5c387103ab56192986622ab3d6445c715d87e8e83181f46c9acc115a25497f2bbf724de1977f60b1590941eb13f76bf126b189aac823aef4d817eeaf7ab0ed30825c47debd5a13db819f6436ce11422611948f7a85efae97f27b35d7ab4d3d69a1b4a4a8cd96254856a98786bee56d806584916f8196f0bb31d0e477435d5781b913d8afa24228297a0880e597a87b775572214f917955b30d911bdaf536ec65617635ae67ccd1ed417b1e5e10799c6fc28c15118608191fcb06397aace29fec26bcefe63ade83dfea1041a02112c4f054400cb70bcdb028c3d9ebacad916df35e0f9321829554d6c14ab34d585ac883e1f5c72b1df4d8dcfc92a6cc0608ed65e1e055785ed4317063bb4db04be6504e13f800dd560a75c91e650c015a9332012ee21ae8d8adc37512d58a66f784ddb8d61ea094009ddb97e2866aca45cae"}, &(0x7f0000000200)=0x1008) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000240)=ANY=[@ANYRES32=r3, @ANYBLOB="82000000ff7dca2a0a5b36ad795fd9bca61e0fda24e838f661eaca4cfac842496f03b0f7ab579ec8bd95d901aaec1da64aa9ac246a58379e61ba2da7cf6b5911f6bff54bd0760849205443dbbec2fcb69a1e26663ce1ef8065883e9f970134b771cf0de0a9f98e6ba2808a911ffc56f9ed69e5e322172688d502381b52e201302994609a4f94"], &(0x7f0000000300)=0x8a) uname(&(0x7f0000000000)=""/185) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) write$FUSE_OPEN(r1, &(0x7f00000001c0)={0x20, 0x0, 0x5, {0x0, 0x2}}, 0x20) write$sndseq(r1, &(0x7f00000000c0)=[{0x2000, 0x3f, 0x7, 0x1, @time, {0x9, 0xfffffffffffeffff}, {0x6, 0x8}, @time=@tick=0x1}, {0x6, 0x2, 0xc1, 0x6, @tick=0x2, {0x3, 0x9}, {0x1aec, 0x8}, @quote={{0x1, 0x8}, 0x3f, &(0x7f0000000040)={0x800, 0x100000001, 0x3, 0x5, @time={0x0, 0x989680}, {0x3, 0x7b}, {0x2, 0x7fff}, @control={0x7c1, 0x3, 0xfff}}}}, {0x8b, 0x3ff, 0x3, 0x80000001, @time, {0x5, 0x1}, {0x8, 0xf0b4}, @control={0x56b, 0x81, 0xfffffffffffffffa}}, {0x100000000, 0x68da353c, 0x7, 0x80000000, @tick=0x1000, {0x2, 0x2}, {0x56, 0x2}, @quote={{0xfffffffffffffffd}, 0x4, &(0x7f0000000080)={0x80000000, 0x9, 0x5, 0x6, @tick=0x2c, {0x8bfa, 0x2}, {0x1, 0x7}, @queue={0xad52, {0x81, 0x20}}}}}, {0xff, 0x4, 0x96b6, 0xa0, @time, {0x6, 0x400}, {0x8001, 0x9}, @addr={0xa4, 0x3}}], 0xf0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1026.186658] binder: 17247:17251 ioctl 40046207 0 returned -16 [ 1026.192457] binder: 17237:17245 unknown command 536872576 [ 1026.205367] binder: 17247:17251 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1026.228809] binder: 17237:17252 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1026.240457] binder: 17247:17251 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1026.245134] binder: 17237:17254 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1026.257427] binder: 17237:17245 ioctl c0306201 20008fd0 returned -22 [ 1026.266669] binder: undelivered death notification, 0000000000000000 [ 1026.311682] binder: 17247:17251 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:10 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x1000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:10 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) getresuid(&(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1026.357283] binder: 17247:17251 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1026.374823] QAT: Invalid ioctl [ 1026.398864] QAT: Invalid ioctl 15:00:10 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) ioctl$VIDIOC_S_TUNER(r1, 0x4054561e, &(0x7f0000000000)={0xff, "b1c716a2a6a4e48f2f203120059fa80d703df80a6accfd0e6ac73da0303b910a", 0x3, 0x1840, 0x9, 0x8, 0x4, 0x3}) nanosleep(&(0x7f0000000080)={0x0, 0x989680}, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_ID(r1, 0x80082407, &(0x7f0000000600)) ioctl$KVM_SET_LAPIC(r1, 0x4400ae8f, &(0x7f0000000200)={"d0d0bfc0e2a45112832c397e7e820b791657198b17048808f377ebc934e80bd3d02c9408b42f6ffc797a0d409bb1874138da3682dd77936904c9876de2d8f43996f70efd979c7f19023506e83fb06275c6315e5b6b27d904ea41eeacf4c283ad3f0d546830f90e28a1121862053ceccb01edc95ed06c8ff4407179ae4b2c2bae79c4d060d6ad526f193d63103b77c65887ec828e40fce4d2b25afe72aebebcdd7ecafcb416ce93279e632b9148fc2649d24b4fd124895385f1715ef84a9de1662e7e6b8e42508f580f1515a57c19a4efa095ecc0eab3f57681a65c7518cd8b34922d1c4d692fcd05a0ae36bfc2fe5e1c4b5f9dc22cd7cb46be08c1dc58faf0b5bd15ec9ae4d70dc27dba54cd4f4c8dac2676eece9b068c8a09e41703cb784a4ec2865ac982c35b26d0b10cc5cbded428791ad6402c1e87a69adb353ae86a1ce1522f992cceaeed9bb2251ecb49a09af0ef30163563d47e6f9a67bd4487d7b1962d37006c3b142067708cc2793d13bedaa72c773a4c531035b07715517d581feefc2b8129f920014ec890450a2e4eecaaa1e61de3e6cb8c05dd60f4041936b53f428b34946f2e51ca90853d0246098e03dbcf989bdcc2a1886beab7829d0c654c15085a6a48b7483402ef5af37929eda77523861a7d04808fbd7e4c7169c373416cebd61d34008a4ce7b5b660671c3677fb664bb8c86778e2c41d4afe0f8624212dfd26b465d37bb0d5ee28f2fd5e9a98c32d52e4a44fa30ad1e881926d80871eb7a8e195eeb0dfd65598ad247a56d7585821cedb09fd86d20b611b64b46fdd5838da5ca4cb6affd6e94ecd83854179fdfa769271bcc6029d9449c7f1fa1c0b6ac0aef1f8d9b5e6019cd3e53cc69350c7ed46c31870c41c14df5c56f66148e68e073b352b69bc4f8aafbdb7b002049958c833ae5fa18c89051850fe27e2228782a2afe3b48066e48e3be34833b47bac7b71a1e79fbb49333c0c7f3231c4cab7cd113038c994ebea439b844cbcbf8ad86739df672ad7d8ab89a67c9ea520a4d8676b45835cc8d07399cc208f87e9301cfb2dee7a171a19d23da7e527651e23f9b541f81a62865c8e1745efaf92fb35cff66c7dcf4a3db9586d2234e67390dec5c8172ebc953433a8b320e68efdab126f28b4a368cc49e427607db20ec5f2058a6a86746e370bd60227804121de62138c28b7d69d897c97b1bedfab2a257e75f73712e6107648c9898057e816163e88c932e1af7d8cfe653fefe6b3d6b1b411e1134e471046dbccebedc5ec2121d5367160a9dd7c6149f163e965e5f7a01a1ee5ec87625f7d0d8e283c2a361b47c87d1277b3b8e44688fed57ff6f928cf0b6511d9b3710d23b4dcb1a4c9cef86f4482a45efa886a841ca5209abab0d5ca15de79d492bb08604ad826741aec86cdf40d4f794d88296a2855d651f9c124a8be9e705e"}) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000740)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000700)={0xffffffffffffffff}, 0x111, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000640)={0x14, 0x88, 0xfa00, {r2, 0x3b, 0x0, @in6={0xa, 0x4, 0xfffffffffffffffd, @mcast1, 0x2}}}, 0xffffffffffffff45) 15:00:10 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x4e23, @remote}, {0x2, 0x4e22, @empty}, {0x2, 0x4e21, @multicast1}, 0x240, 0x0, 0x0, 0x0, 0x200, &(0x7f0000000040)='veth1\x00', 0x3, 0x1, 0x9}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) [ 1026.535528] binder: 17269:17270 tried to acquire reference to desc 0, got 1 instead [ 1026.594380] binder: undelivered death notification, 0000000000000000 [ 1026.615666] binder: undelivered death notification, 0000000000000000 15:00:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b02000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:11 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x2000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000080)='/dev/nbd#\x00', 0x0, 0x800) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000180)={'team0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000100)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x23, r3}) ioctl$FS_IOC_FSGETXATTR(r1, 0x801c581f, &(0x7f0000000200)={0x9, 0x6, 0x8001, 0x7}) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r0, 0x400c6615, &(0x7f0000000040)) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x4, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ROUTE(r2, &(0x7f00000001c0)={0x4, 0x8, 0xfa00, {r4, 0x20000}}, 0x10) 15:00:11 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f00000000c0)={0x0, 0x3}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000180)={r3, 0x101}, 0x8) 15:00:11 executing program 5: r0 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x2000, 0x180) getsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000000400), &(0x7f0000000440)=0x4) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1027.076855] binder: 17287:17289 Acquire 1 refcount change on invalid ref 0 ret -22 15:00:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) dup2(r0, r1) 15:00:11 executing program 5: r0 = syz_open_dev$mouse(&(0x7f0000000040)='/dev/input/mouse#\x00', 0xfff, 0x220400) timerfd_gettime(r0, &(0x7f0000000080)) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) ioctl$TIOCGSID(r0, 0x5429, &(0x7f00000000c0)=0x0) waitid(0x0, r2, &(0x7f00000004c0), 0x2, &(0x7f0000000540)) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x200200, 0x0) ioctl$KVM_SET_CPUID2(r3, 0x4008ae90, &(0x7f0000000240)=ANY=[@ANYBLOB="0a000000000000000000000000000000030000000180000005000000040000000200000000000000000000000000000000000000cc9200000400000009000000a92100000000000000000000000000000000000000000000040000000400000005000000449b0000020000000b0c000004000000000000000000000000000000000000c001000000040000000300000003000000ff010000010000000000000000000000000000000f0000c00800000001000000e600000005fb00000000d00207000000000000000000000000000000000000806ed10000040000000000000006000000070000000100010000000000000000000000000000000080000000000400000008000000040000004b68330f1f0000000000000000000000000000000f000000020000000000000002000000ff070000fc170000090000000000000000000000000000000e0000800104000004000000000000000400000000000080000007000000ec0400000400000004000000da0300000500000007000000000000000000000000000000469b01d5bdddacda78289efc2740fc9ce91a7c66200d2b4dab10c2e6e3f318ab8c83ccc2325b95b4acd3d1609aee9845eae103e5e4e15b62827355ee590c3af3d317c7c1dbdbf1b3aa0dcee979a125391dd801240bdcecf62604b5af9589dc000094309491285608ba27f85d20219f2c44aee18cc8106f8d60cf000000000000000000000000000095fdd87883023863d197fa9df5c4b0ced61ae85acb7334a816deb6404d755b6c356544dd8a7b880d741e9383341c8541891fa47342832cfdd30297922ae77d4792539c9177b30f7555e74294c8b892000000000000000000"]) [ 1027.139336] binder: 17287:17289 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1027.177279] binder: 17304:17307 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:11 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x3000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:11 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd02000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1027.235246] binder: 17304:17311 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1027.255564] binder: 17287:17300 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:11 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r1, 0x28, 0x0, &(0x7f0000000300)=0x1000, 0x22b) timer_create(0xd14667b64d58f2a6, &(0x7f0000000200)={0x0, 0x35, 0x1, @thr={&(0x7f0000000040)="64712606fdfaca145ba8df9d8bcc16cee3f9ee438e8ce4fa625977d13b19d6e765fde41fa2a9d4d08eed1a87fc276c4d984ebd0ef67149d2305f7391cb94768428d1a59bad8996204ef5af3105c270caa040d715a7d16f23a9f0c1f3d9578c1f5092f69e99068041c0ebb4a9bceae19c4af315e6c260799abe63e32c106a13c4dd68a56b5df3b528235a6272b14e16746f796df78cd8312a0b534880b7164d50834d639080d0b25e66641d89c77b610a0f7d8b6e02842a42dd9eb2298af29309a318d3c3ecc017b2b1442c8fb6e32d1c35", &(0x7f0000000140)="69c44ce397aa30c61a3fbcad6df7e653e70a0e8cc1df66c1f65311d7b99a8684cc3e833ccab48ed2c327dd5eee49dee223204eb00f374dafd3c18b5985bdfdef9a54bfb5a8219d8d2f2e651543705dd2354ef7971f87219336fbff65fc94e21dbf42b08174ef1768dc4ece1382db31180f513c35e9554a5c8dd3479763c1d5637c7e261725600f2a3b04331ce57fcb6b69cfbabfba827a5e8dad5081ea5e60bc25870701b4f622ce553ef6cd7c81cec16c7e69"}}, &(0x7f0000000240)=0x0) timer_delete(r2) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) prctl$PR_GET_UNALIGN(0x5, &(0x7f00000002c0)) 15:00:11 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = dup2(r0, r0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) ioctl$RTC_PLL_SET(r1, 0x40207012, &(0x7f0000000000)={0x7, 0x1, 0x4, 0x3, 0xe991, 0x1000, 0xffffffffffffff6a}) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video35\x00', 0x2, 0x0) [ 1027.806663] binder: BINDER_SET_CONTEXT_MGR already set [ 1027.812524] binder: 17287:17300 ioctl 40046207 0 returned -16 [ 1027.819816] binder: 17287:17300 unknown command 536872576 [ 1027.825697] binder: 17287:17300 ioctl c0306201 20008fd0 returned -22 [ 1027.865360] binder: 17287:17337 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:12 executing program 0: syz_init_net_socket$x25(0x9, 0x5, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x80, 0x0) ioctl$ASHMEM_GET_SIZE(r0, 0x7704, 0x0) syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x5, 0x10000) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) 15:00:12 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x4000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:12 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x0, 0x0) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f0000000040)='syz0\x00') write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe403000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_stats\x00', 0x0, 0x0) connect$nfc_llcp(r1, &(0x7f0000000140)={0x27, 0x1, 0x1, 0x7, 0x7, 0x5, "6d111b97dfa0878b1e1a0b460a373ad67cc4128bfdf346052bdc0ccfa89d0a95545179ef64d3a7313b5310b8149d469465652d1f582b5480560fa1384ca369"}, 0x60) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\b@\x00\x00'], 0x0, 0xfdfdffff, 0x0}) [ 1028.049059] binder: 17340:17348 unknown command 16392 15:00:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x7214, 0x500) getsockopt$inet6_tcp_int(r1, 0x6, 0x18, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$VIDIOC_G_CTRL(r1, 0xc008561b, &(0x7f0000000100)={0x5, 0x5}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:12 executing program 5: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ubi_ctrl\x00', 0x42, 0x0) setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000080)=0x1, 0x4) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:checkpolicy_exec_t:s0\x00', 0x28, 0x2) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000380)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) write$RDMA_USER_CM_CMD_BIND(r1, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) [ 1028.080699] binder: 17340:17348 ioctl c0306201 200003c0 returned -22 [ 1028.120777] binder: BINDER_SET_CONTEXT_MGR already set [ 1028.139703] binder: 17340:17360 unknown command 536872576 [ 1028.147135] binder_thread_write: 1 callbacks suppressed [ 1028.147206] binder: 17353:17363 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:12 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x5000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1028.183378] binder: 17340:17359 tried to acquire reference to desc 0, got 1 instead [ 1028.183834] binder: 17340:17365 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1028.193259] binder: 17353:17366 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000040)='/dev/dlm-monitor\x00', 0x80400, 0x0) ioctl$SIOCX25SENDCALLACCPT(r1, 0x89e9) r2 = dup(0xffffffffffffffff) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="f90000005896efcf7d1ef6c18bd7f3198f47a97fb5951bab896f18a18978dc22cb1fa362a57c12c94293deb6577a61868887760f5966c5c49528b6146f91dd9d4ef7a4daf020ddb73559fd1effd658aaf6ec97efa5f92fb4b68c4b941712b59bc07774fc3060d92113c678c5f7449fd80f6223e25d8df04a99b94e2092fb07d99ac34442d15595f2286ae47a3fd90b96793b63c0184e50cf0dd6093a9ea71c65906e68bbeab89bb131c38bd0c503ceadc3068b274a5ab222a03cd68ada1365ccdac97bfb06a867b2604071efe9a5f4a3c5daa4acce3005c7ad51693a3c46453393f1fe2b69057962281dfc3b985d922ec95bcb61814dd128cf4dd0876fa2f908ac0921153f351b647482dc19fa52d2fddc1f2c3133a4939a2ece299209891b99bfec3c2b"], &(0x7f00000001c0)=0x101) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000200)={r3, @in6={{0xa, 0x4e21, 0x101, @rand_addr="45167bcd8607385a6dc5d40e6b4e529f", 0x75a50975}}, 0xc000000000000, 0x7ff, 0xb7, 0x1f, 0x8}, 0x98) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1028.278102] kauditd_printk_skb: 3 callbacks suppressed [ 1028.278177] audit: type=1400 audit(1550242812.328:175): avc: denied { associate } for pid=17367 comm="syz-executor.5" name="ubi_ctrl" dev="devtmpfs" ino=579 scontext=system_u:object_r:checkpolicy_exec_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=1 [ 1028.317232] binder: 17340:17348 ioctl 40046207 0 returned -16 [ 1028.345004] binder: 17340:17360 ioctl c0306201 20008fd0 returned -22 15:00:12 executing program 5: r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_BIND(r0, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {0xffffffffffffffff, 0x3c, 0x0, @in6={0xa, 0x0, 0x0, @dev}}}, 0x90) 15:00:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe602000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1028.390865] binder: undelivered death notification, 0000000000000000 15:00:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:12 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:12 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x6000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) modify_ldt$read(0x0, &(0x7f0000000400)=""/4096, 0x1000) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:12 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf403000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1028.966233] binder: 17394:17397 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1028.993877] binder: undelivered death notification, 0000000000000000 15:00:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x802) r1 = dup(0xffffffffffffffff) getsockopt$inet6_mreq(r1, 0x29, 0x14, &(0x7f00000000c0)={@loopback}, &(0x7f0000000100)=0x14) openat$cgroup_int(r1, &(0x7f0000000140)='cpuset.mem_exclusive\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) prctl$PR_SET_MM(0x23, 0xf, &(0x7f0000ffe000/0x2000)=nil) ioctl$TCGETS(r1, 0x5401, &(0x7f0000000200)) fsetxattr$security_smack_transmute(r1, &(0x7f0000000040)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000080)='TRUE', 0x4, 0x0) 15:00:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) bind$rxrpc(r2, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0xffffffffffff8000}}, 0x24) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1029.048192] binder: 17406:17408 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1029.076208] binder: 17394:17409 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:13 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x7000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1029.097897] binder: 17394:17409 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1029.141246] binder: 17406:17412 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1029.180834] binder: 17406:17412 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm_plock\x00', 0x0, 0x0) setsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000100)=0x401, 0x4) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000040)={0xd91, 0x5, 0x6, 0x5, 0x3}, 0x14) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f00000000c0)) [ 1029.263461] binder: undelivered death notification, 0000000000000000 15:00:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) bind$rxrpc(r2, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0xffffffffffff8000}}, 0x24) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1029.425305] binder: undelivered death notification, 0000000000000000 [ 1029.739023] binder: 17394:17409 unknown command 536872576 [ 1029.744974] binder: 17394:17409 ioctl c0306201 20008fd0 returned -22 [ 1029.758846] binder: 17394:17433 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1029.767270] binder: 17394:17409 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:13 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f0000000040)=""/253) ioctl$RNDADDENTROPY(r1, 0x40085203, &(0x7f0000000140)=ANY=[@ANYBLOB="050000001a000000daf5d91a56bd76a3037342f95ebc7109bf0e00000000004b4ff0"]) 15:00:13 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x8000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) bind$rxrpc(r2, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0xffffffffffff8000}}, 0x24) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:13 executing program 2: r0 = syz_open_dev$admmidi(&(0x7f0000000140)='/dev/admmidi#\x00', 0x9, 0x100) ioctl$KVM_TPR_ACCESS_REPORTING(r0, 0xc028ae92, &(0x7f0000000180)={0x100, 0x87}) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_genetlink_get_family_id$team(&(0x7f0000000240)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000280)={{{@in=@initdev, @in6=@local}}, {{@in=@empty}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000400)={{{@in6=@local, @in=@empty}}, {{@in=@local}, 0x0, @in=@initdev}}, &(0x7f0000000500)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000540)={{{@in=@empty, @in=@broadcast}}, {{@in6=@ipv4}, 0x0, @in6=@mcast1}}, &(0x7f0000000640)=0xe8) recvmsg$kcm(r0, &(0x7f0000000c00)={&(0x7f0000000680)=@hci, 0x80, &(0x7f0000000a80)=[{&(0x7f0000000700)=""/234, 0xea}, {&(0x7f0000000800)=""/132, 0x84}, {&(0x7f00000008c0)=""/134, 0x86}, {&(0x7f0000000980)=""/78, 0x4e}, {&(0x7f0000000a00)=""/106, 0x6a}], 0x5, &(0x7f0000000b00)=""/239, 0xef}, 0x20) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000c40)={'team0\x00'}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000d40)={{{@in=@multicast2, @in6=@mcast2}}, {{@in=@remote}, 0x0, @in6=@local}}, &(0x7f0000000e40)=0xe8) getsockname$packet(r0, &(0x7f0000000e80), &(0x7f0000000ec0)=0x14) accept$packet(r0, &(0x7f0000000fc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001000)=0x14) getsockname$packet(r0, &(0x7f0000001040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001080)=0x14) getpeername(r0, &(0x7f00000010c0)=@can, &(0x7f0000001140)=0x80) getsockname$packet(r0, &(0x7f0000001180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000011c0)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000001280)={'gretap0\x00'}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000012c0)={{{@in=@initdev, @in6=@remote}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f00000013c0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001400)={{{@in6=@local, @in=@initdev}}, {{@in6=@initdev}, 0x0, @in=@loopback}}, &(0x7f0000001500)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001540)={'team0\x00'}) mount$bpf(0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='mode=0']) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='debugfs\x00', 0x0, &(0x7f00000001c0)) getpeername$packet(r0, &(0x7f00000015c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000001600)=0x14) getsockopt$inet6_mreq(r0, 0x29, 0x15, &(0x7f0000001640)={@mcast1}, &(0x7f0000001680)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001ac0)={'team0\x00'}) getpeername(r0, &(0x7f0000001b00)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000001b80)=0x80) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001bc0)={{{@in=@multicast2, @in6=@loopback}}, {{@in6=@initdev}, 0x0, @in6=@dev}}, &(0x7f0000001cc0)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000001d00)={{{@in=@multicast2, @in6=@remote}}, {{@in6=@dev}, 0x0, @in=@local}}, &(0x7f0000001e00)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000001e40)={'team0\x00'}) [ 1029.934390] binder: BINDER_SET_CONTEXT_MGR already set 15:00:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) bind$rxrpc(r2, &(0x7f0000000100)=@in4={0x21, 0x4, 0x2, 0x10, {0x2, 0x4e20, @rand_addr=0xffffffffffff8000}}, 0x24) [ 1029.957810] binder: undelivered death notification, 0000000000000000 [ 1029.969494] binder: 17439:17441 ioctl 40046207 0 returned -16 [ 1030.021061] binder: 17449:17452 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:14 executing program 0: open(&(0x7f0000000040)='./file0\x00', 0x181200, 0x2) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:14 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x10000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1030.089182] binder: 17449:17452 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x200000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="3e04db2a3099a529bc0ffcf4c80e5f0b8f562591209f76bead6b0c699fe8cadc95334c7c8db434e5dac34d3cbcd9d40f14914e94a4b9dc0473029e5ab30ce28a753d080898e4a06dcf34aed60630c2c4cd3f6ea89e61d0007b5fce2c9a3bee2c9afa4b36c26ee89c2703bf54fe44bff4e8a89b040fa3a7284722fe949f9ee378ee59af2dcebfbc8f3795285543498085a08379c4359b70e05405a56caa85545f39c69fbbf9ad922149b102"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) 15:00:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f00000000c0)={0x0, @in={{0x2, 0x4e21, @loopback}}, 0x7, 0x1, 0x1000, 0xffffffffffffffe1, 0xffffffffffffffc1}, &(0x7f0000000180)=0x98) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r1, 0x84, 0x66, &(0x7f00000001c0)={r2, 0x1ff}, &(0x7f0000000200)=0x8) setsockopt$netrom_NETROM_T4(r1, 0x103, 0x6, &(0x7f0000000080)=0x10000, 0x4) ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000040)={0x0, 0xe0, "4bbda590173ac71a5af6e81b28019f6173b92173e21d1bc9", {0x7, 0x8}}) [ 1030.318009] binder: 17464:17466 unknown command 718996542 [ 1030.344447] binder: 17464:17466 ioctl c0306201 20008fd0 returned -22 [ 1030.389903] binder_release_work: 1 callbacks suppressed [ 1030.389937] binder: undelivered death notification, 0000000000000000 [ 1030.406817] binder: 17464:17466 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1030.451052] binder: 17464:17474 tried to acquire reference to desc 0, got 1 instead [ 1030.464291] binder: 17464:17471 unknown command 718996542 [ 1030.484515] binder: 17464:17471 ioctl c0306201 20008fd0 returned -22 [ 1030.494697] binder: 17464:17471 BC_CLEAR_DEATH_NOTIFICATION death notification not active 15:00:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:14 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:14 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x3f000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:14 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='#em1,@#\x00', r1}, 0x10) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000100)=@req={0x80, 0x80, 0x3, 0x401}, 0x10) name_to_handle_at(r1, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="6800000006000000b6a2034472aafade6201e08c2a20a1381fc506000000000000b9000000b0d8bb4ca864ed13e1e08236e2cc7a2a2a6380074de86312cad5fcf4c052a5439b1f9d019aca73d19d600076e7adac3b0a85b33980a3ac8760cdd9e1e6b841d936660e4965f0a64e0b03e4dd6f6c0032634746ac75c99e79fa11fd6bbe5c52152b4e209bded4d728e5b13437fda5a14082061d93ecd4da4477e9aea2dd3c07c96d8f745953c70183432dfbfd099d35bb014ef3655f393838ec9fb9df95cb7526a5730c2b36940780e27037cc1ab140538821c4a50539597d7b801576a44798f8"], &(0x7f0000000180), 0x400) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) 15:00:14 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000200)={{{@in6=@mcast2, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@multicast1}}, &(0x7f0000000180)=0xe8) sendmsg$xdp(r2, &(0x7f0000000880)={&(0x7f0000000300)={0x2c, 0x1, r3, 0x14}, 0x10, &(0x7f0000000800)=[{&(0x7f0000000400)="812453d2ea1066ebd2206000c940b7d48b77a246a044aff27f60ce96cb8a5b49b50fbf316a4122f07ae86e5457219613a44760cdb042611849791e8c0bba46b17b180f71a4ec6f3c147d2c05b5acd398d9fdf5cf2c7b332d67cfd5de26f2899f0d355c3774b1a21b1cbf6d8d568b77eaaca555cc038eb15ee55bc1c8f5af1730b5aca1d0736b51eddc2f713c616dc055cdea7c1962d9b3f35038dd4625bba795d4caf0896a10213f0dd95977da1c26560d925764bbd1cdddef1a8c47f47cad4a43ac272fff75a2d9363e34f7fc5eb492c7df1fc08fcfbaa8a581a485c0f83111c72b0fdb993f62d5e90df1b27ec54c3d7294ac39f984f1a6dd66", 0xfa}, {&(0x7f0000000500)="f1b76fe615a155bfbd5f0458734fe45b5aac8e71ffa905e482a960216fdb82e1d7f59627fccd1545b095f3e78f72adfc5442bfe9a19fd5707b8df8fcc3d9db1d01e0957e4d9d5fcf0e5274c87cb2abe85b1a71896d2fb24c5d84443bcda7f83c0136789c598333d407a663c70cf892ee22e751ae6c41ec8d9a42c2ba927e1af962f516d27781ebff4f0b3f1219409b8b43ebd30a8abcb562c200f6a7b834e53e00c87362af75f2564fe14cd8f1a5ad7bd392adc6978fbec9d9b9bfa1ddda", 0xbe}, {&(0x7f00000005c0)="49c191fcbef15e0607904bd7b7b44bd06ef74e1df901637734f7d77afd29dfa5fab8a26a864807b1cd4f4744641d741aa75fdf87e89e122f67b719338d7653023f10730d058c8eff295d5162ba87cc8590726993a8c39f71bf0a813d7b796e8caea3d81c829fe65a5ac3c55ec03abd02e73bd7c8366e25f35b23f94a948030cbdeba7d080f65f184181794f1b4e1703fe8d0cb904a870f25117757d72fa5bbea559b95dd3f1ac3b3", 0xa8}, {&(0x7f0000000340)="9cce7039f4d5c2ef3fa0247883f925c395a3c31d496b9c616d9dab2db08bbdaa28e7d63c8f76995d3344322e616855b931a64c56d1f467eb1afb60a1d1fe1574d3bde9911198a171577fa16e897d481baecfcba004729fe223ce036f6bf4d67f0e6b3060", 0x64}, {&(0x7f0000000680)="66e7c8c17f1064eceb0ca0ac63620123a4efee6c6db465102749b65e969ffac7a31e84e922bba51e87258a89d91bb07c29d01152af336e749172aa689379584ca3ca71c05d5bdc1977ddaaaf0379d0d31f91c3a738424bf649b63477d8221f7582f8dc126fa10300456ae48032ef13af67e6a3d0ae88c94531eafd13467d09504f2a4209eae22bf67ebc8473d228afcfe56de50a456e2a6aeba7bb8a006879c79b3fe2249c6d1469c5401eaf472e8afdbfbc55e6d40d76e1b535429f185f09553e01430e27bba88780840405d81d25f5e7fb92144080d530d16bdc8ea870437ed41bcd48be251639e31bccfaebc88a35fbf48b53a814", 0xf6}, {&(0x7f0000000780)="1440beee8756200c230f5c9db22dae68fe2964935564656de8d2c7118b4f77062ba82bef4f360cae61a5502f6daa0dc85b2ff55f5e135c771810db3903087e0f2cd2055d6bc97713b88eda2c68f30f526b478111dd", 0x55}], 0x6, 0x0, 0x0, 0x80}, 0x1) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f00000008c0)={0x3, 0x36}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) fsetxattr$security_selinux(r0, &(0x7f0000000100)='security.selinux\x00', &(0x7f0000000140)='system_u:object_r:semanage_exec_t:s0\x00', 0x25, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1030.915235] binder: 17478:17488 ioctl 4b4d 200008c0 returned -22 15:00:15 executing program 0: r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000040)='/dev/hwrng\x00', 0x2000, 0x0) getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(0xffffffffffffff9c, 0x84, 0x6, &(0x7f0000000080)={0x0, @in={{0x2, 0x4e23, @empty}}}, &(0x7f0000000140)=0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000180)={r1}, 0xc) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000003cc0)={0x0, 0x2, 0x5, 0x8001}) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = dup(0xffffffffffffffff) recvmmsg(r0, &(0x7f0000003840)=[{{&(0x7f00000001c0), 0x80, &(0x7f00000006c0)=[{&(0x7f0000000240)=""/119, 0x77}, {&(0x7f00000002c0)=""/103, 0x67}, {&(0x7f0000000340)=""/178, 0xb2}, {&(0x7f0000000400)=""/93, 0x5d}, {&(0x7f0000000480)=""/253, 0xfd}, {&(0x7f0000000580)=""/153, 0x99}, {&(0x7f0000000640)=""/113, 0x71}], 0x7, &(0x7f0000000740)=""/218, 0xda}, 0xfffffffffffffeef}, {{&(0x7f0000000840)=@vsock={0x28, 0x0, 0x0, @hyper}, 0x80, &(0x7f0000000b80)=[{&(0x7f00000008c0)=""/39, 0x27}, {&(0x7f0000000900)=""/27, 0x1b}, {&(0x7f0000000940)=""/202, 0xca}, {&(0x7f0000000a40)=""/131, 0x83}, {&(0x7f0000000b00)=""/72, 0x48}], 0x5, &(0x7f0000000c00)=""/171, 0xab}, 0x8}, {{0x0, 0x0, &(0x7f0000001f40)=[{&(0x7f0000000cc0)=""/76, 0x4c}, {&(0x7f0000000d40)=""/67, 0x43}, {&(0x7f0000000dc0)=""/147, 0x93}, {&(0x7f0000000e80)=""/4096, 0x1000}, {&(0x7f0000001e80)=""/9, 0x9}, {&(0x7f0000001ec0)=""/126, 0x7e}], 0x6}, 0x1}, {{&(0x7f0000001fc0)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002140)=[{&(0x7f0000002040)=""/193, 0xc1}], 0x1}, 0x3}, {{0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000002180)=""/45, 0x2d}], 0x1, &(0x7f0000002200)=""/94, 0x5e}, 0x6}, {{&(0x7f0000002280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f00000036c0)=[{&(0x7f0000002300)=""/95, 0x5f}, {&(0x7f0000002380)=""/144, 0x90}, {&(0x7f0000002440)=""/106, 0x6a}, {&(0x7f00000024c0)=""/4096, 0x1000}, {&(0x7f00000034c0)=""/201, 0xc9}, {&(0x7f00000035c0)=""/220, 0xdc}], 0x6}, 0x2}, {{0x0, 0x0, &(0x7f0000003800)=[{&(0x7f0000003740)=""/142, 0x8e}], 0x1}, 0x40}], 0x7, 0x2000, &(0x7f0000003a00)) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000003a40)={{{@in=@empty, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@empty}}, &(0x7f0000003b40)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000003b80)={{{@in6=@dev={0xfe, 0x80, [], 0x24}, @in6=@ipv4={[], [], @rand_addr=0x101}, 0x4e21, 0x7f, 0x4e24, 0x5, 0xa, 0x80, 0x0, 0x6c, r4, r5}, {0xffffffffffffffc0, 0x3, 0xffffffff, 0xce3b, 0xffff, 0x4, 0x7f, 0x9}, {0x401, 0x1, 0x1, 0x1}, 0x4, 0x6e6bb5, 0x0, 0x0, 0x3}, {{@in6=@empty, 0x4d2, 0x32}, 0xa, @in6=@remote, 0x3500, 0x3, 0x1, 0x3, 0x7, 0x7, 0x1}}, 0xe8) ioctl$BINDER_WRITE_READ(r2, 0x40046208, 0x0) [ 1030.959990] binder: 17489:17493 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1030.964756] audit: type=1400 audit(1550242815.018:176): avc: denied { associate } for pid=17478 comm="syz-executor.2" name="binder0" dev="devtmpfs" ino=530 scontext=system_u:object_r:semanage_exec_t:s0 tcontext=system_u:object_r:device_t:s0 tclass=filesystem permissive=1 [ 1031.006953] binder: 17478:17488 tried to acquire reference to desc 0, got 1 instead [ 1031.007077] binder: 17478:17495 unknown command 536872576 [ 1031.050106] binder: 17489:17493 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:15 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x40000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1031.070214] binder_thread_write: 3 callbacks suppressed [ 1031.070234] binder: 17489:17493 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1031.091905] binder: 17478:17501 ioctl 4b4d 200008c0 returned -22 [ 1031.100654] binder: 17478:17495 ioctl c0306201 20008fd0 returned -22 [ 1031.112298] binder: undelivered death notification, 0000000000000000 15:00:15 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) connect$vsock_dgram(r2, &(0x7f0000000100)={0x28, 0x0, 0x2710, @hyper}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1031.361259] binder: 17511:17514 tried to acquire reference to desc 0, got 1 instead [ 1031.375584] binder: 17511:17515 unknown command 536872576 [ 1031.386412] binder: 17511:17517 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1031.399196] binder: 17511:17516 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1031.412093] binder: 17511:17515 ioctl c0306201 20008fd0 returned -22 [ 1031.420645] binder: undelivered death notification, 0000000000000000 15:00:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:15 executing program 0: r0 = syz_open_dev$mice(&(0x7f00000001c0)='/dev/input/mice\x00', 0x0, 0x20400000) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000080)='cgroup.subtree_control\x00', 0x2, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4800000}, 0xc, &(0x7f0000000100)={&(0x7f0000000200)={0x194, r3, 0x8, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x80000001}, @IPVS_CMD_ATTR_SERVICE={0x28, 0x1, [@IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x1}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast1}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xbd5}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}]}, @IPVS_CMD_ATTR_SERVICE={0x1c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x3c}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'sh\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, [@IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x2}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x8f}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x68}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}}]}, @IPVS_CMD_ATTR_DAEMON={0x38, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x2}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e24}]}, @IPVS_CMD_ATTR_DAEMON={0x60, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x100}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @remote}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'eql\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x9}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0x44, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x1}}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0x5e}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@loopback}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0x2}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}]}]}, 0x194}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000) 15:00:15 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x80ffffff, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:15 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:15 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="052f6a62c5f52b7bda3031702c4963044000e3ffffcf09133f7c59394351f8629a19628d31847b04"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4, 0x0, &(0x7f0000000200)=[@enter_looper], 0x11, 0x0, &(0x7f0000000140)="853183a13a52f82d0700119879fef9000000000000007c7ad5b18b05efc18b79759c1903d7a23ab0d9f8d75d07"}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000080)='/dev/qat_adf_ctl\x00', 0x200, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000240)=0x1) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="10630840"], 0xffffffffffffff5b, 0xfdfdffff, 0x0}) [ 1031.850843] binder: 17524:17527 unknown command 1651126021 15:00:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$KVM_SET_ONE_REG(r1, 0x4010aeac, &(0x7f0000000040)={0x4, 0x10000}) semget$private(0x0, 0x0, 0x104) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1031.895856] binder: 17524:17527 ioctl c0306201 20012000 returned -22 [ 1031.905329] QAT: Invalid ioctl [ 1031.911211] QAT: Invalid ioctl [ 1031.916805] binder: 17524:17533 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:16 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0xffffff7f, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) write$P9_RATTACH(r1, &(0x7f0000000040)={0x14, 0x69, 0x2, {0x1, 0x1, 0x6}}, 0x14) 15:00:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x110], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$VIDIOC_G_JPEGCOMP(r1, 0x808c563d, &(0x7f0000000080)) write$P9_RATTACH(r1, &(0x7f0000000000)={0x14, 0x69, 0x2, {0x8, 0x3}}, 0x14) 15:00:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:16 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0xffffff80, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:16 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$KVM_SET_SREGS(r1, 0x4138ae84, &(0x7f0000000040)={{0xf6b737c05d6c80ae, 0x5000, 0xf, 0x2, 0x8, 0x8, 0x1ff, 0x3, 0x6, 0x6, 0x4, 0x1}, {0x0, 0x1000, 0x0, 0xb5c, 0x7fffffff, 0x9, 0x1, 0x8501, 0x2, 0x10001, 0x1, 0x5}, {0x6003, 0xf000, 0x0, 0x7, 0x0, 0x5, 0x5, 0x80000000, 0x2c4, 0x81, 0x2, 0x1}, {0x1000, 0xd000, 0x0, 0x2, 0x0, 0x80000000, 0xfd02, 0x0, 0xffffe00000000000, 0x3, 0x3, 0x9}, {0x7000, 0x0, 0x3, 0x6, 0x6, 0x2, 0x9, 0x2, 0x7, 0x6f8fa7f6, 0x2, 0x3}, {0x5000, 0x107000, 0x0, 0x3, 0x4, 0x3, 0x3f, 0x9ab, 0x6, 0x8000, 0x8cf, 0xffff}, {0x3000, 0xf004, 0xf, 0x3f, 0x7, 0x35, 0x5c8, 0xb585, 0x27, 0x5, 0x2, 0x7fffffff}, {0xf000, 0x17001, 0xf, 0x9, 0x0, 0xffff, 0x9, 0x1, 0x4, 0x5, 0x800, 0x94}, {0xf000, 0x100002}, {0x3000, 0x2}, 0x40000000, 0x0, 0x7000, 0x250, 0xb, 0xc901, 0x2, [0x4, 0x7, 0x8, 0x3]}) ioctl$BLKDISCARD(r1, 0x1277, &(0x7f0000000240)) [ 1032.524304] binder: 17562:17564 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1032.599023] binder: 17562:17569 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1032.635245] binder: 17524:17527 unknown command 1651126021 [ 1032.646349] binder: 17524:17527 ioctl c0306201 20012000 returned -22 15:00:16 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000100)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:16 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27b], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:16 executing program 0: r0 = dup(0xffffffffffffff9c) getsockopt$bt_sco_SCO_CONNINFO(r0, 0x11, 0x2, &(0x7f0000000140)=""/170, &(0x7f0000000240)=0x36) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) ioctl$VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f0000000040)={0x77, 0x2, 0x2, {0xa, @pix={0x1000, 0x6, 0x0, 0x3, 0x100, 0x0, 0x0, 0x9, 0x1, 0x0, 0x1, 0x1}}}) 15:00:16 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0xed9d4906dc, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1032.673431] QAT: Invalid ioctl [ 1032.677627] QAT: Invalid ioctl [ 1032.834480] binder: 17583:17584 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1032.858195] binder: 17583:17584 tried to acquire reference to desc 0, got 1 instead [ 1032.897601] binder: 17583:17585 unknown command 536871168 [ 1032.898225] binder: 17583:17586 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1032.915145] binder: 17583:17585 ioctl c0306201 20008fd0 returned -22 [ 1032.950319] binder: 17583:17584 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1032.960999] binder: undelivered death notification, 0000000000000000 15:00:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000040)={'mangle\x00'}, &(0x7f00000000c0)=0x54) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:17 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x40030000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2cd], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x44, 0x0, &(0x7f0000000200)=[@reply={0x40406301, {0x0, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x0, 0x28, &(0x7f0000000100), &(0x7f0000000140)=[0x28, 0x0, 0x48, 0x0, 0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xffffffffffffffe6, 0x0, &(0x7f00000000c0)=ANY=[], 0x0, 0xfdfdffff, 0x0}) [ 1033.174412] binder: 17591:17596 got reply transaction with no transaction stack [ 1033.212051] binder: 17591:17596 transaction failed 29201/-71, size 0-40 line 2801 [ 1033.284051] binder: 17591:17604 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1033.318972] binder: undelivered TRANSACTION_ERROR: 29201 15:00:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$clear(0x7, r1) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:17 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x100000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:17 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = add_key$user(&(0x7f0000000100)='user\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000200)="c0304e6a82f77644ac06adcbc5dfd14968c5da03a375625b295dfdf0744769b19f585117be3651f9fda8379df390d45f6b3bc81064bce4d5c28b1101f2c5a7183e38d1fd107041bbf461", 0x4a, 0xfffffffffffffff9) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000180)={r2, 0x7, 0x6}, &(0x7f0000000280)={'enc=', 'pkcs1', ' hash=', {'sha224-arm64-neon\x00'}}, &(0x7f0000000400)="b9f6f8b4b0f05cdb55ac8319ffd6be2bc65b81feaab174853b206e3f628b3df3f2806c3867663aac813189902dfc793f4a629352fba1376c9de6f95ff117cfa93d59b074cea77147222ffd340a4189a4d935c630a25802dcbcca458f8e4477b330b46d859146bc9b1d04d4c7741196f13f2d65a8e86ba442d491cb3dc36a305323ce9cdd7ddd3d9ca538d206581b9302a0da7a170d1de6ecfa69b93ce728d33c4c54d700e96b0841f1fbcd26f704978ba5f48b5bcd3b20cb05a1881ab91620cf1ec4ef4386ee21bc7b73837ef1a5bd6870", &(0x7f0000000300)=""/87) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0xd907b70d045d889f, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2eea38c7"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) statfs(&(0x7f0000000380)='./file0\x00', &(0x7f0000000500)=""/13) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000540), 0x10) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:17 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e6], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:17 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x400000, 0x0) getpeername$netrom(r1, &(0x7f0000000080)={{0x3, @default}, [@rose, @default, @bcast, @netrom, @rose, @remote, @rose, @netrom]}, &(0x7f0000000100)=0x48) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1033.532568] binder: 17612:17617 unknown command 0 [ 1033.563869] binder: 17612:17617 ioctl c0306201 20012000 returned -22 [ 1033.596910] binder: 17612:17617 unknown command -952571346 [ 1033.604645] binder: 17615:17616 ioctl c0306201 200003c0 returned -14 15:00:17 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x200000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1033.627982] binder: 17612:17617 ioctl c0306201 2000dfd0 returned -22 [ 1033.666090] binder: 17612:17617 tried to acquire reference to desc 0, got 1 instead [ 1033.691095] binder: 17612:17625 unknown command 536872576 [ 1033.705613] binder: 17612:17626 unknown command -952571346 [ 1033.739647] binder: 17612:17625 ioctl c0306201 20008fd0 returned -22 [ 1033.768839] binder: 17612:17617 unknown command 0 [ 1033.778992] binder: 17612:17626 ioctl c0306201 2000dfd0 returned -22 [ 1033.783453] binder: 17612:17617 ioctl c0306201 20012000 returned -22 15:00:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:18 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x0) r1 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000000)='/dev/video37\x00', 0x2, 0x0) ioctl$VIDIOC_ENUMSTD(r1, 0xc0485619, &(0x7f0000000300)={0x46fe, 0x0, "b7dc8a68995a75d7850045925996356423753e04494db70c", {0x5ae, 0x6}, 0x8}) fsetxattr$security_selinux(r0, &(0x7f0000000340)='security.selinux\x00', &(0x7f0000000380)='system_u:object_r:getty_var_run_t:s0\x00', 0x25, 0x3) r2 = dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r2, 0x29, 0x2a, &(0x7f00000000c0)={0xc0000, {{0xa, 0x4e20, 0x9, @loopback, 0x3}}}, 0x88) ioctl$CAPI_INSTALLED(r2, 0x80024322) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="4c010000f06c9b15e37d728e513fada3d4b7a4d3a24813a6f107b109caf40014939ad2c486a0f1ccf9c2bef2343e0bb49dd5ca4cc7e35038d2e4261745a0088b32d6dcc0a41c02a60b192dfc7ea2a4ac99283c46df484564", @ANYRES16=r3, @ANYBLOB="000500000000fddbdf250c000000080004000100000040000100080008000080000014000300ac14141f0000000000000000000000000800020001000000080004004e2000000800060073656400080005000000000048000300140002006e657464657673696d300000000000000800030003000000080001000300000008000500ac14141a0800080003000000080005007f00000108000300010000005c000200080006000400000014000100fe80000000000000000000000000002314000100ac141425000000000000000000000000080005000500000008000b000200000008000b0002000000080002004e24000008000300030000001c0001000800090049000000080008000000000008000500020000000c00010008000500000000001c0003000800080003000000080001000100000008000300030000000800050003000000"], 0x14c}, 0x1, 0x0, 0x0, 0x4}, 0x804) 15:00:18 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x356], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0c630000a298934321cbf12925c2519a6d710b850741cd00937a2cb2b2851eb41e7a18be9f7284ee86e8"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:18 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x300000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1034.114254] binder: 17636:17643 tried to acquire reference to desc 0, got 1 instead [ 1034.153063] binder: 17636:17646 unknown command 536872576 15:00:18 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1034.160352] binder: 17636:17652 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1034.170776] binder: 17636:17646 ioctl c0306201 20008fd0 returned -22 [ 1034.182259] binder: 17636:17643 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1034.193176] binder: undelivered death notification, 0000000000000000 15:00:18 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$caif_stream(0x25, 0x1, 0x3) r2 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000004bc0)={{{@in=@broadcast, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@dev}}, &(0x7f0000004cc0)=0xe8) sendmsg$nl_route_sched(r2, &(0x7f00000051c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x42000400}, 0xc, &(0x7f0000005180)={&(0x7f0000004d00)=@deltfilter={0x474, 0x2d, 0x300, 0x70bd25, 0x25dfdbfe, {0x0, r3, {}, {0xe}, {0xffff, 0xfff3}}, [@TCA_CHAIN={0x8, 0xb, 0x3}, @TCA_RATE={0x8, 0x5, {0x0, 0xfffffffffffffbff}}, @TCA_CHAIN={0x8, 0xb, 0x20}, @filter_kind_options=@f_route={{0xc, 0x1, 'route\x00'}, {0x42c, 0x2, [@TCA_ROUTE4_FROM={0x8, 0x3, 0xd1}, @TCA_ROUTE4_FROM={0x8, 0x3, 0x72}, @TCA_ROUTE4_TO={0x8, 0x2, 0x35}, @TCA_ROUTE4_POLICE={0x408, 0x5, @TCA_POLICE_RATE={0x404, 0x2, [0xf7, 0xffffffffffffff22, 0x5, 0x8, 0x4, 0x7f, 0x3, 0x280000000000, 0x8000, 0xc668, 0x9, 0x10001, 0x4, 0x10001, 0x1c000, 0x401, 0x9, 0xb78, 0x3, 0x4, 0x2, 0x2, 0x2, 0x9, 0x7f, 0x93000, 0x7fffffff, 0x80, 0x0, 0x8, 0x10001, 0x3, 0x7, 0xea7, 0x1, 0x6, 0x5, 0xffffffffffff49f3, 0x100000001, 0x8, 0x80000000, 0x0, 0xffffffffffffffc1, 0x7, 0x128ff71, 0x29a8953c, 0x9, 0x101, 0x401, 0x48b, 0x3, 0x6, 0x9, 0x7, 0x4, 0x4, 0x400, 0x7fffffff, 0x4, 0x101, 0x6, 0x66e, 0x1, 0x6, 0x4, 0xcec, 0xfffffffffffffffb, 0x2, 0x7, 0x0, 0x5, 0x5, 0x0, 0x1, 0x9, 0xffffffffffffffff, 0x20, 0xfb4, 0x13, 0xb59, 0x4, 0x2, 0x7fffffff, 0x5, 0x7, 0x68, 0x9, 0x3, 0x0, 0x7, 0x1, 0x7, 0x5, 0xc52, 0x8000, 0x2, 0x8, 0x84, 0x1, 0x0, 0xf34, 0x4, 0x8, 0x80000001, 0x3ff, 0x400, 0x4, 0x8001, 0xea, 0x7fffffff, 0x4, 0x5, 0x7, 0x8000, 0x13b, 0x7fff, 0x3, 0x4, 0xffff, 0x100000001, 0x8001, 0x7, 0x0, 0x3, 0xff, 0x4, 0x74, 0x1f, 0x7, 0x5, 0x26, 0xdd68, 0x9, 0x6, 0x6, 0x41, 0x1, 0x5, 0x100000001, 0x5, 0x10000, 0x2, 0x3, 0xffffffff, 0x1, 0x200, 0x97, 0x3, 0x400, 0x1ff, 0x0, 0x3, 0x1, 0x38, 0x6, 0xfb74, 0x10000, 0x20, 0x7, 0x52b3, 0xffffffffffff389f, 0x800, 0x10000, 0x1ff, 0x10000, 0x81, 0x9, 0x22, 0x0, 0x8, 0x40, 0x3, 0xfffffffffffffffb, 0x2, 0x9, 0x2, 0x4, 0x2, 0x6, 0xffffffffffffffff, 0x75, 0x8, 0x7, 0x1f, 0x2, 0x1, 0x1000, 0x0, 0xffff, 0x1ff, 0x2, 0x3, 0x10000, 0xfff, 0x6, 0x3f, 0x80000001, 0x100000001, 0x3, 0x7, 0x1, 0x8, 0x81, 0x4, 0x0, 0x1, 0x1, 0xbd, 0x8, 0xaa, 0x0, 0x1f, 0x8, 0x8, 0x1, 0x1, 0x400, 0x4, 0x0, 0x7, 0x4000000000000000, 0x8001, 0x6, 0x9, 0x80000001, 0xff, 0x7f, 0x1ff, 0x8, 0x40, 0x1eef, 0xdc4, 0xfff, 0x80, 0x1, 0x101, 0x8, 0x2, 0x7, 0x800, 0x799, 0xf30, 0x7fff, 0xffffffffffff8416, 0x7, 0x0, 0x3ff, 0x4, 0x7, 0x4, 0x7, 0x7, 0x8000, 0x1, 0x53, 0x6]}}, @TCA_ROUTE4_FROM={0x8, 0x3, 0x1e}]}}]}, 0x474}, 0x1, 0x0, 0x0, 0x20000081}, 0x20000010) getsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8) 15:00:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f00000004c0)={0x0, 0x3, 0x30}, &(0x7f0000000500)=0xc) ioctl$KDGKBMETA(r1, 0x4b62, &(0x7f00000005c0)) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000540)={0x2, 0x26e3, 0x202, 0x149b, 0x0, 0x10000, 0x0, 0x9, r4}, &(0x7f0000000580)=0x20) ioctl$UI_SET_MSCBIT(r3, 0x40045568, 0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000140)=0x6) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB="0e630c260000416c"], 0x0, 0x0, 0x0}) getsockname$netlink(r2, &(0x7f0000000240), &(0x7f0000000340)=0xc) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) lstat(&(0x7f0000000600)='./file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETGROUP(r3, 0x400454ce, r5) r6 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) r7 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r6, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000180)={&(0x7f00000002c0)={0xfffffffffffffca9, r7, 0x0, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @local}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3431}, @IPVS_CMD_ATTR_DEST={0x2c, 0x2, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7fffffff}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}]}, 0x6c}, 0x1, 0x0, 0x0, 0x24040001}, 0x4000880) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xfffffd0c, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:18 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x400000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:18 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:18 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1034.460691] binder: BINDER_SET_CONTEXT_MGR already set [ 1034.467193] binder: 17666:17669 ioctl 40046207 0 returned -16 [ 1034.488259] binder: 17666:17669 ioctl 4b62 200005c0 returned -22 [ 1034.522691] binder: 17666:17669 ioctl 40087602 20000140 returned -22 [ 1034.600477] binder: 17666:17669 unknown command 638345998 [ 1034.614212] binder: 17666:17669 ioctl c0306201 20008fd0 returned -22 [ 1034.688928] binder: 17666:17674 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1034.703845] binder: 17666:17674 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1034.712208] binder: 17666:17674 unknown command 0 [ 1034.717404] binder: 17666:17674 ioctl c0306201 200003c0 returned -22 15:00:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3e4], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:19 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x500000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$VIDIOC_S_PRIORITY(r1, 0x40045644, 0x1) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:19 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:19 executing program 1: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:19 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x600000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1035.241684] binder: BINDER_SET_CONTEXT_MGR already set [ 1035.247315] binder: 17666:17674 ioctl 40046207 0 returned -16 [ 1035.289952] binder: 17666:17696 ioctl 4b62 200005c0 returned -22 [ 1035.320437] binder: 17666:17700 tried to acquire reference to desc 0, got 1 instead [ 1035.370293] binder: 17666:17696 unknown command 638345998 [ 1035.377400] binder: 17666:17696 ioctl c0306201 20008fd0 returned -22 [ 1035.377441] binder: 17666:17697 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1035.393643] binder: 17666:17704 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1035.403407] binder: 17666:17704 unknown command 0 15:00:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f4], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:19 executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x101000, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) open(&(0x7f0000000180)='./file0\x00', 0x20002, 0x0) r2 = dup(r0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r2, 0x40405515, &(0x7f0000000140)={0x9, 0x0, 0xebb, 0x4, 'syz0\x00', 0xfffffffffffffffa}) removexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='com.apple.FinderInfo\x00') dup2(r0, r1) r3 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r3, 0x40046208, 0x0) 15:00:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1035.429168] binder: 17666:17704 ioctl c0306201 200003c0 returned -22 [ 1035.513286] binder_thread_write: 4 callbacks suppressed [ 1035.513299] binder: 17709:17711 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1035.555255] binder: BINDER_SET_CONTEXT_MGR already set [ 1035.568412] binder: 17712:17715 ioctl 40046207 0 returned -16 [ 1035.608260] binder: 17712:17715 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1035.615848] binder: 17709:17717 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1035.616011] binder: 17709:17717 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1035.682981] binder: BINDER_SET_CONTEXT_MGR already set [ 1035.706595] binder: 17712:17715 ioctl 40046207 0 returned -16 15:00:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:19 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x700000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:19 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000080)={{{@in=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6}}, &(0x7f0000000180)=0xe8) sendmsg$nl_route_sched(r1, &(0x7f0000000240)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x20c, 0x70bd27, 0x25dfdbfc, {0x0, r2, {0x9, 0x4}, {0x8, 0xf}, {0xb, 0xf}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x4000) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:19 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1001], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x800) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r2, 0xc008551a, &(0x7f0000000140)={0x0, 0x18, [0x300000000000, 0x200, 0x101, 0x5, 0x10001, 0x5]}) getsockopt$inet6_opts(r2, 0x29, 0x0, &(0x7f0000000200)=""/220, &(0x7f0000000100)=0xdc) [ 1036.007494] binder: 17725:17731 ioctl c008551a 20000140 returned -22 15:00:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1036.055189] binder: 17725:17731 tried to acquire reference to desc 0, got 1 instead [ 1036.059490] binder: 17725:17737 unknown command 536872576 [ 1036.086068] binder: 17725:17740 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1036.095781] binder: 17725:17737 ioctl c0306201 20008fd0 returned -22 15:00:20 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x800000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1036.119663] binder: 17725:17739 ioctl c008551a 20000140 returned -22 [ 1036.120258] binder_thread_write: 1 callbacks suppressed [ 1036.120400] binder: 17725:17731 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000900)='/dev/binder#\x00', 0x0, 0x2) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) write$binfmt_elf32(r1, &(0x7f0000000040)={{0x7f, 0x45, 0x4c, 0x46, 0x100, 0x20, 0x1, 0x8, 0x0, 0x0, 0x0, 0x9562, 0x194, 0x38, 0x26d, 0x9, 0x401, 0x20, 0x2, 0x6, 0x8, 0x8}, [{0x2, 0x80000000, 0x4679, 0x9, 0xfffffffffffff001, 0x4000000000000000, 0x1ff, 0x6}, {0x0, 0x42c9, 0xffffffff, 0x5, 0x5, 0x1, 0x4, 0x3}], "2e3d4c6543b5844aa7c290ead354f8ae4c58b2da9693aaac62b8f7733971e172d4d0f37ea290ed82e1d4c7732ea4adf1be07adf85ad1b0858e32f808b84b59bbf7312ed78be1503b1da82219fb41364cc872bfc263325c58da942506c3b877515d6b44ccc2786ac4eacdb93bcad694858ee9f736db9529a281c0b88ae79f78a9ddc3f45062ab7cf6430525b9420adcfcafd51ca1b0c6c344116fc3b6b382752a5c18ecccae681b75052c1e80d5dd9b780ca6259790ce4b7b9ba71b2afd7b025abb7ee8e6616799", [[], [], [], [], [], [], []]}, 0x83f) 15:00:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c00], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1036.209282] binder: undelivered death notification, 0000000000000000 15:00:20 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="0563444000000000"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$GIO_FONTX(r2, 0x4b6b, &(0x7f0000000200)=""/240) ioctl$GIO_UNISCRNMAP(r2, 0x4b69, &(0x7f0000000100)=""/155) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:20 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x1000000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1036.450421] binder: BINDER_SET_CONTEXT_MGR already set [ 1036.468842] binder: 17756:17757 ioctl 40046207 0 returned -16 [ 1036.495828] binder: 17756:17757 unknown command 1078223621 [ 1036.517049] binder: 17756:17757 ioctl c0306201 20012000 returned -22 [ 1036.527834] binder: 17759:17761 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1036.544851] binder: 17756:17757 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1036.609485] binder: 17756:17763 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1036.619605] binder: 17759:17765 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1036.620040] binder: 17756:17763 ioctl 4b6b 20000200 returned -22 [ 1036.654467] binder: 17756:17763 ioctl 4b69 20000100 returned -22 [ 1036.658692] binder: 17759:17765 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1036.662047] binder: 17756:17763 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:20 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:20 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffff9c, 0xc00caee0, &(0x7f0000000080)={0x4, 0xffffffffffffffff, 0x1}) ioctl$FIGETBSZ(r1, 0x2, &(0x7f00000000c0)) openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x80002, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:20 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:20 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x3f00000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:21 executing program 0: r0 = accept$ax25(0xffffffffffffff9c, &(0x7f0000000140)={{0x3, @netrom}, [@netrom, @remote, @bcast, @netrom, @remote, @rose, @null, @default]}, &(0x7f00000001c0)=0x48) ioctl$SIOCAX25CTLCON(r0, 0x89e8, &(0x7f0000000200)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x67, 0xb9b0, 0x7, [@default, @default, @null, @bcast, @null, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}]}) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = dup2(r1, r1) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000040)="bedb9cdc9e730400776301659f0e02e3f21497082aa4dd643a504a51025a2d18bfd9f37a12cf68c1a903173ba176e40ae475b9ba4f99211c8a0cf40be21026512468762b50a3a9095f4b2be004492e5bc98e66fd40feacd1b7f84955237b50d2e1e83f2bd12b8ae53d7485d244c0af3772bd12e78411ec562d18e88d06283ac7a42744d6aec7801a7187e142b780") dup(r0) socket$inet_dccp(0x2, 0x6, 0x0) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e24, 0x0, @remote, 0xdf6}, 0x1c) [ 1036.957436] binder: 17775:17776 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:21 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x4000000000000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x2c, r2, 0x303, 0x70bd25, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4}, 0x20000005) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000180)={0xfffffffffffffffb}) [ 1037.237147] binder: 17756:17763 unknown command 1078223621 [ 1037.260681] binder: 17756:17791 unknown command 536872576 [ 1037.261242] binder: 17756:17793 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1037.279280] binder: 17756:17763 ioctl c0306201 20012000 returned -22 15:00:21 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x80ffffff00000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1037.296061] binder: 17756:17791 ioctl c0306201 20008fd0 returned -22 [ 1037.338840] binder: 17756:17791 ioctl 4b69 20000100 returned -22 [ 1037.339403] binder: 17756:17763 ioctl 4b6b 20000200 returned -22 15:00:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x902) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_all\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r2, 0xc0605345, &(0x7f0000000140)={0x1, 0x0, {0x0, 0x3, 0x4, 0x3}}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) ioctl$ASHMEM_PURGE_ALL_CACHES(r3, 0x770a, 0x0) 15:00:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000080)) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f00000000c0)={0x53, 0x5, 0x8009, 0x1, 0xa9ab, 0xab9, 0x10000, 0x0, 0x0}, &(0x7f0000000100)=0x20) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000240)={r3, @in={{0x2, 0x4e23, @local}}, 0x100, 0xfffffffffffffffb}, &(0x7f0000000300)=0x90) ioctl$GIO_FONTX(r1, 0x4b6b, &(0x7f0000000140)=""/198) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1037.561794] binder: 17801:17805 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1037.607075] binder: 17801:17807 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1037.629636] binder: 17806:17808 ioctl 770a 0 returned -22 [ 1037.641677] binder: 17806:17808 tried to acquire reference to desc 0, got 1 instead [ 1037.650430] binder: 17806:17810 ioctl 770a 0 returned -22 [ 1037.658034] binder: undelivered death notification, 0000000000000000 [ 1037.678996] binder: undelivered death notification, 0000000000000000 15:00:21 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:21 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:21 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0xdc06499ded000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:21 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000540)={{{@in=@multicast1, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@multicast1}}, &(0x7f0000000640)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000680)={{{@in=@multicast2, @in6=@loopback, 0x4e22, 0x7, 0x4e22, 0x3, 0xa, 0x20, 0xa0, 0x2, 0x0, r2}, {0x4, 0x7fffffff, 0xffffffffffffff01, 0x3ff, 0x7eb, 0x0, 0x40, 0x1}, {0x3ff, 0x0, 0x19, 0xd2}, 0x74, 0x6e6bbc, 0x0, 0x1, 0x3, 0x1}, {{@in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x4d6, 0x3c}, 0x2, @in=@broadcast, 0x0, 0x6, 0x3, 0x2, 0x0, 0x5}}, 0xe8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f00000001c0)={&(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000000140)="8d4c6cbdebc2c9a8140173d2186663ca7fb7152bcb2aac8ceb4ac477adb6f35b652799575e3c36c2f57335167dd23e519e589ab80d4f8716d3fc69fe3185231b5a7e80833005379f7118e245883773a4def52218958d02de8d098837a05da6c92146bb9c5d309ac5551b7e52a591fea5c8dbcd8578495113", 0x78, r0}, 0x68) ioctl$sock_inet6_tcp_SIOCINQ(r1, 0x541b, &(0x7f0000000240)) bind$isdn(r1, &(0x7f00000007c0)={0x22, 0x6, 0x72, 0x9, 0xdcb5}, 0x6) ioctl$int_in(r1, 0x5473, &(0x7f00000002c0)=0x2344) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) sendmsg$alg(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="b0ecac2e93b4a83f9d5a4df7f46c25d20008919766d79060210ab94c0a32d97a921dea145bdf5fc48fe1c3591408ee3eeef269fe22e590a2e8879401048172b81a6ee393b0a04762887ce9fd1f0be643af8c86a2c3c987b4ecd094ad5a3e50b5f45e0e205dc5451626753116b0445898d20ee8d9b26ad11b4f4d46fa78b609b76e50651a7a8936e81b4a769d7f10867246e2f9a7556e8e4be3c451ead5735ccac71abb18a021f7", 0xa7}], 0x1, &(0x7f0000000800)=ANY=[@ANYBLOB="880000000000000017010000020000006d00000081fec75d8777dda08cf876cac91c981a9b890e95cf2347ffde26aa1e1014221fb9dd8b14cc01a8bc2bffee678d1bf696aaec1f28d1644796056612f83ecedcd15b99bdbadcc811b0d3dd466dfd9d737b4cabba0c087b0f7f448b79e8f071eb0b4a5db2fd06ebbac6168308704f84d86a710000000000000018000000000000001701000004000000ff03000000000000d0000000000000001701000002000000b8000000360a586396d1a0920a2a1b4ec39ba2c60a4a21c74f58bcecad1edefc0812bcce45093f9b278e247bda7008fe41174a9c05dd5b94281111206d439575ed0c97a58d2a8862d8303f28ba4e57d29867c25a64ee3f2748bf2b105bdb06f3d6fb2de732a0a13a6b09d3c3c27b9c100f34813cd21e3616f57af67d844b5c11934997c04c1846c7d8677ab1d650167087e51c5345f76f7978e6e1f3c25b50f57495c3fda4d7668c0275a7b28547fde5693748898fe2c3e86c6c954500000000180000000000000017010000040000000100008000000000"], 0x188, 0x44010}, 0x4000) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000100)='/dev/dri/card#\x00', 0x0, 0x0) syz_open_dev$sndseq(0x0, 0x0, 0x0) pipe(&(0x7f0000000880)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x704cb558) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000340)={0x1b9}, 0x0, 0x0) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) syz_open_dev$video4linux(&(0x7f0000000280)='/dev/v4l-subdev#\x00', 0x3, 0x0) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000400)={0x0, 0xa4, &(0x7f0000000340)=[@in6={0xa, 0x4e20, 0x5, @ipv4={[], [], @loopback}, 0x8}, @in={0x2, 0x4e22, @rand_addr=0x7}, @in6={0xa, 0x4e20, 0x3, @empty, 0x5}, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e20, @broadcast}, @in6={0xa, 0x4e23, 0x48, @mcast1, 0x1}, @in={0x2, 0x4e21, @broadcast}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000480)={r5, 0x81, 0x2}, &(0x7f00000004c0)=0x8) openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000500)='/dev/ubi_ctrl\x00', 0x101000, 0x0) 15:00:21 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffcbf, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1037.921670] binder: 17813:17826 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1037.949688] binder: 17813:17826 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:22 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0xffffff7f00000000, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5603], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:22 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x2, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1038.472194] binder: 17840:17841 ioctl c0306201 0 returned -14 15:00:22 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x3, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1038.543278] binder: 17840:17843 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:22 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b02], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:22 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0xffffffffffffffff, 0x6000) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:22 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:22 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x4, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1038.900457] binder: 17912:17928 Acquire 1 refcount change on invalid ref 0 ret -22 15:00:23 executing program 0: r0 = open(&(0x7f0000000040)='./file0\x00', 0x140, 0xc) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockname$tipc(r0, &(0x7f0000000180)=@name, &(0x7f00000001c0)=0x10) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000100)=0x4, 0x4) dup(0xffffffffffffffff) set_thread_area(&(0x7f0000000140)={0x7, 0x100000, 0x0, 0x100, 0xb, 0x8001, 0x200, 0xa428, 0xfffffc0000000000, 0x2}) r1 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x78, 0x40001) ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f00000000c0)) 15:00:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd02], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:23 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x5, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/mixer\x00', 0x14000, 0x0) ioctl$PPPIOCGFLAGS(r1, 0x8004745a, &(0x7f0000000180)) r2 = dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) bind$nfc_llcp(r2, &(0x7f00000000c0)={0x27, 0x1, 0x0, 0x7, 0x1323, 0x10001, "b3175a19b19153d2d5636eca3fd68d5bcbd3b402b49d0656be159e7a67579b32963c11193238b25e6896674479b77b6c751987b71f4e805c35bacbeaaa3a97", 0x38}, 0x60) getsockopt$bt_l2cap_L2CAP_OPTIONS(r2, 0x6, 0x1, &(0x7f0000000040), &(0x7f0000000080)=0xc) 15:00:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000040)=0x8, 0x8) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe403], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:23 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x6, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:23 executing program 0: syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x1, 0x480081) r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1039.460533] binder: 17985:17988 ioctl c0306201 0 returned -14 [ 1039.535990] binder: 17985:17994 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:23 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x10000, 0x8) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r2) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="6c15e3b4bdc8026ad7382802a652be075549b8a045061927635d4c48105752f814fca7a262950f889beb73afa14acf30b8b36883d9911aac8fd8631952093ef59878a0b2e8"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) write$P9_RLERRORu(r3, &(0x7f00000001c0)={0x1a, 0x7, 0x2, {{0xd, '/dev/binder#\x00'}, 0x3}}, 0x1a) [ 1039.689115] binder: 17912:17955 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1039.697929] binder: 17912:17955 unknown command 536872576 [ 1039.705168] binder: 17912:17955 ioctl c0306201 20008fd0 returned -22 15:00:23 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:23 executing program 0: r0 = syz_open_dev$midi(&(0x7f00000001c0)='/dev/midi#\x00', 0x23b4a704, 0x82) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='westwood\x00', 0x9) r1 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) getsockopt$inet_dccp_buf(r2, 0x21, 0x8d, &(0x7f0000000080)=""/97, &(0x7f0000000000)=0x61) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000180)={0x0, @aes256, 0x3, "db0161452c98aa3d"}) fsetxattr(r2, &(0x7f0000000100)=@known='trusted.overlay.origin\x00', &(0x7f0000000140)='@#+\x00', 0x4, 0x3) 15:00:23 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe602], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:23 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x7, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1039.862913] binder: 18001:18008 unknown command -1260186260 [ 1039.883663] binder: 18001:18008 ioctl c0306201 20000040 returned -22 15:00:23 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r0, 0xc0305302, &(0x7f0000000040)={0x2377, 0x401, 0x7, 0x0, 0x100, 0x7}) ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f0000000080)={0x40, 0x9, 0x3, {0xf, @sdr={0x777a7657, 0x4}}}) [ 1039.906459] binder: 18001:18014 tried to acquire reference to desc 0, got 1 instead [ 1039.930843] binder: BINDER_SET_CONTEXT_MGR already set [ 1039.937142] binder: 18012:18015 ioctl 40046207 0 returned -16 15:00:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1039.970137] binder: 18001:18019 unknown command -1260186260 [ 1039.989701] binder: 18001:18019 ioctl c0306201 20000040 returned -22 [ 1040.005590] binder: 18001:18008 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:24 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x8, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="1eadac0b"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:24 executing program 0: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/dlm_plock\x00', 0x40000, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r0, 0xc08c5334, &(0x7f0000000180)={0x8, 0x8, 0xffffffff80000000, 'queue1\x00', 0xfffffffffffffff9}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x105100, 0x0) read(r1, &(0x7f0000000080)=""/172, 0xac) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0x40046208, 0x0) 15:00:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf403], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:24 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x10, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1040.378444] binder: BINDER_SET_CONTEXT_MGR already set [ 1040.393649] binder: 18036:18039 unknown command 195865886 15:00:24 executing program 0: syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x4000000003) r0 = socket$inet6(0xa, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$admmidi(&(0x7f00000000c0)='/dev/admmidi#\x00', 0x800, 0x80000) recvfrom$netrom(r1, &(0x7f0000000000)=""/1, 0x1, 0x40000002, 0x0, 0x0) r2 = syz_open_dev$sndpcmp(0x0, 0x80000000, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x29, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) write$selinux_user(r1, &(0x7f0000000100)={'system_u:object_r:userio_device_t:s0', 0x20, 'unconfined_u\x00'}, 0x32) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) [ 1040.423832] binder: 18034:18035 ioctl 40046207 0 returned -16 [ 1040.431022] binder: 18036:18039 ioctl c0306201 2000dfd0 returned -22 [ 1040.461414] binder: 18036:18039 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1040.488985] binder: 18041:18043 ioctl c0306201 0 returned -14 [ 1040.512376] binder: 18036:18045 unknown command 195865886 [ 1040.518250] binder: 18036:18045 ioctl c0306201 2000dfd0 returned -22 [ 1040.528020] binder_thread_write: 9 callbacks suppressed 15:00:24 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1040.528031] binder: 18041:18043 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1040.549229] binder: 18036:18039 unknown command 536872576 [ 1040.593015] binder: 18036:18039 ioctl c0306201 20008fd0 returned -22 [ 1040.619770] binder: 18041:18056 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1040.639712] binder: 18041:18056 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:24 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000340)={r1}) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r2, &(0x7f00000005c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000580)={&(0x7f0000000440)={0x134, r3, 0x100, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_MEDIA={0x98, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xfffffffffffffe00}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc23}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xab6}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffe}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5f6f}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_LINK={0x88, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x40}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}]}]}, 0x134}, 0x1, 0x0, 0x0, 0x4000}, 0x1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x8a, 0x0, &(0x7f0000000080)=[@enter_looper], 0x0, 0x0, &(0x7f0000000680)}) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="95d4990906431d4dac84d762bc0b163af22ffdb6543288d7307d16d63f3c437c59bedc8597e3f99abc5a1520f624cb3bfef82cb236ffd444112532a4e67e4a59e992b4ca440700000000000000da3931c138ae79b4f644bfa23e6ffb775b"], 0x1a0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) write$P9_RATTACH(r4, &(0x7f0000000100)={0x14, 0x69, 0x2, {0x4, 0x3, 0x7}}, 0x14) ioctl$KVM_SET_CPUID2(r4, 0x4008ae90, &(0x7f00000001c0)={0x9, 0x0, [{0x80000009, 0xb6, 0x6, 0x6dba, 0x81, 0x3, 0x100000000}, {0x6, 0x6, 0x3, 0x5, 0x7, 0x9, 0x200}, {0xc0000001, 0xffffffffffff72e1, 0x5, 0x7a, 0x788d, 0x3, 0x10001}, {0xa, 0x81, 0x2, 0xffff, 0x5, 0x0, 0x8}, {0x6, 0x8001, 0x4, 0x1711, 0x0, 0x1ff, 0x800}, {0xc000000f, 0x8, 0x4, 0x200, 0xcf5, 0x1, 0xfffffffffffff001}, {0xc000000f, 0x20, 0x7, 0x24, 0x0, 0x9, 0x41}, {0x0, 0xfffffffffffffff8, 0x4, 0x4, 0x0, 0x8, 0x800}, {0x2, 0x3ff, 0x4, 0x3f, 0x4, 0x8, 0xfffffffffffffffb}]}) [ 1040.671422] binder: undelivered death notification, 0000000000000000 15:00:24 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x300, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1040.765655] binder: 18060:18061 Acquire 1 refcount change on invalid ref 0 ret -22 15:00:24 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b6b6b], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1040.851185] binder: 18060:18061 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1040.871060] binder: 18063:18066 unknown command 0 [ 1040.903829] binder: 18063:18066 ioctl c0306201 2000dfd0 returned -22 [ 1040.931297] binder: 18063:18066 unknown command 161076373 [ 1040.944178] binder: 18063:18066 ioctl c0306201 20000040 returned -22 [ 1040.971374] binder: 18063:18066 ioctl 4008ae90 200001c0 returned -22 [ 1040.999833] binder: 18063:18073 unknown command 0 [ 1041.005583] binder: 18063:18073 ioctl c0306201 2000dfd0 returned -22 [ 1041.018475] binder: 18063:18066 unknown command 536872576 [ 1041.045813] binder: 18063:18066 ioctl c0306201 20008fd0 returned -22 [ 1041.107394] binder: 18063:18066 unknown command 161076373 [ 1041.107878] binder: 18063:18074 ioctl 4008ae90 200001c0 returned -22 [ 1041.118195] binder: 18063:18066 ioctl c0306201 20000040 returned -22 15:00:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:25 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x500, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:25 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0e630c40000000d30d865c468814e0073cf256ddd2354c362ffb3019c98ddc5329591ede20f979eb738289bbddbb653f12ba9a435234c2e9c809000000c1172a"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1041.349202] binder: 18081:18085 BC_REQUEST_DEATH_NOTIFICATION invalid ref -754974720 [ 1041.439475] binder: 18081:18085 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1041.459432] binder: 18087:18090 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1041.476280] binder_thread_write: 2 callbacks suppressed 15:00:25 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x600, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1041.476292] binder: 18081:18089 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:25 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1041.525863] binder: 18087:18091 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1041.556304] binder: 18087:18091 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1041.582210] binder: 18081:18089 tried to acquire reference to desc 0, got 1 instead [ 1041.645738] binder: 18081:18085 BC_REQUEST_DEATH_NOTIFICATION invalid ref -754974720 [ 1041.726036] binder: 18098:18099 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1041.763576] binder: 18098:18099 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:26 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r0 = dup(0xffffffffffffffff) unlink(&(0x7f00000000c0)='./file0\x00') ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) getsockname$packet(r0, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) 15:00:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:26 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x700, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$dmmidi(&(0x7f0000000100)='/dev/dmmidi#\x00', 0x1, 0x4000) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000200)={{{@in=@empty, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6}}, &(0x7f0000000140)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000180)={@remote, r2}, 0x14) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="0c63000030d8fd476321535c5f9b0146bc45589d8dac26da56774639b90365ef721d886d0ea740d58525ef4baab71a0f281492e9c733188ceb8c1590f8022f1707e9410ffce615df22c4ea4ce6feeaa12355a48e6991fdb8328481166b4b1a001cdce80d4ee49b13179e734c96cfb3e821f92779ced92cd8f1a0c45048c9f0384e5a27f7649f60aa23aa579edf88765c9fda5d1cfc84ab65b902c2bfc58a156f2b8ea140fde88c1474ab888a44eab351f3973a80d824e8acd70352ff3862d23292149e65717bdd67ba3d010778398eea956c71ec9a2e895bdfab6d05062fe653c1cc2459bccbe88c2ab6cba388c82e49e368a3f13bc25104b83bab9635a12f7b3cb8ab75395cdad7e5970b2c48d5135a55dae9b8f156f151ec4f181606bb9b96314c996e62c631c8"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1042.170068] binder: 18105:18112 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1042.178264] binder: 18105:18110 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1042.207035] binder: 18105:18112 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:26 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x3f00, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = socket$inet(0x2, 0x806, 0x80000000) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000100)={'veth1_to_hsr\x00', {0x2, 0x4e22, @loopback}}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) write$binfmt_misc(r1, &(0x7f0000000040)={'syz1', "291fd24c7d796463d452e50c86b0"}, 0x12) [ 1042.383443] binder: 18119:18120 tried to acquire reference to desc 0, got 1 instead 15:00:26 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10010000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x8800, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000080)={0x0, 0x7}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp_SCTP_RESET_ASSOC(r1, 0x84, 0x78, &(0x7f0000000100)=r2, 0x5a1) dup(0xffffffffffffffff) tee(r0, r1, 0x8, 0x9) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1042.440719] binder: 18119:18126 unknown command 536872576 [ 1042.447378] binder: 18119:18126 ioctl c0306201 20008fd0 returned -22 [ 1042.473011] binder: undelivered death notification, 0000000000000000 [ 1042.522973] binder: 18124:18134 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:26 executing program 0: r0 = open(&(0x7f0000000040)='./file0\x00', 0x80, 0x80) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x4) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 15:00:26 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:26 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0xc, 0x0, &(0x7f0000000340)=ANY=[@ANYRES32=0x0, @ANYPTR64=&(0x7f0000000300)=ANY=[@ANYPTR64=&(0x7f0000000240)=ANY=[@ANYBLOB="d05b4ac1a1fa1ad4d6d58bf40a936c8fcbf83e7b0eb725e81c0718f63efe1c35d0db3eeae36a8f3ca2afd9217934c5c228451a54160349a28287d84d6994de5417f7795aada48a93689212f2fc1684c7d7882dfdd9575580542b5dbeecab738e2f4e1986ee06e4ec32c94c8e44c75bfebe7a368f00c7a147891c1d743b6ee9a44569eb76ae7fcb0572da9266bbf908190cd5cf583bfb282cdf0c1f129515e7461c0845daa4071c228f8b8491f727c00f"]]], 0x0, 0xfdfdffff, 0x0}) 15:00:26 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x4000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1042.742010] binder: 18143:18149 unknown command 0 15:00:26 executing program 0: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f0000000040)={0x0, @empty, @empty}, &(0x7f0000000080)=0xc) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) syz_open_dev$video4linux(&(0x7f0000000000)='/dev/v4l-subdev#\x00', 0x7, 0x2000) [ 1042.764298] binder: 18144:18150 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1042.776018] binder: 18143:18149 ioctl c0306201 200003c0 returned -22 [ 1042.827393] binder: 18143:18149 tried to acquire reference to desc 0, got 1 instead [ 1042.853300] binder: 18143:18154 unknown command 536872576 15:00:26 executing program 0: r0 = syz_open_dev$usb(&(0x7f0000000080)='/dev/bus/usb/00#/00#\x00', 0xffffffff, 0x4400) getdents(r0, &(0x7f00000000c0)=""/172, 0xac) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$VIDIOC_ENUMINPUT(r0, 0xc050561a, &(0x7f0000000180)={0x1, "2e05dcc739aa7b312047ea3387d50b5f93cd78dc9592e05d3ca618f331ffa37a", 0x3, 0xff, 0x3, 0x400000, 0x40833, 0x2}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) 15:00:26 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x34000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1042.888297] binder: 18143:18158 BC_CLEAR_DEATH_NOTIFICATION death notification not active 15:00:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1042.934074] binder: 18143:18154 ioctl c0306201 20008fd0 returned -22 [ 1042.968457] binder: undelivered death notification, 0000000000000000 15:00:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000100)=[@enter_looper], 0x0, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0f630c40"], 0x288, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:27 executing program 0: r0 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/context\x00', 0x2, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer\x00', 0x800, 0x0) ioctl$FICLONE(r0, 0x40049409, r1) r2 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r2, 0x40046208, 0x0) 15:00:27 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x400300, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1043.374419] binder: 18173:18180 ioctl c0306201 20000040 returned -14 [ 1043.404345] binder: 18173:18180 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1043.440228] binder: 18173:18180 tried to acquire reference to desc 0, got 1 instead [ 1043.453200] binder: 18173:18185 unknown command 536872576 [ 1043.464500] binder: 18173:18186 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1043.472020] binder: 18173:18185 ioctl c0306201 20008fd0 returned -22 [ 1043.480984] binder: 18182:18187 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:27 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000040)={0xffffffffffffffff}, 0x113}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r2, 0x81}}, 0x10) 15:00:27 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x1000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:27 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1043.520633] binder: 18173:18180 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1043.529508] binder: 18173:18186 ioctl c0306201 20000040 returned -14 [ 1043.586772] binder: undelivered death notification, 0000000000000000 15:00:27 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0x2c, 0x0, &(0x7f0000000100)="3de75dbfb66c134999a4f5e1631fbdac0327fb5a4dd426842b38471bc1fbf7c482c4256dec8ece0db6d718c7"}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:27 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x3) dup(0xffffffffffffffff) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x400000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:27 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x2000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1043.839390] binder: 18202:18205 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1043.867044] binder: 18202:18205 tried to acquire reference to desc 0, got 1 instead [ 1043.896501] binder: 18202:18207 unknown command 536871168 [ 1043.912493] binder: 18202:18213 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1043.926517] binder: 18202:18207 ioctl c0306201 20008fd0 returned -22 [ 1043.936228] binder: 18202:18205 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1043.951819] binder: undelivered death notification, 0000000000000000 15:00:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:28 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$binfmt_script(r0, &(0x7f0000000040)={'#! ', './file0', [{0x20, '*trusted['}, {}, {0x20, '#-vboxnet1'}, {}, {0x20, '/dev/binder#\x00'}], 0xa, "76cd64cbd654afdfcc4cc1671a9cfd0cd7c10755f54b3acfe707288cea5dc212fbcb7b00e9096ff3827631d4ed5950cf890102a110b22a035b6d0381fb7a3a23568cbea9ff47b7d73952eb7a33c71e9c960c0f65cf408aaba37c98bf8d8bfc6e1282335419d499fe0473324d31c60c74492e08c0"}, 0xa4) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:28 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:28 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x3000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) connect$pppoe(r1, &(0x7f0000000180)={0x18, 0x0, {0x3, @remote, 'vlan0\x00'}}, 0x1e) close(r0) r2 = dup3(r0, r1, 0x80000) ioctl$sock_inet_SIOCDELRT(r2, 0x890c, &(0x7f0000000200)={0x0, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x100000001, 0x0}}, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e21, @empty}, 0x200, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000140)='vxcan1\x00', 0xcc, 0x3, 0x3}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) write$P9_RMKDIR(r2, &(0x7f00000002c0)={0x14, 0x49, 0x1, {0x80, 0x1, 0x7}}, 0x14) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000280)) r3 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) openat$cgroup_ro(r3, &(0x7f0000000100)='rdma.current\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:28 executing program 5: ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1044.330009] binder: 18223:18228 ioctl 40047459 20000280 returned -22 [ 1044.368255] binder: 18223:18228 tried to acquire reference to desc 0, got 1 instead 15:00:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$P9_RREADDIR(r1, &(0x7f0000000080)={0x49, 0x29, 0x2, {0x6, [{{0x24, 0x2}, 0xc689, 0x1f, 0x7, './file0'}, {{0x0, 0x2, 0x8}, 0x7, 0xfffffffffffffe00, 0x7, './file0'}]}}, 0x49) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1044.401554] binder: 18223:18232 ioctl 40047459 20000280 returned -22 [ 1044.409988] binder: 18225:18235 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1044.412616] binder: undelivered death notification, 0000000000000000 [ 1044.454012] binder: undelivered death notification, 0000000000000000 15:00:28 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x4000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = dup(r1) socketpair$tipc(0x1e, 0x7, 0x0, 0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) write$smack_current(r2, &(0x7f00000000c0)=':\x88:}\x00', 0x5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x8e, 0x0, &(0x7f0000000440)=ANY=[@ANYPTR, @ANYRES64, @ANYRES32=r2, @ANYRESOCT=r0, @ANYBLOB="e9d936ada07604951d05a275be17ffade4293776d6bd27aee0caf08f4fc5e6ee74f4665a1a1b718e1e7eaad26a733d9dc3cb7031e1e799c99700d777e8bb09ed53800f9c777e7a065d6cf4c5fdc537", @ANYPTR64=&(0x7f0000000180)=ANY=[], @ANYRES32=r2, @ANYRES64=r2], 0x0, 0xfdfdffff, 0x0}) 15:00:28 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000080)={&(0x7f0000000040)='./file0\x00', 0x0, 0x10}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$KDMKTONE(r1, 0x4b30, 0x100000000) 15:00:28 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1044.653487] binder: 18244:18246 tried to acquire reference to desc 0, got 1 instead [ 1044.665461] binder: 18244:18249 unknown command 536872576 [ 1044.693400] binder: 18244:18249 ioctl c0306201 20008fd0 returned -22 15:00:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:29 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x56030000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:29 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x5000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:29 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:29 executing program 2: r0 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x0, 0x2) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000140)={{0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x26}}, {0x7, @local}, 0x4, {0x2, 0x4e23, @broadcast}, 'yam0\x00'}) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:29 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:29 executing program 0: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) accept$packet(r0, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0x40046208, 0x0) 15:00:29 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1045.305745] binder: 18268:18273 unknown command 536872576 [ 1045.337859] binder: 18268:18273 ioctl c0306201 20008fd0 returned -22 [ 1045.338806] binder: 18268:18279 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1045.383897] binder: undelivered death notification, 0000000000000000 15:00:29 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x6000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:29 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:29 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b6b6b00], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:29 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x2000, 0x0) ioctl$KVM_SET_TSS_ADDR(r2, 0xae47, 0xd000) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='(c\x00\x00'], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x10002, 0x10) ioctl$KVM_SET_DEBUGREGS(r3, 0x4080aea2, &(0x7f0000000140)={[0xf000, 0x4000, 0x0, 0x3000], 0x5bb4, 0x4}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000240)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1045.635871] binder: 18291:18295 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1045.646283] binder_thread_write: 9 callbacks suppressed [ 1045.646295] binder: 18291:18295 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1045.677683] binder: 18292:18297 unknown command 25384 [ 1045.684391] binder: 18292:18297 ioctl c0306201 2000dfd0 returned -22 [ 1045.695690] binder: 18292:18297 tried to acquire reference to desc 0, got 1 instead [ 1045.706191] binder: 18292:18298 unknown command 25384 [ 1045.712994] binder: 18292:18297 unknown command 536872576 [ 1045.719837] binder: 18292:18298 ioctl c0306201 2000dfd0 returned -22 [ 1045.726581] binder: 18292:18297 ioctl c0306201 20008fd0 returned -22 [ 1045.759778] binder: undelivered death notification, 0000000000000000 15:00:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r1 = dup(0xffffffffffffffff) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$KVM_SET_TSC_KHZ(r1, 0xaea2, 0x18) 15:00:30 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x7000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x4000, 0x0) ioctl$VIDIOC_DV_TIMINGS_CAP(r1, 0xc0905664, &(0x7f0000000200)={0x0, 0x0, [], @bt={0x8, 0x9, 0x1ff, 0x0, 0xa19, 0xa60, 0x10, 0x1}}) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/commit_pending_bools\x00', 0x1, 0x0) r4 = getpgid(0xffffffffffffffff) ptrace$cont(0x18, r4, 0x4, 0x8) syz_mount_image$nfs(&(0x7f0000000380)='nfs\x00', &(0x7f0000000480)='./file0\x00', 0x5, 0x8, &(0x7f0000001a40)=[{&(0x7f00000004c0)="e164dc2f16fe5b606b46d93246476c8ce9fe115d58550d73b2e7d4e5629d1c1dd304767899c4763738cd3a0072e70f155981b40e833c3a6f006d86c42e5d7e75b4d22827678a725dbcc634d8ca8543a135a39da46fc8421288c6f1359b3116289646255c945ce0b27d8ad94d2a5198d8d4acb6d6c3a394b3cf8f5e2f715f31326e663c9e0a58c6622d8a8d80e1e9026a7bc035bff3d2a93a49ca0c39eb6b8376608f6e3b211b8d7379861749", 0xac, 0x10001}, {&(0x7f0000000580)="bfbd05b20b75cc74c470d13d99a4846ec71138356e576b76e0cea5671e75dd00c9c68fd99a38843d9a89f97974135fb761ef8662c2916ddf18f92ac9e28451c36309d0375d5a03ec5274ff51d0b86cdcf7afe63f9d9df3c1d85c4f91fee70b76fa91", 0x62}, {&(0x7f0000000600)="933cb98960a6234edfb78f224c786980b8ba950f7d229284748ed4724857155717bb908285c9841193cc8634c7f77de005cab2d9a742974cdce782bbf9758f7ce5e2666f88f0e0147459213f236a2d9b76467c875ccccd2058495530ef19dfc2596ecdedf6c9dcda5d543c693b627a2fdd3524131b3de9d25922b14c602e5b4ce687", 0x82, 0x3}, {&(0x7f00000006c0)="829c2bab620b36bf33c0500aa84698a2ac164f2436dbfbb8871f3d3c76ff9f8bb747dcda5e3f8f332a2ab26c867413cdece5eb60b11d1a75a06632aaec6b1fa1027e94dbd19d40bd7ba3e826fd0b4341ac07acabdab0754ebc565335a8984a9b0ee897de5975f958221fa651e5b4b210d1dad9d20aae537815483a2cadbb9b44230682fac0df3c0f1c8adaa16fa8361f8f198272a3991a13e6cfeda40012429c767dedbd492380b51091f011f4a7267deee5fd93f7f0e28de62f8f09be41f2ac482d5bee40bcfc08cfe078cde046ed882740f525850749b94a4bf200f69044", 0xdf, 0x2a7}, {&(0x7f00000007c0)="ef82fb7a06174a5ec2c32d6ac0f8a592074d3a83c75c2f16e8e6242ab49eed1c2af3d084364b7d68498d604794225f5579e6ac9f05274b2036ef9d4e8773d48d33d614001994535b47a50b4bbe70c1a290675077df3b76fa77726c429b1f85f0609cf19dbf155aebcd8bcec63d21b71d0b1223471999b6bb321ff56c9bdbc78e6cd75e986856504d195d64521ee5cb95bcc42abfacc6ea4540314449ea7df9df33bd172c77822a1ebd3f07385b683588919d", 0xb2, 0xcc94}, {&(0x7f0000000880)="9345ddc9543e67631b12d3d4d7f0a99b987f06e0495ceeeb570dbc8b82f055cf4c321fe4169b80b9d212a9467bae17c35038c258401ef02f26a517498d6e8e06bf044e59c815927b05d22b035ee746b917aa6935754b7f8c99e3d19289bbaa4bc6c3586caf8fd2cfa443b2d2e25bb3a79a81548cb2e4b099aaa59ea76cf88de30b69dcddd6b27ac05d70a05026097c11e1e1a17a2a9ff1db77e98fc58208867b9ca5e6b5aca53a49395d2846d8a1c78e82a7db1c750afa099f97f7", 0xbb, 0x8}, {&(0x7f0000000940)="776d16ba69e0bc45cc0b5655d0685363e7cca94d5e38f30e972af4bca3e1510ff547294b9fd37ab3cf31a0e36163601e5f12ddaa834c1885a8b39811a57818e4d970b79b459c1244c52efd85a0c70a509c30fefcd6b2ff29fa6bb23166a2f3ba9fad312f11a0fb28e7955e8c9fa948627a5911c4561bfef5192b413c8d53d26cc29dfab0c7274eb5bf99bb3108a819a6d33cfec828d4177c4f19c0a80bc76e273b594769f3a60987c8ce2681ac8dd8acf2e8756ed1c57ced710ec02318afb06962cc59932b9e21d1e594ccf2ffd79c55b4ceddcd43be18ef87308188096bea93d12376a4a50825d5ac53f2ecc97e202ead33f02f6d96794f460e6a0355667c9fd2cfecfa40468607e18476c181fd5c52ce5e1ab6bf902bdc7bbca8a5dd443de197bde0aa67f38b4f553d353f7a14a3f4a05d98a02adb49742a429de27f81e8507efc037b6999a7045233825e4fc63035f0eb94ffb4de52ce76e5236a217b8e99bc738f97642d034d4358cf044f4b6d897763d7f1dbd78b416819d9a7771da2279537713e3bd8461db359337997f6895afd60d753815ee5d0076a890dec9bedf66f287a662c44e7eb50270a6a43a347750884b636544ab3c6134bbf7c51f8bff7910883f527a3d82534ecbcd8e668e873c2a3eb4ac35144391b73025af8bfdcebaf7de47048499044f3e518c842211553c9466ff5313fecf668360e9d388f42799a5cc3c3ff12da2c22296a1eaaefe8d02b85b39d94ebeb25af4d7d04a48c66382fa51194761d01cc2da1c525b7be25de5cc15dd185dedc1b14d845bcbb17b98aaa4d02d2ea633971ba03e465710129c36cf406fe8408309e1acc215c5b4b1ba8a206a6fedf70241fd9cd3bf4d375df766566c0edcf583b9b77381573e6a15b63d0a0ae77c4568a5b7208fd3b0bd73b023973e2f58b545defd04b6ad8f2afdb63cbb4fb1def94a3abff05f02ad4f7ec8a276e2451182b6de2560258700c375ee6233ab3c8d74f729b5b72d75e25995b3951a2ccd9112598f15175284a2bb9d5ab10bc54b271110703d3d7a40a031265b027ad450c455fc5df5eb48e238fb14951ad10af629c3ac7b4c58eb7ba2b103b346110ca94887cff4b3ae24d82ce5b594b9d8519df3cb6bdd1ba7c3f7cdc41e21b070d7354528e0d88fdaf2acf90a152f602d26602d9abb4896e07c50e3adb4566bd9a7c6f6864b37f7f250639cceea1fc9259ef47440b101223918da35ab89dea06bdbd658f0b4d9fdb8172183810567633451028e05aa890d8ad7790878a95fcc06940d9520dcab59e0feb7cbdf428bafe3def4b8e3258b02253aab99f22e4cb4e60b3b0fc41621990226f11a66391a8fdb605897e1c79b13a2607a7bc7ac1d549fa2c8fa06291dbb535194f7bc7c1f071c3e107b257434c4a85eec040b514d20be70fd51157e20f6e5de491a6f108d5d8a21372502c4a1507681ed2c7d62752d6644704ad4f00da00840a09b3ea08cc3de406f23761a23438f7bb33ebb6cf1bef88d0dc3180efd944bdd6383cb82c9198eb7dbb9ee3d2006e16776df0a6f41b3d71c89842c5a11cbf7da5fd9d7d55e0c3815e7b814390d5a9e944b129b4bfcc8146f683332f31bf5fa0953130c0f0cd901751338390d87a41a1a629d65defb33890179606bd75bd681e6932a741143f49c23b2b3c8b7f85b882755c7ee6b795ae053b7354bfd1727c44b00505bbca87d2f45e932120613ce6cb17438685d9f60fbea4d5e1b9b7f1e94f99ed4818dd9175f872f0e52bbd03e3b2712527b6c9fb6353b86c5c10471497b55ee16f1b18df860705ff6ab402e1145e87b989927b3044fcf32c9ebe0ea1175fd92b0925bd4a8c892c1e531feb5c4dd8e32fa20e24596f09be1818d052f4a96141e7edc061dfd7433b41ed3984c2b0e9c7da4aa268543edef8c21b63c330b4fc3a061e3af8a12cedd464d2097a67aa7737d00dd9b1b6f18d15e7f8818fcbb8f66c120d82005c529a263239f000eb3b9f1d717312dcf8da046ca4c29018d6296c7037ca2854f1859f93f141bb46e4c42e2ca40eeca7d2dac531a48fef0bfeabbfbc414a1fe24aee9d4c7f7f65d1f4030ae70abda3a6d1448f5aed9e6ec03dbd59e34f53ddfc0c3c1fe6852f894a909e61df2178de149efbb6d1c4feb0e15b13cf2f2e195070c838529f479fb4c16967416efd0354e7673f3ab70141cccd920484702d1c1a3b79e749857248177049c81f0796a5cafa0745b919cd81e4fba19266275ef764fe951c511171705b1c9d799821829c01936dc7e7194c99d048f21f957a6ecb537740f6525048ef6678ca99d3ce01dd468cce0673f181b4d3e47aebb580ebba16a6ef9bf87f4d489ab5c7c2732a58c9dc9eefe5227657b328ca44a812d8592aa0a474e358bf0a87959187eca1d961debf4491634d37d5b7e2d706616a2bca2163cd6b533941b3e71fc5b4e8ef70e5f509ec6491e5207fafb1253195993c18cbae7037e996c3de7e76e901de6482baad4390359d53b5ed42a547b3ae089487628c1e5e6037e10e507d3599de882bad15d1e51fcd74c6f40670273eae174773b9cedbb95c9ecdd821a209b45e1bc7f7b3f5104a378b1e672c00085a99620d50af835c6fffb7a9fff93ee8de54038b4f15c05f62e9d5be6e82b76fb452d779919eb5e01a74cce683019bb25c51a64e03014783bb3dea7eee07fe08902a73fed8269a901957329245a19f303153cee523f9de6f16f95910971e9b8e5e29045a17192bbb75322064649037eb7a2d70ed23fc92f4e352dc1bdb6e4ac6458326a7f79cd661707f37b10adf314a827d993a39a3d31abef86820393476eb7dab55027d68f5663effb8185a70af9d61d1b20baf2aa7a64b3b553b856e974d136d4f9c4de3013416d53145f6a889890be1dbaca2740a5ef92492db70fe5b7ce0599ac976ccf81cd4bd19f4465ad8652b4896210517609f2049b68c6b47e2dfc60e416b1bd5af024d6a1e104ef17791a7bb7983852fc4215826d17ca8afda9afbad8332a59f868898b5881c5d224321d6f6c1d57de5851c20542cce2750cf2eb7e1c2d46b1d3cc06a05c25cc7067747d0af3109a4a321a1d6d27100132a9c41c3987a2ddc87f8748c670bca80f33b3808f74b87f718ac99825d4b6dfd35d92a0b10a8dfb87674d3eb35a3250a42e6145f195228853e28a567e470b965dec3ac3537fe84f54f4ac2b5b678b668d4e93eadf1d5adcc5906e54b61760fcb823af44574a90c354fcf1b8aa3fb60c21aff1e39b447b17b0d279398630c07fcd98090eb760da6ce064175b2326645c390c31064d0c980bf80b85cadbadd99a3f77f09fac484aeecb3879788b70c940ae230e3be2b91fc185e66e4a0a1200b53f4382a40af4f00e6124d22828f07dfcc26e4747984d931477685a5550d7b7d23ce4a81cfee3d358f4cc13f78be2105f0ca59838cd3a9b987602e87f7f6242989c70ed1e132bc82b8270091a18d7c70f952127b95c724ca439ce75b5d6226794c3762ef8bdf71dd25acf9c60e4f44cf6e99e8367bb25eace000fa3010d5b3912c094a773fd2172a4f20ce42fc9a76b55a050ff500041c227ed4bf60bb0ec710d404624868b24cedc6f7157c176cc5dba0036eb522b661cc09c844b26e66bfd6ce0de045a2605c3f4d516e9812cf1517e62e23020e84b1474aa220006e1b52a07a3a7b41bbb9d247e9b5e6f75c65d2370a5394e1dbadcf33d9945ad3d2def29103a22f44510ec8dedf19937cb9d1e617b4dd7e440c1b5cf274f1704746146a78dd27a2c5cd134e50fd3f9259626f01c1d7fb3475ca6510434cefece1882f4a8d4cd2aa2091ce3ec48f36637cf11607731a0058b68d5ab542b17c4958b772092520d3ed0e2919f9c969c9257f10e67e849c905839e64db5eec2abc8191a3a1d6c203dc79f173d86c9ca1cc06535d3327a97a4501a2770dcbccd70c2a5146e9a8adff746d28d7b31f8aa76494cc8c6d94703103c6a3fb4394306739098da63dac311792e79c5ca951a437d9b2fe7118bca18b522405ef489e17d76f6d67c82897bf6aadb593a0c08a6969464d6b7e6d1bb746379293291679ea1f09a3258d3759eba4547da5584b90583a8b0e476cd3fb4ab02c069f898c043ec07ad2be0c6d9e2f1346d69ba1ac22bf8b6672379ad5a2e09a138079597930ed0b69c40144009a5b957052e394f13fdf6d386759894c355707db5694c22ca5623f51b041d11225b67522b9865dc5a9c54fe9fcbe7bf52d54b04486692024a413fef6f7b8c8b64a252e61227272382443b83ea41d83c400d3679c15472c0f70d2af8a3b85b5afcbc42a676314ce3f295e4cd02633291df94dcf172dc99b145749591d1a7aeee40267e66ffc84ab0915ff0ff399fe71e32485df9b0a92b2476751a3dadac059ba3b8d3622c6113761ed8024cb8f370f338e48005a0db5d572f877b56f520e47ef7a6bfd6abe2db7f7f2e96b66cb29f1eae16a228fa6990b651c3cec75a1e4b36a30dc18c4863ca55d70d955b9fbffbf5debf1115377bee6b610ccd19b6d53ecc4dd46884e2f4c167de7dc3b6adf9a6e67813f84d38e0db0982ec9151a659548a26c7f8a0c207771401aa70b771d5d60429d638e59637b4c2cecf8dc545e6e052372ffdeeca157ae1524780d149d2eb8e4d3b9d865bdc8c3767ce342765727023c98ddfe19a5322b18586448e7595ce63cd17bc9a5c038b0226a3122d25b9d63cb6ff68ca009bf5937aaf3ebb11e18d2d72dcb7d69fe615009f540ab91954da058b52862599c7e7b2ee4092dba3e37f37163b5c237d54d1ef32ec49c4f1cd620b7e17dbc7d82d568f4fdafdc4a2bde7bec5fbb6fc41ea9615c385a1274e471579e1bf90d0a1c03426d194406af64230d600bcc3e3cca757533754848c311c428470d46aec6e7188f712f7a132ef6ebc1087c137e2ae158628067f6d5ee906cc1b85335940288d65950f069441351d26933fd1cab909bba03857eeb11de3519cafe71a0ba64f515276edc785f4e8bf933a8041d136f55fac0def22fd1d115d13f4330793a3b5952ca0355ea2ba9dfd073479390b954ae676ed07a97c609393a7f0be356ae833c2e0e69e7aa2b1f90d7828120104b030939e3fd4ba9ead369e6df2cfc5c2c9fec70a9744dad7f4faf1901a13c2cc48790c88dfbf19393693ff3e7cf458e2d255c938c48417b94b27235e419f5a094da471df9b04e56bcf6b51ab27e54461b6c58c9a2874b384dac6366548c23fb9407acde5ab9cebd2ee16fbddd48ed31fef44df1d762c39a13c7fa2107a69f1d90ac7ccc9b87e8e4e9652d4ecb3b64798e3c48a9405569c35d91188247a32275b53aab944b658ddcdef608054caa0005e121cd4107745ec4951ddde477a6ff82f43223dbdb383bae13bca268be00ee9c6b32ab7c78a8bb3d9ab16b7438b082c55cb83919eaf8dc6af4913f1882dfb71d9cd9dc2fa78987860ed366997d0c7f61b0120e784afb52c3fe897d95fb05810f0cec5aa74f187558be780222cbb2e6d4b1ea68bff716679023d676b145aa7f3a3669b9cbd0d6604a8aecb62620c93b0f33ed6e1cc5e689744df05fe60144008250ae999045a4a42a17db1f97e1e039c1b009cda8c3a7c7e6c9d2ea03cf09b49645208617fd4eb2ec775d19533f410ebf79c4316cf506276fd9209e2ad8e9244b9b1381d5c19927c53f0543a93b2ae6d44dacd5ba0578af7c384212601063ac3f7fd14dedf154a9947c4319157548663e42bb9732847ccc9787b6d2063b74ed9e59eb5ab34cfaa25ecd0a98636", 0x1000, 0x402}, {&(0x7f0000001940)="0af811c2b1e2d3c8be616c7d59e827adb52107e5673a84c7ffc52ae3883dfa52664a96433fd2187fead39d6a52725e71763a2027a72a13e0f12946e52e71b8631485729d44931660c2c11001b3d22c34cf08349f3a6f9f8e94b289ee4d1189c5b6e2653b4273532041fe982701b6c86ad80a483ded7e26721644b8569d88d9d914e9f0d81b1eeb4ee3c6651ac7a672d1145473678fbfba4fb36791dd5f90413fed25655a751011274df2be4c667bdb54671cc125b668234de99c925d2318b860fefe4bbf41ff6178f710230966", 0xcd, 0x1}], 0xfffffffffffffffd, &(0x7f0000001b00)='/selinux/commit_pending_bools\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r3, 0x800442d3, &(0x7f0000000140)={0x101, 0x1, 0xe9da, @empty, 'veth1_to_hsr\x00'}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) close(r3) 15:00:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1046.216408] binder: 18304:18314 BC_REQUEST_DEATH_NOTIFICATION death notification already set [ 1046.231747] binder: 18310:18317 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) setsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000040), 0x4) signalfd(r0, &(0x7f0000000000)={0x7}, 0x8) 15:00:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:30 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x8000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1046.301030] binder: 18310:18321 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:30 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:30 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1046.506821] binder: 18324:18329 tried to acquire reference to desc 0, got 1 instead [ 1046.553245] binder: 18324:18331 unknown command 536872576 [ 1046.553601] binder: 18324:18336 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1046.587654] binder: 18324:18331 ioctl c0306201 20008fd0 returned -22 15:00:30 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:30 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x10000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1046.599351] binder_thread_write: 3 callbacks suppressed [ 1046.599385] binder: 18324:18329 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1046.626997] binder: 18337:18338 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1046.637170] binder: undelivered death notification, 0000000000000000 [ 1046.663436] binder: 18337:18338 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:31 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="5f6eb3bf4f00b6807a0563ff4000002000eae8454a78971ba40edf3cc0e4482a729e87a595f47a9c1489bb9b10230869051b51000000"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/dlm-control\x00', 0x101400, 0x0) accept$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000140)=0x1c) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r3 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f37db"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="50630840137d011179602ea0d071fa48da19bb2fe40ca5c718d94a1791dbd2a41996d431bdd71ca5d84131942e32d943ebacfbc723010000000ea67cf6287203a39f7baacddea165141210c0e4f2a2ff9377ac0129f8770a0da9460cd34ace75abc89359f3f4037542974008004cca7e0010dacb0b2e1162daf7eb9fb4402e2dc4f3494d000000000000000000000000"], 0x0, 0xfdfdffff, 0x0}) geteuid() ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r3, 0x40a85321, &(0x7f00000002c0)={{0xfffffffffffffffa, 0x6}, 'port1\x00', 0x90, 0x4, 0x8, 0x9ac, 0xfff, 0x1}) 15:00:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x7ff) r1 = dup(0xffffffffffffffff) close(r1) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4030000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:31 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x3f000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1047.150581] binder: 18352:18359 unknown command -1078759841 [ 1047.157302] binder: 18352:18359 ioctl c0306201 20012000 returned -22 [ 1047.182407] binder: 18352:18359 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1047.182416] binder: 18355:18360 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) getsockopt$IPT_SO_GET_REVISION_MATCH(r1, 0x0, 0x42, &(0x7f0000000040)={'ah\x00'}, &(0x7f0000000080)=0x1e) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f00000000c0)=[@in={0x2, 0x4e22, @multicast2}, @in6={0xa, 0x4e20, 0x6, @dev={0xfe, 0x80, [], 0x2a}, 0xff}, @in6={0xa, 0x4e23, 0x70a, @rand_addr="e4afa8016beaec210f855835c41534b9", 0x200}, @in6={0xa, 0x4e23, 0x200, @rand_addr="8aaabc9d1957c90ac70b3928a433a9ef", 0x8}, @in6={0xa, 0x4e22, 0x5, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0xfff}, @in6={0xa, 0x4e24, 0x0, @local, 0x2}, @in={0x2, 0x4e20, @remote}, @in={0x2, 0x4e20, @multicast2}, @in6={0xa, 0x4e24, 0x6, @local}], 0xd8) [ 1047.182569] binder: 18355:18360 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:31 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x40000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1047.247376] binder: 18352:18364 ioctl 40a85321 200002c0 returned -22 15:00:31 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6020000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) dup(0xffffffffffffffff) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:31 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:31 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:31 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x80ffffff, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1047.546984] binder: 18377:18379 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1047.571865] binder: 18377:18379 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1047.941176] binder: 18352:18364 unknown command -1078759841 [ 1047.946215] binder: 18352:18387 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1047.947246] binder: 18352:18364 ioctl c0306201 20012000 returned -22 15:00:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x40050, r0, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f0000000100)="f010af49862f52e7c445092249ce8f3dc9c257cdb6ac71a1e691252b02d7b22d460e4bfbb9ca2f41f8360ecb841d398bbaec6ac974873a53fa397109a119ecd9a007477d95ba44d24804746e62504e23352fa28dcd154cf6d886398937ecfe8b7b") close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf4030000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) write$capi20_data(r1, &(0x7f0000000140)={{0x10, 0x2a5, 0x4, 0x80, 0x227, 0x6e}, 0xce, "3d12427c603b2916694da1c7b3a9ebd327b96fc717045f55843f0ee5850fc75609551e900a444f8aa05826cef234c8472b2ff6061378c697a1df29d46ebc27dbf19c4ecb0be8814739dabc61f4ce3900c62962bf87c7735dbf10a180be2741d8fae0532bb1dd6ecfd444a7ddbac91769c4abec6ef0edd485170f87c15aeafbcd0f08aab5f7cdb2e8e2c9d68704ff980c607051d92d160f891d65be87549bd34268ee7e641a0d3daa4e001e0a656739df3c8158b54ffe2428c49eec9ffbcf64d476884098d66480e4feb0bdf28726"}, 0xe0) r2 = getpid() readv(r0, &(0x7f0000000100)=[{&(0x7f00000000c0)=""/50, 0x32}], 0x1) prlimit64(r2, 0xf, &(0x7f0000000040)={0x8001000000, 0x6}, &(0x7f0000000080)) ioctl$PPPOEIOCDFWD(r1, 0xb101, 0x0) 15:00:32 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0xffffff7f, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1048.024686] binder: 18352:18364 ioctl 40a85321 200002c0 returned -22 [ 1048.028116] binder: 18390:18391 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1048.041563] binder: 18390:18391 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1048.097981] binder: 18390:18395 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1048.125033] binder: 18390:18395 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000040)=0x400) [ 1048.202839] binder: 18400:18404 ioctl 4b41 20000100 returned -22 [ 1048.237409] binder: 18400:18405 tried to acquire reference to desc 0, got 1 instead 15:00:32 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0xffffff80, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:32 executing program 0: syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = dup(0xffffffffffffffff) getpeername$inet6(r0, &(0x7f0000000040), &(0x7f0000000080)=0x1c) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) [ 1048.283985] binder: 18400:18404 ioctl 4b41 20000100 returned -22 [ 1048.316680] binder: 18400:18405 unknown command 536872576 15:00:32 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1048.374992] binder: undelivered death notification, 0000000000000000 [ 1048.384406] binder: 18400:18405 ioctl c0306201 20008fd0 returned -22 15:00:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vsock\x00', 0x80000, 0x0) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(r2, 0x81785501, &(0x7f0000000400)=""/4096) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00688b4737fc01e078f2c31fcbd2d90000"], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) fcntl$getflags(r0, 0x3) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x1, 0x0) ioctl$TIOCMBIS(r3, 0x5416, &(0x7f0000000180)=0x8) r4 = dup(r1) poll(&(0x7f0000000100)=[{r0, 0x40}, {r0, 0x49}, {r0, 0x4000}, {r0, 0xc0}, {r1, 0x80}, {r0, 0x2000}, {r4, 0x582}], 0x7, 0x3f) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) write$capi20_data(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="100016008f830900ff03000000000000ed006fffda28b83fb91594d3310ba9c98ed4d4ec6c1b328dffdd093b9d910cadbf6ba94cd804a839bc44a25c0b3d1fb4f49d2f72a1119cd0a4ebb34b7144dffc3873f4c9a4cd2f34f22fbeaa44c97862c86b5c1ae22ced42a12ce036962a8e062c4e21d792fb838f2e76fe2ffa67bd992dd90f73124bb29e08184b5474a5ece4e06ad650b185d747dd5ced038b05b54456dec05680282bf830a4bdf39c888083390817a68617fdbb91f0e1d3dfccdaf1618616fc845655825561ef2bd0a6592e28ab030216e08c1ee94012451be1dbac219ee3641202f4a38a3a84536d6d0283a982faf3a3857a5173a0e9823992a2"], 0xff) [ 1048.631955] Unknown ioctl -2122820351 [ 1048.637695] binder: 18425:18426 unknown command 1200318464 [ 1048.672996] binder: 18425:18426 ioctl c0306201 2000dfd0 returned -22 [ 1048.713679] Unknown ioctl -2122820351 [ 1048.718492] binder: 18425:18426 tried to acquire reference to desc 0, got 1 instead [ 1048.734858] binder: 18425:18430 unknown command 536872576 [ 1048.735264] binder: 18425:18431 unknown command 1200318464 [ 1048.748536] binder: 18425:18431 ioctl c0306201 2000dfd0 returned -22 [ 1048.764092] binder: 18425:18430 ioctl c0306201 20008fd0 returned -22 15:00:32 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:32 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0xed9d4906dc, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:32 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x800, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000140)='bic\x00', 0x4) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) r3 = geteuid() fstat(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fchownat(r1, &(0x7f0000000180)='./file0\x00', r3, r4, 0x1000) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:32 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6b6b6b00000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000040)={'veth1_to_bridge\x00', 0x800}) dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) pread64(r0, &(0x7f0000000080)=""/136, 0x88, 0x0) [ 1049.021034] binder: 18440:18448 Acquire 1 refcount change on invalid ref 0 ret -22 15:00:33 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000000180), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) ioctl$VIDIOC_S_CROP(r2, 0x4014563c, &(0x7f0000000100)={0xb, {0x1f, 0x2d6b, 0x90e, 0x19a}}) 15:00:33 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x40030000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1049.110257] binder: 18440:18451 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1049.168829] protocol 88fb is buggy, dev hsr_slave_0 [ 1049.174955] protocol 88fb is buggy, dev hsr_slave_1 [ 1049.223749] binder: 18453:18458 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1049.241197] binder: 18453:18458 ioctl 4014563c 20000100 returned -22 15:00:33 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x802) r1 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x1, 0x2) write$P9_RREADLINK(r1, &(0x7f0000000080)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:33 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x100000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585604, &(0x7f0000000100)={0x1, 0x0, {0x4, 0x5, 0x701f, 0x7, 0x0, 0x7, 0x2, 0x7}}) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000040)={{0xfffd, 0x80000001}, 'port1\x00', 0x10, 0x100000, 0xffffffffffffffff, 0x1, 0x100, 0x2, 0x4, 0x0, 0x1, 0x2}) 15:00:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(r0) ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f0000000440)=""/154) ioctl$KVM_GET_LAPIC(r1, 0x8400ae8e, &(0x7f0000000040)={"d60dfe4640a3ef12770dc07856bcf09251574ffbed88dfa32427d1065a96dda2027b378204b2299e187ced50bb3850bd99bab1233e0dbadf0068f3e22eca3bf074b568c6fd8ce1c19d12275671918854bc2021d584014041c9c995fe8846ac9ce29f70e8b407f77a2f1a286f45cb954d21de1b102ef8912b75dc4a7d156c7564bb783d16f5726c789dff2fc223efcc3360eff4b1ec2f7b3fa9cfbf4f338e750d1905c95f7498316229dc72c8f1b63936530975def6c8223388c3a3be84fe4c47ffb4296c5536355d908a9c79b8c79921ff8d9c6a6159acd8745a7fa227eb763937eae1b7927ec02c09fa464de565bb9122a0ff98ab39b94d0fa4d1ef7cdc7bbcf77a7dfa01f2f00484f1a3e88838f02827d107526bbffe9b4c376ef78f5600fcca5a6a485964ffad2a43e5196d8fb31fe1f8a1817e74aa87f993df63f4f0b9c73e720864b8c34b032d501c7cfc31cd5c829fc37fb632f9b2e4845c3747983994ccb36670f8e2820b07920477e78d19b5325307516d676d28f63bf563878f70865978edf4d7df3a4fda8e91b3f09a8510ea5a8887568b304808c9e3b91e288a15c23af065c4b7fa15db40996ccef562a06bb707324ed67bf615f335597dd401c8a0de602692c550fbf20023ccde0af96e03ec7ea3a8291741f0ca2d080ce310e2909a7c0f54b021a8b9f7b31db5aeee7f984009f69293b871cf2b92cd5e71b5c2f12109a9d19eae38d6ec4d231a25f8cbd361db10a524fe273490a6e7d8283d8a210cb80f8ba44ad5e15bbb5614277752ee66f7042a0ff2003a49017414bd5b5b2cdb4dde942e123a4c3345f6432112a93e9b751058075f1d20acaa79cfa409a36a80e60323a64471bfa4fcb2f4382a8aec1cae54f8d785a633d9995f0ec4301b3069d50b03960685a5e38bb09cd74c09400a9c2b0292bf3bb7ce70c07d2c8bf9c652208513374ccd5a3020554aa77d4635e40f746604f9c3df703f21b37a914440dba0bb3a4550ab103d627b24132123a6bbee8f1f24f0c5d73d7d3939536fb5e64103741514a1b4411f8c50f8d81770d1844b683fd0f0ca777946e6ac2abc0785629f7d8fc3f5e14e41f3848398a709cb66ffff72f4d237fc7aaad221666cf77ffccd3047da818fb1d1095faf724a3d17bd771968377dbf2f61fde2418b60af3ccf1d8a82eb3cfbfb8096e7dacf4f7efc2c73f9174e7b21de1e23c1d2bedd0924bb957603490be30ec49432b2bfcd317571d351c3214290a82e9c8c09f434f4e5566407b8f784b0ea18f206efc2e41114d1ea5480ae1eff1985477fa0559f8b7c496f55ee4d96ec8bd44b6cf14a880d9989d1d7b70dea3052b76767ed833c49f99c550856e9100155e4e827afcc30c498472d0d23a76e46e606a1e90a949a7a9c93b0c66e5a73cb5369f06ed3be64590f6fc859ff455caa7e24d8ab7982edda"}) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 15:00:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:33 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:33 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x200000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:33 executing program 0: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup(0xffffffffffffffff) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000080)={0x0, 0x1, 0x200, 0x52}) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, &(0x7f00000000c0), &(0x7f0000000100)=0xc) r2 = syz_open_dev$swradio(&(0x7f0000000040)='/dev/swradio#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r2, 0x40046208, 0x0) [ 1049.977882] binder: 18489:18491 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1050.024656] binder: 18453:18492 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1050.037498] binder: 18453:18493 ioctl 4014563c 20000100 returned -22 [ 1050.061180] binder: 18489:18494 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:34 executing program 0: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) ioctl$UI_SET_SNDBIT(r0, 0x4004556a, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x12) write$uinput_user_dev(r0, &(0x7f0000000880)={'syz0\x00'}, 0x45c) ioctl$UI_DEV_SETUP(r0, 0x5501, 0x0) write$input_event(r0, &(0x7f0000000180)={{0x77359400}, 0x12, 0x0, 0x852}, 0x18) [ 1050.185245] binder: 18498:18499 unknown command 0 [ 1050.192066] binder: 18498:18499 ioctl c0306201 2000dfd0 returned -22 15:00:34 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1001000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:34 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x300000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:34 executing program 0: socket$inet6(0xa, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000001c0)='IPVS\x00') sendmsg$IPVS_CMD_DEL_DAEMON(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000300), &(0x7f0000000340)=0x4) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000140)=0x148, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @initdev, 0x2}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(0xffffffffffffffff, &(0x7f00000092c0), 0x800010b, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000040)='/dev/uhid\x00', 0x2, 0x0) write(0xffffffffffffffff, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x80, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000900)={{{@in=@multicast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000500)=0xe8) mount$bpf(0x0, &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='bpf\x00', 0x1000000, &(0x7f0000000a00)={[{@mode={'mode', 0x3d, 0x8}}, {@mode={'mode', 0x3d, 0xccac}}], [{@rootcontext={'rootcontext', 0x3d, 'staff_u'}}, {@appraise_type='appraise_type=imasig'}, {@euid_eq={'euid', 0x3d, r1}}, {@fsname={'fsname'}}, {@subj_role={'subj_role', 0x3d, 'vfat\x00'}}]}) ioctl$sock_bt_hidp_HIDPGETCONNINFO(0xffffffffffffffff, 0x800448d3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x20400040c2, 0x0) r3 = open$dir(&(0x7f0000000380)='./file0\x00', 0x6c400, 0x0) write(r2, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r2, r3, 0x0, 0x10000) connect$inet(0xffffffffffffffff, 0x0, 0x0) add_key$keyring(&(0x7f0000000440)='keyring\x00', &(0x7f0000000480)={'syz'}, 0x0, 0x0, 0x0) [ 1050.229307] binder: 18498:18499 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1050.269231] binder: 18498:18499 tried to acquire reference to desc 0, got 1 instead [ 1050.310183] binder: 18498:18502 unknown command 536872576 [ 1050.310605] binder: 18498:18509 unknown command 0 [ 1050.342337] binder: 18498:18509 ioctl c0306201 2000dfd0 returned -22 [ 1050.355787] binder: 18498:18502 ioctl c0306201 20008fd0 returned -22 [ 1050.373989] binder: undelivered death notification, 0000000000000000 15:00:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x40000, 0x42) getsockopt$inet_sctp_SCTP_DISABLE_FRAGMENTS(r2, 0x84, 0x8, &(0x7f0000000140), &(0x7f0000000180)=0x4) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1050.475535] audit: type=1800 audit(1550242834.528:177): pid=18514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=17346 res=0 [ 1050.526606] audit: type=1804 audit(1550242834.538:178): pid=18514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir933902076/syzkaller.TRnklj/934/file0" dev="sda1" ino=17346 res=1 [ 1050.558644] binder: 18520:18521 tried to acquire reference to desc 0, got 1 instead [ 1050.573600] binder: 18520:18522 unknown command 536872576 [ 1050.582827] binder: 18520:18522 ioctl c0306201 20008fd0 returned -22 [ 1050.583410] binder: 18520:18524 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1050.591499] audit: type=1800 audit(1550242834.538:179): pid=18514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=collect_data cause=failed(directio) comm="syz-executor.0" name="file0" dev="sda1" ino=17346 res=0 15:00:34 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x400000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1050.633009] binder: 18520:18522 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1050.673032] binder: undelivered death notification, 0000000000000000 15:00:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:34 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c00000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:34 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) r2 = request_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)='/dev/binder#\x00', 0xfffffffffffffffc) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000200)={r2, 0x9, 0x4}, &(0x7f0000000240)={'enc=', 'pkcs1', ' hash=', {'rmd128-generic\x00'}}, &(0x7f00000002c0)="a63c05c21d87319d1f5a8b84a798892e872807099c975611", &(0x7f0000000300)=""/58) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:35 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x500000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1050.959230] binder: 18532:18535 tried to acquire reference to desc 0, got 1 instead [ 1051.016990] binder: 18532:18535 unknown command 536872576 [ 1051.025707] binder: 18532:18535 ioctl c0306201 20008fd0 returned -22 [ 1051.051880] binder: 18537:18544 BC_CLEAR_DEATH_NOTIFICATION death notification not active 15:00:35 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=ANY=[@ANYBLOB="05630412fc4aed00"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) r2 = dup(r1) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000340)={0x0, 0x80}, &(0x7f0000000380)=0x8) setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f0000000400)={r3, 0x10001}, 0x8) r4 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x5, 0x3, &(0x7f0000001fd8)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x25}}, &(0x7f0000000000)='PL \x00L\xf7\xd1*\xf1\x1c\xe9%7\xb5\xe3\x19\x1ef\xde]N\xc1\x8eL-\xf0\x14\x84\xa8mw\x84/bIF\xea\xe3\x10yL\x8c\x96\xff\x14f#.%\x95\x119\xbd\xa5\xd2\x99\x0eR?\x8e\xc3\b\x0f\xfc\x12$\xd8\xdcL\x84\xa9\xc8\xe8\xab1Wh\x06qU#\xfat\x9e\x86\x15\xc6\x10I\xb8\xb1\xbej\xa7t\a\x02\xccZ\xdd', 0x5, 0x252, &(0x7f000000cf3d)=""/195}, 0x48) getsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f0000000440), &(0x7f0000000480)=0x4) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r5) r6 = gettid() getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f0000000200)={r3, 0xffffffffffffff75, "2dfafb712db4bb4601f72493c72f91cc4553ce40153245a3f04abdc2d129c4fb9dbc9977cd1ee89cf28f71842204ac69ed6327830dda6122c909cd08a1b65858316320e68a8cc3607dc7538326133e8aa831c9199c0b4c9e7789533baffd85a0ff908383e8d40c39d62a5cf87590b85bbedf4b748dec9e8b9826bfc23fdcdbac28b188c910"}, &(0x7f00000002c0)=0x53) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, &(0x7f0000000300)={r7, 0x10001}, 0x8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000003c0)={r6, r4, 0x0, 0x1000000, 0x0, 0xffffffffffffffff}, 0x30) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x18a, 0x0, &(0x7f00000001c0)=ANY=[], 0x34c, 0x0, 0x0}) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f0000000140)={0xbf0000, 0x9, 0x7, [], &(0x7f0000000040)={0x9a0910, 0x0, [], @ptr=0x8}}) ioctl$VIDIOC_QUERYCTRL(r2, 0xc0445624, &(0x7f00000004c0)={0xa6, 0x4, "90b8602f65e98f50d6a07e5f958a96329d2c5a9aa2a2108ea15fc18abbb7c205", 0x2, 0xb5, 0x3, 0x1e, 0x88}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1051.079747] binder: 18537:18544 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:35 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:35 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x600000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1051.307665] audit: type=1804 audit(1550242835.358:180): pid=18551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir933902076/syzkaller.TRnklj/934/file0" dev="sda1" ino=17346 res=1 [ 1051.356691] binder: 18549:18554 unknown command 302277381 [ 1051.371463] SELinux: security_context_str_to_sid(staff_u) failed for (dev bpf, type bpf) errno=-22 [ 1051.408205] binder: 18549:18554 ioctl c0306201 20012000 returned -22 [ 1051.418076] binder: 18556:18558 ioctl c0306201 0 returned -14 [ 1051.442677] binder_thread_write: 11 callbacks suppressed [ 1051.442704] binder: 18549:18559 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:35 executing program 0: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/arp\x00') sendfile(r0, r1, 0x0, 0xffffffff) [ 1051.469921] audit: type=1804 audit(1550242835.478:181): pid=18514 uid=0 auid=4294967295 ses=4294967295 subj=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 op=invalid_pcr cause=open_writers comm="syz-executor.0" name="/root/syzkaller-testdir933902076/syzkaller.TRnklj/934/file0" dev="sda1" ino=17346 res=1 [ 1051.477117] binder: 18556:18558 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:35 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1051.597693] binder: 18549:18559 unknown command 0 [ 1051.660635] binder: 18549:18559 ioctl c0306201 20000100 returned -22 [ 1051.660829] binder: 18549:18568 ioctl c0205647 20000140 returned -22 15:00:35 executing program 0: mlock(&(0x7f0000556000/0x400000)=nil, 0x400000) munlockall() 15:00:35 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x700000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1051.721881] binder: 18549:18559 ioctl c0445624 200004c0 returned -22 [ 1051.785822] binder: 18549:18570 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1051.932823] binder: 18572:18575 ioctl c0306201 0 returned -14 [ 1052.013002] binder: 18572:18575 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1052.106678] binder: 18549:18559 unknown command 302277381 [ 1052.143936] binder: 18549:18559 ioctl c0306201 20012000 returned -22 15:00:36 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x800000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1052.174481] binder: 18549:18568 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1052.219642] binder: 18581:18583 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1052.265577] binder: 18549:18559 unknown command 0 [ 1052.291597] binder: 18549:18568 ioctl c0205647 20000140 returned -22 [ 1052.315791] binder: 18581:18588 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1052.351305] binder: 18581:18588 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1052.370758] binder: 18549:18570 ioctl c0445624 200004c0 returned -22 [ 1052.371223] binder: 18549:18590 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:36 executing program 0: mlock(&(0x7f0000556000/0x400000)=nil, 0x400000) munlockall() [ 1052.400939] binder: 18549:18559 ioctl c0306201 20000100 returned -22 15:00:36 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x81000002) r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x8, 0x80202) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, &(0x7f0000000200)=@broute={'broute\x00', 0x20, 0x3, 0xef0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000400], 0x0, &(0x7f0000000140), &(0x7f0000000400)=[{0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x5, 0x40, 0xee504fb198aa1729, 'vxcan1\x00', 'caif0\x00', 'yam0\x00', 'caif0\x00', @remote, [0xff, 0xff, 0x0, 0xff, 0xff, 0xff], @local, [0xff, 0xff, 0xff, 0x0, 0xff], 0xa0, 0xa0, 0xd0, [@pkttype={'pkttype\x00', 0x8}]}}, @common=@AUDIT={'AUDIT\x00', 0x8, {{0x2}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x2, [{{{0x7, 0xa, 0x1a, 'hsr0\x00', 'hsr0\x00', 'veth0_to_bond\x00', 'veth1_to_team\x00', @local, [0x0, 0x0, 0xff, 0xff, 0x0, 0xff], @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, [0x0, 0xff, 0x0, 0x0, 0xff], 0x8f0, 0x998, 0x9c8, [@among={'among\x00', 0x858, {{0x3, 0x8, 0x1, {[0xffff, 0x8, 0x4, 0xffffffff7fffffff, 0x80000001, 0x1, 0x7, 0x7, 0x3f, 0xfff, 0x1, 0xb2, 0x1000, 0x23fdc0000, 0x8001, 0x101, 0x3, 0x2, 0x2036, 0x683c, 0x8000, 0x0, 0x3, 0xffffffffffff7fff, 0x3, 0x6, 0x0, 0x5, 0xc3d, 0x4, 0x6, 0x5, 0x100, 0x5, 0x7ff, 0x5, 0x80000000, 0x4, 0xffff, 0x0, 0x5, 0x8, 0x0, 0x5, 0x8, 0x4, 0x2, 0x9, 0xffffffff00000000, 0x3, 0x4, 0xd033, 0x30, 0x3d7, 0x9, 0x9, 0x2, 0xd8, 0x8, 0x2, 0x7, 0x3, 0xd03, 0x90000000000, 0xffff, 0x6da3, 0x20, 0x39, 0xafa, 0x20, 0x9, 0x33b, 0xbca, 0x1, 0x1, 0x100000001, 0x4, 0x0, 0x400, 0x0, 0x7, 0x4, 0x80000001, 0x9, 0xffffffffffff208e, 0x6, 0x5, 0xfffffffffffffffb, 0xfffffffffffff000, 0xb21, 0x40, 0x7fad, 0xfffffffffffeffff, 0x200, 0x4, 0x3ff, 0x9, 0x4, 0xb0, 0x101, 0x401, 0x400, 0x4, 0x4, 0xffffffffffffff2c, 0x7f, 0x6, 0x1, 0x40, 0xca, 0x2, 0x3, 0x0, 0x0, 0x2, 0x7fff, 0x4, 0x0, 0xffffffff, 0x400, 0xff, 0x5, 0x100, 0x5, 0x3, 0x20, 0x3, 0x8, 0xffff, 0x200, 0xfffffffffffffe54, 0x6, 0x6, 0x6, 0x7, 0x38, 0x35800aca, 0x7, 0x10001, 0x3, 0xffffffffffffff7f, 0x7fff, 0x64d956b9, 0xe53, 0x0, 0x8, 0xfffffffffffffbff, 0x40000, 0x6, 0x9, 0x21b, 0xfffffffffffffff7, 0x400, 0x9, 0x1f, 0xe50, 0xffffffffffff8001, 0x17, 0x1ff, 0x400, 0x9, 0x9, 0x5, 0x8000, 0x7783, 0x4, 0x5, 0x5, 0x6, 0x20, 0xffffffff, 0x0, 0xffffffff, 0x6, 0x8, 0x6, 0xfe6, 0x101, 0x20, 0x2, 0xcec0, 0x100000000, 0x8000, 0x0, 0x80, 0x729, 0x5, 0x0, 0x10000, 0x100000000, 0xfff, 0x9, 0x2, 0x903c, 0x800, 0x1, 0x4, 0x7, 0x40, 0x0, 0x6, 0xe2ba, 0x6, 0x9, 0x7ff, 0x7, 0x7, 0x4, 0x3, 0x3, 0x80, 0xff, 0x2, 0x6, 0x1000, 0x6, 0x3f, 0x3f, 0x7b9, 0x3, 0x5, 0x7, 0xffffffffffffffc0, 0x401, 0xf7, 0x1000, 0x10000, 0x7fff, 0x100000000, 0x9, 0x101, 0x1, 0x1000, 0x80000001, 0xd2, 0x3f, 0x1, 0x1, 0x2, 0xfffffffffffffffb, 0x5, 0x1000, 0x9, 0x80, 0x8, 0x9f3c, 0x101, 0x6, 0x6d, 0x7, 0x8000, 0x1, 0xe0000000, 0xfffffffffffffff9, 0x8000, 0x6, 0xffffffff], 0x3, [{[0xad, 0x400], @broadcast}, {[0x1, 0x20], @broadcast}, {[0x3ff, 0x800], @broadcast}]}, {[0x718, 0x6, 0x1, 0xfff, 0xffffffff, 0x7fffffff, 0x1, 0x4b, 0x3f, 0x5, 0x7, 0x2, 0x451e3b43, 0x2, 0x3, 0x18, 0x4, 0x1, 0x8, 0x7f8ed00c, 0x1, 0x0, 0x7, 0xe760, 0x40, 0xffffffff, 0x9e75, 0x2b, 0x4, 0xf3, 0x9, 0x9, 0x80, 0x2, 0x3, 0x1ff, 0x1, 0x200, 0x800, 0x5, 0xfffffffffffff801, 0xcb02, 0xdc0, 0x3, 0x10001, 0x2, 0x1ff, 0x9, 0x6, 0x7, 0xe, 0x7, 0x6, 0x8b, 0x80000001, 0x1, 0x4, 0x1, 0xfffffffffffffffa, 0x9, 0x401, 0x997, 0x2, 0x7fffffff, 0xffffffff, 0x100, 0x7f, 0xd440, 0x6, 0x2, 0x22b134ec, 0xfffffffffffffff7, 0xa1f, 0x1, 0x6, 0xa8, 0x5, 0x5, 0x4c3, 0x0, 0x9, 0xc4c7, 0x100000001, 0x8, 0xe255, 0x8000, 0xffff, 0x2, 0x2, 0x10001, 0x401, 0x7, 0x2, 0x7, 0x2, 0xffffffff00000001, 0x48, 0x100000000, 0xffffffff, 0x100000000, 0x8, 0x5, 0x0, 0x1, 0x2, 0x6, 0x3, 0x85dd, 0x7, 0x3, 0x7, 0x7, 0x7b, 0xda, 0x8000, 0x1, 0x100, 0xffff, 0x5, 0x6, 0x3, 0xd0a, 0x8, 0x5, 0xfffffffffffffe00, 0xd165, 0x1941, 0xbf6, 0x100000000, 0x1, 0x4, 0x100000001, 0x5, 0x364, 0x40, 0x1, 0x3, 0x81, 0x9, 0x8, 0x2fe4, 0x1, 0xa03, 0xfffffffffffffffc, 0x32, 0xfffffffffffffffc, 0x1, 0x0, 0x10000, 0x0, 0x0, 0x1, 0x7, 0x0, 0x0, 0x5, 0x3, 0x8d, 0x3, 0x8, 0xffffffffffff5367, 0x5, 0x3f, 0x4, 0x3, 0xffffffffffffff89, 0x200, 0xfffffffffffff6b6, 0xf4, 0x8000, 0x10001, 0x101, 0x4, 0x100000000, 0x3, 0xff, 0x7fff, 0x3, 0x40000000000000, 0x100, 0x7ff, 0xd4ba, 0x9bbc, 0x8000, 0x3, 0x3f, 0x8, 0x3, 0x1, 0x81, 0x216, 0xa563, 0x2, 0x8, 0x2, 0x9, 0x4, 0xfff, 0x1, 0xfffffffffffff001, 0xb59, 0x7, 0xffff, 0x7, 0x1, 0x7, 0x40, 0x7, 0x7, 0x3f, 0x7, 0x0, 0x23f, 0x8, 0x7f, 0x1, 0x431b, 0x3, 0x2, 0x7, 0x0, 0x9, 0x4, 0x6, 0xff, 0x5ec, 0x7fff, 0x1, 0x80, 0x3ff, 0x5, 0x7, 0x4, 0x5, 0x6, 0x5, 0x0, 0x1, 0x8, 0x0, 0xfff, 0x45f, 0x48, 0x4, 0xec, 0x10001, 0x400, 0x0, 0x2, 0x3183, 0x1ff, 0x8, 0x2, 0x9b, 0x440, 0x1], 0x2, [{[0x6, 0xfffffffffffff983], @multicast1}, {[0x4, 0xb782], @dev={0xac, 0x14, 0x14, 0x20}}]}}}}]}, [@common=@nflog={'nflog\x00', 0x50, {{0x6, 0xfff, 0x1000000, 0x0, 0x0, "4abd410ecea3867e38a7722c2ff8c5978f35002e9d93c695f1d57d22e142f7070814cd22a14998f670c843fdee0094e4933ef2b40b07eacbe96902ce691ed05a"}}}, @common=@AUDIT={'AUDIT\x00', 0x8, {{0x1}}}]}, @common=@CONNSECMARK={'CONNSECMARK\x00', 0x8, {{0x2}}}}, {{{0xf, 0x2, 0x0, 'rose0\x00', 'dummy0\x00', 'veth0_to_bridge\x00', 'hsr0\x00', @remote, [0xff, 0xff, 0xff, 0xff, 0xff, 0xff], @empty, [0x0, 0xff, 0xff, 0xff], 0x2a8, 0x350, 0x3c8, [@bpf0={'bpf\x00', 0x210, {{0x5, [{0x81, 0x1, 0x0, 0xd0c9}, {0xc9, 0x7fffffff, 0x8, 0x6}, {0x80000001, 0x400, 0x0, 0x8}, {0x3f, 0x7, 0x2, 0x1f}, {0xfffffffffffffffd, 0xfffffffffffffffa, 0x4, 0x3}, {0x4, 0x1, 0x401, 0x100000000000000}, {0xffffffff80000000, 0x6b38c3b8, 0x3, 0x10000}, {0x4, 0x4, 0x1f, 0xc05}, {0x1, 0x9, 0xffffffffffffffff, 0x2eaa23a2}, {0xffff, 0x5, 0x401, 0x400}, {0xe7a, 0x6, 0x7, 0x2}, {0x3ff, 0x3, 0x5, 0x40}, {0x2, 0x8, 0xb89, 0x7fffffff}, {0x5, 0x3f, 0xb647, 0x5}, {0xfff, 0x100, 0x9, 0x100000000}, {0x2, 0x4, 0xff, 0x100000000}, {0x7fff, 0x9, 0xadbe, 0xfffffffffffffff8}, {0xa4d3, 0x1f, 0x423b, 0x10000}, {0x7ff, 0x105c, 0x3, 0x8}, {0x7fffffff, 0x81, 0x24722094, 0x6}, {0x6, 0x5, 0x2559, 0x100000000}, {0x7, 0x1ff, 0x4d1, 0x40}, {0x8c, 0xffff, 0x4, 0xfffffffffffffe01}, {0x5, 0x6c15329f, 0x4, 0x100000000}, {0x185, 0xfdb, 0x3, 0x9}, {0x100, 0x2, 0x66efc13}, {0x0, 0x9, 0x0, 0x9}, {0x2, 0x1, 0x200}, {0x5, 0x901, 0x8000, 0x1}, {0x5, 0x0, 0x8, 0x1}, {0x9, 0x4, 0x6000000000000000, 0xed3}, {0x9, 0x55f3, 0x7, 0x1705e0a3}, {0xe82, 0x8, 0x9, 0x8fd}, {0x5, 0x5, 0x70d47a40, 0x100000000}, {0xfff, 0x7, 0x0, 0x100000000}, {0xff, 0x1, 0x9, 0x3}, {0x4, 0x1, 0x5, 0x5}, {0x2, 0x40, 0x4, 0x401}, {0x800, 0x0, 0x0, 0x4}, {0x8, 0x7, 0x101, 0x7}, {0xee, 0x21, 0x6, 0x1}, {0x1, 0x5, 0x9b, 0x100000000}, {0x6, 0x7, 0x2, 0x10001}, {0xffffffffffffffc8, 0x1, 0xffffffff00000000, 0x6}, {0x6, 0xc062, 0x0, 0x9}, {0x1f, 0x2, 0x2, 0x81}, {0x200, 0x9, 0x0, 0xfffffffffffffffb}, {0x88, 0x3, 0x8, 0x4}, {0x1, 0x0, 0x40, 0x2}, {0x3, 0x4, 0x6, 0x4}, {0x391, 0x7ff, 0x0, 0x200}, {0x2, 0x7f, 0x0, 0x7ff}, {0x7fffffff, 0x5, 0x5, 0x1}, {0x1, 0x1000, 0x8d49, 0x2}, {0x0, 0x0, 0x1, 0x1}, {0xdcf4, 0xb, 0x9, 0x1ba2}, {0x2, 0x740}, {0x2, 0x6, 0x2, 0x400}, {0x3, 0x0, 0x9, 0x7}, {0x5, 0x2, 0x200, 0x7fff}, {0x5, 0x200, 0xad, 0x5}, {0x9, 0x4, 0x2, 0x4}, {0x3, 0x2, 0x477761c9, 0x9}, {0x0, 0x9aa6, 0x5, 0x81}], 0x1}}}]}, [@common=@STANDARD={'\x00', 0x8, {0xfffffffffffffffc}}, @common=@NFLOG={'NFLOG\x00', 0x50, {{0xbaf, 0x8000, 0x0, 0x1, 0x0, "8791cc38a184ca5c78ccba7a3698929bd22bbea21e83661564469ecce90ed32c21cc8d733fb35b237697995fb3966049497cb30a6b0a2c02860fef9352d64140"}}}]}, @common=@nflog={'nflog\x00', 0x50, {{0x6, 0xfff, 0x1, 0x0, 0x0, "fa2cfc8b5cf59558872e2122a655ce6aed16fcc7c167ae42bb202b8ba225b223e3c2521ed0c4bc06152451cf1fa4b8dfdb22c311bc03f0ec31048d8b79fabc60"}}}}]}, {0x0, '\x00', 0x3, 0xfffffffffffffffe}]}, 0xf68) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:36 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x1000000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:36 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:36 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1052.770841] binder: 18596:18599 tried to acquire reference to desc 0, got 1 instead 15:00:36 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) pipe(&(0x7f0000000180)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x0) [ 1052.826913] binder: 18596:18607 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1052.852632] binder: 18604:18609 ioctl c0306201 0 returned -14 [ 1052.863819] binder: 18596:18606 unknown command 536872576 15:00:36 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x3f00000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1052.902776] binder: 18604:18609 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1052.910788] binder: 18596:18606 ioctl c0306201 20008fd0 returned -22 [ 1052.941213] binder: undelivered death notification, 0000000000000000 15:00:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0x0, 0x801) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="8468d781e0cfaf4f57d7ab32fabfb02cced9bd08f8fade1b40efad57a15d970fdc4db5b3f6ea69132d5a0fdb72b0452111720e1f7d956fb9511c504e042385cd1f240eaf8fb0cd289c321332c7e4254e5aa168ffd1c6b38b0d6b11c58cb3a22eeff84f1ffe5a4e809a02df09f709469adc872164806d080ae24867954d717b710bff5e0e469b6832178c510d578094b3f0d6ca4558c3fd8b4c72503ff24b01d7028506eeb7d2e11ff529c9961f6dbc9dd4df1e9881fb2ee9581ae029ab131bef098a46e5af59a2dbbce32b4c3f3e2dbc24c813d2dea9e998fa2161dd8d952e2b4fb4d88c7ea18aab277b81a5bf53b6c04cc99ced12852fceddbdfef4fade9d9f27d0aa2ffd83acbaac85ad8bbce33e72334ae6e827f24ecb7950377e04ee419ac6109a41857c0635ee4c8d252289d81d00070d62cb82682375b9586100bea4a792c635da25d23ccb6316888f7a667a9664d75435"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) r2 = semget(0x3, 0x3, 0x8) semctl$GETZCNT(r2, 0x3, 0xf, &(0x7f0000000100)=""/101) 15:00:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5603000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1053.138573] binder: 18618:18619 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1053.173603] binder: 18618:18619 ioctl c0306201 0 returned -14 [ 1053.208815] binder: 18623:18626 unknown command -2116589436 [ 1053.219439] binder: BINDER_SET_CONTEXT_MGR already set [ 1053.231272] binder: 18618:18619 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1053.243682] binder: 18623:18626 ioctl c0306201 20012000 returned -22 15:00:37 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x4000000000000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1053.255828] binder: 18624:18627 ioctl 40046207 0 returned -16 [ 1053.267079] binder: 18618:18619 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1053.274151] binder: 18623:18626 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:37 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) [ 1053.305597] binder: 18623:18626 ioctl c0306201 2000dfd0 returned -11 [ 1053.329981] binder: 18623:18626 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 1053.372788] binder: 18623:18626 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1053.410464] binder: 18638:18639 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 1053.436491] binder: 18623:18626 unknown command -2116589436 [ 1053.437417] binder: 18623:18632 unknown command 536872576 [ 1053.450448] binder: 18623:18626 ioctl c0306201 20012000 returned -22 [ 1053.458307] binder: 18623:18626 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 1053.476375] binder: 18623:18632 ioctl c0306201 20000180 returned -22 15:00:37 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x80ffffff00000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000100)='/dev/mixer\x00', 0x4000, 0x0) getsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000140)=@assoc_id=0x0, &(0x7f0000000180)=0x4) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000200)={0xffffffffffffffe1, 0x8002, 0x781, 0x1, r2}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) getsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000300), &(0x7f0000000340)=0x4) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) setxattr$trusted_overlay_origin(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x1) r4 = dup(r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0ffbc1ce7e40"], 0x0, 0x0, 0x0}) syncfs(r4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:37 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b02000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1053.656795] binder: 18644:18647 unknown command -826148081 [ 1053.681011] binder: 18644:18647 ioctl c0306201 20000040 returned -22 15:00:37 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0xdc06499ded000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1053.703889] binder: 18644:18650 tried to acquire reference to desc 0, got 1 instead [ 1053.714593] binder: 18644:18647 unknown command 536872576 [ 1053.723085] binder: 18644:18647 ioctl c0306201 20008fd0 returned -22 15:00:37 executing program 0: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x3, 0x0) sync() 15:00:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$KVM_CREATE_IRQCHIP(r0, 0xae60) r1 = syz_open_dev$binder(0x0, 0x0, 0x802) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000340)={0xb, 0x0, &(0x7f0000000300)=ANY=[], 0xffffffffffffffcc, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) syz_open_dev$mice(&(0x7f0000000180)='/dev/input/mice\x00', 0x0, 0x402) r2 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0fbe3823"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) sendto$unix(r2, &(0x7f0000000200)="b63e7c2645f4c487673a5e81b53304fc3ecfdd3a437c77c8b04086fe2dc4d848fae0a4072180ffe0de4b0baaf886ac33a71ec2f66a2a46dec291ffcc84e16fc8559fc85701d601253bb3629e41fed7e65211ad90248880044f740617f3af60b36547cb439010b38781c7a5e6c15421e64ecf8b786a1c5ccbeedba9c248a7ac3e6506f7c6dffbaa03e7d60cd6184e2be0062ddaf9c8b069997944a71f2ac3d444c57144a7506d227a78bb9badbd81cdaab8eb774f092b2459eca9dd97967a9f279575062646e6594f63178c40026ae1c1ba1ae5b46d136d236ff8a30066225e959e99f68d226083213b64ee2abf14", 0xee, 0x10, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e22}, 0x6e) 15:00:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:38 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0xffffff7f00000000, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcd02000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1053.940354] binder: 18661:18662 ioctl ae60 0 returned -22 [ 1053.960213] binder: 18661:18662 unknown command 0 [ 1053.994999] binder: 18661:18662 ioctl c0306201 20000340 returned -22 [ 1054.053398] binder: 18661:18662 ioctl c0306201 2000dfd0 returned -11 [ 1054.077009] binder: 18669:18671 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1054.089435] binder: 18661:18668 ioctl ae60 0 returned -22 [ 1054.110485] binder: 18661:18668 unknown command 0 [ 1054.110611] binder: 18669:18671 ioctl c0306201 0 returned -14 [ 1054.121006] binder: 18661:18668 ioctl c0306201 20000340 returned -22 15:00:38 executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x19, &(0x7f0000000280)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) pipe(&(0x7f0000000180)={0xffffffffffffffff}) write(0xffffffffffffffff, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x7}, 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r2+30000000}, 0x0) vmsplice(r1, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) 15:00:38 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:38 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1054.215881] binder: 18669:18679 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:38 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x2, 0x100010, r1, 0x0) r2 = mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x2010, r0, 0x5d) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000400)=[@acquire={0x40046305, 0x2}, @request_death={0x400c630e, 0x1, 0x1}, @exit_looper, @decrefs={0x40046307, 0x1}, @clear_death={0x400c630f, 0x3, 0x3}, @exit_looper, @dead_binder_done={0x40086310, 0x3}, @increfs_done={0x40106308, r2, 0x2}, @request_death={0x400c630e, 0x0, 0x3}], 0xffffffffffffff79, 0x0, &(0x7f00000004c0)="b99bff2b0c727dd6f2c405e4af77282f3847eb39790614aabfbce1a8180de42bd829fab41083280b4664afcb679e8fd2c7ba37ba298193fb8c60caaaf3b4e30c3ecf32adc77d87c212ef84437a8c845b2aa644252c402f628a3375e07555b2f7a613411ae3d4f075b9458a4bfc82bf74b837f1f1d4c4c9081c9e0c13c58a47fc9e686121bf270db2ed5b541dd21c211227f38239d3e8893730e50000000000"}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe403000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1054.388431] binder: 18687:18688 Acquire 1 refcount change on invalid ref 2 ret -22 [ 1054.443707] binder: 18687:18692 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:38 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe602000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:38 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:38 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf403000000000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:38 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1054.996314] binder: 18712:18714 Acquire 1 refcount change on invalid ref 0 ret -22 [ 1055.020186] binder: 18712:18714 ioctl c0306201 0 returned -14 15:00:39 executing program 0: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/vs/expire_quiescent_template\x00', 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(0xffffffffffffffff, 0x6609) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$ARPT_SO_GET_INFO(r0, 0x0, 0x60, &(0x7f0000000740)={'filter\x00'}, &(0x7f00000007c0)=0x44) prlimit64(0x0, 0x0, 0x0, &(0x7f00000002c0)) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) syz_open_dev$dmmidi(&(0x7f0000000240)='/dev/dmmidi#\x00', 0x8001, 0x0) mount$bpf(0x20000000, &(0x7f0000002600)='./file0\x00', 0x0, 0x2001001, &(0x7f0000002640)=ANY=[]) syz_mount_image$ext4(&(0x7f0000000040)='ext2\x00', &(0x7f0000000200)='./file0\x00', 0xbd07, 0x0, 0x0, 0x100032, &(0x7f00000000c0)=ANY=[]) prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b) [ 1055.081018] binder: 18712:18716 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:39 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1055.186881] binder: 18687:18692 Acquire 1 refcount change on invalid ref 2 ret -22 [ 1055.269054] binder: undelivered death notification, 0000000000000000 [ 1055.276040] binder: undelivered death notification, 0000000000000000 15:00:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) syz_open_dev$radio(&(0x7f0000000200)='/dev/radio#\x00', 0x2, 0x2) r2 = dup(r1) ioctl$PPPIOCSPASS(r2, 0x40107447, &(0x7f0000000180)={0x9, &(0x7f0000000100)=[{0x0, 0x7, 0x7c6, 0x15d6bcd4}, {0x0, 0x2, 0xf2d, 0xe1}, {0x8, 0x21750820, 0x0, 0x6}, {0x7f, 0x8, 0x7ff, 0x9}, {0xff, 0x2, 0x8, 0x239}, {0xa6, 0x4, 0x401, 0x400}, {0x7, 0x800, 0x7, 0xeea5}, {0xeb8, 0x4240, 0x10000, 0x2}, {0x6, 0xb3, 0x2, 0x7}]}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:39 executing program 0: r0 = socket$inet(0x2, 0x2, 0x2200000088) bind$inet(r0, &(0x7f0000000000)={0x2, 0x1004e20}, 0x10) recvfrom$inet(r0, &(0x7f0000000040)=""/222, 0xde, 0x0, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x0, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000440)="dd", 0x1, 0x0, 0x0, 0x0) 15:00:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:39 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1055.515240] binder: 18739:18742 ioctl 40107447 20000180 returned -22 [ 1055.537984] binder: 18739:18742 tried to acquire reference to desc 0, got 1 instead 15:00:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1055.562716] binder: 18739:18745 unknown command 536872576 [ 1055.585169] binder: 18739:18748 ioctl 40107447 20000180 returned -22 [ 1055.599863] binder: 18739:18745 ioctl c0306201 20008fd0 returned -22 [ 1055.608501] binder: undelivered death notification, 0000000000000000 15:00:39 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="0563044000002e1c6fdd97c62a57d9f10000f099d629b870c6fc2205993d18b738ca89bba1b80e823ac293df7200000000"], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1055.751796] binder: 18755:18756 Acquire 1 refcount change on invalid ref 472776704 ret -22 15:00:39 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) [ 1055.810931] binder: 18755:18757 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:39 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1055.939170] binder: 18762:18763 Acquire 1 refcount change on invalid ref 0 ret -22 15:00:40 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:40 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x110], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:40 executing program 0: perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xf7c, 0x8000000000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff) 15:00:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x27b], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:40 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:40 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x0) perf_event_open(&(0x7f000000a000)={0x6, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x8000000200000000, 0x800007f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000343ff8)='./file0\x00', &(0x7f0000fb5ffc)='nfs\x00', 0x0, &(0x7f000000a000)) mount(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)='rpc_pipefs\x00', 0x0, 0x0) umount2(&(0x7f0000000040)='./file0\x00', 0x0) [ 1056.548512] binder: 18755:18757 Acquire 1 refcount change on invalid ref 472776704 ret -22 [ 1056.549826] binder: 18755:18793 unknown command 536872576 [ 1056.582826] binder_thread_write: 11 callbacks suppressed [ 1056.582841] binder: 18755:18797 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 15:00:40 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0}) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/mls\x00', 0x0, 0x0) r3 = getpid() ptrace$cont(0x18, r3, 0x100000001, 0x3f) write$FUSE_GETXATTR(r2, &(0x7f0000000100)={0x18, 0x0, 0x8, {0xfffffffffffffffe}}, 0x18) r4 = dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$VIDIOC_G_JPEGCOMP(r4, 0x808c563d, &(0x7f0000000200)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) 15:00:40 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2cd], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1056.619344] binder: 18755:18793 ioctl c0306201 20008fd0 returned -22 [ 1056.722656] binder: 18803:18804 unknown command 0 15:00:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x1000000, 0xfdfdffff, 0x0}) 15:00:40 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1056.760040] binder: 18803:18804 ioctl c0306201 20008fd0 returned -22 [ 1056.790884] binder: 18803:18804 ioctl 808c563d 20000200 returned -22 [ 1056.832706] binder: 18803:18806 tried to acquire reference to desc 0, got 1 instead [ 1056.857133] binder: 18803:18804 unknown command 0 [ 1056.876670] binder: 18803:18804 ioctl c0306201 20008fd0 returned -22 [ 1056.885505] binder: 18803:18806 ioctl 808c563d 20000200 returned -22 [ 1056.899374] binder: 18812:18815 BC_CLEAR_DEATH_NOTIFICATION death notification not active 15:00:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e6], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) [ 1056.926005] binder_thread_write: 1 callbacks suppressed [ 1056.926017] binder: 18812:18815 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x0, 0x0, &(0x7f0000005fd4), 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x8, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) 15:00:41 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:41 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, 0x0}) close(r0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0xfffffffffffffe80, 0x0, &(0x7f000000dff8)=[@release={0x400c630e}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f000000dfd0)={0x4, 0x0, &(0x7f0000000080)=[@enter_looper], 0xaf14113f02c18c41, 0x0, &(0x7f0000000680)}) dup(r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0f630c40"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000003c0)={0x4, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="10630840"], 0x0, 0xfdfdffff, 0x0}) [ 1057.122830] binder: BINDER_SET_CONTEXT_MGR already set [ 1057.132799] binder: 18826:18828 ioctl 40046207 0 returned -16 [ 1057.144963] binder: 18826:18828 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 15:00:41 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) [ 1057.175848] binder: 18825:18829 BC_CLEAR_DEATH_NOTIFICATION death notification not active [ 1057.194057] binder: 18825:18829 BC_DEAD_BINDER_DONE 0000000000000000 not found 15:00:41 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x0, 0x0) ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000080)={[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x356], 0x0, 0x400, 0x2779}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 15:00:41 executing program 3: r0 = socket$key(0xf, 0x3, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = fcntl$dupfd(r2, 0x0, r1) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) sendmsg$key(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000400)=ANY=[@ANYBLOB="0203200313000000000000000000000005000600000000000a0000000000000000000000200000005500000000000000000000000000000005000900df0000000a00000000000000fe8000000000000000000000000000ff000000000000000002000100000000000000050d0000000005000500000000000a00000000000000ff0200000000619500000000000000010000000000000000"], 0x98}}, 0x0) 15:00:41 executing program 0: getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000140), 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x0, @initdev}, 0x1c) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000010000)="eb3c906d6b66732e666174000204010002000270fff8", 0x16}], 0x80, 0x0) r0 = open(&(0x7f0000000200)='./file0\x00', 0x0, 0x0) fchdir(r0) mount$bpf(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r0, 0x800448d3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x0, 0x3}, 0x0) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x20400040c2, 0x0) r2 = open$dir(&(0x7f0000000380)='./file0\x00', 0x0, 0x0) write(r1, &(0x7f0000000600)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r1, r2, 0x0, 0x10000) add_key$keyring(&(0x7f0000000440)='keyring\x00', &(0x7f0000000480)={'syz'}, 0x0, 0x0, 0x0) [ 1057.429314] ------------[ cut here ]------------ [ 1057.435901] ODEBUG: free active (active state 0) object type: timer_list hint: xprt_init_autodisconnect+0x0/0x170 [ 1057.446651] WARNING: CPU: 0 PID: 9 at lib/debugobjects.c:325 debug_print_object+0x16a/0x250 [ 1057.455149] Kernel panic - not syncing: panic_on_warn set ... [ 1057.461026] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.0.0-rc6+ #72 [ 1057.467682] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1057.477021] Call Trace: [ 1057.479615] dump_stack+0x172/0x1f0 [ 1057.483234] ? debug_print_object+0x100/0x250 [ 1057.487724] panic+0x2cb/0x65c [ 1057.490939] ? __warn_printk+0xf3/0xf3 [ 1057.494839] ? debug_print_object+0x16a/0x250 [ 1057.499340] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 1057.504870] ? __warn.cold+0x5/0x45 [ 1057.508489] ? __warn+0xe8/0x1d0 [ 1057.511849] ? debug_print_object+0x16a/0x250 [ 1057.516334] __warn.cold+0x20/0x45 [ 1057.519868] ? debug_print_object+0x16a/0x250 [ 1057.524359] report_bug+0x263/0x2b0 [ 1057.528035] do_error_trap+0x11b/0x200 [ 1057.531926] do_invalid_op+0x37/0x50 [ 1057.535636] ? debug_print_object+0x16a/0x250 [ 1057.540129] invalid_op+0x14/0x20 [ 1057.543592] RIP: 0010:debug_print_object+0x16a/0x250 [ 1057.548688] Code: dd 80 50 a2 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b5 00 00 00 48 8b 14 dd 80 50 a2 87 48 c7 c7 20 46 a2 87 e8 24 1b 18 fe <0f> 0b 83 05 a1 96 31 06 01 48 83 c4 20 5b 41 5c 41 5d 41 5e 5d c3 [ 1057.567579] RSP: 0018:ffff8880a9897bb8 EFLAGS: 00010082 [ 1057.572932] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 [ 1057.580209] RDX: 0000000000000100 RSI: ffffffff815a9266 RDI: ffffed1015312f69 [ 1057.587469] RBP: ffff8880a9897bf8 R08: ffff8880a9888240 R09: ffffed1015d03ef9 [ 1057.594737] R10: ffffed1015d03ef8 R11: ffff8880ae81f7c7 R12: 0000000000000001 [ 1057.602029] R13: ffffffff889adce0 R14: ffffffff815fc240 R15: ffff88808a64cac8 [ 1057.609300] ? __internal_add_timer+0x1f0/0x1f0 [ 1057.613969] ? vprintk_func+0x86/0x189 [ 1057.617856] ? debug_print_object+0x16a/0x250 [ 1057.622363] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 1057.627463] debug_check_no_obj_freed+0x29f/0x464 [ 1057.632310] kfree+0xbd/0x230 [ 1057.635413] rcu_process_callbacks+0xa4b/0x1390 [ 1057.640082] ? rcu_check_gp_start_stall+0x240/0x240 [ 1057.645096] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1057.650557] __do_softirq+0x266/0x95a [ 1057.654383] ? pci_mmcfg_check_reserved+0x170/0x170 [ 1057.659403] ? takeover_tasklets+0x7b0/0x7b0 [ 1057.663832] run_ksoftirqd+0x8e/0x110 [ 1057.667635] smpboot_thread_fn+0x6ab/0xa10 [ 1057.671898] ? sort_range+0x30/0x30 [ 1057.675517] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1057.681051] ? __kthread_parkme+0xfb/0x1b0 [ 1057.685286] kthread+0x357/0x430 [ 1057.688643] ? sort_range+0x30/0x30 [ 1057.692261] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 1057.697793] ret_from_fork+0x3a/0x50 [ 1057.701508] [ 1057.701514] ====================================================== [ 1057.701519] WARNING: possible circular locking dependency detected [ 1057.701523] 5.0.0-rc6+ #72 Not tainted [ 1057.701528] ------------------------------------------------------ [ 1057.701533] ksoftirqd/0/9 is trying to acquire lock: [ 1057.701537] 00000000d4c860cd ((console_sem).lock){-.-.}, at: down_trylock+0x13/0x70 [ 1057.701552] [ 1057.701556] but task is already holding lock: [ 1057.701559] 000000000e3a1cb2 (&obj_hash[i].lock){-.-.}, at: debug_check_no_obj_freed+0xbe/0x464 [ 1057.701575] [ 1057.701579] which lock already depends on the new lock. [ 1057.701582] [ 1057.701585] [ 1057.701590] the existing dependency chain (in reverse order) is: [ 1057.701592] [ 1057.701595] -> #3 (&obj_hash[i].lock){-.-.}: [ 1057.701610] _raw_spin_lock_irqsave+0x95/0xcd [ 1057.701614] __debug_object_init+0xc6/0xc30 [ 1057.701618] debug_object_init+0x16/0x20 [ 1057.701622] hrtimer_init+0x2a/0x300 [ 1057.701626] init_dl_task_timer+0x1b/0x50 [ 1057.701630] __sched_fork+0x22a/0x4b0 [ 1057.701634] init_idle+0x75/0x670 [ 1057.701638] sched_init+0x952/0x9f5 [ 1057.701642] start_kernel+0x3ce/0x83c [ 1057.701646] x86_64_start_reservations+0x29/0x2b [ 1057.701651] x86_64_start_kernel+0x77/0x7b [ 1057.701655] secondary_startup_64+0xa4/0xb0 [ 1057.701657] [ 1057.701660] -> #2 (&rq->lock){-.-.}: [ 1057.701674] _raw_spin_lock+0x2f/0x40 [ 1057.701678] task_fork_fair+0x6a/0x520 [ 1057.701682] sched_fork+0x3b2/0x900 [ 1057.701686] copy_process.part.0+0x188c/0x79a0 [ 1057.701690] _do_fork+0x257/0xfe0 [ 1057.701694] kernel_thread+0x34/0x40 [ 1057.701697] rest_init+0x28/0x37b [ 1057.701702] arch_call_rest_init+0xe/0x1b [ 1057.701706] start_kernel+0x803/0x83c [ 1057.701710] x86_64_start_reservations+0x29/0x2b [ 1057.701714] x86_64_start_kernel+0x77/0x7b [ 1057.701718] secondary_startup_64+0xa4/0xb0 [ 1057.701721] [ 1057.701723] -> #1 (&p->pi_lock){-.-.}: [ 1057.701751] _raw_spin_lock_irqsave+0x95/0xcd [ 1057.701755] try_to_wake_up+0x8f/0xff0 [ 1057.701759] wake_up_process+0x10/0x20 [ 1057.701763] __up.isra.0+0x136/0x1a0 [ 1057.701766] up+0x9c/0xe0 [ 1057.701770] __up_console_sem+0xb7/0x1c0 [ 1057.701774] console_unlock+0x6ee/0x10a0 [ 1057.701778] vprintk_emit+0x280/0x6d0 [ 1057.701782] vprintk_default+0x28/0x30 [ 1057.701786] vprintk_func+0x7e/0x189 [ 1057.701790] printk+0xba/0xed [ 1057.701794] kobject_uevent_env+0x96/0x1030 [ 1057.701798] reg_query_database+0x232/0x340 [ 1057.701803] reg_process_hint+0x13f/0xd30 [ 1057.701806] reg_todo+0x33f/0x9a0 [ 1057.701811] process_one_work+0x98e/0x1790 [ 1057.701815] worker_thread+0x98/0xe40 [ 1057.701818] kthread+0x357/0x430 [ 1057.701822] ret_from_fork+0x3a/0x50 [ 1057.701825] [ 1057.701827] -> #0 ((console_sem).lock){-.-.}: [ 1057.701842] lock_acquire+0x16f/0x3f0 [ 1057.701846] _raw_spin_lock_irqsave+0x95/0xcd [ 1057.701850] down_trylock+0x13/0x70 [ 1057.701855] __down_trylock_console_sem+0xa8/0x210 [ 1057.701859] console_trylock+0x15/0xa0 [ 1057.701863] vprintk_emit+0x267/0x6d0 [ 1057.701867] vprintk_default+0x28/0x30 [ 1057.701871] vprintk_func+0x7e/0x189 [ 1057.701874] printk+0xba/0xed [ 1057.701878] __warn_printk+0x9b/0xf3 [ 1057.701882] debug_print_object+0x16a/0x250 [ 1057.701887] debug_check_no_obj_freed+0x29f/0x464 [ 1057.701891] kfree+0xbd/0x230 [ 1057.701895] rcu_process_callbacks+0xa4b/0x1390 [ 1057.701914] __do_softirq+0x266/0x95a [ 1057.701917] run_ksoftirqd+0x8e/0x110 [ 1057.701921] smpboot_thread_fn+0x6ab/0xa10 [ 1057.701941] kthread+0x357/0x430 [ 1057.701944] ret_from_fork+0x3a/0x50 [ 1057.701947] [ 1057.701951] other info that might help us debug this: [ 1057.701954] [ 1057.701957] Chain exists of: [ 1057.701959] (console_sem).lock --> &rq->lock --> &obj_hash[i].lock [ 1057.701978] [ 1057.701982] Possible unsafe locking scenario: [ 1057.701984] [ 1057.701989] CPU0 CPU1 [ 1057.701993] ---- ---- [ 1057.701995] lock(&obj_hash[i].lock); [ 1057.702005] lock(&rq->lock); [ 1057.702014] lock(&obj_hash[i].lock); [ 1057.702023] lock((console_sem).lock); [ 1057.702031] [ 1057.702034] *** DEADLOCK *** [ 1057.702037] [ 1057.702041] 2 locks held by ksoftirqd/0/9: [ 1057.702043] #0: 000000009e397595 (rcu_callback){....}, at: rcu_process_callbacks+0xa0d/0x1390 [ 1057.702061] #1: 000000000e3a1cb2 (&obj_hash[i].lock){-.-.}, at: debug_check_no_obj_freed+0xbe/0x464 [ 1057.702078] [ 1057.702081] stack backtrace: [ 1057.702087] CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.0.0-rc6+ #72 [ 1057.702094] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 1057.702097] Call Trace: [ 1057.702101] dump_stack+0x172/0x1f0 [ 1057.702106] print_circular_bug.isra.0.cold+0x1cc/0x28f [ 1057.702110] __lock_acquire+0x2f00/0x4700 [ 1057.702114] ? mark_held_locks+0x100/0x100 [ 1057.702119] ? check_preemption_disabled+0x48/0x290 [ 1057.702123] ? debug_smp_processor_id+0x1c/0x20 [ 1057.702127] ? perf_trace_lock+0xeb/0x510 [ 1057.702131] ? zap_class+0x460/0x460 [ 1057.702135] ? kvm_clock_read+0x18/0x30 [ 1057.702140] ? kvm_sched_clock_read+0x9/0x20 [ 1057.702144] lock_acquire+0x16f/0x3f0 [ 1057.702147] ? down_trylock+0x13/0x70 [ 1057.702152] _raw_spin_lock_irqsave+0x95/0xcd [ 1057.702156] ? down_trylock+0x13/0x70 [ 1057.702160] ? vprintk_emit+0x267/0x6d0 [ 1057.702164] down_trylock+0x13/0x70 [ 1057.702168] ? vprintk_emit+0x267/0x6d0 [ 1057.702172] __down_trylock_console_sem+0xa8/0x210 [ 1057.702176] console_trylock+0x15/0xa0 [ 1057.702180] vprintk_emit+0x267/0x6d0 [ 1057.702185] ? __internal_add_timer+0x1f0/0x1f0 [ 1057.702189] vprintk_default+0x28/0x30 [ 1057.702193] vprintk_func+0x7e/0x189 [ 1057.702196] printk+0xba/0xed [ 1057.702201] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 1057.702204] ? zap_class+0x460/0x460 [ 1057.702209] ? __lock_acquire+0x53b/0x4700 [ 1057.702213] ? debug_object_deactivate+0x1e4/0x360 [ 1057.702217] ? __warn_printk+0x8f/0xf3 [ 1057.702222] ? xprt_register_transport+0x140/0x140 [ 1057.702226] __warn_printk+0x9b/0xf3 [ 1057.702230] ? add_taint.cold+0x16/0x16 [ 1057.702234] ? kasan_check_read+0x11/0x20 [ 1057.702238] ? lock_downgrade+0x810/0x810 [ 1057.702243] ? xprt_register_transport+0x140/0x140 [ 1057.702248] debug_print_object+0x16a/0x250 [ 1057.702252] ? _raw_spin_unlock_irqrestore+0xa4/0xe0 [ 1057.702257] debug_check_no_obj_freed+0x29f/0x464 [ 1057.702261] kfree+0xbd/0x230 [ 1057.702265] rcu_process_callbacks+0xa4b/0x1390 [ 1057.702270] ? rcu_check_gp_start_stall+0x240/0x240 [ 1057.702275] ? rcu_lockdep_current_cpu_online+0xe3/0x130 [ 1057.702279] __do_softirq+0x266/0x95a [ 1057.702298] ? pci_mmcfg_check_reserved+0x170/0x170 [ 1057.702303] ? takeover_tasklets+0x7b0/0x7b0 [ 1057.702306] run_ksoftirqd+0x8e/0x110 [ 1057.702310] smpboot_thread_fn+0x6ab/0xa10 [ 1057.702314] ? sort_range+0x30/0x30 [ 1057.702319] ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20 [ 1057.702323] ? __kthread_parkme+0xfb/0x1b0 [ 1057.702327] kthread+0x357/0x430 [ 1057.702330] ? sort_range+0x30/0x30 [ 1057.702335] ? kthread_cancel_delayed_work_sync+0x20/0x20 [ 1057.702339] ret_from_fork+0x3a/0x50 [ 1058.891245] Shutting down cpus with NMI [ 1059.597708] Kernel Offset: disabled [ 1059.601351] Rebooting in 86400 seconds..