7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:38 executing program 0: r0 = dup(0xffffffffffffffff) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000000)=0x7, 0x4) clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x31) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="052fc73cb001feffff013d6ba0d70000000000000089dc55bcd41a125d19e38dd69500000026adb1e39affff1ace9cffff070074004000eae4"], 0x39) ptrace$cont(0x18, r1, 0x0, 0x0) epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r0) ptrace$setregs(0xd, r1, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r1, 0x0, 0x0) 04:03:38 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2418.410804] binder: release 19568:19575 transaction 337 out, still active [ 2418.417867] binder: release 19571:19574 transaction 334 out, still active [ 2418.429601] binder: unexpected work type, 4, not freed [ 2418.440633] binder: undelivered TRANSACTION_COMPLETE 04:03:38 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x200000000000000, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() waitid(0x6, r0, 0x0, 0xa, 0x0) 04:03:38 executing program 4: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x24000, 0x0) r1 = fcntl$getown(r0, 0x9) waitid(0x3, r1, &(0x7f0000000080), 0x60000000, &(0x7f0000000100)) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x40082406, &(0x7f0000000040)='selFnodeveth1\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = getpid() waitid(0x2, r2, 0x0, 0x4, 0x0) 04:03:38 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2418.481044] binder: 19616:19619 ioctl c018620b 0 returned -14 04:03:38 executing program 4: r0 = accept$packet(0xffffffffffffffff, 0x0, &(0x7f0000000000)) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00'}) fcntl$getown(0xffffffffffffffff, 0x9) r1 = fcntl$getown(0xffffffffffffffff, 0x9) r2 = getpgid(r1) ptrace(0x4218, r2) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = getpid() waitid(0x2, r3, 0x0, 0x4, 0x0) 04:03:38 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2418.581281] binder: BINDER_SET_CONTEXT_MGR already set [ 2418.593826] binder: 19612:19637 ioctl 40046207 0 returned -16 [ 2418.601389] binder: 19612:19637 unknown command 2097152 [ 2418.612573] binder: 19612:19637 ioctl c0306201 200002c0 returned -22 04:03:38 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() waitid(0x2, r0, 0x0, 0x4, 0x0) [ 2418.638289] binder: 19612:19637 Release 1 refcount change on invalid ref 1 ret -22 04:03:39 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:39 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:39 executing program 4: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, r0, 0x0) r1 = getpid() waitid(0x2, r1, 0x0, 0x4, 0x0) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_FIOSETOWN(r2, 0x8901, &(0x7f0000000000)=r1) 04:03:39 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:39 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000040)=""/14) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:39 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2419.257388] binder: release 19612:19637 transaction 343 out, still active [ 2419.265803] binder: release 19616:19629 transaction 340 out, still active [ 2419.299110] binder: 19657:19663 ioctl c018620b 0 returned -14 04:03:39 executing program 4: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PPPIOCSMRRU(r0, 0x4004743b, &(0x7f0000000240)=0x2) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x121000, 0x0) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080)='SEG6\x00') set_tid_address(&(0x7f00000001c0)) sendmsg$SEG6_CMD_DUMPHMAC(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="b191fc9819890ef594f6ed682f03ed4479699f0a6202cbc6bb0d75f995332f77f2f3d05ad9e9dd94e11137ec7872d9dc9bdf9ab4549347cf15727f654082e7ce7f7da52909a6f81ec8c9f36584071ad5c2d73fcf96e95ec1252f9f5e512891764af13b0949eb0d025c6c95b7956874d21df8cff6f6859404816dab8537825dfad26a78992f8ceb35a40daf7b679543380ab453042663fbe31db2c337f045caa2c7e0dbe7b6df60c3baaa1004e9852836dd4ba3ba3f67e00d5eeca4a2da75611b611f2d8be2380b11e122671cbaa357d34c97b9313ff61fb3000e84192821ce99a03a460338", @ANYRES16=r2, @ANYBLOB="080027bd7000fddbdf250200000014000100fe8000000000000000000800000000aa1000040044000000040000000500000008d10000000000000000060000000000080003000600000008000600450000000800050005000000"], 0x60}, 0x1, 0x0, 0x0, 0x800}, 0x4080) r3 = getpid() waitid(0x2, r3, 0x0, 0x4, 0x0) 04:03:39 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:39 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = accept(0xffffffffffffff9c, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @empty}}}, &(0x7f0000000080)=0x80) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@ipv4={[], [], @initdev}, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f00000001c0)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000200)={@initdev={0xac, 0x1e, 0x1, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, r1}, 0xc) r2 = getpid() waitid(0x1, r2, 0x0, 0x1, 0x0) 04:03:39 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2419.446444] binder: BINDER_SET_CONTEXT_MGR already set 04:03:39 executing program 4: r0 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/context\x00', 0x2, 0x0) lseek(r0, 0x0, 0x3) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() waitid(0x2, r1, 0x0, 0x4, 0x0) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x2) [ 2419.474667] binder: 19660:19682 ioctl 40046207 0 returned -16 [ 2419.486457] binder: 19660:19688 unknown command 2097152 [ 2419.507219] binder: 19660:19688 ioctl c0306201 200002c0 returned -22 04:03:39 executing program 4: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = getpid() waitid(0x2, r1, 0x0, 0x4, 0x0) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000040)='team\x00') getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@remote, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in6=@local}}, &(0x7f0000000180)=0xe8) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000001c0)={@multicast2, @dev, 0x0}, &(0x7f0000000200)=0xc) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000001800)={0x0, @local, @multicast1}, &(0x7f0000001840)=0xc) getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f00000019c0)={0x0, @multicast1, @multicast1}, &(0x7f0000001a00)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000001b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000001b40)=0x14) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f0000001d40)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000001d00)={&(0x7f0000001b80)=ANY=[@ANYBLOB="c771385e", @ANYRES16=r2, @ANYBLOB="280027bd7000fddbdf250300000008000100", @ANYRES32=r3, @ANYBLOB="000102003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r4, @ANYBLOB="40000100240001006d6f6465000000000000000000000000000000000000000000000000000000000800030005000000100004006c6f616462616c616e63650040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004002100000008000600", @ANYRES32=r5, @ANYBLOB="40000100240001007072696f72697479000000000000000000000000000000000000000000000000080003000e000000080004000800000008000600", @ANYRES32=r6, @ANYBLOB="08000100", @ANYRES32=r7, @ANYBLOB="400002003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c0004006861736800000000"], 0x164}, 0x1, 0x0, 0x0, 0x4000805}, 0x0) [ 2419.520107] binder: 19660:19667 Release 1 refcount change on invalid ref 1 ret -22 04:03:40 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:40 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000040)=""/14) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:40 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = getpid() waitid(0x2, r0, 0x0, 0x4, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x40, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r1, 0x29, 0x1, &(0x7f0000000040), 0x4) 04:03:40 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000000380)='oom_score_adj\x00') r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000), 0x10) sendfile(r0, r0, 0x0, 0x79ffff00000011) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000540)=""/140) ioctl$FS_IOC_FIEMAP(r1, 0xc020660b, &(0x7f0000000140)=ANY=[@ANYBLOB="ff7f000000008100000000000000000001000000ffff00000300000000000000040200000000000001f8ffffffffffff29c80000000000000000000000000000000000000000000000010000000000010000000000000000264b0000000000000200000000000000530800000000000000000000000000000000e25c395c000080000000000000000000000000000000ff7f0000000000003f00000000000000020000000000000000000000000000000000000000000000800c0000000000000000000000000000"]) 04:03:40 executing program 2: r0 = perf_event_open$cgroup(&(0x7f0000000080)={0x2, 0x70, 0x100000001, 0x0, 0x6, 0x6f5, 0x0, 0x4c, 0x82802, 0x2, 0x100000000, 0x100000000, 0x7b7, 0x101, 0x3e5, 0x0, 0x70, 0x3ff, 0x7000000000000000, 0x1000, 0xff, 0x4, 0x3, 0x7, 0xfffffffffffff5c3, 0xffffffff, 0x3, 0x4, 0xfffffffffffffffd, 0x7, 0xfffffffffffff000, 0x1, 0x1, 0x5, 0x0, 0x58d, 0x7, 0xff7d, 0x0, 0x7f, 0x2, @perf_config_ext={0xb65, 0x713}, 0x8232, 0x4, 0xf57e, 0x9, 0x7, 0x0, 0x31}, 0xffffffffffffff9c, 0x6, 0xffffffffffffff9c, 0x8) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/enforce\x00', 0x10000, 0x0) ioctl$PPPIOCSNPMODE(r1, 0x4008744b, &(0x7f00000001c0)={0x802b, 0x3}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = inotify_init1(0x0) getsockopt$inet6_udp_int(r1, 0x11, 0x65, &(0x7f0000000000), &(0x7f0000000040)=0x4) fcntl$setown(r2, 0x8, 0xffffffffffffffff) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000280)) r3 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockname$inet(r1, &(0x7f0000000200)={0x2, 0x0, @broadcast}, &(0x7f0000000240)=0x10) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000340)={{{@in=@loopback, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@broadcast, 0x0, 0xff}, 0x0, @in=@empty, 0x0, 0x4, 0x0, 0x6}}, 0xe8) sendmmsg(r3, &(0x7f0000002040)=[{{&(0x7f0000002100)=@rc={0x1f, {0x7, 0x100000000, 0x5, 0xffffffffffffff01, 0x6, 0x5}, 0x1}, 0x80, &(0x7f0000000540)=[{&(0x7f00000004c0)="7fa0296dd524dbdf994f30746fb3bf37bbe5c176b7b98a30cb00fd4967fdbb5e337c75cafc7b69d2195adddd7c0e2424b359e147c5badf3b0242a56f27b6ae5fde2bc3bfd7e5aace64f17a46e9b1b6b121f37429c7ecfae6c31513", 0x5b}, {&(0x7f0000000300)="76092f2ffd459ed2040b9eb1307233eb53914fd3dc587b50ff4f", 0x1a}], 0x2, &(0x7f0000000580)=[{0x1010, 0x116, 0x2, "c81e04a1b84e493b1c3e9cf3527bc18550bf61532ad1c7dafe59a00da520a39912629db3052937a8e6cd6b6ae6d32efe081d4e718ebb7a19b8e6416110cafe0fc9f7978c5eba6d3cb794843d4c3bea356f3e6d8c6fadfb2178c3b313b8755d93d620d5139ea0688e4f6b5c933d3ecfe9eac526c266d2166c6b91fe1c7b8c87aae7aeb535ffbdf3fcfce30f6a5b544e6a4a2861e6f441ce293cdd36c0cf035212babe16203dc07120c3f4c7e319177df31cea87ee12bdfce3c4ac0735bf947c812695e476395d21e450a225f172644b7734d6c67135e601925796e09d06ba9634323d8226accad839b0b28414e07593bbb0f212c58498937828f5eed08d5df21d0f4aaae885e9926d7e3e185f4f05e5b0fffd012d046185f6da3eb3ccd1476390094221521bda8db4b36a1f815a0e4f88aa154e1d4cd183924df244733e3add51b45293c7eee7d04b5dbcbbcdb13dff67c8eeb30ff8e631005886b56877b574c1450912bae7307cc5a46a17e1947539a2d90adf17ef2c920450c0d25d22ba260ebc4d3bb480ac7e6458a9ab8f7f33d972e568cb912ad03caa64b5195df6790b5ead322be8895435bd86e1bd866243f4ce51bac8e5525ef9a951160a724d11e948f6ef72efc42afd5a9e9679c720775851280ad98fbd81f5b8ea16fea5919cd1219b10b65fc0665b714617cd9c83c7304eeebc6d4e27a9143f376b10b890553f90361ac42c1f62760f864c1aa22a6ea5b7d7ef85ad2a2b59b9232d9ef68a12c4bc95aacb661e7ea86ea891efd5bf46712b7c0328e5682e8784ce29734fb15854ee5baf21edcf7d43b67ea18393461b9358a2b3a1496b359ebb9d9ce7cfbd6743c785cd906c5d42214e3ff47907e3393bc580a65d3c8bae0a7b1f4578bc02370e4c0476bde44026d579d2bb2ab83151b92e2c0bbfca70fbc6364a990bbb597d42a26a7cf5294b970cf43ee9f36699e1ae7b9d1bbf9b958476ae813af475fcbfd7caef26cd6786bbed4815aea948b11cfad30d1cb2d9c1db9768eb9db2f553a7224000de40d94cb07df19bfa8159f9e0071c49fdf6aaa18e90984e7cd89d9fd5daeb0c04ddab0e98cad733ff4e2acf0d485c7abd08d7ea1c453abc8e82d937a7efcb4cbc65bf0a4b0faa5c491e115bd58af9935b1b014d1f110004892ef68f567aa368ff2ad5b041683736523d54c4441304e06e74a58662f66bac6d7110f13838a2a24c9b2733fda21cfab6fb37d4a21743c487fa95cee338fc8df2c04b4f47c94408a2f978161862bde53ec7d3cb51c0b96153930ab5c3b9236b162e68f20ea26d81bfd2adb1414624f20666bcf958e50b911e8bed0f7d97647af4516a1b0da2f485afd5a6cc124a1b19981b89ea3661b0d4ce3ebd9319c03d09e80bcc03d72bb72049d133853f3ff012972c32292c1a07a8cb6f6aa9895be2a7b55777d3053fb44e75e580ffd64c17790c033ae194a42ba5d5ea2f0908411cee3e719b3cb8563e4becaccc02e776e4d03555a35190f818d6264b2240ff04fac05beeb0ad2df6260949bbdc68a9915717d225b1bdc0a46860d64d517ec4819fa3470acea904d4491ea59b9407fc727db8c60f9c7e96f0109128f9c6528cb7c64a98ad8649985fadee90ee19147651e18d7cc78091c0724648308862a79e9c30e6598e782b1f401c6882406287f87a38c4eeaa75838567452122093de24ffde4c0dad523243d1f6ad9218be93031ccd659f4fb35a457d3239be2ec6055d68d696091541dc1f982662691b27ee4699292f933a03d1dbc0658c3e013422e4c76898a1d5386af6ccf84839df4bb02b67e99cb9a1bf0598280ddcf0e117b057584cd516e8100f9b95e9352733c70ebf65157ca978722b8378b635bfdc56da7994f6281832ba94b73d0f8f617ff98d3bdf1a0f442b5e791b4493f2300f45d6bf841dfd4ef70c58798abb06d3e815ce9489bb49ef272d9dbf2604e06277d85b14d362e0b3aa046436e623dccf7e804126236130f69a9085bd492f20809923c392577566abc7257d60c64db45720538a310d6d38324ad52bc3e23218add28c7c57d6326a536ff9baebc280a91bd493c3b856cf79bbc11aac63b80e4f2d4b759cc682d59c9193f4b7c6e9bdbc6955b0379b89473a827651f6f82b2e4b9ba9b68429d8cfda8289c934bbf2a8717958ec58375706990f0da4cde947760a20f8b04399a1af88d1d0537fefb77058ca4b4dd8e4f909d666df76c365a6933619130d089ab345a3fd6638afae4efacac2c314bace68a62faaeb554d6657a79c46682a9222e9f98564cba88edd16898b40980f333b70fbaecd82a52592bc45085576d8b652b658af3108eae923231ac3bb2f37f6c2731076461def1d63c863963181a2804175cf76efd1a573552fa9b3cc4e6fbe5ca7c8f29906d30177b74c5b293c384fc24b0791b8df25657918842c7257230c338fa1cedb4d27e329fcdb9338b849cc9f24cb79048425b4326e86e75e0edcbd01e4abbd6919ad10beeb4e40c4ef703a116e87bcc379f903eb09e1b67fa1d2360bcd551ec529e2018b2054baa21d37114805931436614fe8afeff51822df8bb36057173ed8952aa8fd21f12e878050ab31bb9f02fbb8ab865b9c190c5140f14391c3d2e8ee0138146003cb28dc06e5f982270147f4d3565c0a5eafe17b922845fa0c76b33723d130a6dae38a6c5848668b88561296dd8230bb8bf17c3c2c75882b6822f217a3346e51e968ca901209a18bc8ab28b8f0a2965a7347d5063b1ede6f5b7503a23e5ac0b7f911e9c302151f326aa517e9955f5c9c32be10334efadcd98d94e6b8d67ce49b7e08e6944aa237df96606568dfb16ec95dc99b11b9096fe00065b203a519e30d519f178081c27f04775b47749e971dd70cafa5611879b1377e96c9f79895ccf62d129f88fc1e3a1c4e37b88ebee4ddd41bd9609f35e0ef68178f5ed5510db3a0ae3f2263987c524635f3b8d2cd4ce182aade5a7437b7ec2478e621894dbfa3a189d7a4b617c51b2c619e5562b735f41708854471b85f2d4088b01055a9a14fa38058d0da2bd5b1f7a99558939a93b0f82733bdd5aa312d5f956ecce20d90f7e75eb21a8f4925104b611c20585052d2ad5cb42b9da4dcd81a31e846140e4e08fdf20f9e4d20dd31b868e0d9df5acd27d741746271d23550903e19629a8ecaf218d14b13971bf54d83222cd5ff93bfa007a631b415dc3174bae01cb67347fd25273ce40b2cb4494ae5af874593a9187f02a7155b65e0301f26dd69e44e57a01ec52357c8d1a9583bfc3f105f992d0e1ed57a5984e6bc0841b9ce0d12f5b6a21ecaafbf0228d9027014238083e30b15401237959d2140457e36e1f35cc27fde0bdcc0fb9339f461d94abc25b99b7251aaad93304756884dd0e87180538f54b8c1146bc32751b8d99722e3acf671a592412f98a87bb065ef36190ee86dfdbe3380d2e945bb4e264572e8fe985a759d93fc83f06b135b808cc6d41e5a0a219064b2e67875803283ae5eff2b79ed196a6a48579de37b206566c73e3f1c27fda08b7402cacbd0caba38c0d8f640a0402ccf768e0a5d77301ca410b5b6144489240211896060d1d62f8dcd3d6618c5a725de47987f11ea463b82a8966ab33983fe69d0682480d86d8b0f7289cbf55389ada43c4173438b07cc8631c99125c9261601999cde60edcf98f3e7e82a2375e2b7157b6c943ac0bb3248e28079e58428fcee1291a15f162ef3bf59f5823967eb598db5087c666cbba3a59957e1762d42313f57c7c022c94364b26a2f203a0f1264229cdcfddc526d32a831bea24282578f5942ff6ecb0c142cb8357c0cb7cb3b4aafb63bb133c9e3061279ebdf1011a8253145765ba5112b10aba9287263ccb167847bcb6bbcf74881a0fee7bf3bdf96caaa0dd8b07ecda6f6175e70d387afb29151839b3678918afbe7885647b332bde114b6c54014dcc0652cef81d1e67c94dc06bf6e3d9c0e86b2f797ff25ac3cd3e53edc49980d5f0b136d3b018744828441264111dc96f2aa92dbafb0a33e8fe244afbd1d8c96da970d1a0953f667156ce5b6193fde9286c9f11daed7f4d0a6cddfdc4ca8409f6774f47d2e9207cf893d317bf0c9a70cb5065f12d6376f7687bf9b7852d86045480613ef91d868311f4a404014d2214519754bb66c283c433fb5b472ed3c8bfff52b6fb2bc653f36258d6ccf7b7a850bfc4c59aaff176f598a4b19567c8737447dbe44df5d261188bb93f9cfeed8b692fb9968f1942ab8d5e3117a28a8d78e930ea01228d3e284b5ad75291bd9a6712c2f33863c306d6931856de622346ce0e1b6c7d06ed086fe9238c041dd98a72053706d4d2c00fdebdc080d099efd27e3cdce823501f6b37902c5973e3d866a2d132db471eaab6a2daf42231fc5290bedad51bcd363b49601437eacb1cb3dc76b03d6e74b2dcfcf783af0497ef74f79a0a078a647ce4b04e0ca77dcac2774bbca3ae59307ad1389453153779711e4154a8f6a4005d1aca22cb2f02553c7b9c62beb5d049c45a932fe3167255bd9ece3331f14a269339e865ba225e6db2fef81775cab37645233365ac35f227b8f612cd9ab2aeffbb3a07150d744e3d8ce6ef8fd94001153ee274e9c4edafcd35197af0b8fd6505bd310b454b7f85734070596a3e0f0414853d78625170d2cde6c0b38617d305bfbbbb83d15246cc00dac6df5a0aac4ccda4a5abfa7104a6e019753f45c417e9108f6548361a89d6f81855a58e4db06403323f9b5ef489980413c0646e8faba23dbd05b7ef1dd61d38493506f848f385da46bca0c5934015fc168807dec47c43c142abf91a5e4dfcc502e658d15af372baddfbd70b12d9e6d0b78611cc91945f90042aeaacdd7c5a49de823b0ac4d3a0d2bb5824fd0bca544d510e5466cf6826a2ea599af9a13ae4ceb6519bb85c9d915c0180b9367026005c317d83010ded1afa492e44b05e3f0909e6c4918299eb17a02d1fb0fe7d896e05c2ba6cf4e35aa1400f5b68f8fab891b3ce823b8f414f52216c80b4cf7847dbcda21338186a91c6ff404c916bc4a9469fc59e690445db999f6ead31796af6f86168a33954a1e59199c37607c4852b4443de0700a9747dae7829d110d6954ba07982a5ce8fbe38b186907068e6b9ccdc2ac1ad27763082e40500c3dc4b0774b4805c90031414b5708cc84f2b89e81f4433d6a1fb0d15ca5116825189b7dbde1e95b4d56494ae4316c3d9493368376b4ccaa91e28e2fe6ddb7e3bbacdc4a000ad569c6e4116e0e0a0d60e04b83935f69570002d8505a33eddd87fe6501ea8a5d1d443aeeca5bfe7010d40b2cfc6ddedf0c2d37d3a26b0661d94cc81c397c595b97a27281939783dec74bbf7417c2e80dfab815e1c2ba9b4a3659ba38b4c0f6d0e4f529db56c808c76e55a55e56ff2d7b48ecb9a2bade21d080c2274b13da1b6d1fe95d76b03b6f4db55d975c23feeb833844758321294a3fbd07b3860ccb134f8795c59f7b9a7da836ba935175c551abee1e9db100c9fc34c37c408d2b9568c99c3ea75333f4a35419fc084952e92d4748f473bea0ec16082143273499d8e8f005ea816e6bf24fedae07bcb88a340b1d736eb5a63b2451246480274a827f2d06f5f8a0d8cb88da1ab9884f2aaeb9abe38f68ba2668a0966bbe792aeca4b794af2acf9080b4a81e7ff1f847901af6ca56ad4bb9b7f479931a1df0918bde19fc4bda749e449cbba10f721bfb62ea1131fdf98fd6333dd0c190fa7cddff54c4782cd30b9d5c5ec94cf578dbf359c2c86f33cc4a1ed55120a12"}], 0xf5b}, 0x1ff}, {{&(0x7f00000015c0)=@isdn={0x22, 0x9, 0x5, 0xe01, 0x5}, 0x80, &(0x7f0000001800)=[{&(0x7f0000001640)="09748a7440c85cbdf53fb44c166d35e30b2ce4315a8543e8c7fb98e93808fafbf0eb5e0590a430e861f521f37b9e65c28d83557497639d2c5e615379791be4d5af4df2fdff248a36dd32808f8cf353f9468b3a37cfc8d2d2de65a9bf5a3dd27604b28ca11deee12b5adcb9e922eaf799d7b96b5b62f3cefa310db284bc3a72a7ab5c603eb25f4f3f94868fb67b3f7af28336be38b3", 0x95}, {&(0x7f0000001700)="c84df4152114d2fd82710d30dc8e8a3b1fa91f302d8aaff57a283c80f54deb8e67c571c64839968e32dc8c7bcfa1c1757b063f7a13beadef1eab85182a42dcf3ce5e3fda682a71a8d674105445d257c87f728d9315f90b1f282a35da694486b6066345764c9fb891e5d3fefeeaa53725e7e1dc60d242db435000b606a3c0", 0x7e}, {&(0x7f0000001780)="545cdff6cb109b7eaeb73040c893933a64b1056ac47fdf5645d1cdf76758beb4fb20cfd698a671e5023593154d359cc135cd57306df73aaf251031ecb858", 0x3e}, {&(0x7f00000017c0)="6593232fef23757eeb06e904c14b2e385c626734c13e2039cae9f638adc21435ecc688e5372e5ee08c25b1ee8d91e5a640f1cff27c11", 0x36}], 0x4}, 0x7}, {{&(0x7f0000001840)=@isdn={0x22, 0x100, 0x4, 0x4, 0xbbd}, 0x80, &(0x7f0000001cc0)=[{&(0x7f00000018c0)="f9b1708e65c126790dd27540d1f8f8efd16472c6bc4b1974522954e9e42e12258778168dd9b7011e6dc98479799482cc76d192753589ecd669895c5029902c4f75c0c0eb3d2b831bf2d42c479a", 0x4d}, {&(0x7f0000001940)="e817792e062effebac11305c96da509c019f120985cf224b14ba6dec5282102ff5034d268dd7c114194873c6229d5bb44be3b73404573428bac30f7cacf8466ad1", 0x41}, {&(0x7f00000019c0)="9b3eca0397586ad3b1f7ac4c274511c00dee5fe88fd246fe0200af3a9a50f949754d4f32837c005913fb4f5aaf468b2cec8846c721946b6130b12a7f3e5a8d27200eb836296764eea8c5b1b35423894f1becf33920ba0db4c82b5f5a2ef1b35bbcb212075ffe91cbd508195f2e4f2498144a81d09e8df20c96f46505ee169f52b9c09de0622fbc6cdaa9b2634a335841c1ed58cbf80e64c6908f8b726439d766cc6e3e91d5e808fe6cfccb4004293c50f3fed6e1eb8b9e2f4dac013a80524e4a265cd5a34b205fdc3c141366c1de6465bc69f471b2f44ac6ebc9b7dd18d140d47f00d662c627781adb702e", 0xeb}, {&(0x7f0000001ac0)="462a195c3501ef8272e56ff9126c0891b50efc84cac1bbd0bc1a9cd5237b453a", 0x20}, {&(0x7f0000001b00)="a1a21079e4f8236597cbab4b11ea49e5f5cf3c4962142141520165403d10a151b3a2ab117a4811f592aa078bef0e1ec027edf7cd8b58eb4186f6fb4c36c1e6e5d40ad90600000b608dc7e6476a70beecdc22c190502704ee78516f8c1aa90b6b3ae8789a832e81ef4a8704661853e5e34383de3305c2b34bb72d30efe44e4d15cdf689a6eb15f39a38893e88fc22e5d2a69499bdc801e0d8f8c07d0135c0ab46533e", 0xa2}, {&(0x7f0000001bc0)="c4ca8d91f34b9cca6ba86d1add099625aa8ee3c6f9fbebf0e0b40c4cd5e275c16031d53403e5ca33a421b1d6de469b07de2ef5fdee3e552f5e1a8b801f442b4aa0f1af5e3ca466db957bb30632", 0x4d}, {&(0x7f0000001c40)="d39c759c49872cc87cf23a809fbc96e7175605c5160b93bf686e18a18d4e21aa418ffeb634cd4b5e1a6f180840e3f6b64e66a35182f7688e639e7812c8bcf385406baf5047f5ea42241376", 0x4b}], 0x7, &(0x7f0000001d40)=[{0x38, 0x10c, 0x80000001, "5d25b0d8a23271d4b2020dd9ee2b582a7dad4cc5b293d64e2a049db2ecbf86631f59"}, {0xb8, 0x10f, 0x400, "729f66f26575366c8a7c0b6e5bcd041ff10bd9bdb84cecde62124b3dd1c6dfb453cb7cca0c3753ee6fb4907c5d585a9eaec01999d3a6f1229bc0637ff2efeb7b978832418249cce7118b439a74a92c3812322d3ada87974e182274650e09a2d655ffce6ebe817052782d952b89ca11f42d34490dee7b9e41cda32c89798ae71e2a287b204877d6c9da7a13a34f0f24eadcf6c4536b182bd7eaf72525d80c133f436c712c"}, {0x80, 0x10e, 0x2, "ef6a060b6ed02ad7d2e7cb17aeb97dfaae14b73f666baf64c1bc4f87a051209740b60b7877f7a4da07033602909ac4fec7c051862a943a49ceb8250016a10f727c880e14a7f88f7d0503f32acf27b4d3fc657ee53dacd2d427463026591005685b21d730cb8aa7795b7183a34c63f143"}, {0x90, 0x10d, 0x7, "323348d2d1381af48770057bcf6a425da7e00819c0fbb746d0f522dc4108e45aab573aeea546c275cd1e815a3c7ef8b079bccc60d858686a32d3232725c87364c6204a3b08470ca3a2609f57e0a6677efe718738d9db7fc87b4042f1ffd69ee1c63b0b394b99a357937d43d5b75ee74173c1baba2e1fef24f29aab3d279987"}, {0xc8, 0x105, 0x4, "53ae47229b672a47f4ea7bfda6bd1a8f349651ab60808813764ea6ac2a6d832c4e9e021203e14cad49e81804938ba136fd4df28fcefc6af01296f66affb2668c16e2fcc8b992f07d9b04831b85ba18b3607ec5630e9ce1fffc6b828d6ea0c79bb8590426a85c231b1c31734a6c87fab804dbb438d06e2f6a239533c5a988a11b08d87bf5a41947246e5e8c72507e84e0a61a4653a5d408f54a66666c381ab623b1c591ff1ebe478991f649802f1470cd1a40bde74da1"}], 0x2c8}, 0x8001}], 0x3, 0x20000015) futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, 0x0, 0x0) [ 2420.097804] binder: release 19657:19663 transaction 346 out, still active [ 2420.118817] binder: unexpected work type, 4, not freed [ 2420.128621] binder: 19712:19717 ioctl c018620b 0 returned -14 04:03:40 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:40 executing program 0: r0 = open(&(0x7f00009e1000)='./file0\x00', 0x8040, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400000) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f0000000000)=0xaaaf) fcntl$setlease(r0, 0x400, 0x0) r2 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) fcntl$setlease(r2, 0x400, 0x0) fcntl$setlease(r2, 0x400, 0x2) 04:03:40 executing program 4: r0 = perf_event_open(&(0x7f0000000080)={0x3, 0x70, 0x5, 0xfffffffffffffff9, 0x8, 0x0, 0x0, 0xe0f, 0x20, 0x0, 0x3, 0x5, 0x9, 0x5, 0x8, 0x7, 0x0, 0x81, 0x3ff, 0x401, 0x8, 0x9, 0x4, 0x13, 0x0, 0x622, 0x2, 0x2, 0x800, 0x9, 0x5, 0x200, 0x1ff, 0x8001, 0x0, 0x9, 0xdb, 0x0, 0x0, 0x2, 0x0, @perf_config_ext={0xffff, 0x7f}, 0x8400, 0xe04, 0x7, 0xf, 0x1, 0x8, 0x8001}, 0x0, 0xe, 0xffffffffffffffff, 0x2) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000002c0)={0x0, r0, 0x0, 0x4, &(0x7f0000000280)='id1\x00'}, 0x30) ptrace$peek(0x2, r1, &(0x7f0000000300)) r2 = creat(&(0x7f0000000000)='./bus\x00', 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_GINFO(r2, 0xc0f85403, &(0x7f0000000140)={{0x1, 0x2, 0x2, 0x3}, 0x9, 0x40000000000, 'id1\x00', 'timer1\x00', 0x0, 0x7429, 0x80, 0xeed, 0x6}) ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40086607, &(0x7f0000000380)=0x5) ioctl$PERF_EVENT_IOC_PERIOD(r2, 0x40082404, &(0x7f0000000040)=0xb56d) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000240)=0x0) ptrace$setopts(0x4200, r3, 0x3, 0x100000) [ 2420.146296] binder: undelivered TRANSACTION_COMPLETE [ 2420.158717] binder: release 19660:19688 transaction 349 out, still active 04:03:40 executing program 0: r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$cgroup_type(r0, &(0x7f00000009c0)='threaded\x00', 0xd4b9bff) clone(0x104, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() ioctl$BLKTRACESETUP(r0, 0xc0481273, &(0x7f0000000000)={[], 0x4, 0x0, 0x4, 0xeb9, 0x1f9, r1}) write$P9_RLERROR(r0, &(0x7f0000000180)=ANY=[@ANYRES32], 0x4) fcntl$notify(r0, 0x402, 0x80000020) fcntl$setsig(r0, 0xa, 0x10) ptrace$setopts(0x4206, r1, 0x0, 0x0) tkill(r1, 0x4) lseek(r0, 0x0, 0x0) 04:03:40 executing program 4: perf_event_open(&(0x7f00000001c0)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0xa, 0x800000001) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x3}, 0x1c) write$binfmt_script(r0, &(0x7f0000000000)={'!! ', './file0', [{0x20, '!! '}, {0x20, '!! '}, {}, {0x20, '!! '}, {0x20, '!! '}, {0x20, 'ppp1*\\'}, {0x20, '!! '}, {}, {}, {0x20, '!! '}]}, 0x2d) [ 2420.224628] EXT4-fs warning (device sda1): ext4_group_extend:1733: can't shrink FS - resize aborted [ 2420.243831] EXT4-fs warning (device sda1): ext4_group_extend:1733: can't shrink FS - resize aborted 04:03:40 executing program 4: r0 = creat(&(0x7f0000000080)='./file0\x00', 0x0) r1 = syz_open_dev$loop(&(0x7f0000000400)='/dev/loop#\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c00, r0) ioctl$KDMKTONE(r0, 0x4b30, 0xe7) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) stat(0x0, 0x0) fstat(0xffffffffffffffff, 0x0) ioctl$TIOCGPGRP(r0, 0x540f, 0x0) fstat(0xffffffffffffffff, 0x0) [ 2420.349573] binder: BINDER_SET_CONTEXT_MGR already set 04:03:40 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000040)=""/14) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2420.388708] binder: 19725:19746 ioctl 40046207 0 returned -16 [ 2420.395779] binder: 19725:19727 unknown command 2097152 [ 2420.440611] binder: 19725:19735 Release 1 refcount change on invalid ref 1 ret -22 [ 2420.445277] binder: 19725:19727 ioctl c0306201 200002c0 returned -22 04:03:41 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:41 executing program 4: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='.\xb3\x04\x03d_\xe6\xe6+\x10\x8b\xa4e?\xb5\xca\x0e\x11)\xef#', 0x1ff) 04:03:41 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000040)=""/14) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:41 executing program 4: r0 = inotify_init() inotify_add_watch(r0, &(0x7f0000000440)='.\x00', 0xfe) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000400)='/selinux/policy\x00', 0x0, 0x0) open(0x0, 0x200c2, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) sched_setaffinity(0x0, 0xffffff24, &(0x7f0000000500)=0x208000009) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) openat$cgroup(r1, &(0x7f0000000080)='syz1\x00', 0x200002, 0x0) tkill(0x0, 0x0) r2 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) perf_event_open(&(0x7f0000000180)={0x2, 0x4f, 0x618, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f00000003c0)='./file0\x00', 0xfffffffffffffffe) io_setup(0x40000100000003, &(0x7f0000000000)=0x0) ftruncate(r2, 0x0) syz_genetlink_get_family_id$tipc(0x0) getpeername$packet(r2, 0x0, &(0x7f0000000380)) io_submit(r4, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0x377140be6b5ef4c7}]) ioctl$FS_IOC_SETFSLABEL(0xffffffffffffffff, 0x41009432, 0x0) r5 = perf_event_open(&(0x7f0000c86f88)={0x2, 0x70, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x4011, r5, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x400000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe2(&(0x7f0000000240), 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0xb, 0x6, 0x209e21, 0x3, 0x1}, 0x2c) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000340)={r6, &(0x7f0000000380), 0x0}, 0x18) [ 2420.930084] binder: release 19712:19717 transaction 352 out, still active [ 2420.937173] binder: unexpected work type, 4, not freed [ 2420.943480] binder: undelivered TRANSACTION_COMPLETE [ 2420.965151] binder: 19769:19771 ioctl c018620b 0 returned -14 04:03:41 executing program 2: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) recvfrom(r0, &(0x7f00000001c0)=""/3, 0x3, 0x0, 0x0, 0x0) mknod(&(0x7f0000000180)='./file0\x00', 0x1420, 0x0) r1 = dup2(r0, r0) r2 = open(&(0x7f0000000200)='./file0\x00', 0x2, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000340)) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f0000000380)={0xfe, 0x100, 0x2, 0xf13}) open$dir(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x95) ioctl$int_in(r2, 0x5452, &(0x7f00000000c0)=0x3) ioctl$EVIOCSMASK(r2, 0x40104593, &(0x7f0000000080)={0x17, 0xe8, &(0x7f0000000240)="9a996c17112930882c8461ca9bb84efb275544f1d236a4f76a4b79c77e334b58227723632ca7e29bc521da43b6e3391596c8fd8e1b90d7bf79cc594e6df4114884ca3990b5b5f6aa82ba6bed968ee66ec8ca141a3b0b684fdb52f8bf6fd60c1de06ba4d1c46b03c7b0c37c52abddab7532a12625cd8aa84f626d8e02102feee700496e742d82c3fa0cefbac23fe322da0be974368e210c161ba297023ed2f2e58dbab74f5a85976f91a54b0c488fc6fd65b2c0509cc9129acc76ab15f5382f5d46928cfb04cd94ce955b5d70fa86644a859b7587e7146c7d04cf890641646f2d29e73e51a1b57bb4"}) write$input_event(r2, &(0x7f0000000140)={{0x77359400}}, 0x18) 04:03:41 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2421.000695] binder: release 19725:19727 transaction 355 out, still active 04:03:41 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:41 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000040)=""/14) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) [ 2421.222926] binder: BINDER_SET_CONTEXT_MGR already set [ 2421.228482] binder: 19783:19785 ioctl 40046207 0 returned -16 [ 2421.306318] binder: 19783:19785 unknown command 2097152 [ 2421.332084] binder: 19783:19785 ioctl c0306201 200002c0 returned -22 [ 2421.350635] binder: 19783:19794 Release 1 refcount change on invalid ref 1 ret -22 [ 2421.773154] binder: release 19769:19771 transaction 358 out, still active [ 2421.780913] binder: unexpected work type, 4, not freed [ 2421.786214] binder: undelivered TRANSACTION_COMPLETE [ 2421.893573] binder: release 19783:19785 transaction 361 out, still active 04:03:43 executing program 0: mkdir(&(0x7f0000000440)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) r0 = open(&(0x7f0000000100)='./file0/file0\x00', 0x0, 0x0) r1 = openat$cgroup_procs(r0, &(0x7f00000004c0)='cgroup.procs\x00', 0x2, 0x0) write$cgroup_pid(r1, &(0x7f0000000000), 0x2) 04:03:43 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:43 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_all\x00', 0x26e1, 0x0) pwrite64(r0, &(0x7f0000000080)="ff", 0x1, 0x0) ioctl(r0, 0x1, &(0x7f0000000180)) fsetxattr$security_selinux(r0, &(0x7f0000000000)='security.selinux\x00', &(0x7f00000000c0)='system_u:object_r:sendmail_exec_t:s0\x00', 0x25, 0x1) socket$inet6(0xa, 0x6, 0x0) openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f0000000180)='/proc/thread-self/attr/current\x00', 0x2, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000140)={0x0, 0x8000000000, 0x9, 0x20000ffd}) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) ioctl$FS_IOC_FSSETXATTR(r0, 0xc020660b, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x980000}) 04:03:43 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x12, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d45"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:43 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000040)=""/14) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 04:03:43 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2423.274936] binder: 19807:19811 ioctl c018620b 0 returned -14 04:03:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f00000002c0)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$unlink(0x9, 0x0, r1) 04:03:43 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = add_key$keyring(&(0x7f0000000280)='keyring\x00', &(0x7f0000000100)={'syz'}, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz'}, 0x0, 0x0, r1) 04:03:43 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") prctl$PR_MCE_KILL(0x21, 0x1, 0x2) 04:03:43 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:43 executing program 4: r0 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r0, &(0x7f0000002fc8)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000000)="5500000018007f1412fe01b2a4a280930a06000000a84306910000000b000f0035020000060000001900154002000001d40000dc1338d54400009b84136ef75afb83de44110016000d0004000000060cec4faba7d4", 0x55}], 0x1, 0x0, 0x0, 0xfe03000000000000}, 0x0) [ 2423.481170] binder: BINDER_SET_CONTEXT_MGR already set [ 2423.495152] binder: 19809:19837 ioctl 40046207 0 returned -16 04:03:43 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000001c0)=@broute={'broute\x00', 0x20, 0x1, 0x170, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000540], 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0100000009000000000000000000697036746e6c300000000000000000007465716c3000000000000000000000004872696467655f736c6176655f3100006272696467655f736c6176655f3100000180c2000000000000000000aaaaaaaaaaaa00000000000000007000000070000000b80000006c6f67000000000000000000000000000000000000000000000000000000000024000000001f9bf16029c6f67d33397ab27cb70202980708693b59969ffe29b1186b14000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000ffffffff000000009aa8d9b2a246d15b2fbb764cf54fc1e814c86941389e1502a7a6d70f00dd066e6bf425bb7a9cc21f"]}, 0x1e8) 04:03:43 executing program 4: fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000140)) socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) pipe2(0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RLERROR(0xffffffffffffffff, 0x0, 0x0) recvmsg(r0, &(0x7f0000000580)={&(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, 0x0}, 0x0) getresuid(0x0, 0x0, 0x0) r3 = dup3(r1, r2, 0x0) lsetxattr$trusted_overlay_nlink(0x0, 0x0, 0x0, 0xfffffffffffffdf2, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQ(r2, 0x5411, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) setsockopt$inet_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000000)='tls\x00', 0x4) write$P9_RGETLOCK(r3, 0x0, 0x0) gettid() ioctl$sock_SIOCSPGRP(0xffffffffffffffff, 0x8902, 0x0) getsockopt$sock_buf(r3, 0x1, 0x3b, &(0x7f0000000680)=""/4096, &(0x7f00000001c0)=0xfffffffffffffc95) ioctl$FIGETBSZ(0xffffffffffffffff, 0x2, &(0x7f00000000c0)) 04:03:43 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x6}]]}}}]}, 0x3c}}, 0x0) [ 2423.530946] binder: 19809:19837 unknown command 2097152 [ 2423.536364] binder: 19809:19837 ioctl c0306201 200002c0 returned -22 [ 2423.556092] binder: 19809:19814 Release 1 refcount change on invalid ref 1 ret -22 04:03:43 executing program 0: r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ion\x00', 0x200000, 0x0) fcntl$dupfd(r0, 0x406, 0xffffffffffffffff) 04:03:44 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 2424.072702] binder: release 19807:19819 transaction 364 out, still active [ 2424.095074] binder: release 19809:19837 transaction 367 out, still active 04:03:44 executing program 2: request_key(&(0x7f00000011c0)='logon\x00', &(0x7f0000000040)={'syz'}, 0x0, 0x0) 04:03:44 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000040)=""/14) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) 04:03:44 executing program 0: r0 = syz_open_dev$sndtimer(&(0x7f00000001c0)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD(r0, 0x40045402, &(0x7f0000000300)=0x1) readv(r0, &(0x7f0000000600)=[{&(0x7f0000000200)=""/92, 0x5c}], 0x1) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000040)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r0, 0x40505412, &(0x7f0000000480)={0x0, 0x3ff, 0x0, 0x0, 0xf}) readv(r0, &(0x7f0000000000)=[{&(0x7f0000000080)=""/195, 0xc3}, {0x0}], 0x2) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 04:03:44 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:44 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) socketpair(0x2, 0x1, 0x6, 0x0) 04:03:44 executing program 2: sched_setaffinity(0x0, 0x7a, &(0x7f00000000c0)) perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000003500)=[{{0x0, 0x0, &(0x7f0000002580)=[{&(0x7f00000012c0)=""/115, 0x73}], 0x1}}], 0x1, 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='mountinfo\x00') preadv(r0, &(0x7f0000000480), 0x10000000000002a1, 0x4000000000000000) [ 2424.127729] binder: 19864:19865 ioctl c018620b 0 returned -14 04:03:44 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") prctl$PR_MCE_KILL(0x21, 0x1, 0x1) 04:03:44 executing program 0: prctl$PR_SET_TIMERSLACK(0x1d, 0xfffffffffffffcd2) prctl$PR_GET_TIMERSLACK(0x1e) [ 2424.244417] binder: BINDER_SET_CONTEXT_MGR already set [ 2424.253285] binder: 19868:19886 ioctl 40046207 0 returned -16 [ 2424.260511] binder: 19868:19886 unknown command 2097152 [ 2424.266008] binder: 19868:19886 ioctl c0306201 200002c0 returned -22 [ 2424.273191] binder: 19868:19886 Release 1 refcount change on invalid ref 1 ret -22 04:03:44 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0x40046208, 0x0) 04:03:44 executing program 0: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f00000001c0)={'bridge0\x00', &(0x7f0000000000)=@ethtool_cmd={0x4, 0x0, 0xf}}) 04:03:44 executing program 2: perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) clone(0x802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x200000000, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000380)='nfs\x00\xef\xf1a\x17\x12\x9e\xd0Y\x8a\xa8\xd4', 0x0, &(0x7f0000000000)) 04:03:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:45 executing program 2: ioctl$int_in(0xffffffffffffffff, 0x5421, 0x0) shutdown(0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000100)='net/fib_trie\x00') getsockopt$IP_VS_SO_GET_VERSION(r0, 0x0, 0x480, 0x0, &(0x7f00000000c0)) sendmsg(0xffffffffffffffff, &(0x7f0000002fc8)={0x0, 0x0, 0x0, 0x102, &(0x7f0000000400)=ANY=[], 0xffffffc9}, 0x0) perf_event_open$cgroup(&(0x7f0000000280)={0x1, 0x70, 0x51, 0x100, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x5, 0x905f, 0x3fe1, 0x100000001, 0x4, 0x800, 0x0, 0x4, 0x7, 0x1000, 0x0, 0x5, 0x100, 0x81, 0x0, 0xd6f, 0x9, 0x8, 0x3, 0x100000001, 0x0, 0x0, 0x5, 0x77aa, 0x0, 0x8f03, 0x0, 0x9, 0x0, 0x1, 0x1, @perf_bp={0x0, 0x4}, 0x200, 0x0, 0x0, 0x0, 0x7, 0x100000000, 0x200}, r0, 0xa, 0xffffffffffffffff, 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) uname(&(0x7f0000000300)=""/230) preadv(r0, &(0x7f00000017c0), 0x1fe, 0x400000000000) execve(&(0x7f0000000400)='./file0\x00', &(0x7f00000005c0)=[&(0x7f0000000440)='system-\x00', &(0x7f0000000480)='user\'}@\x00', &(0x7f00000004c0)='port0\x00', &(0x7f0000000500)=':-md5summime_type!eth1[\x00', &(0x7f0000000540)='port0\x00', &(0x7f0000000580)='port0\x00'], &(0x7f0000000800)=[0x0, &(0x7f0000000680)='\xb5ppp1\'', &(0x7f0000000740)='#:wlan1,mime_typeselinux,trustedsecurity\x00', &(0x7f0000000780)='port0\x00', &(0x7f00000007c0)='port0\x00']) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000840)) ioctl$FIDEDUPERANGE(0xffffffffffffffff, 0xc0189436, 0x0) socket$inet6(0xa, 0x1, 0x0) 04:03:45 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f0000000040)=""/14) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:45 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x4000000000000000, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 04:03:45 executing program 0: r0 = socket(0x10, 0x3, 0x0) ioctl$SIOCGSTAMP(0xffffffffffffffff, 0x8906, 0x0) getpgid(0xffffffffffffffff) fcntl$setown(0xffffffffffffffff, 0x8, 0x0) sendto(r0, 0x0, 0x0, 0x2000008e, 0x0, 0xec) sync() getsockopt$inet_tcp_buf(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) 04:03:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:45 executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x8}]]}}}]}, 0x3c}}, 0x0) [ 2424.930213] binder: release 19864:19865 transaction 370 out, still active [ 2424.937186] binder: unexpected work type, 4, not freed [ 2424.945574] binder: undelivered TRANSACTION_COMPLETE [ 2424.957831] binder: release 19868:19886 transaction 373 out, still active [ 2424.970908] binder: 19909:19911 ioctl c018620b 0 returned -14 04:03:45 executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x1, 0x7f, 0x1, 0x3, 0x0, 0xffffffffffffff9c}, 0x2c) bpf$MAP_CREATE(0xf00000000000000, &(0x7f0000000400)={0xd, 0x4, 0x4000000004, 0x7fa5, 0x0, r0, 0x0, [0x305f, 0xa]}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) 04:03:45 executing program 4: perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x4000000000000000, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r0, &(0x7f0000000080), 0x1c) 04:03:45 executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0xc, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x10}]]}}}]}, 0x3c}}, 0x0) 04:03:45 executing program 2: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) read(r0, &(0x7f0000000080)=""/230, 0xe6) prctl$PR_SET_TIMERSLACK(0x1d, 0xfffffffffffffcd2) prctl$PR_GET_TIMERSLACK(0x1e) syz_execute_func(&(0x7f0000000040)="3666440f9bf56664400f9f3241c3260fac6a0f00c4c27d794e003e0f1158100019c401ab5d1184cdc4626d98edcd0fc4017f126dcc") 04:03:45 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") keyctl$unlink(0x9, 0x0, 0x0) [ 2425.136331] binder: BINDER_SET_CONTEXT_MGR already set [ 2425.155807] binder: 19916:19937 ioctl 40046207 0 returned -16 [ 2425.164329] binder: 19916:19937 unknown command 2097152 [ 2425.170168] binder: 19916:19937 ioctl c0306201 200002c0 returned -22 [ 2425.177191] binder: 19916:19937 Release 1 refcount change on invalid ref 1 ret -22 04:03:45 executing program 2: 04:03:45 executing program 4: 04:03:45 executing program 0: pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f00000004c0)=[{r1}], 0x1, 0x0, 0x0, 0x0) close(r0) 04:03:45 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:45 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2425.776961] binder: release 19909:19911 transaction 376 out, still active [ 2425.789263] binder: unexpected work type, 4, not freed [ 2425.799877] binder: undelivered TRANSACTION_COMPLETE [ 2425.806871] binder: 19947:19949 ioctl c018620b 0 returned -14 04:03:45 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:45 executing program 4: io_setup(0x1, &(0x7f0000000280)=0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) close(r1) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000300)={'nr0\x01\x00', 0x4005}) io_submit(r0, 0x1, &(0x7f0000000600)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, r1, 0x0}]) 04:03:45 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x1, 0x7f, 0x1, 0x3, 0x0, 0xffffffffffffff9c}, 0x2c) bpf$MAP_CREATE(0xf00000000000000, &(0x7f0000000400)={0xd, 0x4, 0x4000000004, 0x7fa5, 0x5, r1, 0x0, [0x305f, 0xa]}, 0x2c) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) 04:03:45 executing program 2: 04:03:46 executing program 0: [ 2425.827286] binder: release 19916:19937 transaction 379 out, still active 04:03:46 executing program 2: 04:03:46 executing program 0: 04:03:46 executing program 2: 04:03:46 executing program 4: 04:03:46 executing program 0: [ 2425.983484] binder: BINDER_SET_CONTEXT_MGR already set [ 2425.988988] binder: 19961:19970 ioctl 40046207 0 returned -16 [ 2425.996698] binder: 19961:19970 unknown command 2097152 [ 2426.002558] binder: 19961:19970 ioctl c0306201 200002c0 returned -22 [ 2426.009497] binder: 19961:19970 Release 1 refcount change on invalid ref 1 ret -22 04:03:46 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x9, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbf"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:46 executing program 2: [ 2426.601431] binder: release 19947:19949 transaction 382 out, still active [ 2426.632889] binder: 19974:19976 ioctl c018620b 0 returned -14 04:03:46 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:46 executing program 4: 04:03:46 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:46 executing program 0: 04:03:46 executing program 2: 04:03:46 executing program 4: 04:03:46 executing program 0: [ 2426.680419] binder: release 19961:19970 transaction 385 out, still active 04:03:46 executing program 2: 04:03:46 executing program 0: 04:03:46 executing program 4: [ 2426.844779] binder: BINDER_SET_CONTEXT_MGR already set [ 2426.850354] binder: 19986:19991 ioctl 40046207 0 returned -16 [ 2426.857383] binder: 19986:19991 unknown command 2097152 [ 2426.862864] binder: 19986:19991 ioctl c0306201 200002c0 returned -22 [ 2426.869897] binder: 19986:19991 Release 1 refcount change on invalid ref 1 ret -22 04:03:47 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:47 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2427.425881] binder: release 19974:19978 transaction 388 out, still active [ 2427.450348] binder: 19995:19997 ioctl c018620b 0 returned -14 04:03:47 executing program 2: 04:03:47 executing program 4: 04:03:47 executing program 0: 04:03:47 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:47 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:47 executing program 2: 04:03:47 executing program 4: 04:03:47 executing program 0: [ 2427.547658] binder: release 19986:19991 transaction 391 out, still active 04:03:47 executing program 2: 04:03:47 executing program 4: [ 2427.724092] binder: BINDER_SET_CONTEXT_MGR already set [ 2427.729410] binder: 20004:20012 ioctl 40046207 0 returned -16 [ 2427.736748] binder: 20004:20012 unknown command 2097152 [ 2427.742347] binder: 20004:20012 ioctl c0306201 200002c0 returned -22 [ 2427.749257] binder: 20004:20012 Release 1 refcount change on invalid ref 1 ret -22 04:03:48 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:48 executing program 0: r0 = socket$unix(0x1, 0x1, 0x0) prctl$PR_GET_CHILD_SUBREAPER(0x25) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$GIO_FONT(0xffffffffffffffff, 0x4b60, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000000), 0x4) 04:03:48 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:48 executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x800000018, &(0x7f0000000000)=0x7ff, 0x4) sendto$inet6(r0, 0x0, 0x0, 0xc001, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) write(r0, &(0x7f0000001100)="43e8ea125f8e68518d7b73733edc9839028ffc8d2ea800afff9dd85a10c44a278dd7c2ea4109cf5be5ecc7643d7300135f475d84d6815f50f839cee38ade6520dbd51f095af2f2783b6a4efdab6b2e0da432f40394e321b7fc190f1c5536dfea106b67c643df2347a954d547d4cd5c7d7ecb870d9e29fcd9c6917c28a4dda740253937cafc5ef19fab062b1f4c4953c4b2dfa2da150b45aa31230b4dfe1b71bc0f3b44ae55729e8d2b8f58a7b6a2dfc45142c0db5c10e0c8b16e606f96f01ba943bf6de3fad9ee2e09cf0103759bd04e0d939f63bc2933f7c03b646ac6c7cb507573808efb1649f6fef795f285bb44473447077b155abc312ab47e184d39dff9dd8267b5515d59026c98ad79a5029791572d9a453b06305b0b9cb4a742ed73d9e1623f36217ac2ef320b0a72411ab92854cf922108b5a9f48e6f35315923514aeecd7b809be6eb91ce4ac2b9eb287e79b7c477bc5b89509126f3ead78cab7fc20dd1f64a0ee6d23d7319a73221d6b2562cf355e66ff9efe5944bc61ff7b68edaf8460612668385818d473479e9f09071a30b51cf09ec9357961592a66f8987ebc7d0ce10011da2b7ad92345bf5536fb8530bc2b664326b11aaff352dc1249d74167c0f398f45026277e7ff233b30b3a086b4d0cef957d0b4bc633e789d03111967b0e9abb773e534303ac9c09c85bb2878d99e81054c6a8764c6a4f34c2163d8f5e1993227abed1f392cb8598302d8666eaa5dda14ff95028353bcb0d4a0d8fab917e4d973db38da45e3525ecfe0e7bc6ac8cf49bd3a31a68ade73ce9452a7378e076cef3db5ddaeca9183e7194f5ff93c83d6d10477ca8226b59fb71deae1c161a1d7d74ac4dbde0d996728b324e58252095e24f30e95d2da4b74b8f66cfd402defdd97f03f54d5d25baf0392f8caee2256cbdc94c5d47ebb5b2abf574e106c47c214abc1fc64cec2e4123e129e972b1ebcd362f422d59ed0bdaf8a92d43e8023bbd1069588791465804609fb1da11c3f9d8aae628c1fc9f4f410a300e271d9d9bd7fcd2ceaf77cbbe7838bc1f1c7c3f90a8bffb7fd1d16573c87c7dc0e42cb64bc88f3f3a4da9616bc6d5b962be5b51bb6bdf54308749e8e999b4e499eac1b25dc8d57b4032e9fd28456314ba5eee58d597ba002a7d3f915aa4e18259b315d2fea56ca600731309d1fd0f98ad99adb7e96838249f9e7086349a9d020f8493c7ba338272f5d79361bd42e45b9b57c38eefce613dd7b1fe67ac241a91527fec7e59140809eb6fec8dde4beb5d2b094520fc010e64d9934e344078c0926e342b8bb9dd667c37f57a2c87d1516e8d5c7c830bf7f7035118d8bc2acbc9fea9260a5fd1406e249c75f48b777efd160442a6b7379a241ff846e0d602c9f3dc089f79a6346b0f032e80dac10296dfa93915414e42a8d88b9bf428d914e8ef21549dc8f94c71b8c1c59b5cba98c987c1a4cc695d62773ed255eb585954ce92e7f33a0fb312af04c3b456aeb868ebcd67ffd3e32d0f6aa86af85b8ea0311fcf3345cbf569577043314e8db0433de6aea9ee1c4a937cd6c5c17cb8e96f642131d1aeeb190bd17c9ab2d361920341ba32cd3f95fb7e6d97e4d26c560fc8ad78403e591af3550d3d65aef165564cacd20118afde4688fb4dbfebbd05c89a651b352087ae7225a7caf4d9c2a48ff74c8eea65885dd7e3c916fdbde8d027d5868353300c99729690896ca3410ef9a2529d570c4cf14b3af5c38f9f0de993a932c2fe53d5e84585a51109280545940690f2f32358a7819f02e2345b60667c9083be8c548a4fd9bd6f9d64e841e8e0572a48ca190ac75fb4b67290faff1f8868859162a5159ccea51a72d08759f731b05dc55e54c204fdf99bbd952d85a0e5ee09731bdb9f0d718f050c3d771a60174d2869cbee5fc20b8602076bb3132ff3341baa646f9e0ac2966bfc15f01f162a552649da949ffa3cc477a0c0cb3a1d5a8b9cf6aedca801584947430325155653381e008cfa8d4763d8ecc74d801c20f6b0e", 0x599) 04:03:48 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setsockopt$IP_VS_SO_SET_STOPDAEMON(0xffffffffffffffff, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'bpq0\x00', 0x3}, 0x18) r1 = socket(0xa, 0x1, 0x0) ioctl(r1, 0x8916, &(0x7f0000000000)) [ 2428.256115] binder: release 19995:19997 transaction 394 out, still active [ 2428.275818] binder: unexpected work type, 4, not freed [ 2428.276947] binder: 20017:20019 ioctl c018620b 0 returned -14 [ 2428.293747] binder: undelivered TRANSACTION_COMPLETE 04:03:48 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:48 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") prctl$PR_SET_PDEATHSIG(0x1, 0x0) 04:03:48 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") keyctl$describe(0x6, 0x0, 0x0, 0x0) 04:03:48 executing program 2: r0 = socket$inet6(0xa, 0x10000000000002, 0x0) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x0, 0x400, @dev, 0x3}, 0xfffffffffffffcb0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0xe, &(0x7f00000000c0), &(0x7f0000000080)=0x1) 04:03:48 executing program 4: socket$inet(0x2, 0x4000000000000001, 0x0) dup(0xffffffffffffffff) r0 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340), 0x14) r1 = creat(&(0x7f0000000100)='./bus\x00', 0x2) fcntl$setstatus(r1, 0x4, 0x4000) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) r3 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1, 0x11, r0, 0x2) write$P9_RSTATu(r3, &(0x7f0000000c40)=ANY=[@ANYRES32], 0x4) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0xfffffc1d}]) ioctl$HDIO_GETGEO(r1, 0x301, &(0x7f0000000000)) [ 2428.400773] binder: release 20004:20012 transaction 397 out, still active 04:03:48 executing program 0: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/uhid\x00', 0x0, 0x0) r1 = epoll_create(0x15b4) epoll_pwait(r1, 0x0, 0x0, 0x0, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x0, 0x0) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x10000014c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r4+30000000}, 0x0) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) dup(r0) accept4$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0}, &(0x7f0000000100)=0x14, 0x800) ioctl$sock_inet6_SIOCSIFADDR(r3, 0x8916, &(0x7f0000000240)={@dev={0xfe, 0x80, [], 0x26}, 0x4e, r5}) 04:03:48 executing program 2: setrlimit(0x6, &(0x7f0000000000)={0x0, 0x1}) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x8000, 0x0) ioctl$TIOCLINUX4(r0, 0x541c, &(0x7f0000000100)) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write$UHID_INPUT2(r0, &(0x7f0000000140)={0xc, 0x9d, "7a550ac25022ba66c984a9654f0c3ac5fdb60c20a8479c88c998912580f03465446956bca31f6c8304cd8afae89a765a8bb41ed1dbc522d6776c02a42fe8a7cf74a6bdaa9af50e02bf2d02bce17f50746c5984ddb7be3120fae586f9246b2ea2a4f2a0b90f7f54cca41efe4b82527474b0a2b116cf8e5a94ec02e1c001ca8f2fca60882500abf9be1f31be80b52549cf976b3bd2e4e73e0724a9ceb459"}, 0xa3) setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000240)={@broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1}, 0xc) [ 2428.522385] binder: BINDER_SET_CONTEXT_MGR already set [ 2428.528870] binder: 20035:20053 ioctl 40046207 0 returned -16 [ 2428.560300] binder: 20035:20053 unknown command 2097152 [ 2428.585752] binder: 20035:20053 ioctl c0306201 200002c0 returned -22 [ 2428.610368] binder: 20035:20057 Release 1 refcount change on invalid ref 1 ret -22 04:03:49 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:49 executing program 2: getrusage(0xffffffffffffffff, &(0x7f00000000c0)) [ 2429.080415] binder: release 20017:20019 transaction 400 out, still active [ 2429.089136] binder: unexpected work type, 4, not freed [ 2429.097804] binder: undelivered TRANSACTION_COMPLETE 04:03:49 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:49 executing program 4: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x80, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000007c0)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000007000000040000005005000000000000000000001802000068040000680400006804000004000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="7f0000017f000001ffffffffffffffff000000000000000000000000000000000000000000000000000000ffff0000000000000000000000aaaaaaaaaaaa00000000000000000000000000000000000000ffffff000000000000000000000000000900c400000025000801ff7465616d300000000000000000000000767863616e310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000100000000000000000000010000000000000000000000f0001802000000000000000000000000000000000000000000000000000028015345434d41524b0000000000000000000000000000000000000000000000010000000900000073797374656d5f753a6f626a6563745f723a73797374656d645f6c6f67696e645f7661725f72756e5f743a733000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000200100000000000000000000000000000000000000000000000000003000434f4e4e4d41524b0000000000000000000000000000000000000000000106000000000000000700000002000000e00000027f000001ffffff00ff0000ffaaaaaaaaaaaa000000000000000000000000000000000000ffffffffffff000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000400010000040002000100047465616d3000000000000000000000006966623000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000040000000000000000000000f0003001000000000000000000000000000000000000000000000000000040004552524f5200000000000000000000000000000000000000000000000000cd28e7e7cbfd513ab6dbc3f7fd22b0f1cca42588902db53d9059445c53c700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000f6844afe094c57a7909ac6f75911f579a1866ac5c51371e52ab7f3e3a05d83ec1866b11ae93851a85fdc3148003d50f351c183f72d4e57"], 0x5a0) ioctl$int_in(r0, 0x5452, &(0x7f0000000080)=0x3ff) r1 = socket$netlink(0x10, 0x3, 0x9) setsockopt(r1, 0x10e, 0xb, &(0x7f0000f67000)="9adc01ce", 0x4) write(r1, &(0x7f0000000180)="220000002186979f580700f49e8ca9cb5f2513c2888700b1feca6817b3eb10d141aa", 0x22) 04:03:49 executing program 2: r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0xb}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket(0x10, 0x0, 0x401) ioctl$sock_ifreq(r1, 0x89f1, &(0x7f00000000c0)={'\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) [ 2429.122168] binder: 20062:20065 ioctl c018620b 0 returned -14 [ 2429.182046] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=34337 sclass=netlink_audit_socket pig=20070 comm=syz-executor.4 [ 2429.204315] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=34337 sclass=netlink_audit_socket pig=20070 comm=syz-executor.4 04:03:49 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:49 executing program 2: sched_setaffinity(0x0, 0x8, &(0x7f0000000100)=0x5) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x8000000000006, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000600)) perf_event_open(&(0x7f0000000040)={0x1, 0xffffff3e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_pts(r0, 0x0) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0x519) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f00000001c0)="a70d0d7ec4fac7341694b7b7d579a690f26dbfa93013f0bf0561882df1d34620b310a173cd9c30a702cfa8f77f9e3b194c810f7c5f642f73e19439a99a4308229002cc18e531c7cc9e5b18e539b4766f8c441825b6ee1ba4b4ca98e14cf0c8744598c7f347a14335c4b7402dfcde360b776b60ca6c4880e824cd85c5204fbbdd194ec5a62651e934ae864ec919cf72750085") ioctl$TCSETSF(r1, 0x5412, &(0x7f0000000040)={0x17}) 04:03:49 executing program 4: getpid() ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000100)={@remote, @local, @rand_addr="8959a1d99624053f5b48d70028c0a54d", 0x0, 0x0, 0x0, 0x0, 0x4000002}) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000140)=""/246) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x80000, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000080)) fsetxattr$security_ima(r1, &(0x7f00000000c0)='security.ima\x00', &(0x7f0000000240)=@md5={0x1, "877921641a5d342a1579666cfd4112cb"}, 0x11, 0x2) getpid() 04:03:49 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fa, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f00000001c0)=0x4, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000040)=0x820, 0x4) r1 = dup2(r0, r0) getpeername$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$TIOCSCTTY(0xffffffffffffffff, 0x540e, 0x0) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, 0x0) socket$inet6(0xa, 0x0, 0x0) bind(0xffffffffffffffff, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r2 = syz_open_procfs(0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0xfffffffffffffd8c) socket(0x0, 0x0, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, 0x0, 0x0) clock_gettime(0x0, 0x0) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x1, 0xa3) ioctl$TIOCGETD(r2, 0x5424, 0x0) r4 = fcntl$dupfd(r0, 0x0, r0) sendto(r3, &(0x7f0000000200)="afa645afd0e52ae26f65c0af589c75296268befde84e783228b7abbc5a04d26a3811fda6ad8b5191133b7dab6a2728127cf4ccf50e7670363cdcc761c3b12ea45eacd7509ca31b3f4fd2f766b6711e9efd50f5427af96e2ec9fce0ada924b6ba6bd8453301d6d911058764a6ee147a846bc513341c85d7eb184d45bd5a5b8011af0ac7bfeb74e85ad88477385026e7f8e2782b6ec4689923489f816b89ca0247d6", 0xa1, 0x814, &(0x7f0000000080)=@caif=@dbg={0x25, 0xe0b1, 0x1}, 0x80) writev(r4, &(0x7f0000000400)=[{&(0x7f0000000100)="da", 0x1}], 0x1) [ 2429.242920] binder: release 20035:20053 transaction 403 out, still active 04:03:49 executing program 4: ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xffffff7c) r2 = socket$inet(0x2, 0x3, 0xff) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) setsockopt$inet_buf(r3, 0x0, 0x27, &(0x7f0000000080)="b5a4963e9ba76b", 0x7) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) connect$inet(r2, &(0x7f00000001c0)={0x2, 0x1000000000, @dev={0xac, 0x14, 0x14, 0x10}}, 0x10) splice(r0, 0x0, r2, 0x0, 0x110005, 0x0) 04:03:49 executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r0, 0x29, 0x24, 0x0, 0xfffffffffffffffd) fcntl$setsig(r0, 0xa, 0x17) 04:03:49 executing program 2: r0 = syz_open_dev$sndtimer(&(0x7f00000000c0)='/dev/snd/timer\x00', 0x0, 0x0) r1 = syz_open_dev$sndtimer(0x0, 0x0, 0x0) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/cache_stats\x00', 0x0, 0x0) write$P9_ROPEN(r2, &(0x7f0000000080)={0x18, 0x71, 0x1, {{0x8, 0x3}, 0x612}}, 0x18) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000000)={{0x3, 0x2, 0xfffffffffffffffe, 0x1, 0x6}}) ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, 0x0) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) [ 2429.386955] binder: BINDER_SET_CONTEXT_MGR already set [ 2429.407610] binder: 20079:20103 ioctl 40046207 0 returned -16 [ 2429.424468] binder: 20079:20103 unknown command 2097152 [ 2429.430721] binder: 20079:20103 ioctl c0306201 200002c0 returned -22 [ 2429.438225] binder: 20079:20103 Release 1 refcount change on invalid ref 1 ret -22 04:03:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000700)="2ba063fb30"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:50 executing program 0: bind$inet(0xffffffffffffffff, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @loopback}, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00') setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, &(0x7f00000000c0), 0x4) [ 2429.924357] binder: release 20062:20065 transaction 406 out, still active [ 2429.941895] binder: unexpected work type, 4, not freed [ 2429.953748] binder: 20116:20119 ioctl c018620b 0 returned -14 [ 2429.960391] binder: undelivered TRANSACTION_COMPLETE 04:03:50 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:50 executing program 2: r0 = openat$pfkey(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r1 = socket(0x200000000f, 0x10000000, 0xce1) gettid() getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(0xffffffffffffffff, 0x800c6613, &(0x7f0000000100)={0x0, @aes256, 0x2, "94c614edb8cb0660"}) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = creat(&(0x7f0000000140)='./file0\x00', 0x3) ioctl$DMA_BUF_IOCTL_SYNC(r0, 0x40086200, &(0x7f0000000040)=0x6) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f00000000c0)=ANY=[@ANYRES64=0x0, @ANYRES64, @ANYRES64, @ANYRESDEC=0x0, @ANYRES32=r2], 0x1db) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, 0x0, 0x0) write$binfmt_elf64(r1, 0x0, 0x11) fallocate(r3, 0x0, 0x0, 0x4003ff) write$cgroup_type(r3, &(0x7f0000000240)='threaded\x00', 0xf96d) fallocate(0xffffffffffffffff, 0x3, 0x40000005e89, 0xfff9) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x20004000) write$P9_RSTAT(0xffffffffffffffff, &(0x7f0000000280)={0x7a, 0x7d, 0x2, {0x0, 0x73, 0x1, 0x1, {0x20}, 0x0, 0x451e, 0x1, 0x0, 0x9, 'threaded\x00', 0x5, 'wlan0', 0x21, 'system!trustedtrustednodev-@wlan1', 0x11, '/selinux/relabel\x00'}}, 0x7a) unshare(0x40000000) ioctl$sock_inet_SIOCDARP(r2, 0x8953, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x6b3edd432b1d0d12, 0xfffffe) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000300)) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, &(0x7f0000000000), 0x4) clone(0x13102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) gettid() write$binfmt_elf32(r2, &(0x7f00000006c0)={{0x7f, 0x45, 0x4c, 0x46, 0x4, 0x1, 0x1, 0x0, 0x400, 0x2, 0x3f, 0xa57, 0x153, 0x38, 0x2a3, 0x7, 0xba77, 0x20, 0x2, 0x8, 0xb8, 0xfffffffffffffffc}, [{0x70000005, 0x0, 0x15e, 0x1, 0x6d2, 0x0, 0xbc3}], "d024729e47ec26a93f0b2da5f2ef2ff5fc292d3e8f622d3aa8257900ecea8f0e71375a4feecea75ac00196e2cf986cad0b020f9eae88e591ce5adad9cef5f2b4b7c37505f23497379ddee744aab0a1af051c8232e66cde662287493da5c5512d7c011989add35c1f852ff95d5e6c759c21e34911957a0f96548145c1ffbcc3fb71ff6a7654c9934a82576487f80672a345dec5436c1bfd4bb35ff2cc96bd01c2fcd6a6d7bd68b6f88f7471ba91580dc4151ec157fc53206ddffb7aef349fcd9423e866b21165fe48461dd83ebe7043d62d8e4f5643ed5948f491956b2ea2f8d1a992ac086c14fdec1bcf947e999d94b30151e9f10485d382641b80406341d89db3c9e34f34a16b7624d99d328e48fccdf46a5c4a9cad18e8ecb4a91c20e5282b5a4f59f7c4a02b7f9ee2c44111c4a52ee6d3ee522e09dcdb8698591ef8e690569ed5bb228dab5436fa51b7fd501fe7ce57d7db518753ec0c968b8e9dd296b117793ae63008cddac1e812063471260cf1e72b2c8330449b9112b4abef7b1d29937a517f5aa5cca944dac61eb99c8d84a4ce3c2410ec0c959323e0afc1287829821045ea41ac9db92e538c6dfe782af783c298798f3e1f39234bebf7966c28e2657c7e500bd1f5589e7b9504437b02eb93a75701a8dee552ff4e1ee86918f0aac7f067f8d68a676dc36ec5cbded7ff134d948d4da9e9659a902ea3aa23defe610051912fa2c44b627b047b1862d14cf43026f58d84665ea2c31baaecd541ea8a0758ac40b882d858c181f9c62b1077f16e045cd974fea557ee57137e0ddf0851f67929858e20a3b2057261dd8c1e74f49a7c2e37671e32974f1b6166d9c38c4eb7f3c976223eaefc2c17c431818c018cae40a7787593350783e66213f21f00347e29427a1b51d89f5c92a8977b88e7cb359689ef2de28b5d779fb59fedae8f423b6744421644844333710b255a72ca272f9f9278d1ae8a03dbb59dc912c3c9587484dc2227629a3ebe5344495603e2c40448c58fe586e08bac1fc15604ff3efd5c9312ce5672712fd556b3a6e1708b93f0a6b5ab65f288b220226192619cd8c20f233b640b12a05e2905a05d3b7becc2771f13e92cf6e4b942777e6b4c019ee118188ca79fea64a7e9e0f4e9ab4585c1b795a70283a5dc214c531664f4cd09489a01b0644688fb9273bdeb9118ab73bc5347631a8914f3251720f2a241cdf711a8645f7d6c0989a8bc28b994f522bf594221501313d05696e9e0c1e05166b52de6fd999e3d16beb5a565aba325b7c42e1b511794a9242db326f4ecc78f61183e690a52ac7cd837c158c957b3f00c965d99134296c96a3190dabe00a8f7f024e1a06985c3809e884ceceebcd13b39d0bb409fb15f536bfe2b5173ff34c4732d753f55c81f34b22f2566723e7bf39284e2cc98b822ba62080452b60575cf599a0ea33690f75702abb706ac905f0a8c945b84a89dcaa32a4cc3a915fd37ca635e523ff56f1eba214f8235d77cc2e64eec3289701a3586843c63f608c95d029bf04cb11e8e7d8deb129f90121ef53bf4e056dd284e5a4eac238cc116670f70160c740de47706dfd5766f29923955738dc227379ef2e4e4cbac4dc466158ed5dfacc6b1ef620896eb281817e3a7ecf1c958243143d60e9de36eac0cb8e3b9832d09bba844d7a6b44cd7332688d178e60356b3bb9742b9caae6f87ddb93031767d5a4d51628965d477665da79ff08134f87dd22248e2fb56b5a50c334e01aff03b6d4ee4821accb12b0b5abdf90a7abcac3e620cc945f502bf10a7c41b122c2a82d4c04911dbcf673ea63b765ddb5fe79980c9ad35ae61a5e206876da376a223d4e408e060cbc42d3d690a17ee5e533aac28639a048454a49bacfca2f62d80c1244c49c69b3e70a7f8b312baa9aeaace8e2ee1f266c9f470169d33c1f1a5809214b6f079188d596dee0a4c926174a28a5cd9839321cea3fdc38eb8e6a8fe8557126fdb3fc44691cf4872952eb850c1d45ba1645c59f2e6ae720c756b2e479bb9fa12f325e1a81c979975e169f84afb64f7ea5c020c5f60baa872ee53192a1246dd15fe181a15aec354572bb0964d255335d69d6fa1769c362a0e503e687f42e7ea2663cfbce72012146a4b71def22666b56a89a0fc17c4f0dfde314eaac19adcd5eba76c5e75c1ce3a8068711bce0338c0e06ed48ca8a43998ce81fa7605d2500b7a213332f82e002e2ff3752975b1dbf38f24a891c01e302b69ba7d162322c6672268b86324b907d4c0136fe1712113460719e27ebef8d3affd06c8c01e7d03689cd217825e21f71bcda3e05150af0d266f3b9916e23083b9b2b4618f983e06e9ae1879023f89c54d46c38f636ae4d34445f94b59f9cd160cac689df716525cc4a75283ebd77fd1c1129c888a2383909a51ef1b743cf6c9ba2636f8d007ba12716bf8417a123e3630189c818c6e9ea008044d9d0afff9796fa11b92c525230500fc888cd1aa0c885f422633e555710b3f0e57a6a5ca840380c07704559875546f7013ce77a2cc11c71205b92022a79e3288a63fae1840703ec15e21a24c4580930d32d15df17c1ca0f67620eaf83acbcdde9c69162e4fe4a63a624176d865ed494274a7c35d72493b8627b38891dfcf05c92e31fe582779177c842e820d9ca3e807512bbd4d25377aea7364a320061783324908c6e40303fea33a4757f47484f12f509c64db106decc3caa3c0e3d2eb2e4c491dfd57e4247249e9babde42c09208d0b9589caa0c5c91e67114ca1e4e08ba699b94ddf47966ff4d38e2d0bb697468bca07a8cda9e5d307b8986c739216ebf5fe190f1e1002c4e9ff447f12c5b110e44411e39cce42ec05d0d4e386f97ea76459e27eb8597e95d4ae547b810f6b1e3333394ec2611d79622a704e51fc6c3ecb731f2dd75c7583b6661ee4326885b331a1c1545ddc94c86a71f46fc7a07b57317cd447fa28a72af134dfa02ce024f131ad59503740634ff1ac41339d3e1b58d3e270bf874e51286cd4d175226db5baad358da6bf2762fa7feea0fd85465c8456dbddd36187be05fbe5ea6976701291a4667c01f4e53232f11863bc09d0671416d8e25c820b3cd6a641e0c6e2aa3a0d9605ac42b75eb9e485b8cb2cdef77310396f8953829d50c2d0e62730caa44c7d5ebe1c176ed6636313d525dedd18dc078224e1ead951639888694830ab797cc5036e005998e35d49887962af64e609f6092f9e0bb0b2dbef54a2c7ea36e3be26f9e844b9fe8a1a90325d3978ff11a9bc0e4ea775458c1c44af5afb7709646dd7370ded326c0e8d8d1f38f38c82d3718900ceabc04ed64b36e3fd371993cda077e0bd4e7e538287e950241a341138203249d85323d43ac124c7f602d9a9f1ae8b6ca159138c9816642d26f5f31cc19f3d60ece4a5e730662358a090ed4306da69b62839cf4f7e27b47c1bd0e2a4413ef02e0d7caa50d98b6d95328f3b22f61aa988be9b40cfcc46c2fd5aca71a5b2af033cc803056930753569b33ad9c882df7b62642cd779b9173b3634894737e1277ec66684011b72d4069e5a2c1a52620a0c581e88bcfb463e27622b292c0396a8c80e216c583ebd55a632423646dc6d0697019eb968ac767cf95666ef68ce176f64c0b235240094f90f64c08b452e9658358716f7751f2b6023fc47c66f0a204f63d6501d0b436ed2768d64b7055233e355ce12b2488f90c25106b8e0be13117405d1c23c06d7d2185c98a5a09b437d57536682261685f2b3244f374554d616307afe8bce316f011bcdca4b0a275ca174d1de214141817bf8d0954c10588dbe5d0be68a6f34f7f6a918e95cbbfdc3c933709e875db3ebb4287d19d7662c7a3d4fed8cf97e228e20f4b397cecfecde5a6c5c39c96ec32ccb2af4230ab1c01f240636563f378e5e37bf1220219e00b84972cce4426779e74da5c61e011635ebba7621e43a7b0bc7371de56842f10cd63da43fceba6323b7f7a2db5ffd6f153e4f7e40068af23c06fc394cdf7e96b90c1a94cd22ddcaa4fb63f80ce48a9f695d0b9eda596901d0c683c3e88c457871e886e553d1d7aab5efa0b75bf0ef131ceb5c29ec856c1d63fb6a7f17f4cda216a1d1386eed167b3a91f2634ab9d21d9faced3965a20df86ca2a236637e4aaf4eb844ee6787ecbe3b3ffd8f3b05bdd88dfbce2b75a08ae28f17cdb2dccdcd66a3252e363ec93509c3b67ee0fa3d0390cd35e3fb7c48f2ab32eeadd9ef731cb10f1e28c9bb8ee50c0bbba58522d98cc2ecae7e98cc491d6e55f492ef8295b3f7f4c6fa8ebd5e900f870c85ec3b2ef0034241f73aa1d961edb85272ba3af8ad3d382c0564ffdf807a4ad70ef91b4032b497be8540e007d2bfcc542c2c0b8e99d637981ecae0a432626bf51e376f8069c5cd9a34995a33a6dee516d069966610a5f2cb6718f6f8e226fc1705aa2514b6717b08914ff3743d2fe8734547ea9e2736f08af1f32b8b3ed5c9d97764d67de336702d1136f821233a7ccf8a01c80b45174c360522c17c9a83189702c533ab45bab96e07a7c4b8a4f801a912731ca0bdc22bc1de23f98853d2721fda1eb995ae8b7ab59a340700053ce096cfdb799fdd9ed44a8d3662ff6f083025a1d12827b97087264ea3c8475d177c0cd772506de4b41e8e235077ee8a5ef0d1ed6385cfa60b85b324057547cec4067db59ed598e9edc70b7567d8293715d96c7bf0d4125edab8757bf3f0f95ea2096bcbc190ea101f93f22ae27aaa7696ec987e215016405af65c9f542120dcc0c0a3b53157901e697e170d007e9d9b20c533bb9688977c4590ad4188fd3073edee3335ea126806c247b9acd11eaed761e6df1520a6e70d3d743f0931fab67d7bdbc612c44454149c428bc1de58d5ebc735dfc797e552aaae7557d4df7c2a7d6a4a9b5aeb527923b7a240545b789b625ae8a2616e640cb3d9ae88eacba966a6b6cddd9ff2128737c42d4bed08221d7b40cdd3f919944bbd7d4bc284f3d970f7dbabd35c055073d60729cc14b62ab4059856799c12770d4671afedb998f002d01a76bd84ca3052364931b4e962ceaa50927b855eb0dbd928b723aa07f2afcad46a0386456b64f0c36ef8e13e3782d605695daef0ed9b1cadfccd128bf72b9718cc8a7f8801b7030e3520f0eb5cb3b13063cd468ff15f489461ab7552aedae08a547238eef68e36d5b572961141687dabbdc4fc2c512a451c9e80cdfa8cd8f06ea4b5130c21af40be45d5920ae9d62c18e871f9fd8244ae1ae23677251c11ffb4d1de06495dfdf5f79d7adc70cad85e5179824f4580ff08eb9fbf348f47cfb6ca4bcd2de94b0c8b42a3639f7c1656e83b70904541766ff5bda8f23e81e62a4558f71057d4c125da6309b350e5456f73f30f73ae988fb0952d8f763173d86fcfad074269edb8b235d072328d11b32143d5423951dc3d5fdfdeb0ffcce8f162d4e631294a60d74fb978fd01b0e169f11ed3058fa5586e921d614a944784067ee0ed82763520405b7fd0cc8af06203e5b6f5099e78e20dd15d0f94e845f660a4827637e183e4658949355b6c21dc2ad711f564c0ee28c208ed108d2aee89023ac71fb42890bdbd3c3a65b090abaf74364f875b3c34345c37f09bb5a275e72b0ab3edd98b262a5513631798f94377a4b9ad1f7a059a9cd2f57a3b884abb656dfb4c4b3fadb83958e805cb32596b05adf6a618b12ae34e90331ac8b6e36cd176ccd3631736a30985ca84910034b41ddabb160d8ed7d7efb914cf89d86187306170ecde3d", [[], [], [], [], [], []]}, 0x1648) wait4(0x0, &(0x7f0000000680), 0x80000002, &(0x7f00000005c0)) 04:03:50 executing program 0: perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x365f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000200)='net/udplite6\x00') preadv(r0, &(0x7f0000000080), 0x0, 0x0) ioctl$EVIOCGKEY(r0, 0x80404518, &(0x7f0000000040)=""/51) 04:03:50 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:50 executing program 0: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='net/ipv6_route\x00') getsockopt$inet6_buf(r0, 0x29, 0x22, &(0x7f0000000040)=""/25, &(0x7f0000000080)=0x19) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/rtc0\x00', 0x0, 0x0) ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000400)={0x1, 0x0, {0x0, 0x0, 0x0, 0x12, 0x0, 0xff}}) ioctl$RTC_PIE_ON(r0, 0x7005) 04:03:50 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2430.089179] binder: release 20079:20103 transaction 409 out, still active 04:03:50 executing program 4: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000040)='wlan0\x00', 0xffffffffffffffff}, 0x30) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, 0x0) syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x240000, 0x0) r0 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fcntl$setstatus(r0, 0x4, 0x4000) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) creat(&(0x7f00000002c0)='./bus\x00', 0x0) r2 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1, 0x11, r2, 0x0) ioctl$KIOCSOUND(0xffffffffffffffff, 0x4b2f, 0x1bb) io_submit(r1, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r0, &(0x7f0000000000), 0xfffffc1d}]) 04:03:50 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000540)='/dev/rtc0\x00', 0x101001, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101}) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000300)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(r1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000240)={0x0, 0x2, 0x3cc6e8db, 0x80000000000400}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000000040)={0xa, 0x2}, 0x1c) getsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000000500)={@dev}, &(0x7f0000000280)=0xffffffffffffff53) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="108000000010000008000a00", @ANYRES32=r5], 0x2}, 0x1, 0x0, 0x0, 0x40}, 0x0) splice(r4, 0x0, r3, 0x0, 0x1000000000000003, 0x0) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f00000003c0)=0xc) prctl$PR_SET_PTRACER(0x59616d61, r7) ioctl$sock_inet6_SIOCDIFADDR(r4, 0x8936, &(0x7f0000000200)={@remote, 0x41, r6}) sendto$packet(r4, &(0x7f0000000340), 0xfffffffffffffd4d, 0x57, 0x0, 0x0) clone(0x4000003102041ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x16) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00'}) fcntl$getown(r0, 0x9) ptrace(0x4205, r7) socket$packet(0x11, 0x3, 0x300) [ 2430.227280] binder: BINDER_SET_CONTEXT_MGR already set [ 2430.273974] binder: 20134:20147 ioctl 40046207 0 returned -16 [ 2430.291032] binder: 20134:20152 unknown command 2097152 [ 2430.329688] binder: 20134:20152 ioctl c0306201 200002c0 returned -22 [ 2430.337439] binder: 20134:20147 Release 1 refcount change on invalid ref 1 ret -22 04:03:50 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0xa, &(0x7f00002d6000/0x1000)=nil) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') preadv(r0, &(0x7f0000001400)=[{&(0x7f0000000040)=""/113, 0x200000b1}], 0x1, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) ustat(0x4, &(0x7f00000000c0)) getresuid(0x0, 0x0, 0x0) 04:03:50 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='cgroup.controllers\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f00000002c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r1, 0x101, 0x70bd26, 0x25dfdbfb, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0xf48c}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20000010}, 0x4004000) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x2, 0x400000000000004, 0x24, 0x9, 0x0, 0xffffffffffffff9c}, 0x2c) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_SET_CONFIG(r2, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800080}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x8c, r3, 0x100, 0x70bd26, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x70, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@broadcast}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@dev={0xfe, 0x80, [], 0x13}}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x1f}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x8}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x50}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@multicast1}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x1ff}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0x8c}, 0x1, 0x0, 0x0, 0x8000}, 0x80) bpf$MAP_CREATE(0x2, &(0x7f0000003000)={0x3, 0x0, 0x77fffb, 0x0, 0x10020000000, 0x0}, 0x2c) 04:03:50 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:50 executing program 4: r0 = epoll_create1(0xa06) r1 = epoll_create1(0x0) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = timerfd_create(0x0, 0x0) ioctl$EXT4_IOC_GROUP_ADD(0xffffffffffffffff, 0x40286608, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f00000000c0)={0x20000001}) timerfd_settime(r2, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(0xffffffffffffffff, 0x8918, 0x0) epoll_pwait(r1, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000021ff4)={0x2001}) [ 2430.750236] binder: release 20116:20122 transaction 412 out, still active [ 2430.795528] binder: 20186:20188 ioctl c018620b 0 returned -14 04:03:51 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:51 executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000540)='/dev/rtc0\x00', 0x101001, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101}) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000300)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(r1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000240)={0x0, 0x2, 0x3cc6e8db, 0x80000000000400}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000000040)={0xa, 0x2}, 0x1c) getsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000000500)={@dev}, &(0x7f0000000280)=0xffffffffffffff53) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="108000000010000008000a00", @ANYRES32=r5], 0x2}, 0x1, 0x0, 0x0, 0x40}, 0x0) splice(r4, 0x0, r3, 0x0, 0x1000000000000003, 0x0) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f00000003c0)=0xc) prctl$PR_SET_PTRACER(0x59616d61, r7) ioctl$sock_inet6_SIOCDIFADDR(r4, 0x8936, &(0x7f0000000200)={@remote, 0x41, r6}) sendto$packet(r4, &(0x7f0000000340), 0xfffffffffffffd4d, 0x57, 0x0, 0x0) clone(0x4000003102041ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x16) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00'}) fcntl$getown(r0, 0x9) ptrace(0x4205, r7) socket$packet(0x11, 0x3, 0x300) 04:03:51 executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000540)='/dev/rtc0\x00', 0x101001, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101}) ioctl$SIOCGSTAMP(r0, 0x8906, &(0x7f0000000300)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shutdown(r1, 0x0) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000240)={0x0, 0x2, 0x3cc6e8db, 0x80000000000400}) pipe(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r4, 0x0, 0x0, 0x20000001, &(0x7f0000000040)={0xa, 0x2}, 0x1c) getsockopt$inet6_mreq(r2, 0x29, 0x1c, &(0x7f0000000500)={@dev}, &(0x7f0000000280)=0xffffffffffffff53) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000002c0)={'team0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000480)=ANY=[@ANYBLOB="108000000010000008000a00", @ANYRES32=r5], 0x2}, 0x1, 0x0, 0x0, 0x40}, 0x0) splice(r4, 0x0, r3, 0x0, 0x1000000000000003, 0x0) ioctl$RNDGETENTCNT(0xffffffffffffffff, 0x80045200, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f00000003c0)=0xc) prctl$PR_SET_PTRACER(0x59616d61, r7) ioctl$sock_inet6_SIOCDIFADDR(r4, 0x8936, &(0x7f0000000200)={@remote, 0x41, r6}) sendto$packet(r4, &(0x7f0000000340), 0xfffffffffffffd4d, 0x57, 0x0, 0x0) clone(0x4000003102041ffb, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x16) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00'}) fcntl$getown(r0, 0x9) ptrace(0x4205, r7) socket$packet(0x11, 0x3, 0x300) 04:03:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:51 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2430.915493] binder: release 20134:20152 transaction 415 out, still active 04:03:51 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2431.109677] binder: BINDER_SET_CONTEXT_MGR already set [ 2431.166496] binder: 20203:20217 ioctl 40046207 0 returned -16 [ 2431.166845] binder: 20203:20221 unknown command 2097152 [ 2431.190943] binder: 20203:20221 ioctl c0306201 200002c0 returned -22 [ 2431.212616] binder: 20203:20217 Release 1 refcount change on invalid ref 1 ret -22 04:03:51 executing program 1: fcntl$setsig(0xffffffffffffffff, 0xa, 0xb) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) 04:03:51 executing program 0: openat$selinux_attr(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/attr/current\x00', 0x2, 0x0) mkdir(0x0, 0x110) perf_event_open(&(0x7f0000000200)={0x1, 0x171, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x182b88ae}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x2102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() clone(0x4000000, 0x0, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0x11) wait4(0x0, 0x0, 0x0, 0x0) lsetxattr$trusted_overlay_upper(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='trusted.overlay.upper\x00', &(0x7f0000000280)={0x0, 0xfb, 0x10d, 0x2, 0x7, "ff3c102a7800e27f84a307cd01e536c8", "1e9d688c1c080934efb29c23541ab056a1615d26d9c8f7e4523b001e15d954d58531b53f51b08f6e69c766c0db9da4e8023b3c3a11784fb68b6da01c68c4889fc8b79e9b6757ab127c86e92259693ce017e7f7adbaa54e4277df6acfef0cfc6ee44fe718685f9a9672327daa9cc59bf527a060a3408f632323f143b615f78386210309c6556ed63796a81d36274c884d4d9a069294ce885c8d58ed6a645dc35961d3b3c9e299f1126751eaf1f552273952d78b1ea979004caecc0280cfbf32060e5d5db18d8c4dbec7dfc04d6ec230310617651dc582e1299a60691b2bab8da87adef13fc6c9f0959be4a4a35a168cca16a6d4258292a5a8"}, 0x10d, 0x0) readlink(&(0x7f00000003c0)='./file0\x00', &(0x7f0000000100)=""/198, 0x3d3) r1 = open(&(0x7f0000000040)='./file0\x00', 0x8000, 0x108) ioctl$BLKGETSIZE(r1, 0x1260, 0x0) 04:03:51 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000208910, &(0x7f0000000080)="c739b79c6463fafd07e8486ba35717d53db06eaf8fee192ef025a0") r1 = socket$inet(0x10, 0x2, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="24000000200007041dfffd946f610500020000001f0000000000080008000c000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 04:03:51 executing program 0: openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/enforce\x00', 0x0, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000080)=0x10000005) memfd_create(0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x81806) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000140)={0x401, 0x0, 0x0, 0xfffffffffffffffe}) [ 2431.518224] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. [ 2431.540815] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. 04:03:51 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 2431.566549] EXT4-fs warning (device sda1): verify_group_input:104: Cannot add at group 1025 (only 16 groups) [ 2431.586828] binder: release 20186:20190 transaction 418 out, still active 04:03:51 executing program 4: r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000180)='cgroup\x00') ioctl$IOC_PR_PREEMPT_ABORT(r0, 0x401870cc, &(0x7f0000000140)={0x7, 0x4, 0x100000001, 0xfffffffffffffffa}) dup2(0xffffffffffffffff, 0xffffffffffffffff) r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x7d) ioctl$PIO_FONT(r0, 0x4b61, &(0x7f0000000300)) setns(r2, 0x2000000) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c) openat$ptmx(0xffffffffffffff9c, 0x0, 0x80000, 0x0) setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$sock_inet6_udp_SIOCINQ(r0, 0x541b, &(0x7f0000000200)) ioctl$sock_inet_tcp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000100)) connect$inet6(r3, &(0x7f0000000800)={0xa, 0x0, 0x0, @remote}, 0x1c) getpgid(0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f00000007c0)='ip6tnl0\x00', 0x10) openat$selinux_load(0xffffffffffffff9c, 0x0, 0x2, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0x124, r4, 0x20, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x5c, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}]}, @TIPC_NLA_SOCK={0x40, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xffffffffffff2ed0}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}]}, @TIPC_NLA_MEDIA={0x74, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x124}, 0x1, 0x0, 0x0, 0x804}, 0x24000000) 04:03:51 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000208910, &(0x7f0000000080)="c739b79c6463fafd07e8486ba35717d53db06eaf8fee192ef025a0") r1 = socket$inet(0x10, 0x2, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000380)="24000000200007041dfffd946f610500020000001f0000000000080008000c000400ff7e280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0) 04:03:51 executing program 0: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x2000, 0x2000) renameat2(r0, &(0x7f0000000140)='./file0\x00', r0, &(0x7f0000000180)='.\x00', 0x1) 04:03:51 executing program 0: unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000480)='devpts\x00vh\xd2p!s\n@ha.\xc1\x88\x05\x89\x1d\b\xb3Xd\x92Y\x1b\x8c\xc0\xd0\xf4\x952\x8c!JC\xd1]Ul\xa2\x80\x19\x88 \xd4b\x0f\x87\x89P\xb4M\xf7]w\xa9\xb6\xc3}\x16\f\x87ueg$\xd9,\x8c\x9b\xbb*\xfe\x95\xb8\xa1\x9aVA\xb73w\xdf/\xa9\xc5\x8e\xe1\xef\xc5\x8d\x168\xba\"\x83\x8b\xe2\xf7*\xfa\xd20a\x94\xc7yiF\a\v\x14\xd2\xc1z\x94\x9d\x9d\a*\xab\xea\xd9Ee\xac\xa28p\xa2\xa1\x9a;\xb4o\xa0\xf1\xd7&[2\xf2\x82\xbc\xc2tu\xfb\xf5\xb1Y\xd6\xa9\x1b\xbec\xdeA\x8d\x94W)\x93,\xac\x02\x86\xd1\r\x00\xefZ\xf3Y\x84\xdbF\xf2u\xa1\x8b_\x9fe\xfe[q\xb1\\\xcen\bC \x81', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuset.effective_mems\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000001c0)='cgroup.procs\x00', 0x2, 0x0) poll(0x0, 0x0, 0x84d8) lstat(&(0x7f0000000d40)='./file0\x00', &(0x7f0000000b40)) r1 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000040)={'ip6gretap0\x00', @ifru_data=&(0x7f0000000000)="b55d2ef0a85d138de81bb8778b1efc428c88162e88fb40eddb1c983bc3356045"}) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.SMACK64MMAP\x00', &(0x7f0000000100)='ip6gretap0\x00', 0xb, 0x1) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) rmdir(&(0x7f0000000580)='./file0\x00') [ 2431.627599] binder: 20246:20247 ioctl c018620b 0 returned -14 [ 2431.661961] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.2'. 04:03:51 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:51 executing program 2: syz_mount_image$vfat(&(0x7f0000000540)='vfat\x00', &(0x7f00000002c0)='./file0\x00', 0x800000000e004, 0x1, &(0x7f0000000140)=[{&(0x7f0000000000)="eb3c906d6b66732e6661740008001000029634f39ff8", 0x16}], 0x0, 0x0) r0 = add_key$keyring(&(0x7f0000000040)='keyring\x00', &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f00000000c0)={r0, 0x8, 0x1}, &(0x7f0000000180)={'enc=', 'oaep', ' hash=', {'cryptd(cbcmac(tnepres))\x00'}}, &(0x7f0000000200)="2fe29f6a33fe879cbc4fcd72946bfcfda88d760fdc62ea1a883528a7f72ea4733c2f13b1a246bc1f66371b0e1cfaa6b373b778aa8d5db43db4765d61a39f081ed7109d6d458cdba961847abf1221de736f00058ff1f04ed51c036e401cd86700fd", &(0x7f0000000300)=""/140) 04:03:51 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = socket$inet(0x2, 0x800000000000805, 0x22023) fcntl$getown(r1, 0x9) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r2, 0x6, 0x13, &(0x7f00000004c0)=0xfffffffffffffffd, 0xc11b) write$selinux_validatetrans(r2, &(0x7f0000000300)=ANY=[@ANYBLOB='syste\x00_u:object_r:syslog_conf_t:s0 system_u:object_r:modules_object_t:s0 000000700nfined_u:system_r:insmod_t:s0-s0:c0.c1023\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x84) r3 = fcntl$getown(0xffffffffffffffff, 0x9) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f0000000200)='y\x00', 0x2, 0x2) getpgid(r3) syz_genetlink_get_family_id$tipc(0x0) ioctl$TIOCMGET(r0, 0x5415, &(0x7f00000003c0)) write$binfmt_elf32(r0, &(0x7f00000006c0)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x2, 0x9, 0x0, 0xa2b3, 0x3, 0xdf9d405f75a5c344, 0x9, 0x33, 0x38, 0x1da, 0x2, 0x200, 0x20, 0x1, 0x1000000000, 0x400, 0x6}, [{0x7, 0xffff, 0x3, 0x6, 0x0, 0x1, 0x7ad2}, {0x7, 0xfffffffffffffffe, 0x100000000, 0x3af4, 0x1, 0x6, 0x7, 0x200}], "5ec7bb666063f84798a641c139850b04f15b37eb23524187ecc0cdb1d7ccf17bacb2b6b548", [[]]}, 0x19d) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40086602, 0x400007) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r2, 0x800c6613, &(0x7f0000000100)={0x0, @aes128, 0x0, "39ece9f508aaa92b"}) ioctl$TIOCLINUX6(r0, 0x541c, &(0x7f0000000280)={0x6, 0x1f8000}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000680)='memory.events\x00', 0x7a05, 0x1700) getsockopt$sock_buf(r1, 0x1, 0x1f, &(0x7f0000000500)=""/236, &(0x7f0000000240)=0xec) sendto$packet(r4, &(0x7f0000000a80)="c5c3660e956872cd1aa632be07d87078af29dec1d00b284a55f2c51a53e8dd71351ce18018104477b461005df4cfa5671e2f396a3ccab009b0e56c999bb270b76345eb498041efcef77e34329d205d64b98a555282f3854a4c5ef5b9a8ffc4993caf89cdee92c8504a2308a6242e580777cced95ea95b74025b4e62358c32830b7836ac6470cf61ce7d534cf4b0ceddd3a7cb3bf3d24456306f629d5787ac9f982ccbb71d6b309326e8324b7e11071ae4aa4b5e2291ef993f91051672a8ad1e5ea152ff0d4b2fb01df47f22998907a82123ff3bf04ae08d860a43d1c5ea78b531b22817acf208b5d96b91098882eefed6498fac734aa140d16707b6ffa6969edfda5bfeb281c03556e5f5b1e1b985367ee320a5a8b75483e54e5612f8b98e8f1b4c4ba91d279e545bd1d97db3ea54c4ed9101af81064189aebbaa3653dcbc86b794922afd2af0713f2b28d252127797510cadaa8ed22f6c42b9604a5589bc8323678d24c061412ad8d77604ff42eae336bebd8ce6c1c8d9b5c4919e5c2680c77432034ae77a349e19caf9524a12c1a8f4a3a47538c9fac25ae66f85b31bd193af6b682cac47105b14d201911e52c88ce53dd980503e0ad37c20362ac659f4137e36bdbac6c54bc01b95fd336dfca92d419970b46207c7f66c6d622e31147af230cf5c5ebf29f42f949e7c896e7c03c7dea56e518fb2940e3cc4b353884e113921535b025ad6fffbc3ddfbd2cfef937cb5218f09c9d6d56e7e16178a6a7ec94caf02bb6d95e2325575afe17262a9108db442834d9a3bca3a28d7a69ff488d0e40c2061610dbfdde7dd9b505c2742f9e6ba2db1d7500884568901de7571998533e3876d96f105ff0106a5d550c7dc814775b1539a3572f5f679f5292b338d29fe34f4c6cf0deb09342fc5da70db568cf2ba67c8a707928adf9c7094930d612e37dd53584c8957c6ea3a4e299967c8e21d3c44c0905be49bb510f43d9c110aac5c57ddcaa8698cc30f75bcaaa87dabda7b903d001c5412394e2b59f822cfa08fb4a58845e53531798663bfba56df0fe24e99fc0b50210380349f072bc4011b1b9bf4aa6c8bccc055cae66f0021748f6905e37ca17d944a702f9cd8f47e7b6cfde22e08208c54e996f362ed38a1037216fa709e4ebbb8767fb85fb971b75cdb6e524fec6a304f92f193a5c9d12f12d377b73d8bdce4abaf00af5ee5424002bdd1c9b1061c6459104deb3c7ec3b03ef6cff417143d064e5599e44f6cb8ce1a466bac83c16a70c1c3d741c85372dd059852079f46a457c54f74a7ffc9fc3e4d97dd34874c82c5c20803b9fab542f6a585087f348afde72ea8b40993aa887f13244c1584b9698101ad0f648c87093cdf0bedd30b155ab17a226678d4175b06defe635ebd9387f78698b0531914bc4245814984585a0d8ebf2ff3d46cd3457d62a09391ba0228b797315e950690983a26c997f0c9ce3accb9d793d1eb2c99c67b78a2e73c91376832d00a8bb58a1c627b249a4f8b9ecc82941ceff360c50b79c57e6447c9dcecfdd5aca61446cc42d03360934d07ae3de9e2e3a12e58592d697d341ca90a889e37cbabaad48d5ab8022f963a96fb400fd64b3e7ebbf154093e2f08436f06d271c2f870ab1f8430df1b772ad42fef170ef4ac8c0e00296ee36755e67c6e3800a7a217a337424340262371378e87524913d2ce565e8cbbc93ac4802ac8ebf69211eeed1da9baaf78fb505ba46bc1c6d8539ef3f7938969b5a24cb9f90a12d7d1d4689c8366863ebe88265d5be11db6764a8f9a01784cc3ada7c9b363b926d7b0a686d6761a2e12867cad3654cddfd68aa274ac32f66f99442cb934d325ffde947694497ce7198e95d5077255f433144cbd9b8a7c2e25e5bdacdc030ad93fc7d17401c41d9343a31b1bda79b7ccfe43d52d0df155d1351b729053eb5efc97f7643a0aaa48ae979d687a91e8d639f025abf622723bdb37bd81c9237f2d8858af2bcc54cfd221e1a93a050ca03602c3fd458e2a4978390ac905e83be6e58d140c49574e879e2fa3c9fa9df64add9da9fa14e5535118428637858028d153013f9d6ebd7cf30c319b0b7f8969bb402eeff033a8604486f1e927684715a6b740ff8331491562db396bdcdc82b7d51c00a9697c29a9a8013b56503aecc5ce3a80786a493c1c879dcb630216944d5ebbd2fda1c597c53f9a8fbdc8ab059fd1826a4289400ba411aba782f692710bc522a631053945f0c6bff5bb20d99ca3f5e5a4a1d69c4444243acf373a920fe25d4c8f3199c5503331b7e20026f8988e8b1d4987006c9cc44f4ffae7c5b3acc72d834fc6562220f3d24e1a99c4273ef60a9bcd76915d1428f27cc790b1c9e44448096d03e77bbe5071afd582a6a4a3ca8b048ddc90da4363c6ef8c8fc71bd62b9c8a3284c24a334a2238bc880ce7640b3a57869832884ca0ff0becdfd0ef97bfcf1bea0c8f9d44f8ab71c832ef14bda8720eaf25b26206a0d0ef968619f673ce307ae730169225e5a160db52dab043e89e517a48aa012e314cdf537e96765e5e0d4cc1e2c17e2c0a62e62a773c3cdb247817a7d99fc3b484d2d9453f26c3fb51343d54311aecdf0f9bb5251138a8ef3b04cf457e02e991e2742d363469a90fe9ffe6f36b28112bde55ac8792e4e25bb356167356f2305c26b94be5f49693a5ded348ed1001a2d1390745bf842bf27ce19a43832e6adcb67a70b957993f993ea14bfeded1c34ee8aea52092bd5e6ea5e74f214934e56b8d727e14f388adb28f2d825802c1a1cde844b9a81497f2676fc17a891229e90c44ed82d0c049e087795cd16447bc4428aaceecca33aa51aa1316ed476499284bf204dacd53616cf4115dee74d29c7b409c401919ea6f8c02226aa3cd9ef3896de0bd73c114955d68b68ec62c0b645d9f547f499f658b0426af3fa11e8c5f517eeb1f16a47135f6c5a6966496f7a80d3823f90bd4c27c977dd99218853cd762540241dad51101fdcb50c4470568aefa2c8339f3af83866f567ede24806f5da4642db37c110f89b9893faa6f2904252c89f58bb138f9be9f9c2377613d8b76601d56f2e4aec8b626acfe320440748857a0cd7d2a66748872cc3d3486f0a0b57e07931ce97457dd4f5e510333ce62d2fa35aebf3a50151a7136310a4acbdf132e4e823794a49fea5b9f3e8d54ca4f785c19f0273b9d7a84712f7d83e8aeead9096851ad3bb45af56435ee6b204a5b5c14d6ac73a4b05ffa0610ceac627c416376bea4532fa599b17b623dbef4e642614dcca812e63059218cc173e0d65cc43decaa40537b366f467aabd66e4b9b1b0bfc96779680ded7604ab47e189503ccba0a13e904e8926aec630b3c1a1cffc543798849a3a2a637fbb231b3ef15c15e12a0185dd019471e2a0ccda48c1ae67320dbd06e9099a6984bb694ada7c2170293e8e11ed865066820829aed67b4b57ea6634f1ce2b819c0015f05d802f149ce7771e99331aa509ade3182b63d1b8a5bc8c6a9e5e8b961174cbfab01a719b7255513466c580b1054abbe2715144337ebd0c60f77897d4438bbecc880c8d0d7e8aa45128460d08336aa2dafc0c982b770ae17f206f6cdde61a9541a2d2d8c798f30c792491a88a8390dbc954e40f4753df3215ef35e0b444d8c18db33b84807103b6d92aa2ae3b68a49a9061e55552e09086697693d2dbed0c0e08db2b3b5b0343357feab5263e43044546c025c8d67a037fa9654021ec2f1f6ee9575efd7bbf34ea15a45cd64c74b856468c07a1b2125abb20497a77f8ed22240bbfd559aa735c49fc6ef75451adc9f015d2b024eb9bf0fdc0cda1abd27730f9e5c3cf5fce19cd0fa6580f7b7d91bbddcafca2f0859f8b8a4052386e12de70a24a050dacd7ae8002cf46d5209c8fac0c5ef5570d02ddc51ef18d21d9104def437e19e7651debe4bfe1d026c3845fa5f68eafa85095560305b029faed7451bb9666ad457ba236cfeb5bb0ef07b25bbb107b51d50fbef5c79666651837aadb2ba43fd9f990cc3886c31b39688029b3e992b47688872978f6c455db9d5c85e4b0b692689f6f43ff70260b834a4e188a444f6dee8e30e011c4919f4625002b3de3655130874d8dedb16e69ef983a7b8846d592c546ac62a1d311b496d3bfdcde8c846d85996d6df5f1245f26812dddec55cce272a48f0a5b3226b175d70442c8b27437f75c0160b73c923c501c2bd2813e61aca7659f5b2250669440923adffc4cdff809eefe0667c98c0f1e54cde0f47f3d7d93c7bb1309bc3d08b94f7089214b15563971787d2b1b532fdf13723f935518f2549533bc075118b1affba75f857595530edfbded7dce229fe443a0f72234d3c2ca7ffe205ec33a89b93c85182627b5c096c371811446fcfc2ce5c93cf4970d15901e2c0e8a44e7bb93d13dc3b571b61bc1039605b41d47ec9ce8a690ef878bb39e01cbe64de1ef477bef2835332085f23fc755c9d31d3eb531eeaf84bc19adb9363fcea16c20c75e9ed04d7e534ad488cd49c71d6557ac3b57450e2880781ce552daec4dfe7b5a9bf3f85c1be9fb5da80ead00924e90b110669b1647460ef8345dbf337b6336e6f77c72095bf1f027b80aa5e05e900d660af017dfaf9752936b00aba0116022ead68a954cbb02198afd53ec722f6f53b8ac000da11d521261e8075d5d136e29dc21d18ae6ea708c3adbc2b4634c8917f870c02b78381b624092f6ff655c78070e74d852567f68c57ed9d07657ada06093805fd9d814c43286aa18a4c54e4632378a1e05f6162b381527fdf53c18f34925b8e157559d69abff65c31298ed09bacd70e68a5df74b86ed39f91aa301b6393ca03682a183f0439cd7c84f864a916a84a4cd69988bb0605886b3c60c0627303c00c71ffa0167e6ff4a1155723f1429ad87d9b4caf3d8360b8585c11debbd2587dee54211e76039684c363e8e1157df2ff83567c7532bac6028bbab4c212dd29fd590b6ed91a2c782ecfeb7078231a1c2fcdeb0f3", 0xdd4, 0x4004000, 0x0, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r2, &(0x7f0000000480)={&(0x7f0000000140), 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x1c, 0x0, 0x202, 0x70bd28}, 0x1c}, 0x1, 0x0, 0x0, 0x8800}, 0x1) write$cgroup_subtree(r4, &(0x7f0000000240)=ANY=[], 0xfffffffffffffc58) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x0) ioctl$EXT4_IOC_MIGRATE(r4, 0x6609) socket$inet6(0xa, 0x7, 0x5) [ 2431.772727] binder: release 20203:20221 transaction 421 out, still active [ 2431.875393] binder: BINDER_SET_CONTEXT_MGR already set [ 2431.881321] binder: 20267:20273 ioctl 40046207 0 returned -16 [ 2431.889061] binder: 20267:20273 unknown command 2097152 [ 2431.895124] binder: 20267:20273 ioctl c0306201 200002c0 returned -22 [ 2431.910490] binder: 20267:20273 Release 1 refcount change on invalid ref 1 ret -22 04:03:52 executing program 2: accept4$inet6(0xffffffffffffffff, 0x0, &(0x7f00000001c0), 0x0) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, 0x0, &(0x7f0000000000)) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/policy\x00', 0x0, 0x0) futimesat(r0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={{0x77359400}, {0x77359400}}) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pselect6(0x40, &(0x7f0000000280)={0x100000001, 0x0, 0x0, 0x0, 0xf3, 0x80000001}, 0x0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'hsr0\x00', 0x1}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TIOCSLCKTRMIOS(0xffffffffffffffff, 0x5457, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000040)={@local, @dev, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x0, 0x0, @local={0xac, 0x28}, @dev}, @tcp={{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) 04:03:52 executing program 1: fcntl$setsig(0xffffffffffffffff, 0xa, 0xb) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) 04:03:52 executing program 4: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockopt$IP_VS_SO_GET_DESTS(r0, 0x0, 0x484, &(0x7f0000000040)=""/175, &(0x7f0000000100)=0xaf) listen(0xffffffffffffffff, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000000), 0x4) 04:03:52 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r2 = socket$inet6_udplite(0xa, 0x2, 0x88) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @mcast1={0xff, 0x3}, 0x40}, 0x1c) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, 0xffffffffffffffff, 0x0) 04:03:52 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:52 executing program 2: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) ptrace$setopts(0x4200, r0, 0x6, 0x10) clone(0x1000500002c100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r1 = gettid() tkill(r1, 0x22) ptrace$setopts(0x4206, r1, 0x0, 0x0) sched_setattr(r1, &(0x7f0000000000)={0x30, 0x7, 0x0, 0x9, 0x3, 0x8, 0x7}, 0x0) wait4(0x0, 0x0, 0x0, 0x0) 04:03:52 executing program 4: ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000000c0)) r0 = fcntl$dupfd(0xffffffffffffff9c, 0x0, 0xffffffffffffff9c) sendmsg$TIPC_NL_MON_SET(r0, 0x0, 0x80) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x0) read(r1, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/mls\x00', 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x800000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(0xffffffffffffffff, 0x0, 0x0) recvmmsg(r2, &(0x7f0000003b40)=[{{0x0, 0x0, 0x0}}], 0x300, 0x0, 0x0) setsockopt$sock_int(r2, 0x1, 0x2e, &(0x7f0000000000), 0x4) shutdown(r2, 0x0) setsockopt$IP_VS_SO_SET_EDIT(0xffffffffffffffff, 0x0, 0x483, 0x0, 0x0) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f0000000200)) getdents64(0xffffffffffffffff, 0x0, 0x0) io_setup(0x101, &(0x7f0000000040)=0x0) io_getevents(r3, 0x26, 0x8, &(0x7f0000000100)=[{}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000080)={0x0, 0x1c9c380}) [ 2432.427349] binder: release 20246:20247 transaction 424 out, still active [ 2432.441595] binder: unexpected work type, 4, not freed [ 2432.448239] binder: undelivered TRANSACTION_COMPLETE [ 2432.463092] binder: 20301:20305 ioctl c018620b 0 returned -14 04:03:52 executing program 2: r0 = open(&(0x7f0000000180)='./file0\x00', 0x40, 0xfffffffffffffffc) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) execve(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x4, 0x830, r0, 0x0) 04:03:52 executing program 0: unshare(0x20020000) mkdir(&(0x7f0000000140)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000480)='devpts\x00vh\xd2p!s\n@ha.\xc1\x88\x05\x89\x1d\b\xb3Xd\x92Y\x1b\x8c\xc0\xd0\xf4\x952\x8c!JC\xd1]Ul\xa2\x80\x19\x88 \xd4b\x0f\x87\x89P\xb4M\xf7]w\xa9\xb6\xc3}\x16\f\x87ueg$\xd9,\x8c\x9b\xbb*\xfe\x95\xb8\xa1\x9aVA\xb73w\xdf/\xa9\xc5\x8e\xe1\xef\xc5\x8d\x168\xba\"\x83\x8b\xe2\xf7*\xfa\xd20a\x94\xc7yiF\a\v\x14\xd2\xc1z\x94\x9d\x9d\a*\xab\xea\xd9Ee\xac\xa28p\xa2\xa1\x9a;\xb4o\xa0\xf1\xd7&[2\xf2\x82\xbc\xc2tu\xfb\xf5\xb1Y\xd6\xa9\x1b\xbec\xdeA\x8d\x94W)\x93,\xac\x02\x86\xd1\r\x00\xefZ\xf3Y\x84\xdbF\xf2u\xa1\x8b_\x9fe\xfe[q\xb1\\\xcen\bC \x81', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000180)='cpuset.effective_mems\x00', 0x0, 0x0) openat$cgroup_procs(r0, &(0x7f00000001c0)='cgroup.procs\x00', 0x2, 0x0) poll(0x0, 0x0, 0x84d8) lstat(&(0x7f0000000d40)='./file0\x00', &(0x7f0000000b40)) r1 = dup2(0xffffffffffffff9c, 0xffffffffffffff9c) ioctl$sock_ifreq(r1, 0x8924, &(0x7f0000000040)={'ip6gretap0\x00', @ifru_data=&(0x7f0000000000)="b55d2ef0a85d138de81bb8778b1efc428c88162e88fb40eddb1c983bc3356045"}) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.SMACK64MMAP\x00', &(0x7f0000000100)='ip6gretap0\x00', 0xb, 0x1) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) rmdir(&(0x7f0000000580)='./file0\x00') 04:03:52 executing program 2: r0 = getpgrp(0xffffffffffffffff) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000040)=0xc) rt_tgsigqueueinfo(r0, r1, 0x22, &(0x7f0000000080)={0x1d, 0x2}) syz_open_dev$binder(&(0x7f0000000e80)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) 04:03:52 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:52 executing program 2: mlock(&(0x7f0000ffb000/0x2000)=nil, 0x2000) r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000200)={0xc000040e}) sendmsg$IPVS_CMD_DEL_DAEMON(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x81000200}, 0xc, &(0x7f0000000140)={&(0x7f00000005c0)=ANY=[@ANYBLOB="600000003a49ba3c984afccb71e1928c66cb43b68f4c80bd43ad3a95917dcc755f8997cd6d73ff6732b88b47281af031ccbd4f8874212ace34f67d548effd2450ca2ea6db5353155d0cd5a636b8240c495d39109dc88ab2b84cbdf3b4dcbe84e3b627843390beeb35cc0142ff4006980bb143a2c0e42dd0521ba76e938fec6e6b6eed609d84c57ec9f302853ba390b6c36ec07b0645fdb3b5adf5eb54ab839dce82fc71803980349fb759212760a5d045bd1107e6434bcec19a38a0e331e62a75f6e28f7335f4cc9dc024d3f0f60dfef1b33f50ac2fd7ecbc0722225c2a5b1a3366ba5e6fb30084dd6a2d8def7f74a2fad38b7e269d8775e61d21fa8dc86b5daf5f041097e6496314869c4ff48a2a94cb2dcadc3904e2a50d3fbc17f64608c2d9a2e572952e3b3c2f023b3b3182fecef49c619f70a49e92eb75aac70ba3fa52479d857ee30d13f90c1bef5caa95e8387d9bca93971124c7d7c9664997a7482c796839f26d33844392b0b4d6fa40a028607d7ea6dc9bda59b513a872d7b6643896217638ac482a12dccd04dbe22579a1c457847256a711b765ba6c5ddfb32cc1356dde6be7a0fa9da6d6406c8447de10ed76a55ed0898a8c467a50c430af313fc881aa8413a8db43713f76c47d7dff3c1079068e190db3eb00c5885a1abd6062c5995eef472d3cf003396434b6ee17198b632eb69a1d1e238dbe8", @ANYRES16=r1, @ANYBLOB="040029bd7000fddbdf250a0000000c000100080008000100000040000100080002006700000008000500000000000c00070000000000020000000800050002000000080008004797000008000200870000000800050002000000"], 0x60}, 0x1, 0x0, 0x0, 0x80}, 0x8080) mremap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000ffb000/0x1000)=nil) [ 2432.624783] binder: release 20267:20273 transaction 427 out, still active 04:03:52 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x24400, 0x0) ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f0000000080)=""/81) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000400)='/dev/ppp\x00', 0x101002, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000001600)=""/246) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f0000000300)={'bond_slave_1\x00', 0x7ff}) r3 = memfd_create(&(0x7f0000000280)='^\x00', 0x0) writev(r0, &(0x7f00000002c0)=[{&(0x7f0000000140)="13c5a10452dacb8011d660851db34dc4ce2293d3b8e4cc69b32db3944af6ffce", 0x20}, {&(0x7f0000000180)="8cc16080500fa12d73f4d14812672a0883ea8df3b6d9fce2d5d6fdb6d4f8b28fbc9c8167e0acd542d18e7293421162e9e8eb1281c927ee817db654d83be09011494f2c818ee12005a38820b3de9db8f635c0acb0bd5f85f5fe65c877117819d8906dd9425bdd7a2eb4920332939c7bd6b9356a7a8d7cde7bfbdde7d3b12a03e23a7a0063847d15bc9e468b3684bcb88f02e3cd9f49fb07d19446cf07d7bc65e321506e3b18c4fcd2d9e83341d2407461a93727c3c5255d487103572eddc3a8cd40d1ace0ee0f23bbf5557c0ddcbdb64ae87704de", 0xd4}], 0x2) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f00000003c0)=0x17642c4) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000000)) pwritev(r3, &(0x7f0000f50f90)=[{&(0x7f0000000100)="a8", 0x1}], 0x1, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000440)=""/4096, 0x1000}], 0x1, 0x0) sendfile(r2, r3, 0x0, 0x102002700) [ 2432.721409] binder: BINDER_SET_CONTEXT_MGR already set [ 2432.728156] binder: 20331:20342 ioctl 40046207 0 returned -16 [ 2432.735895] binder: 20331:20342 unknown command 2097152 [ 2432.741754] binder: 20331:20342 ioctl c0306201 200002c0 returned -22 [ 2432.753459] binder: 20331:20342 Release 1 refcount change on invalid ref 1 ret -22 04:03:53 executing program 1: fcntl$setsig(0xffffffffffffffff, 0xa, 0xb) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) 04:03:53 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f00000001c0), &(0x7f0000000200)=0x4) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000002800)='/dev/ppp\x00', 0x0, 0x0) getdents(r2, 0x0, 0x0) r3 = accept$unix(0xffffffffffffff9c, &(0x7f0000002900)=@abs, 0x0) splice(0xffffffffffffffff, &(0x7f0000000400), r3, &(0x7f0000002640), 0xb33, 0x8) fcntl$setsig(r0, 0xa, 0x2e) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x40, 0x0) clone(0x2902001ffb, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000002b80)='/selinux/policy\x00', 0x0, 0x0) r7 = socket$key(0xf, 0x3, 0x2) ioctl$PERF_EVENT_IOC_RESET(r4, 0x2403, 0x8) sendmsg$key(r7, &(0x7f0000001500)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000440)=ANY=[@ANYBLOB="020d00000602000004000000ffffffff030006000000000002000000e000000100009f000000000000080012000220020007000000000000000600000000000000f52b023e2c74e79b970a0000000000000400000000000001ac14ffff000000000000000000000000040017"], 0x6c}}, 0x0) rt_sigtimedwait(&(0x7f0000000040), 0x0, &(0x7f0000000180)={0x0, 0x1c9c380}, 0x8) fcntl$F_GET_RW_HINT(r1, 0x40b, &(0x7f0000000600)) r8 = getpid() rt_tgsigqueueinfo(r8, r8, 0x16, &(0x7f0000000100)) ptrace(0x10, r8) getsockopt$inet_mreq(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000002680)={@remote}, &(0x7f00000026c0)=0x8) ioctl$FS_IOC_MEASURE_VERITY(r5, 0xc0046686, &(0x7f0000000500)=ANY=[@ANYBLOB="03005f005880d2b5d0baea4ee84da2207a38f4b0f96e2a61c82bba4a3e69b72e862301ca7afd647570154c07acb844fb1575fbe995875ba9eb729c4d78725c54dd4f90aba3a47e0e13f4719417c90ae166c6b1cdfa4e0100010000000000457ba3559d1e543c4458c7fabb17264b6eec1edeaa153428bea825906f8778d0d37bb61cb623f10fad5ffbf390143897fb4c6b043e2058c390c08995375ee29893a2e65952545ccaba2693e6f6f2529e693aa65eb8c81d86b2000000d816630143947db8557d64883db8d01f03f695be94f1d279c5e258a00fc9c71fb2d123497b6300000000000000000000000000000000"]) getsockopt$packet_int(r6, 0x107, 0xc, &(0x7f0000000080), &(0x7f0000000240)=0x4) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f0000000280)={@ipv4={[], [], @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x5, 0x3, 0xff, 0x1, 0x4, 0x2}, &(0x7f00000004c0)=0x20) wait4(r8, &(0x7f00000003c0), 0x200000000000, &(0x7f0000000300)) ptrace$pokeuser(0x6, r8, 0x388, 0xffffffffffffffff) ioctl$VT_RESIZEX(r6, 0x560a, &(0x7f00000000c0)={0xffffffff, 0x7f, 0x0, 0x8, 0x10001, 0x100000001}) 04:03:53 executing program 4: r0 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000080)={{0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe}}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) dup3(r1, r0, 0x0) 04:03:53 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:53 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, 0x0) socket$packet(0x11, 0x0, 0x300) r0 = socket(0x10, 0x3, 0x0) ioctl$sock_ifreq(r0, 0x89f0, &(0x7f0000000080)={'ip_vti0\x00', @ifru_data=&(0x7f0000000000)="b06f31673d3da2b793d4f9a507e3c9133ba7ce8f5e6e538ecf8829b08f7f4aae"}) connect$netlink(r0, &(0x7f0000000140)=@proc={0x10, 0x0, 0x25dfdbfc}, 0xc) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f00000000c0), &(0x7f0000000100)=0xc) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) 04:03:53 executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000140)={'sit0\x00', 0x0}) 04:03:53 executing program 2: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/policy\x00', 0x0, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x1) r1 = timerfd_create(0x3, 0x80800) close(r1) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) sendmsg$nl_netfilter(r0, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000240)={&(0x7f0000000100)={0x108, 0xf, 0x2, 0x2, 0x70bd2c, 0x25dfdbfd, {0xc, 0x0, 0x8}, [@nested={0x3c, 0x5a, [@generic="bd", @generic="bf975c6119a854ed0799bc630905ff08c1978f574187ec319991e2fd6788461f4530e750a0da2bf6c59003b11c7575f799978c8f28"]}, @generic="be75ee002e3f38eb1a089f0041cd6b78644d42d37859442dfb55c6623c20374ff7e04d8a3788e3f64d1793679c20d26351da3ad95f283d1bd61c902fa3e6bf6a9b69b05bdd9fe4be5e4a8611bd459beabb9734282e1878f843b62460355e6d60fee0759a825df1f497eaa32e8f07320b025f645b7bbc7af49215648075cc58829841d6e5e3ac0ccc", @nested={0x18, 0x8f, [@typed={0x14, 0x83, @str='/selinux/policy\x00'}]}, @nested={0x18, 0x7c, [@typed={0xc, 0x22, @u64}, @typed={0x8, 0x3c, @pid=r2}]}]}, 0x108}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) [ 2433.260224] binder: release 20301:20305 transaction 430 out, still active [ 2433.271410] binder: unexpected work type, 4, not freed [ 2433.290805] binder: undelivered TRANSACTION_COMPLETE [ 2433.308096] binder: 20364:20366 ioctl c018620b 0 returned -14 04:03:53 executing program 0: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000040)=0xe71) r1 = syz_open_dev$binder(&(0x7f0000000640)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 04:03:53 executing program 4: bind$inet6(0xffffffffffffffff, 0x0, 0x0) listen(0xffffffffffffffff, 0x0) setxattr$security_smack_entry(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='security.SMACK64\x00', &(0x7f0000000140)='eth0},nodevmd5sum]\x00', 0x13, 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0x7, 0x0) clone(0x802122001ff9, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x9, 0x2b, &(0x7f0000000480)=ANY=[@ANYBLOB="180000004fd215d3e15383c3e95abd5a111fb33e000000000000000000000000790057d085af8a462eac4372270200000000009500000000000000f09926c67b0ae1379f704dca3ed2b336316a14d4ace8912141b557dedd3d0e1d3ca0a10a144edd3111a202b416ffece8462700269c6b1bd0e6065e9e64fa754a7c6b0bbc43298a8e147dfe971924e6f7c1ab34878a37257dadad8efd62774463a56c27cb821c91c52efc06ae04541a5ee17b2c7feecdf96b50475ad9c8ede9dee6de53f3a12c2f1e5216328d7dbfabd650e0b5bd20dcbc59b607c8625c00aff6765c050a0c4d5493b9d7c769ddd2e9108b4278ecea04ef6b9e62018112ca7ce60f23b5393009c48228275a610bd9d5fc9a3b30a7c174b8e19cf1d26e7834158fe3fb5d4db72795ac0e75c41bad5ec40c63facf6b9715b0cfe2cb38471026962d17573999083cceb9d600f58f3a83699841c3157b2f0dfc0706bb6fc232f50dbe6a51"], 0x0, 0x80, 0xfb, &(0x7f00001a7f05)=""/251}, 0x48) prctl$PR_SET_ENDIAN(0x14, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) write$P9_RLOCK(r0, &(0x7f00000001c0)={0x8, 0x35, 0x2, 0x1}, 0x8) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000200)={@local, 0x0}, &(0x7f0000000240)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000280)={'team0\x00', r1}) 04:03:53 executing program 2: perf_event_open(&(0x7f0000000040)={0x1, 0xff42, 0x0, 0x0, 0x0, 0x4, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0xfffffffffffffffc}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$user(&(0x7f0000000180)='user\x00', &(0x7f0000000240)={'syz'}, 0x0, 0x0, 0xfffffffffffffffe) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$BLKIOMIN(r0, 0x1278, &(0x7f00000001c0)) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_inet6_udp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000140)) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_STOP(r2, 0x54a1) keyctl$assume_authority(0x10, 0x0) lsetxattr$trusted_overlay_redirect(0x0, 0x0, 0x0, 0x0, 0x0) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000000), 0xffffffffffffffff) request_key(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f00000000c0)='\xd1?\xf3\xd7v', 0x0) poll(&(0x7f00000001c0), 0x0, 0x40) ioctl$PPPIOCSCOMPRESS(r2, 0x4010744d) 04:03:53 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:53 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000000)=@framed={{0xffffffb4, 0x0, 0x0, 0x1000000000000, 0x0, 0xffffffbd}, [@ldst={0x3, 0x2, 0x3, 0x1c10a1, 0x0, 0x35}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0x265, &(0x7f000000cf3d)=""/195}, 0x48) ioctl$TUNGETFILTER(r0, 0x801054db, &(0x7f0000000040)=""/160) 04:03:53 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socket$netlink(0x10, 0x3, 0xd3d9718f3d73ae36) r4 = dup2(r3, r1) write$P9_RSTATFS(r4, 0x0, 0x0) ioctl$EVIOCSREP(r4, 0x40084503, &(0x7f0000000100)=[0x101, 0xec]) ioctl$PERF_EVENT_IOC_SET_BPF(r0, 0x40042408, r4) recvmmsg(r2, &(0x7f0000000b80)=[{{&(0x7f0000000180)=@l2, 0x80, &(0x7f00000005c0), 0x0, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0xfffffffffffffeb6, &(0x7f0000000a40), 0x0, &(0x7f0000000040)=""/147, 0x93}}], 0x2, 0x10062, 0x0) setsockopt$sock_int(r2, 0x1, 0x23, &(0x7f0000000340)=0x1, 0x0) [ 2433.471466] binder: release 20331:20342 transaction 433 out, still active [ 2433.568906] binder: BINDER_SET_CONTEXT_MGR already set [ 2433.599077] binder: 20376:20395 ioctl 40046207 0 returned -16 [ 2433.615172] binder: 20376:20395 unknown command 2097152 [ 2433.621305] binder: 20376:20395 ioctl c0306201 200002c0 returned -22 [ 2433.628479] binder: 20376:20395 Release 1 refcount change on invalid ref 1 ret -22 04:03:54 executing program 1: r0 = open(0x0, 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:54 executing program 0: socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = memfd_create(&(0x7f0000000180)='\x06\x00\x00\x00^\x00\xac\xd8\xfd\xcc\xeeq\xe5\xf5\xcb\x801`\xe48\x85\xa4\xf5\xd0\x1b\\\x04\f\xf8F\\\xb4\xba\x8d\xef\x12d\xee\xa5?\x00kZ\x8b\x19h\xd7|\x14i\r\x18U9\xc1\xd7\x10\xf0G\x12\xa8\xbaa\xb2\x94|%n\x1e+\x9f\xbb\xb8\xac\x81\x8d\x93q\xd4\xd4z\xaaZ\x0f\xaa\xc7\x97#\xe5g l\xd55\x15\xbf\xfc\xf5\x83\xb72\x00Y\x15\x92\xb1\xb6a\xf4\xe9u\xb2\xe7\xeciy\b\xdb\xc7\xf1\x87\xc9\a\x91\x04J\xc8\x0e\xff|J\'Nxr\x00\xbc\xab5\x9b\x85>\x99\xcaz2\xabKI\xdc\xe4\x9f\xa5\xd0\x0ewm\xe7\xccK\xc9\x8b\x8bE\x89\x03\x00\x00\x00}@Ry\xa69^\xdc\x9d\xa0\x04\xdf \aelO7\xf1\xda\xcc\xa2x\xc2\x9a\xf5\x18F\xa0\x80M\xf9,+\xc9\xf7/nt\x9ba\x14\x1b\x18\xdd\x18X\xd2o\x15\x97L\xe6\xb5\xba\xc7\xf2W\n\x7f\x14ZIL:T\x1bd\x19\x8dE\x9c\xb1\xb9JK\x1do\x85\xe9\xa2\xca\x9cd\b\xc8\xbdiQ_L\xb0\xb9 \xf7/F\xfc\'M#,\x84M\xba\xa9\xa2yr\'?f\tb\xdai\xfd\x8c\x9aoj\x84\x03i\x8a|\xf7T;=p\xa2\x98f\xc7\xefu=\x96\xcb\x11\x91\xce\xce\xbev\xaa\xbb\xca\xfa\xa3\xde\xd5\x1f\xd7\x03:12\xf2\xfd\rN\x84=A\xae\x9b3\x81\xa9~\xb7\x80\xd1\xe2\xf6\xf2\xb8\xc9\x8a\xabC\xe2\xec\xb8,j\xe1\xbb\x1b\x1f@', 0x3) write$binfmt_misc(r1, &(0x7f0000000c40)=ANY=[@ANYRES32], 0xff67) sendfile(r0, r1, &(0x7f0000000040), 0xfffb) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/status\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ID(r2, 0x80082407, &(0x7f0000000140)) fcntl$addseals(r1, 0x409, 0x8) fcntl$notify(r1, 0x402, 0x8) sendfile(r1, r1, &(0x7f0000000000), 0x7f) r3 = dup3(r0, r1, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/urandom\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) fchmod(r0, 0x1) 04:03:54 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:54 executing program 4: r0 = open(&(0x7f00000003c0)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x2e7) rename(0x0, &(0x7f0000000080)='./file0\x00') unlink(&(0x7f00000002c0)='./file0\x00') r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, &(0x7f00000006c0)) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000600), 0xfffffffffffffe97) lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.capability\x00', &(0x7f0000000200)=@v2={0x2000000, [{}, {0xffffffff, 0x1ff}]}, 0x14, 0x2) fstat(r1, &(0x7f0000000640)) accept4$unix(r0, 0x0, &(0x7f0000000380), 0x80000) creat(&(0x7f0000000300)='./file0\x00', 0x161) futimesat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={{0x0, 0x2710}}) sendfile(r0, r0, &(0x7f0000000040)=0x4, 0xa198) sendto$unix(0xffffffffffffffff, &(0x7f0000000500)="81be9346fbfe62133a6f6ca3a38fab17f9e1e94620a270a774e8eb1829c599515c5d346330a966a60ad1da7c5ef7e34bf4c3816f0214533468861c78cda91719c1b8c0c6aba330677a3e2b09442b103f029c6945ff4213607f11063acb442361bc8c26438d1abb8eead6879d61642a5d6c4d0b9f1e7bf5d5d2dd9bc6d2e4cd78dc71808cf73c69105247334ca83c2b168740e91bf382b2b7584d7331f700fb5eb98f1d55fff90da35b4ecb6baee89eea3606eb1875a8d74d8b5d0a8780fbd981205da30cfdda06b830dad829b0e5ef2623fea2d44b4611e5", 0xd8, 0x20000040, 0x0, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x3, 0x4) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000000c0)={0x3fe00000000, {{0x2, 0x4e23, @multicast2}}}, 0x88) connect$inet6(0xffffffffffffffff, &(0x7f00000004c0)={0xa, 0x4e21, 0xffffffffffff1d12, @rand_addr="35b75d67778ca429c838a53cd8c1814f", 0x200}, 0x1c) connect$unix(r0, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e22}, 0x6e) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) r2 = getpgrp(0xffffffffffffffff) sched_getaffinity(r2, 0x0, 0x0) 04:03:54 executing program 2: r0 = socket$inet(0x2, 0x2, 0x0) getsockopt$inet_int(r0, 0x88, 0xa, 0x0, &(0x7f0000000000)) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) renameat2(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f00000000c0)='./file0\x00', 0x2) 04:03:54 executing program 0: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x0, 0x0) clock_gettime(0x0, 0x0) futimesat(r0, &(0x7f00000000c0)='./file0\x00', &(0x7f00000001c0)={{0x77359400}}) sysinfo(&(0x7f00000007c0)=""/154) r2 = creat(&(0x7f0000000000)='./file0\x00', 0x8) ioctl$VT_RESIZE(r2, 0x5609, &(0x7f0000000080)={0x3, 0xe, 0x40}) ioctl$BLKPG(r1, 0x1269, &(0x7f00000006c0)={0x1, 0x0, 0x0, &(0x7f0000000800)}) 04:03:54 executing program 2: inotify_init1(0x80800) io_setup(0x3, &(0x7f0000000000)=0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) io_submit(r0, 0x1, &(0x7f0000356ff0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0}]) pipe2(&(0x7f0000000040)={0xffffffffffffffff}, 0x84800) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@loopback, @in6=@dev}}, {{@in=@loopback}, 0x0, @in=@remote}}, &(0x7f0000000080)=0xe8) sync() 04:03:54 executing program 0: r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0) write$binfmt_elf64(r0, &(0x7f0000000800)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x1, 0x7fffffff, 0x5, 0x8, 0x3, 0xf44ef7ade82b60ac, 0x0, 0x185, 0x40, 0x38e, 0x4, 0x8, 0x38, 0x2, 0x0, 0x2, 0x1f}, [{0x6474e551, 0x4, 0xa068, 0x9, 0x7f, 0x2, 0x100000001, 0xfffffffffffffffa}], "ba7a53c7aa0153ab378278a93b23830b4c1e3cc4b67407386a6ce2b8c9fd577d3a0928b88cd3d95fbd30ed3dbbb5a7319da7b949ea497ac42d46775eef15e3b3bb288ed65bc401823c89fb7e043d2f480fb9bccf73163657614f301a2ba339b87e989a09f4c6dceacb885d6dd54d6f514906a34fec4bcb0eb96b6c", [[], [], [], [], [], [], [], [], [], []]}, 0xaf3) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/load\x00', 0x2, 0x0) ioctl$FITRIM(r0, 0xc0185879, &(0x7f00000007c0)={0x80000001}) ioctl$PIO_SCRNMAP(r0, 0x4b41, &(0x7f0000001300)="1d5b3e9d6619625df860815e8e06ae372fbaa6e36883f2e9c52d025268d9e41f21d8b126e5b0467b24f6333279a66d891c83cb774ad15935b2f674570d36f5ee297211aa2b06fca350a8b56f2202dd4a8d5e4b79ed073baf16be9ea8aeada361ccadfb16c8570845e1c75fe9ad6b53439a65c4697eae5449b49d7941becd266b63d574d42a9db2d1ac87fad3a587492066d827893f19e91611ba20f661f388cb6f997d78966979f00a2a89d4ed69bf4b6fa3f09dba130f5ff800e41fdc20413ed77429e569a7c4a22e31a2b2fa524f3ddb0ef99f3cdc0ee1183ede37b286b16d6cb29fa4a11006f8cf024c550f271300192e38e9cff5b3ee9f5fc4eb40a46c8d423ad6cb9404652225608a8e9ef61d03cc426320fa73d4a03c797a1d69c1b0f5f5bc20660937964b554b7aa9aa569acabb2fb12cdde8bb768d10873a3737ba08982979dfcfc1b0646e2add516c88149b866bea85a7fd52c8bb584363852b139af8b1b998af102f1e464d72c61f80752e05dcac09f2ba303529ac1d5913d48d5d81a35a1021b8c97bc8eede8c3663f799e87bfd1e12b454a529edb95453dc87c050274ea2a6f3ed1a2ba33a449d82d25baaec26114c7c050b5ad378288cc834c56c3e1eab180ddbba614bac1ca254c97c625b807503a66c7a1635690c1fdc0b193b328b34a964949bb4f29d9b68a0c46c2214e43c4c5a59f1414ac67a9b87850215fde1f3125ecc0fb3a1e101743c2270ca7182e58450d3d9395cb8ebdecf1048a606fbe2b9947dc967196346a5c72e8643650e6a6cac878297205a33151798c1d5189da528cc08f4613df1dce5fd33c7c92d2be4f18038a5de2008b96214b032f7c509509e0a5a4a283cb7d269346242559e94211ca1f9f44c49a0daa003a09706b60392b93935552b5cdf9600805da9e14d1aa5e17aee7c713d46ebc32b52200cf92528240e58a54ede5ddb573026151e9ca13baae1a304d9c94ce9f141e49e08a502ee6954c1e6d2b9bc2693df0bce2a30a79d596d578f57db8d6ae9c9c02d52d62fab13b677180111090f9369fd72f163bbcb4d927ba555d4e8ff8ff16c3305a08c7ba6c64b641bcb1eb4e45bd2f5a6069b9c0722bec41098c0bd22b57afae5f457ec8d49f3020adb0eb23e2d0dec579fa638bec7759507455116cc57349b38e309af7a73a55685e375695a2817b1ef0e026d9adcbba85325283281528a7502a0f8c0e956a35e0668afa6af7f177d745ae603c473ab97c4a3592093192a58ff75059e59b2ed4e40c6f34b313bcd5bc6b7e2e17a74afc365b39617ceba89f6d25a2dea6791df5ca74e8fb274d7c7d98cf67ecc2677d613fd9142e3066acb1fc6d735504bd9ffe9524b906c6a676fe97bb5aef5a89a8aea93f013cffa203d8d728540c95623e81f7e3668c3cee162a8a850f4415f675ba006ba665ceb1b294e9a3f0661be3bada64990198682624c17202cb1d8f7abd1a53793f3ab7d18213e33c5b1b3a9e2dc1f10bcb46212ec32dc5565695a92f9c40a3774e72d8e4947491ee3d44f9d53632a88a4e1b9b790c357af1d20560ad464e7a14c5e11f0e02b2dafd00214cb67eb6e4935269c6ea4c255e785857d11bd2fdcbabe548d76c0c8bd846f3c9f98413c12b028e9ffe7c29f6dbd0de0714ae035846e9bfa0863cafca374645c0bad8369110057907c1402825323fe3f1e6a9f37bd7daf07f1c62509be9e95471dd781c1ff4fb463ab1769ad20be5bf951f245ce4c33f326316f0afe76a07e47682edeefb6467287135058c91edb8c2b2144459f595dc4222bef20016ea2cd791950b80daa7f6396be8d123047ea3b7bb0426240867095790bc7660155bd231a1b2db891a45ff4ba878a89e74c6fdb630b20007234fb9d279e2bd31984b385107c100a12c61c40837b968cbc38acd9ae21e218f8b8ff70a470aa24c4c9f73b98c61c55397fb3c000426cc2d6d2334a6d0936892bfc060af34852e89ea7493e7112c604bf3ab7c97192bb84ac1f5d2ba7fb670dd74357013eb6561c5dd851c7bc5be5f037ba68e40455317a7bebb176d2f7e7682cbc36298912ce9e7784f31cbe28750dfd3d252c56b770dea27e1984990b91821986a2a8d5f7c541c2ac96c3f95304df940f12263e586c3d66c52d835fc2dddda25569dd8955ceda4e9c78087692b323a247a8ec779603b6f98e65209a9f9026cb0a3bc1479d285831f71f1f8cc789424c92d20102e37237507c0a6c18c3b5b8a3249572c4b4a7c71759d1afa4ba2e0820f06a6360f57f8e7bc2d4a8c670e46caa1881839c6e97c0da5678b23b6d5d90be424918f626d3f73be4f5a9149071eefa7113a66b7e5a8d010a98e4fd16ec13a93bb9bb6c053485c5f40db298040c8b0ef6ae9ff7ffdc02cdca02327b444eca385fe839bbf64619730df6711dc72f49d7d806c6f5f5365da72bbcb38b9d5ed2d775f15dc6f7b691f35f097999cfe5a5eab8fc79bacd78399c27ed5624314cce94caae8ba8bdb965af80b976354433396403aa0d2fa22268e0da298a8e0c4546eea2acfa5a9d57502d729ab727e131ebe020f6b0de3dbb0d759823ac3e722152261abf9e6d5e07d678ef5218717e0d578e7f85f93271ee70adf0fa51d446a2a56eea961c86140c71e6f2e6fcd1e800cd627db58c8f4f1681fd1d904dc21628f1162a7c17412980c807c492f4627ecf9d172fd8c323be8dd44cf80710c4424903925965cd2ef60742d970e5fbf01d175e47a5d9e05a98d84e0a79791e2fa90e1e512b37321a8e8c983a79a4b0535d5c478337cf8da9661a0be26b498f373a1c68c98a98060862b80c2fdb7529bdc2278acfdd80e5a619e055383c9e7a8b60d4a5dfa1816d0c75512558f95295518b3f2412eccbed41fed9173e004776d11a346bf3cce7af62601c9e539251fc827575710325cc350c293ccfd4218f59e09def2f28064d4c684f1b5e8b8f1cbdb8d0f43ad8c8c39595339fc9820eb24c6b755ea167a1a6c4519eaf5436db745a13b12344fad8c7207154ee5b0e5efb5d8f850ca3150a6a2c2393060f0f623e2bed523df4fc51ecc3b56981b2bf27e31ebbecc01b30e930daa796f5dd5056641fd47afaec2727cc2982d5be1e9bab2089b61e26374fb20939d6d9265411de22408f1315b936d2aed4a0b24e66efb32ce01eb1ed1b89cc50c6b37d5d55efd8155d1fa82817dadd31048563efb916c7c0723faad5d1c68898edeadb9ea64a46ef377f98ebe39c8e41786de8771ff05b2ccddaa0567783fa2587e388174d243471653d01630b43f993dda498bdc4c91046dc99e1484de7f583922dc3ba302fde9a2829c542d9e82580071ae088b78678e540ef049e890487546b524f994f493c84e7909fafc3a511aed5667306902f6066026758f712e6a6d222bec9a51ccda916233ec170edc30bba4869dfa07ba7330f7d9d0ea4630ebcf05a21bc3ffaa11240559cc9444f9bb6e2624c9507a3ce4ba73965761f69d6be44533e8e47a41181a8f272b6ec88b5043f9889ec5b2372a22ce457b7052ce4b2eaeffe217a562a81a78e5eed4f054b619073854151a94ef7e9daa068abbb713fab5ffa8ca5c92afbc3b09057091d769f68f385c32aa81fc4641ee08db63c0ed3c05c07f981b299950c802b37e7daaf5387cfedfd94fab86ec4a9a05a6a2d96dc009c3f5ca5eda03e39039ec16c172a68da2aab0d19f36ccd592689fd6b217b69928d7c6b05e1b1d80e37cc2e28b076d074956a2b67d74f91b25602c50aa28f8cc0103683115a22805ce877dccafa38b2dcdf4cfa997a3d5c02f6c02ef099f410582297853e2b0ac4f0c74d92497d2bd251868dc185c208545faccafb6aabf1417a3401fbea3d7e42a5baea89ba19419edeb5a82de955030dde38777f5901922030622c8ffb6a86b0cd1a3694ab017ed0769f5980d33a7d0e9f637a1f097fee7b3c370a7a1fa200b216bd549b55d3e33d692d35b9ab41754b8579ceb68f58cf7fd93eccab183b874104f332f647ec0fbca7610e555f7065c5752a31195370a7ff1a3b4d4b5383d3cecce351c871440ac7e185002f16bbb560b079ae749232a0c355c50649b3633a5c04d8be74e107afbde20076f48bf63cdda6e9d722a6acab9c57581e81798c0cc1f7f05765d04e9c236a65a9f448da6a695df5cac029b2efbc4509a3062ac858d8852cbc0208d8be74177203203dc4a4f005dfccec1c4e04803ea4d62611cffe8d3cef4b79be10bd9f17e1a7088b199de4450c13e29ca1c014c09c7f4d49b7fe19301df9e86c1c0d4d689a42cc0ba39e952e6b29dbf8babe6e2a985b997a754cbd633c2cbe6fa435d1de88cc111dedeea8eb7c3373042b922790a8bc7c5dbdc31e3df830bb3e445c0e18622b28cf8addb4265bab37222b9ff9aca68289ab8af20d53d418811e9ed237739f7d9ef5a17abca86c4cfd83e284b626db12a6f941b7781040d0b79109d209b6da8830f2d3279f7ae46674b1efdb7019e9faf7a6248b485dd120befc5600336c4556b27c32fad06a974ac193662b9dbfaac24ee2e819a46dfcb736d8541acae6f017bcfa9796b1fe0e2a27248442510194de0901ee9db227d10ef49c931e7816a8d03efd6160b0e33eb4561c4e9d7eb04e65b962ae99f9cdbde9deddd5549cf30c9719c787140110f14cea81602d6570001f80f716678f5c7cfe7258248d10f5b75ae15b82caab692e37976960e6b005df83b64e9c309363d606ed8c46c971dd39d5a6d260caa156b57889bcd1648d7144f22693553babce5cf05739a1fb1599052656c329999171cef321000c190e6e7d1a9c41f5549179fc08a1d16720ede45c95bee76f8c3df2dff75f0f6189ab478386a06c79152c92addbad61c1ac83d1273f59680ce900728fea732fa3561a6eb990a9365000c6b4bc5fbc059e2e0c23c0d9d90a9749c91d1b704a6978186f8fed3acb1f34f39a89bd830b2fd4412552788869ff3dcc439bfef4b5a1482f76d0342a49ca0a2257a03aa485a4b97107e35a42ad94cd17f7ef977d1391cd9199a59613c1e2205f992dccf454c340d544d874205c449b066c6f28681ac05ca4cbb4ccde6bb1590f079bb5a8f6a72700fd92ace70fd0ec8175a077b9a28f4c5a8a0d5c861f5dd07afbbf4f9ee4a6c91ecd27b311fdca31ea6917f837e812f71026adf49ea0cc10e6fcce9d8c62c636def8963b8f388a2f9d400ead700dcd638eb196a0d8f27baa8dca36229a35a46c6fa20d72ab562b4a2e3b883ee4fed900ba582954b0eae45b1a3dd48a10091102dbc9b9ec58864bb10ca83300bae39e8a5455e83566d31ac210590aeed202543b81ce4a181d2c9e47d36e7fef3235fa0a445b0f4c702f8d8b852a15bcbcf10ba17b9cbc27e7a67bc5da8deeebfc38ecd05731b1a5a92596ad7284f3a7ce5667ac97788abd530e5978d15ea857f418d90592d7d8b67d224be24e2d3e7e1d05addfd5ba73850adccc110af346500bc54444a5b04cf7664abd69e64e3289559677e3e94e97a5764ea672d28aec0b391f45d32f8fce4634081332c047e5156a900c9f0705de08d6fa2397bc502b0535f6c3ace6e3d71af1ded4bbc20016149bfc5396d46cea6b46ab53464ce480aeac560709f9e1e7ff993eab66f6fc9879961d9fd416535e4fab74137dec8b0bc8ac11162b104947d488997b9f4386a53ba28c4abf7738b17df34d42a7000239014ee263dde6c952d1b88aa6b473661b5b9d93f6a78d16824ea6d93b778bf7b9002fec9562bbea554cd01ef77c8c8e494ea701d61adc7af18b7eb3bcdf7690") [ 2434.110278] binder: release 20364:20366 transaction 436 out, still active [ 2434.120520] binder: unexpected work type, 4, not freed [ 2434.139354] binder: undelivered TRANSACTION_COMPLETE [ 2434.147033] binder: 20413:20415 ioctl c018620b 0 returned -14 04:03:54 executing program 0: getcwd(0x0, 0xc6) recvmmsg(0xffffffffffffff9c, &(0x7f0000002380)=[{{&(0x7f0000000000)=@ax25={{0x3, @rose}, [@default, @bcast, @remote, @default, @rose, @rose, @rose]}, 0x80, &(0x7f0000000180)=[{&(0x7f0000000080)=""/240, 0xf0}], 0x1, &(0x7f00000001c0)=""/214, 0xd6}, 0x2}, {{&(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x80, &(0x7f0000002780)=[{&(0x7f0000000340)=""/81, 0x385}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/79, 0x4f}, {&(0x7f0000001440)=""/218, 0xda}, {&(0x7f0000001540)=""/26, 0x1a}, {&(0x7f0000001580)=""/125, 0x7d}, {&(0x7f0000001600)=""/128, 0x80}, {&(0x7f0000001680)=""/55, 0x37}], 0x8, &(0x7f0000001740)=""/218, 0xda}, 0x4}, {{&(0x7f0000001840)=@generic, 0x80, &(0x7f0000001b40)=[{&(0x7f00000018c0)=""/107, 0x6b}, {&(0x7f0000001940)=""/225, 0xe1}, {&(0x7f0000001a40)=""/227, 0xe3}], 0x3, &(0x7f0000001b80)=""/58, 0x3a}}, {{&(0x7f0000001bc0)=@generic, 0x80, &(0x7f0000001d40), 0x1, &(0x7f00000026c0)=""/144, 0x90}, 0x9}, {{&(0x7f0000001e40)=@in6={0xa, 0x0, 0x0, @remote}, 0x80, &(0x7f00000022c0)=[{&(0x7f0000001ec0)=""/189, 0xfffffffffffffeaf}, {&(0x7f0000001f80)=""/174, 0xae}, {&(0x7f0000002040)=""/145, 0x91}, {&(0x7f0000002100)=""/10, 0xa}, {&(0x7f0000002140)=""/236, 0xec}, {&(0x7f0000002240)=""/106, 0x6a}], 0x6, &(0x7f0000002340)=""/9, 0xffffffe8}, 0x1000}], 0x5, 0x40000020, &(0x7f00000024c0)={0x0, 0x1c9c380}) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000002580)='/selinux/commit_pending_bools\x00', 0x1, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000440)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) gettid() pipe2(&(0x7f0000002500), 0x4803) time(&(0x7f0000004e00)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000000)=0x102, 0x4) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000005880), &(0x7f0000000240)=0xfffffffffffffde9) mlockall(0x6) clone(0x20000000, 0x0, 0xfffffffffffffffe, &(0x7f0000005680), 0xffffffffffffffff) r1 = add_key(&(0x7f00000053c0)='asymmetric\x00', &(0x7f0000005400)={'syz', 0x0}, &(0x7f0000005440)="f84e0cad4f825044c5b3ce49e3b957cc3997c30212fea77bbce9f3d7851d4d53fc4b6e9f1d822a65d07444d2bcf953b6827a4d0cda715fb3a32c410404bc5d", 0x3f, 0xffffffffffffffff) keyctl$clear(0x7, r1) r2 = open(0x0, 0x0, 0x40) exit(0x7fffffff3ffffffa) recvmmsg(r2, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)=""/226, 0xe2}, {&(0x7f0000000300)=""/206, 0xce}, {&(0x7f0000000400)=""/173, 0xad}, {&(0x7f00000004c0)=""/69, 0x45}, {&(0x7f0000000540)=""/101, 0x65}], 0x5, &(0x7f0000000640)=""/231, 0xe7, 0xfc}, 0x1}, {{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000740)=""/221, 0xdd}, {&(0x7f0000000840)=""/220, 0xdc}, {&(0x7f0000000940)=""/252, 0xfc}, {&(0x7f0000000a40)=""/173, 0xad}, {&(0x7f0000000c40)=""/223, 0xdf}, {&(0x7f0000000b00)=""/125, 0x7d}, {&(0x7f0000000d40)=""/219, 0xdb}], 0x7, &(0x7f0000000ec0)=""/157, 0x9d, 0x6}, 0x1}, {{&(0x7f0000000f80)=@nfc_llcp, 0x80, &(0x7f00000011c0)=[{&(0x7f0000001000)=""/139, 0x8b}, {&(0x7f0000001100)=""/181, 0xb5}, {&(0x7f0000000b80)=""/32, 0x20}], 0x3, &(0x7f0000001200)=""/32, 0x20, 0x80000000}, 0x2}, {{&(0x7f0000001240)=@ipx, 0x80, &(0x7f0000001440)=[{&(0x7f00000012c0)=""/71, 0x47}, {&(0x7f0000001340)=""/226, 0xe2}], 0x2, &(0x7f0000001480)=""/148, 0x94, 0x3}, 0x4}, {{&(0x7f0000001540)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}}}, 0x80, &(0x7f00000036c0)=[{&(0x7f00000015c0)=""/212, 0xd4}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f00000026c0)=""/4096, 0x1000}], 0x3, 0x0, 0x0, 0x20}, 0x946}, {{0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000003700)=""/173, 0xad}], 0x1, 0x0, 0x0, 0x4}, 0x8}, {{&(0x7f0000003800)=@ipx, 0x80, &(0x7f0000003980)=[{&(0x7f0000003880)=""/42, 0x2a}, {&(0x7f00000038c0)=""/174, 0xae}], 0x2, &(0x7f00000039c0)=""/3, 0x3, 0x8}, 0x6}, {{&(0x7f0000003a00)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000003c80)=[{&(0x7f0000003a80)=""/74, 0x4a}, {&(0x7f0000003b00)=""/103, 0x67}, {&(0x7f0000003b80)=""/245, 0xf5}], 0x3, &(0x7f0000003cc0)=""/4096, 0x1000, 0x3}, 0x2}, {{&(0x7f0000004cc0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000004e40)=[{&(0x7f0000004d40)=""/12, 0xc}, {&(0x7f0000004d80)=""/16, 0x10}, {0x0}], 0x3, &(0x7f0000004e80)=""/38, 0x26}}], 0x9, 0x2, &(0x7f0000005100)={0x0, 0x989680}) syz_genetlink_get_family_id$ipvs(&(0x7f0000005180)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r3, &(0x7f0000005280)={&(0x7f0000005140)={0x10, 0x0, 0x0, 0x44000000}, 0xc, &(0x7f0000005240)={&(0x7f0000005900)=ANY=[@ANYBLOB="02042dbd7000fc000c000200080002004e200015080004004d00000014000100080005000000000008000900770000003000030414000600005a45efe7060000000000000000ffffffffffff08000500ac1414bb0801080600000000080007004e2100005d0004074630278631bb35ba294313c87c66c15dfd844378fd536307379e023b0057cc8d237c282918bf40128fdd6d3b9ac482627a4173f3d26080b3c8b5214ac76597d9a4d5c5f058fbaf5db704622f62cc1af932e0528eb34a90a84a6b04b7dfa0cd887987d45b4c2835c1c603a85d273d347ff41a975e64c21ed24b7c3f1596b3a3b5cf68f308b7a38dd4b1daf82a3b87278b21c0492bed58e01e7d4783050000004ca3b4c5fae4639ab635054f469722e95dada1f361a9eda4974fb622698c2fc2596bd7daa96040ca176bf4d5757fb1257c3001000000000000002ca33d107e780f50c11f8938e560522aa795b7c84cf2de19d16e42046de61e3775326e9ab668ac894a6598cd1b85c9e18cef07fd016f12c89e37719a5b39777f18a1634fa8752cee025e11d36fda12a3359a014e784ef0a0ca7c41feb23ac0926b953c9a4f9a7f77e64e49b083559a2e4f7014d036968a351fb5f8c3abb2c251422c041c55330000000000000000000000000000000066e7dbaf936ca41d2b0f15259ac6b26ba6256face60a7f7d4c7eb14eae2e1d3c2b5a57aadbd3bab0cccf606f78ed2e19b0afa72451b3f6727800a59e4b6762245429a1aaa30a6082ead3c9e63df85068e7dc48749bc7837ea582a9ab6c2b64f68aa9896f4d2dbf167493708f4e015c6c7d7c5a2e122313fb1fa6b0befb20623eb35354ad7ad291869f2e99e536b40080e817b67cd307722ba977ff23c13d114a70771b96cd3e6d76d3c0b535fe9a1da57ac5d9817d9c6e2f405ea7c27c67a9b34e391c6e34eeb24ef902d49e7a3c2104b30639d9fb6af877116d1bec43431ca1974a6d2d32cd5d6d270baea898ab7d211144ea348aab6c399247b10b8b19fb0c3d39474dc06e843d9ec5a562f8a893b39063f1442f5ced1b15ec4d01392d13d67826844d1a2646a89532aa1758921d898810ab660eda6191ddc9abb1487dbf7e75cc8767b94ac00cbd399b8e62735d4711e803002d7ec5a927758d7d66d969f95b0e57eb031e3f5c179373395967f80446151b3cfbd67fe920e7e49607a7ed941194ab8abe41b55ee120b7583af45b6e006fabc532ca4cd1c860d6ff096bf1e7327893db7a0ac4165b54f879eb0000000000000000000000000000"], 0x1}}, 0x4000841) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x1) accept4$inet(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000100)=0x10, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) fchmod(r0, 0x50) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f00000055c0), &(0x7f0000005300)=0x2b) 04:03:54 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:54 executing program 2: stat(&(0x7f0000000440)='./bus\x00', &(0x7f0000000500)) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x400000000001, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000280)={'\x00\x00\x00\xe6\xff\xff\xff\x00\x00\x00\x00\x00\x02\x00', 0x5002}) clone(0x3102001ffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x800001, 0xffffffffffffffff) tkill(r0, 0x38) ptrace$cont(0x18, r0, 0x0, 0x0) mknod$loop(&(0x7f0000000040)='./file0\x00', 0x6000, 0x1) open(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) eventfd2(0x9fc, 0x1) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x20000000, 0xa7}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x20, r0, 0x0, 0x0) wait4(0x0, 0x0, 0x0, 0x0) add_key$user(&(0x7f00000001c0)='user\x00', &(0x7f0000000200)={'syz', 0x3}, &(0x7f0000000240)="ea3d7ee9aa8d27c4e6b22700e9889c07052689bcd15494073ede88b1", 0x1c, 0x0) open(0x0, 0x141042, 0x0) [ 2434.311496] binder: release 20376:20395 transaction 439 out, still active 04:03:54 executing program 2: socketpair$unix(0x1, 0x4000000001, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_MCE_KILL_GET(0x22) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) pwritev(r2, &(0x7f0000001280)=[{&(0x7f0000000380)='S', 0x1}], 0x1, 0x4081886) sendfile(r0, r1, 0x0, 0xe7) sendfile(r0, r2, 0x0, 0x20020102000007) r3 = dup2(r2, r1) openat(r3, &(0x7f0000000440)='./file0\x00', 0x0, 0x82) sendmmsg(r0, &(0x7f0000001140)=[{{&(0x7f0000000000)=@rc={0x1f, {0x3, 0x3f, 0x4000800000000000, 0x320, 0x6, 0x7}, 0x80000000}, 0x80, &(0x7f00000003c0)=[{&(0x7f0000000080)="61a114fe306ef560c7ffe7fa4ea78f3f030eabf387e51d94fb47deae7125c54b23225904d9791feffb86c5152f34c25054a33ba34d8f9ebba9a39a1a1979642db4d8", 0x42}, {&(0x7f0000000100)="c90e3f306d46d86e0fbe094bdbb4cfc265273678c72817d5640c918c206fb5f04d0cb7aa5bec7b4d1d37cd14cdf87fd8d1d0a20f954753f8311618798dc4e2cbbc", 0x41}, {&(0x7f0000000180)="7fc538930d339cd18b0e536ba4bb8eae1a595a6dfc", 0x15}, {&(0x7f00000001c0)="e4daebf6496a9908937610585fa12ec36eb38f2137754ba7fb5dd30792e4394c21cde65e7bbd932e975b77418e8a15cb55ccc585", 0x34}, {&(0x7f00000002c0)="97dff3d60bcba6d0302cb3f88e4eda3d82461579046852392218e2e0458b7d944f5ef04f96e883a3dbc8a66e1054ed0bb0fe6afe50aab73bfb9bbf4dd8cbf7c7f1a50d5e47667f65cf7ea3e8f5a13f12c3b5743ee83a27aee55091121d4059128f1dd1a50e93b993a1de11fafeb2e0cfef1a18e4ecc078f4d44fcdb9b8de2077256d137932ee7b705325ba45", 0x8c}], 0x5, &(0x7f0000000480)=[{0x60, 0x10f, 0x5, "72fca446b7b17f5802d91e5840f2b718405c27cee9708b0e3a4cc08c4e62d24d1921684b773ee7bfae9b0c82506e50608008023dd03fe34d9579390334a39aadb4f0a8b61378fb4c59b050d75ddbbe"}, {0x58, 0x10a, 0x40, "eee1ce8a05ca3c64268cfd898a83eb7f159012617bd59557dc6ebec434772855496649e6c48f012976f919104182269b421dbd2232e74b8ed31396a7a9073f3d1f3ff04d5bc9a80b"}, {0x90, 0x1, 0x9, "d400bec48cde35f92894f94f03721d21192af9b7734e1f3b02ed09ab438e5f8827f723d2514e334ad278da06f00c7eceae2c4d98a701f1984e83c01b377f5703da96e84efd28ae3ee8760d686221c22d7f7eff19422a1ce2c4fa90cba5739aab14c1ee534b75c435b237446e320de1a89596f3bc8eebc5899213"}, {0x70, 0x11a, 0x4, "ea778ba7ac2d971caaca8b9b4a052f426d297348060b656bde4595c0c30963a53db56dbed3e8c8a6cd87a472a8b626ff82cc157c6600efc382e461676e926dd186fb063b0cc2c11d901e1ce71b21b4e77a51e58b89171ea17472e2"}, {0x90, 0x0, 0x9, "8c8f2199e2c7c9068b70b1541fc0d97a0ef37ab09a24766c61bd33b944669f6f45dbbbd57a48d3462acd84495267c2910887d05bce19ed5245ddf145c2295dbd480283aface198ab40da0418dccbc89a30682a9cd98f21aa77d2bca8fbeffc494dedbf6ce13792fe75553626c92076308d846bafc9a128fcfd21e70ee36a"}, {0x78, 0x115, 0x0, "5200718bced6c5cf09ea7cc5c7744a74a7edba40cc9478ad2c0a15143f198e5207d503390aeeb015c0a7ca0a263bdfc1044b2f9136dc25663a5939cbcee3290f350607ebf466ec17d5c1e7ff0e7a5c8ae9134dce6c3ca08ba04daf50d04633b588b4d51d"}, {0x80, 0x111, 0x401, "479c29b7244a90c9d81e9157a5a8167d2bff137a71ece4bfcbe640727140a288acb322adc68c919216d94448f9880544f766886f1e6bf29cf8d05fa65590d8e5a7a5a21aa12ed580553cfff8b118803739096cf36e382276ce8a85a94aeeff55cd73c14fa6afdf5e41d9706ad9"}, {0x90, 0x11c, 0xfffffffffffff6d4, "295c0c93bd3ae1145cc3480a29dd87decdebba52f5b494362e1f6d1bb024b25d1368c240b437a34fa5d6a14ea0d6f9f6fa9376a1980d4eefabd91b1839c9638a6c1719af77a105feb178f265bd7d22c98d37a5badeda47764b74fad7b531dfcdd476e3a51763817bcb21a79e318507cfc9a8a410504777fe1358ff50c6"}], 0x3d0}, 0x4}, {{&(0x7f0000000880)=@rxrpc=@in6={0x21, 0x4, 0x2, 0x1c, {0xa, 0x4e24, 0x5, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0xffffffff}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000900)="b7a7948d0df916b24b3fd3b2a57adb09f793059dc62d5af074d764370e6b24a7ff5fbaedf0c57277f3075c8d1d6b87b95e9873dd746a9395cb5b0ac4445f31b6af06f023677014f48bc67fc7e10f7f2aee52bb8a0a8e506530cf2a8ce0cb53ace45949b654c5fca236604283347c1e545092f93956f8ba3dff2fe7f9565f8bddb61d33d45e3eab13031ab84f7f1b6d70d1b7ca72d3861c3ded7454b54adfa8236805f93544c1ff168f04ae", 0xab}], 0x1, &(0x7f00000009c0)=[{0xc8, 0x102, 0x4, "33a2dbc6e92be07a1a734583e5be681e0848f818d40c4aa1e676a71c02cd963df318b83d01b8cba8d0ac7cd0c90852ec99278925031da93b59bba7c25de12fd40a3edbbea670cdbcbdf9d22e77553e806478108d95904695cbc28d697b8c1c74733d3452218111b67c9498e0b5ee97748da6fc8b3a550ca611a2babd888dd152dfbf903113b167fc50927d29cb821c8011c0cb6f85353143f18295466295a8139ca13ee82c8e6ea11240c89604839393955d97579a"}, {0xf8, 0x10e, 0xffffffff80000001, "49dc035c2562519ea98d91f1ea6e78f276099bdb688f8101ab40a2dc1e4c3d01e076dc07f62ffbccb1ab27344ccc552e34c00fba69867d25b149df765ea0ce92d4c9e6c323916731d15e7108fad62408295770fc174a4e95cb98f8e0f9262a5fbc809b677ae2ebf0874da112fc610cdf8c25072dac92e6c10a76e05b35206b9c10c88e24b4959ca01738c98beb18d58ee8192334f2e5c894722ab1fb4ccc22267bdc910960b2ed33fc4795384435c085c384ac5135d9100742488cf389f86bf5dda6e02a87fdb28d2c3590c721b84e2953366fc8f349fa9424d0089968bd855a984e"}], 0x1c0}, 0x6}, {{&(0x7f0000000b80)=@llc={0x1a, 0x0, 0x2, 0x9, 0x1ff, 0x5, @random="cf6606cef2bd"}, 0x80, &(0x7f0000000cc0)=[{&(0x7f0000000c00)="7e5d91e9a66920c8ac1bb0361d6a055c7e04434d81cde03a9a4531079b630a4d3241c9c7603ebe177659e91e6c3531c39d3186fe5f4cf085bd33627efa00343b5b4304f3164d1a3f41e5b8c3cb97c700b51424371151c75ca32704b3fe6c561fa43a2e7974d01b83e753bda751c07499199ffa53e1db510c55b54ec703ab241d3537fba0be8f5c42dc3e1d894066b5f5a04c786aae024e156c003cdaf51070636ad46b1e93b19e53029964db184a63cf8228d93d01", 0xb5}], 0x1, &(0x7f0000000d00)=[{0xc0, 0x13a, 0xc9e, "fed3c2566e34ee9272f6f5c28d0511dce096b006f36653485dd8e821fe6a25e401074adf9e890191af70d01f98922f96729f5de60d3185fb54f4a56b2904f8fc2473acdf95770de8307b085e1c211ab91b87c4fcae2e60e9ed22dd8fc50ebc0603127e8bc8c64efef9b360cfe207b08ccc2cb8889ab2b571b9c457338e1d55f9f73c43add81737eb0d19d83d8ce1f773727c91e08f4555bd813678a78b2dd3ecb956dea4d34456db8b"}], 0xc0}, 0x5}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000dc0)="b40469ce860c40ef48d4bb639b45d78a7a6698a6790ac5ebc80bc58682b3eea90d107bfb49608c1aa876cfdaaa1a986301cbd5d2d509978ec990ebbafb2b813ff320b17d2b47c4dc61b5ff442e32f7039fb433646e47b5b112a25a0d275e9470636da6fe797d8acb84aba62846cec55f45781e174e9429fa0f9cdafc2e44", 0x7e}, {&(0x7f0000000e40)="dce61f39d6e43056e21d3f80cb4baf652855bd79844d5f9b49d0e523832126390cca08d40ae8c931b15290e3ad658258217e36fa51aaa73827147e7cbb17ee7a23dee8a25aa40ebfab57f83e3336a5512de01812a297485fa050ecbcffc52f01fd38bae0a08c766927334b173b1e984117adb05b1a003abcf50dfbb42753", 0x7e}, {&(0x7f0000000ec0)="6fa86129bde4266d7be314943ca468d2719f004aaa72754633075320030becf86099dbb46508f0bc2213a0c1f4d462d1db12c34a16a13ee08720a207bdc068b5ca4128f5aed1bc4305bbd67f13d4fd9a7171f2c46063d6b596da963b88ac5266b7df898b7decadb261ea696a3ad28dedae0cb46f1ed744ee59a8765b3ac59b1f6e2f88b2fffd662d308c9a82474c595af4308209580d0994e4a3a49da9f56dea3b6752bffadff2194c7ae3f6", 0xac}], 0x3, &(0x7f0000000fc0)=[{0x48, 0x0, 0x7, "c32f707a5e6c76be74c793d23acba6a24df87f8405f78d04257098132ac3a752daed6add911cb283b3dc6c0648027264994c102faca5"}, {0x10, 0x113, 0x8001}, {0x108, 0x1, 0xfe2, "8fffcab114fec7a6de65d5fb6da1148a8dc62d1e08b0414dc43f1a87e258c5a1dd01929c2dfe9064b0e304304ba6f48da395d2b395851d52d563a7279994f9c3be2c6bb473daf9e56293ac0ba6cdcb5254ec629a828121fdc7d86669f87e33b3a837911831206ec50212ea0d30e94e7646f87238e39d581448e208e8f86d408ac74d13c904c30fbf3c9170f144391f40c98e51e72cb81bc13a6d0ad7207747e5bac208d912d69ba048a9a04fa9af07700c814c2674d87767a9e53a6d74da05968457fd5f09fe35d9a3e594d6c35bbdcd4968819e7b3d337883d374235e467c4380a6c4915bb9b68df74408402d61b965e34c4249bcd032"}], 0x160}, 0x8}], 0x4, 0x20040800) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000001240)='/dev/loop-control\x00', 0x408180, 0x0) [ 2434.551200] binder: BINDER_SET_CONTEXT_MGR already set [ 2434.557489] binder: 20435:20448 ioctl 40046207 0 returned -16 [ 2434.568623] binder: 20435:20448 unknown command 2097152 [ 2434.575253] binder: 20435:20448 ioctl c0306201 200002c0 returned -22 [ 2434.585396] binder: 20435:20448 Release 1 refcount change on invalid ref 1 ret -22 04:03:54 executing program 1: r0 = open(0x0, 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:54 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat(0xffffffffffffffff, 0x0, 0x20000, 0x1fffffc) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, 0x0, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(0xffffffffffffffff, 0x0, 0x83, 0x0, 0x0) clone(0x900100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) syz_mount_image$f2fs(&(0x7f0000000240)='f2fs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0xaaaaaaaaaaaa8b8, &(0x7f0000000200), 0x0, 0x0) 04:03:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:55 executing program 4: r0 = open(&(0x7f00000003c0)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x2e7) rename(0x0, &(0x7f0000000080)='./file0\x00') unlink(&(0x7f00000002c0)='./file0\x00') r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, &(0x7f00000006c0)) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000600), 0xfffffffffffffe97) lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.capability\x00', &(0x7f0000000200)=@v2={0x2000000, [{}, {0xffffffff, 0x1ff}]}, 0x14, 0x2) fstat(r1, &(0x7f0000000640)) accept4$unix(r0, 0x0, &(0x7f0000000380), 0x80000) creat(&(0x7f0000000300)='./file0\x00', 0x161) futimesat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={{0x0, 0x2710}}) sendfile(r0, r0, &(0x7f0000000040)=0x4, 0xa198) sendto$unix(0xffffffffffffffff, &(0x7f0000000500)="81be9346fbfe62133a6f6ca3a38fab17f9e1e94620a270a774e8eb1829c599515c5d346330a966a60ad1da7c5ef7e34bf4c3816f0214533468861c78cda91719c1b8c0c6aba330677a3e2b09442b103f029c6945ff4213607f11063acb442361bc8c26438d1abb8eead6879d61642a5d6c4d0b9f1e7bf5d5d2dd9bc6d2e4cd78dc71808cf73c69105247334ca83c2b168740e91bf382b2b7584d7331f700fb5eb98f1d55fff90da35b4ecb6baee89eea3606eb1875a8d74d8b5d0a8780fbd981205da30cfdda06b830dad829b0e5ef2623fea2d44b4611e5", 0xd8, 0x20000040, 0x0, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x3, 0x4) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f00000000c0)={0x3fe00000000, {{0x2, 0x4e23, @multicast2}}}, 0x88) connect$inet6(0xffffffffffffffff, &(0x7f00000004c0)={0xa, 0x4e21, 0xffffffffffff1d12, @rand_addr="35b75d67778ca429c838a53cd8c1814f", 0x200}, 0x1c) connect$unix(r0, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e22}, 0x6e) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) r2 = getpgrp(0xffffffffffffffff) sched_getaffinity(r2, 0x0, 0x0) 04:03:55 executing program 2: r0 = socket$key(0xf, 0x3, 0x2) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000001c0), 0xfa) sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)={0x2, 0x18, 0x0, 0x0, 0x2}, 0x10}}, 0x0) sendmsg$key(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)={0x2, 0x12, 0x0, 0x0, 0x2}, 0x10}}, 0x0) r1 = open$dir(&(0x7f0000000000)='./file0\x00', 0x80080, 0x10) execveat(r1, &(0x7f0000000080)='./file0\x00', &(0x7f0000000300)=[&(0x7f0000000100)='vboxnet0#^trusted\x00', &(0x7f0000000200)='\x00', &(0x7f0000000240)='eth0cpuset\x00', &(0x7f0000000280)='&^&\x00', &(0x7f00000002c0)='%([eth0lo\x00'], &(0x7f00000004c0)=[&(0x7f0000000340)='@\x00', &(0x7f00000003c0)='cgroupnodev&em0)md5sumem1\x00', &(0x7f0000000400)='\\cpusetnodevppp0GPLbdev^\x00', &(0x7f0000000440)='selfselfeth0\x00', &(0x7f0000000480)='ppp1vmnet1@*\x00'], 0x400) [ 2434.967653] binder: 20461:20467 ioctl c018620b 0 returned -14 04:03:55 executing program 2: clone(0x41fc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = getpid() rt_tgsigqueueinfo(r0, r0, 0x16, &(0x7f0000000200)) ptrace(0x10, r0) r1 = dup(0xffffffffffffffff) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f0000000080)) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$RNDADDTOENTCNT(r1, 0x40045201, &(0x7f00000000c0)=0x3) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$SIOCGSTAMPNS(r2, 0x8907, &(0x7f0000000040)) ptrace$getregset(0x9, r0, 0x0, 0x0) 04:03:55 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2435.176726] binder: release 20435:20448 transaction 442 out, still active 04:03:55 executing program 0: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) lookup_dcookie(0xe0, 0x0, 0x0) clone(0x100802102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xffffffffffffffff, 0x31, 0xffffffffffffffff, 0x0) socket(0x0, 0x0, 0x0) write$binfmt_misc(r0, &(0x7f00000000c0)=ANY=[], 0x7fffffff) sched_setattr(0x0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x3}, 0x0) recvfrom(r1, &(0x7f00000004c0)=""/184, 0xfffffe4c, 0x10100, 0x0, 0xfffffffffffffcec) r2 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) r3 = ioctl$LOOP_CTL_GET_FREE(r2, 0x4c82) ioctl$LOOP_CTL_REMOVE(r2, 0x4c81, r3) ioctl$LOOP_CTL_ADD(r2, 0x4c80, 0x0) [ 2435.281462] binder: BINDER_SET_CONTEXT_MGR already set [ 2435.291024] binder: 20482:20484 ioctl 40046207 0 returned -16 [ 2435.299615] binder: 20482:20484 unknown command 2097152 [ 2435.307811] binder: 20482:20484 ioctl c0306201 200002c0 returned -22 [ 2435.316620] binder: 20482:20484 Release 1 refcount change on invalid ref 1 ret -22 04:03:55 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fchdir(r0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, 0x0) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) getrandom(&(0x7f00000001c0)=""/184, 0xb8, 0x3) sched_setaffinity(0x0, 0xfffffffffffffec1, &(0x7f00000000c0)=0x6) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000280)={'\x00', 0x1}) clone(0x802122001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="1549bf857b7b582057efe7baa449700f4a9175935955f21e50703cfe0852419b9f8d0bb4d0560f0fe0614d48c5b5f23b1444bd67934bcacc9365da87b8db7c9729421117c7236845404edbd80011cdd7444a9ac17c58962923c280d6e8fd2eb3b33ca78a59547db4060593fb81074c38b9c0d04065b4574cf93902"], 0x4d) perf_event_open(0x0, 0x0, 0x1, r2, 0x207) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000040)=ANY=[@ANYRES64=r7], 0x8) r8 = socket$inet(0x2, 0x3, 0x7f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r7, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) flistxattr(r7, &(0x7f0000000240)=""/192, 0x28) connect$inet(r7, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10) ioctl$sock_inet_SIOCGIFPFLAGS(r5, 0x8935, 0x0) splice(r5, 0x0, r8, 0x0, 0x110005, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f1fc4a4e93b0de635ba4fe045da55813bfbae6fc9fea32de6d92e25ee46984c1e56e9c8b22eff63bfd53bd9b54f7d6621812070aa3ed7714bdc1aeb5e22e705c9290dc569dfcb330262532ebf8b64053c29979517779412c1647d6bdb627a30e3be741a9160f0591b064789adbf820c3a56c86c690b"], 0x76) fcntl$setstatus(0xffffffffffffffff, 0x4, 0xc00) open(&(0x7f0000000340)='./file0\x00', 0x40100, 0x10) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000100)={0x1}) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) 04:03:55 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fchdir(r0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, 0x0) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) getrandom(&(0x7f00000001c0)=""/184, 0xb8, 0x3) sched_setaffinity(0x0, 0xfffffffffffffec1, &(0x7f00000000c0)=0x6) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000280)={'\x00', 0x1}) clone(0x802122001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="1549bf857b7b582057efe7baa449700f4a9175935955f21e50703cfe0852419b9f8d0bb4d0560f0fe0614d48c5b5f23b1444bd67934bcacc9365da87b8db7c9729421117c7236845404edbd80011cdd7444a9ac17c58962923c280d6e8fd2eb3b33ca78a59547db4060593fb81074c38b9c0d04065b4574cf93902"], 0x4d) perf_event_open(0x0, 0x0, 0x1, r2, 0x207) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000040)=ANY=[@ANYRES64=r7], 0x8) r8 = socket$inet(0x2, 0x3, 0x7f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r7, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) flistxattr(r7, &(0x7f0000000240)=""/192, 0x28) connect$inet(r7, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10) ioctl$sock_inet_SIOCGIFPFLAGS(r5, 0x8935, 0x0) splice(r5, 0x0, r8, 0x0, 0x110005, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f1fc4a4e93b0de635ba4fe045da55813bfbae6fc9fea32de6d92e25ee46984c1e56e9c8b22eff63bfd53bd9b54f7d6621812070aa3ed7714bdc1aeb5e22e705c9290dc569dfcb330262532ebf8b64053c29979517779412c1647d6bdb627a30e3be741a9160f0591b064789adbf820c3a56c86c690b"], 0x76) fcntl$setstatus(0xffffffffffffffff, 0x4, 0xc00) open(&(0x7f0000000340)='./file0\x00', 0x40100, 0x10) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000100)={0x1}) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) 04:03:55 executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) fchdir(r0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$FITRIM(0xffffffffffffffff, 0xc0185879, 0x0) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000740)=0x200, 0x4) getrandom(&(0x7f00000001c0)=""/184, 0xb8, 0x3) sched_setaffinity(0x0, 0xfffffffffffffec1, &(0x7f00000000c0)=0x6) r3 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000280)={'\x00', 0x1}) clone(0x802122001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r4 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000600)='/selinux/load\x00', 0x2, 0x0) write$selinux_load(r4, &(0x7f0000000440)=ANY=[@ANYBLOB="1549bf857b7b582057efe7baa449700f4a9175935955f21e50703cfe0852419b9f8d0bb4d0560f0fe0614d48c5b5f23b1444bd67934bcacc9365da87b8db7c9729421117c7236845404edbd80011cdd7444a9ac17c58962923c280d6e8fd2eb3b33ca78a59547db4060593fb81074c38b9c0d04065b4574cf93902"], 0x4d) perf_event_open(0x0, 0x0, 0x1, r2, 0x207) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = socket$inet_udp(0x2, 0x2, 0x0) close(r7) write$binfmt_misc(r6, &(0x7f0000000040)=ANY=[@ANYRES64=r7], 0x8) r8 = socket$inet(0x2, 0x3, 0x7f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bind$inet(r7, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) flistxattr(r7, &(0x7f0000000240)=""/192, 0x28) connect$inet(r7, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10) ioctl$sock_inet_SIOCGIFPFLAGS(r5, 0x8935, 0x0) splice(r5, 0x0, r8, 0x0, 0x110005, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[@ANYBLOB="7f1fc4a4e93b0de635ba4fe045da55813bfbae6fc9fea32de6d92e25ee46984c1e56e9c8b22eff63bfd53bd9b54f7d6621812070aa3ed7714bdc1aeb5e22e705c9290dc569dfcb330262532ebf8b64053c29979517779412c1647d6bdb627a30e3be741a9160f0591b064789adbf820c3a56c86c690b"], 0x76) fcntl$setstatus(0xffffffffffffffff, 0x4, 0xc00) open(&(0x7f0000000340)='./file0\x00', 0x40100, 0x10) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r3, &(0x7f0000000100)={0x1}) ioctl$TIOCSBRK(0xffffffffffffffff, 0x5427) 04:03:55 executing program 0: perf_event_open(&(0x7f0000000300)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x7c7e, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/full\x00', 0x101000, 0x0) write$cgroup_subtree(r0, &(0x7f0000000040)={[{0x2d, 'io'}, {0x0, 'pids'}, {0x2b, 'pids'}]}, 0x10) recvmmsg(0xffffffffffffffff, &(0x7f0000004540)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000002e00)=""/58, 0x3a}}], 0x1, 0x0, 0x0) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000380)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x111400, 0x0) geteuid() add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) sendmsg(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), 0x3, &(0x7f00000004c0)=[{0xfffffffffffffdae, 0x29, 0x40, "1a1caf68709cd7a6fd09b16e92e4"}, {0x10}, {0x1010, 0x117, 0x1000, "7f40aa6c94406013fe5d7026bf185fc5d26431db62dc5f2d4b078e48e02e4e8d35da00eb2668564f504a9a1b79d1126202d0de47d0fa26ba462d505f203c6c53099e6c92289d68e843c051ec8c68b50037409b8191c98cf2e1a9449cd28b5be077c8e325a592c570fabdeb510c402ddc3226ae3e54a05ff540aa220f6479c8d40e69ee039b1e8ea26485c2e341dbe9c48075d7cab6e1115a558abb876d65a4d78787530bc82366c1e9d8b73f764e597956d792909f64d0b29c1e5b60c3f0de99b0b29b3245f65b31edc2c91d03d1d527fe2172907101dfa9ee1e9f3eb8f42799a96eb6c7109b732bee15f7e9a15ee3c519bc4c0c1eb8616df0069c692581f33815001d76e623f128f9ebf87ae7102a14afae43b4c065be222bf5cbbba4442e50e88ff1b865756713f78392502a431de5bc6dfd4f9c36e0c1ee4388f1d30ddc54072e063f95d44cb20866e12ae7b67c149f4f4d04e2a25aa496f58af9544854ee806d3f8b1358e6864e2dd1ebaba0901f9209c0350db60ae9bb6091559b6d31678a9b418605ad774429e9f1915dc16f570056ecca0df47330c5781569228b315bd4e8103b889626b4dbab01cec31819b876f83b01ff0ede2664857c039616ad355dc3a2bdb376ab3029a724cf12f0b24066d28c90910c3b73f417905ba780038fec3e0d58703bd96461136bc23feadb6e77e6c355607dba288914ea0e4a0d1cde2a2c84c3f4eefc7b0c08d1047126657f3f6b49d8fa435712d6641f6ab119d28560f0599e553e5aff6419d43735d77d81e795a5d3bca48ff75bbe3d245f4560cd4e2d0ad4f69a3f922f8027b7060db2d6f1a0a1194f712c7d4919f275454be6fb5449bce14443b55802061b4911b40d2753b149a1677285318ddd75b11af92dc6fa92f5e69d64055a34567b0a26adcf343868e211812c67be717a4911cdca1578f56de8146876dcb6f11764a2d2d88c689c706aa2051489085d1f47d3591ef990805a1de093c57ed9e450d78943c4f2df5c0b01f65d126cecda4bb68948dbc5c0a955d627af20ae9ff8b7fad13691448404c308c43a82962fee1d9ad928e4c263f6cbf28b79c73ea3004054605ca48772b5bdbd2328c5a19999686995f550c01531da9e8fcf567445d59f82223c8641d0a7d281ca9f35e8491d04588d2c5d7027ef9d5db66e30d07d0c53a7df82420a7a899a39298c58073098cce94d39f945c8d70f16883c409a26684193d9856f5f96aa97fe7c470365e14ecdc2c08e4004f6b74569ae17ce867cb41f2d9ff538dfea34f7e2921c7e25f39ebc474f170302d7633fa878e6cedf702553a430c849deb4c84271cab7c31a73ac7b10b9ea27c60cd6dbfb7dfaeb9bd7352e0af273ea3e8b9a408f2a969daf3a3a75a672f6752c7d7a9d9207a4d55796d6ccdd134ab832c617951fe41c225074170e201d5d67ec196c15ff905b613671daefeb5df2419c385c31ccf29a58eea3297d44ea7609d9e435587b719ad3f5ca40be377c86a79027e8be6b2f9c0bc9695c65fa2aa240152d0fb52bf1067999495c89c7977808cbe80db3f3be3329585992f661f2ec9e2035a60e5e2e1789d314396ad05b749e79843321e811cb9452708a87ac45f358f5c086033653bba202cafa2205f8970cc1ec8b5c192653a6c5e23bf2438de556052d173ecbd82c5b105574c5744d5dcad9f4780558f8ea134b288917c9e97baf4532fe8424b60d6d1c1d79c7c4216df84e19be1f7d63f07f1c28b4aae025eca1b0381e90272d8e9cf8e390b580cc20c6aa64e65daf13330b93c9101fddabdd5f312733ffaa885af8d9418b7cb1f3f5e9cf898ad6b804a5e46a949022c3457cebd21d9279125fb71931d2f4000688af69e935ef374ed88307c0d016f64780574b683a7cbee61a504babc221573730bbe7c41af1177a66739ca88767f662ef7b3a6cc2b3ff3f6d8571cc599ae657be967311d6f3643286f3b8226c7da2ffc6ac34b4ab5fd1b0b76740da270f0da9e9cb34299d9307ced589a3ec20ce52af32550833b18ae91388572324d235e3d1c6cfefd08ec851685830348ca9215e13ae47a292b0038f8d9538843ab36a1df14e59db45f0cafc006cb9734e6aeb3b88536271ee065f28cd943176fcd147e24ad65dcb8ce52f002243abb49096a0d80597cf239e0ea48fd696e1127cb81cb550a6f5bb14f96aa4c9614b756c85bc9c359b1abcf6a5658654b2ef40bc9fc39b15362fba776c5e21a4a8fd67536c489a72fdfedbe664d3823ef2adda9d979cf30a91398a117fd09ba2023da1bfc3d141759498a8003130f0a7d6c8a90d8376525454311772c8f380f1d9c57415f6d6ded1cdc76f57462e6ed5cc5ae983622ab41e856d3c5c9c6acb014cc331aa378d0a374c29e1613853bff8d44f22ed48a996ea283a21f041647da746b1af7db6c897d5bd65f025779c267f7fe10349c513f2ba874dc127c6d2eba159298bf4c43a1763e4a74f9bccf30050bc0ebb3d488cf0341f5f235d7a63784e213af75838c38b6f2f2c62f8a323fad84f9fbc0a045c14256262a9171713fc87c0a92c3b05d0e59ecb553aee137e8e5bd7cf6792e54d81bda29469d6b4c5e2e944320c69714aa3c001d8e0f295fd854e3345f54ae421c86792c4a840ccc1829572fe41a3adb6799fe7f16ab1447f7a23fdfb16e24b3f82356a7e68318b08e8f54cba323d9ea63997d0400434054105dfa9f2f74609f6dd678037b1a5477e7d4659d31ab99a59723575d1d677d85b50e552976ef4cb8fc43bf233eefc534fce256c70f8a9543f0b866662a6e3a440a3eb2db87e08189c20556b3176c618dbcead73380470c66713b866bc016c879883a3099a04b304d2e4002e19d0ed2fd4c2d6d95ffbdb0c9b3c23892892d4e7647600a6455ec98e1b94513f1ffdf1c1f48c5208842b652b636fc26d05f45a1ba6a192bf44e3e0a623c234f8a79b2ab80f7ffa144b1dd17d21d5d41f14836f35dc92761abb2fdeb15495791ecd64c5219520c8fae7d58cebbc266037b563b7e45b981876847afac062062094a306641be948dc6f73679b9fe7741e4f26740d96115c9be58d77d1003abb70c78ab8719327e5aedc1045638fa469db655b1d1578c9bc70f43371b1558e63046effe2554774fe5222f35731c50d0459d39b341f2d44f7a4ed157e7c20a79360b87ed56fd624327cb0a1cd74dff66eed1ddb89bdf586b19b075cbc669a7b859926a3189ed65299d0663a443b400f09302a107b0940eecd9626fb4d4385a386645daa18d438650bbcb155c2159226f052b62f45758ee8740b340ccdf0791e1df7102e2cba2c0647fbbb4a39a81abd86a6db4843671eb9603b09cf88665d6e55f5344371fed2ad2bb4b1121467a23cc4c5a680c508e91b6e6f67b6f1dae800e289c2e0cd7acbe0e358c2a3c080cba601d276ce9219e2aa4420abd6054ce821a517b2b8fc28d278faa1cef2f6e81ca4fbbd49a87c4d6e187618f3d25b2a84570bfc9f0e9bead7fb5f2e6e36d71e68cf2d4bf5d9b126d4c198fb4e39d6a37147426fd73cccbf271639445f1f531d22593f64a1bcb3dbb0dc04dc6ea7e8d76bbc5dee24cf81d13b73cd0a6f221556bf0db0fb6afc1af1fa2738ec68d52e10ca054afc64180dce580f1439071ea5a1829029ecc7048ebd14dc5039742f5edab2b27c5c832df65d515c95e744387c94578cd683b4119bb452afaa5096c0fd3e7affbeb5bfac35723ce18f3a9b04ab95019a91df1dc717596248add1f910dba282378e03e4a47287fc756e77f4931c1d3e58c34f8eb63ae8206c72a39da58366a48ddbfa7911f94a2961a4586bc8a7836ebef6c52b3628320565ef155cfdd0a73db11e198aad6d9ee38ee07000c95e46e6abb842b202c57f466f13d6b3e93198816fefc1eefc3ecd101d9e076eb5d4768ae66592964c4963d084b11fd1d6f15457deca06ee592d4602968be0ecb40a777bd597c34a42e4fa9bf8e3c23ee0d46be422111ffb4c526165f87a5bdfbf07f41dcf5e1e9799373a1350b3014e869ac54816f1e16a9c7365e1475800da42a43dd1209f9a380ceaece402f89c44019f170fdd25fc26cdb07206ec7f118bdafb3e4e8430e9c63bb576600977b536e848303887feef8a369b50be6d055e26bc256dc972894532291a006f7181a383c283953c5b50d37ebb7167ef68682eeed74e9e242b34b743bc7918048a9dae28f42e05f2c4b32a089d34fadf301aa127706473e40176c59a50b556ba52fe4826f2a44646c8347b23807c906029c8d679736afc3f8342659080152077543e49dd7402bd9730fd184a93751cdccb258011c8bf0ef8529b13ae6ba79c5e78af7fb347de8fcf87d136d1e52dbcf5fa2652f915ff3d3a126d07f8ac732623fdf4c894b662783b603e365a64595f504c941221a2a3bd1f877a939d1d772441e523c7a8c21910f92f0fc469b9de255fb20c67bf5a575e24c0d88ff941beaa993ed9e7e6baebc64399809402d3090e8575427fd4db89cbc16174c5f418f3b02c0fa77a8e8496d81f45cf0d7229876b5d0459c5dcff56db2212df05e41a6fc4179ab9feefec15c99de3e1f463782fb5f993c438b3d489309f84a3d1f220f696428c0113b10213e6aa72045b690cd7b2cc29c9f3db4310e29f0918c3325d699dfdd3cd657bfdda0e891b7ebb778acb3f821cadaa1285f8717b8ef5294e72c57a82cce0827de26ffcbf166b26c11c0a8b2a3fe8af48118ec53b87c984399665742b09d0da3c2aae81ac2ad35c03367a8344c204637e682ced5fa1f2d483a4c72ae3026c66e813f6fa9be98e69eccb6379bacdc6107cb33a95e590f259074db4791e43744a4893c53c8135e0d4dc4ba324a2149ab8a7eeae0895a2b7172e3a0e1c5e397791056ea0d2e1b343de62677dd5f8851081bc33c168f9bfdf081a5d156c6e55a19ec77b1766b8480f05d2958c76b196ab45d9ea2a634dcecca72f19ef8fbe7149fa20fb05c2b89e732d088d71b50448eb28cfd770dc5934b73785830c46244dcc4cb55fd84c3eefdc977ea3c559056502bb3cca9cfe3abdd2c178f0a2cfc920cad69e418aea352fb8fec6836da4aa9c6d08f3e25553fd36dc05777673c4dd29870fa2ed58d48d7003ec04b627c69ef3df4a4ea626ee05ee9063dd1957f1d8820be2d78126c31d5cba3d67f8c1a4f508827d2ea821ef4d37fd3dd59467c1f2694c79585b43091cb6c7c43f350aa97344956d6048d0004eef3cd9815072c62197dc2e6f0a66ea68d3d9127c87995e69f34b9933a82bc05a5c46e1fbda8cbfbb1b4db944d643bb98088348c1f883751e7abd60f81fda3b2791d80947913f26b58a7e92ffc4b16efdcd63ce7b3827750501f01dd5aac6c6242d646846fc3e9ec5abc27aad66af8f2229412a600def6a4b7d13a84c0c3bfa5f1df4c1b1ed68dcf3bf64f2a752933ae21bb2353aa7a69c638e587dab28722a6fd800ab1fbc19b030acb01e0b07c900c6029245124f293feda61c6352b2d0f7dea633354a6d53249a6b595b4829b4b00984aa08eda958da0e862d1e67d0f2a151128608af2d724470d68bff609da4e106b85dbe59df1f9200da19948be6207e91e63a005aa5a935b3441fd1970fca7d2b224c3f10fbd3b68826fa5b979bf7c68c5aa85cb744b17c60d55934ac2aa3c7aae8c632ad5f54468c812bca6c7f6c284c8a628b967671a1b893c506f4be5b5c700866b454eab5e23a4f432680aecd4611b5e59108895586ae7c92f68c767ca879670bc6cfc4d13624d52d7ead6fcea84e01315b8776795dbf"}, {0x80, 0x101, 0x4, "23c7563e6319739f043ddcd1b5e008aec2e14f2a37640dad887979b0ea2bc8e306083990721ef81cd47ff57be423347e3918c91e964d8dbaf2d2c32bfe0ee7bb3db1d810c6598a9d269526e427ef6edb4622f9907922fad85dcb5ff2bb27d00a114c8c1dd11de1ddde7ee2b6f1a2"}], 0x10c0}, 0x4000000) ioprio_set$uid(0x3, 0x0, 0x0) writev(r1, &(0x7f00000023c0), 0x1000000000000252) 04:03:55 executing program 1: r0 = open(0x0, 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:55 executing program 4: perf_event_open(&(0x7f0000000100)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}, {{0xa, 0x0, 0x0, @ipv4}}}, 0x108) preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='net/mcfilter6\x00') preadv(r1, &(0x7f0000000100), 0x2df, 0x80000000000) 04:03:55 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:03:55 executing program 4: r0 = perf_event_open$cgroup(0x0, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)) r1 = getpid() perf_event_open(0x0, r1, 0xfffffffffffffffe, r0, 0x3) mount(0x0, 0x0, 0x0, 0x0, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) futex(&(0x7f000000cffc)=0x4, 0x80000000000b, 0x4, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0x80000000000b, 0x0, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, &(0x7f0000fd7ff0)={0x77359400}, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc)=0x4, 0xb, 0x4, 0x0, &(0x7f0000048000), 0x0) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1c0000000, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000840)=ANY=[@ANYBLOB="020300c07d1533876d9d854874030a00ff000000000000000000020009004000000000412d1fbc0000000382512c8cb625cfa75637319716000604000000190200ee00e0000054d8fb0c186fe8b9000200010000000000000002000006013f01000000e60000fca0d963d30c09bbbec10ee6879faeed94707a24258ee34bfa5847db30986494f31a8fc451847ee95c07ab46195abb4390f184065555d0b966d5e58c848ce023e25de71e4e964a55c35abe4a8982090f0738fe98876daf61f59d43f8ca49225aeb31e2c4eaf043d122474b2c24cb62c90f2983063fd4eb9bd9f61c82e115437b715d32b3943c36ca564002d4d832ebbea365f8a6617885258bf76218df2bcf71cfade66ed6de8d3036a09875d844b182796230027be6c5c297fa48a3db2847ceed1452ee49407a233456877431fa000100002fb9585496d4e1782dd28c6a2fbd1310fed9b2b82fd59419e3ddd07dfb4edbfbe4d6eb058537dbe20b55ddca1b7c9f5ff89d7202b71e83ec6deaa3d6a04f5030f32e1ad5eca6567fd08519af93f26536f34edc9d4b6c044b67e8387e9c5d1ccad68885d1e92765c470af231a94d450a0ef32af68d47521faf292b27250f81a503df115f62c04fdffd9802139b9d38b0191059455628b385cbb9f41577df885dd65b1a8ced68af72853b98bdf86a938ec83f033bd9bce85e7929ba37f38e2435152649172f4feabca1b654f9a67ef810dc6164cbcdc1389bff7d8d67d46c52f8270432f48d5c912893de10067232209a6e4519651ac945d79edf9d69b94d9b014ea4e665d306df6c5fca40ab0c4ba3814ec01bb6c4cba93a18339af123ce17eddb8b3a198f9f0a607e4ad6b391cbae848f932c8fd69513722f4ab9559a6e60a21b8c24a8871d7b3c86e5636af242c"], 0x60}}, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000100)={0x3f, 0x5, 0x8a, 0x0, 0x100000000}) exit(0x0) lsetxattr$trusted_overlay_upper(0x0, 0x0, 0x0, 0xfffffffc, 0x3) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x1, 0x0) r4 = ioctl$LOOP_CTL_GET_FREE(0xffffffffffffff9c, 0x4c82) ioctl$LOOP_CTL_ADD(r3, 0x4c80, r4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={0x0, r2, 0x0, 0x12, &(0x7f0000000480)='securitycpusetem1\x00'}, 0x30) futex(&(0x7f00000001c0)=0x1, 0x9, 0x2, &(0x7f0000000200)={0x0, 0x989680}, &(0x7f0000000240), 0x2) perf_event_open(&(0x7f0000000400)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x40, 0x0, 0x7, 0x0, 0x0, 0x0, 0x401, 0x10001, 0x0, 0x3, 0x4, 0x6, 0x0, 0x0, 0x0, 0x0, 0x580e, 0x5, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x0, @perf_config_ext={0x0, 0x1}, 0x0, 0x7}, r5, 0x0, r0, 0x8) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r6, 0x400c6615, &(0x7f0000000140)) getpgrp(0x0) symlink(0x0, 0x0) ioctl$TIOCGWINSZ(0xffffffffffffffff, 0x5413, 0x0) setpriority(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$nbd(0x0) 04:03:55 executing program 0: socketpair$unix(0x1, 0x400000001, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000100)='trusted.overlay.nlink\x00', &(0x7f0000000140)={'U-', 0x36cf0000000}, 0x28, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000080)={0x2, 0x3, 0x1}) ioctl$UI_SET_LEDBIT(r1, 0x40045569, 0xa) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f000001bfc8)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="3000000010000108000000000000000000000000", @ANYRES32=0x0, @ANYBLOB="00c6b1d779c69eb836d604c04907"], 0x30}}, 0x0) [ 2435.790733] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. [ 2435.798039] binder: 20522:20525 ioctl c018620b 0 returned -14 [ 2435.804087] netlink: 16 bytes leftover after parsing attributes in process `syz-executor.0'. 04:03:56 executing program 2: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0x4) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40086602, 0x400007) r2 = openat$cgroup_ro(r1, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) ioctl$EXT4_IOC_MIGRATE(r2, 0x6609) 04:03:56 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:56 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x1) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket(0x0, 0x4, 0x2) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540)='/dev/zero\x00', 0x10200, 0x0) write$selinux_attr(r4, &(0x7f0000000580)='system_u:object_r:ld_so_t:s0\x00', 0x1d) sendmsg$TIPC_NL_NODE_GET(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x204000}, 0xc, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x80) sendmmsg(r2, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) write$selinux_load(r4, &(0x7f0000000280)={0xf97cff8c, 0x8, 'SE Linux', "8fcde7b91e0a0a201180ca9f2cdcb0535608f3d21c2a00d1b63009a5cd02ca91fce985abb6b8a4aa28d0245f0c91a2d8ec3d6d52da9a5422ca1eac0aa607b283eed6972c6e065416c473d3b242fb3366b271a2ce5fb027a94f473cc8bd597d10e3b42681af1fa85c667f7ce6a72121c96d866a462e1a6f1a14a9476ad6d228051f98341942eacc98edf1e2d87d3afd7473154d28ad2590c2477fa6cb1e4894d32ec2f0427fe1bfcbf3f667f4a2110e7e3cfbf1c11976f1125ee069c5aca42b9d8442d2565b0fa2eccfcc540d799f67e617b2b3cfd4516894fc86c76ffd4eb8f8f457d5a0e7f17664f41a12d6ae53"}, 0xfe) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) 04:03:56 executing program 2: pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$GIO_FONTX(r0, 0x4b6b, &(0x7f0000000040)=""/96) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @ipv4={[], [], @remote}}, 0x1c) listen(r1, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f0000e11ff0)=[{&(0x7f0000000940)="580000001500add427323b470c458c5602067fffffff81004e220000ac1414aa0b4824ca945f64009400050028925aa80000000000000080000efffeffe809000000fff5dd00000010000100090a1000410400000000fcff", 0x58}], 0x1) [ 2436.016438] binder: release 20482:20484 transaction 445 out, still active [ 2436.046739] netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'. 04:03:56 executing program 2: socketpair(0x11, 0x807, 0x2, &(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000500)=ANY=[@ANYBLOB="8f000000000000000a004e200000003ffe880000000000000000000000000001ffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000070000000a004e210000001ffe88000000000000000000000000000102000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2000000004fe88000000000000000000000000010104000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0095bd6d490004ff0100000000000000000000000000012d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000a004e220000000500000000000000000000ffff7f00000101000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a004e2100000005a175c30a44d985f5489bc5e43cfae5f10000000000000000000000000000000000000000000000000000000000000000000000000000000000e0ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00004000000000fe8000000000000000000000000000bb01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000a004e230000fffffe8000000000000000000000000000aa0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000911d7291447e94cb597fcdf59909c9a63a5deb9c198c5bb71b095e4c8f7a28fedbb5eba8ef0e56256ce305bfdf1c23862046ce4dbded5f72f04deb44b446e2165baa7ecd7bfd36a95defee985e42883bf7636828f2c2a7c712f5c0baf15dafd77fdb86856ec715c8fd5b4395f90e821afa28d1488a2443af4fe61bb051f1ace0"], 0x410) r1 = perf_event_open(&(0x7f0000940000)={0x200, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mlockall(0x4000000ffd) recvmsg(r0, &(0x7f0000000400)={&(0x7f0000000040)=@x25={0x9, @remote}, 0x80, &(0x7f0000000380)=[{&(0x7f00000000c0)=""/152, 0x98}, {&(0x7f0000000180)=""/160, 0xa0}, {&(0x7f0000000240)=""/248, 0xf8}, {&(0x7f0000000340)=""/28, 0x1c}], 0x4, &(0x7f00000003c0)}, 0x2041) fchmod(r1, 0x8) [ 2436.061223] netlink: 64 bytes leftover after parsing attributes in process `syz-executor.2'. 04:03:56 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) fstatfs(r0, &(0x7f0000000080)=""/102) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x11, r0, 0x0) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000040), 0x4) 04:03:56 executing program 2: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord\x00', 0x2000, 0x0) write$P9_ROPEN(r0, &(0x7f0000000200)={0x18, 0x71, 0x2, {{0x1, 0x0, 0x4}, 0x20}}, 0x18) mknod(&(0x7f0000000140)='./bus\x00', 0xa88, 0x0) lsetxattr$security_selinux(&(0x7f0000000180)='./bus\x00', &(0x7f0000000280)='security.selinux\x00', &(0x7f0000000100)='system_u:object_r:mount_exec_t:s0\x00', 0x22, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) execve(&(0x7f00000001c0)='./bus\x00', 0x0, 0x0) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x1110c0, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) setsockopt$packet_drop_memb(r3, 0x107, 0x2, &(0x7f0000000080)={r4, 0x1, 0x6, @link_local}, 0x10) [ 2436.152493] binder: BINDER_SET_CONTEXT_MGR already set [ 2436.165704] binder: 20540:20564 ioctl 40046207 0 returned -16 [ 2436.175468] binder: 20540:20564 unknown command 2097152 [ 2436.189525] audit: type=1401 audit(2000001836.310:557): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 newcontext=unconfined_u:system_r:mount_t:s0-s0:c0.c1023 [ 2436.209412] binder: 20540:20564 ioctl c0306201 200002c0 returned -22 [ 2436.217126] binder: 20540:20564 Release 1 refcount change on invalid ref 1 ret -22 [ 2436.243406] audit: type=1401 audit(2000001836.380:558): op=security_bounded_transition seresult=denied oldcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 newcontext=unconfined_u:system_r:mount_t:s0-s0:c0.c1023 04:03:56 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:56 executing program 2: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x5762943f3e7ee2be, 0x20000802, &(0x7f0000000000)={0x2, 0x10004e23, @loopback}, 0x10) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) r2 = fcntl$dupfd(r1, 0x0, r0) ioctl$PPPIOCGFLAGS1(r2, 0x8004745a, &(0x7f0000000100)) 04:03:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 2436.629005] binder: 20672:20674 ioctl c018620b 0 returned -14 [ 2436.692806] binder: 20672:20702 ioctl c0306201 0 returned -14 04:03:56 executing program 4: mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000002, 0x2172, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0x9000)=nil, 0x9000, 0xe000, 0x3, &(0x7f0000ff2000/0xe000)=nil) futex(&(0x7f0000000000), 0x4, 0x0, 0x0, &(0x7f00000000c0), 0x0) r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x4500, 0x0) ioctl$RTC_VL_READ(r0, 0x80047013, &(0x7f0000000080)) 04:03:56 executing program 2: r0 = syz_open_dev$evdev(&(0x7f0000000080)='/dev/input/event#\x00', 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x1, 0x0, 0x0) r2 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xe7a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x1, 0x0) r3 = openat$keychord(0xffffffffffffff9c, 0x0, 0x101000, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xfffbffffffffffff, 0xffffffffffffffff, 0x0) statfs(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)=""/45) r4 = dup2(r1, r1) ioctl$BLKBSZSET(0xffffffffffffffff, 0x40081271, &(0x7f00000000c0)=0x2) dup2(0xffffffffffffffff, 0xffffffffffffffff) getuid() arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000100)) r5 = syz_open_dev$loop(&(0x7f0000000300)='/dev/loop#\x00', 0x3, 0x50db4dba1eb86aee) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sysinfo(&(0x7f0000000440)=""/154) openat$selinux_context(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$BLKSECTGET(r4, 0x1267, &(0x7f00000002c0)) inotify_add_watch(0xffffffffffffffff, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280), &(0x7f0000000400)=0xc) prctl$PR_GET_THP_DISABLE(0x2a) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000240)) write$P9_RVERSION(r2, &(0x7f0000000500)=ANY=[@ANYBLOB="1400000065ffff0900000006003950323045308b2d6e0798be7b4cd2be2148631f92b932216ca12a5020ce7cbd792228e6cc3e470b6691c75a41cbbcc03dae1d348322f13117b4477a0624ff805b8aa9e90a2d07fe74e0412c346ae0dbd23a569cdb5d5f4fb143bc2134346b5f707744ba52d2d3c5d24d8e2fff78e24f7e1e984b0ade88d0bd701175ac4fb318b69148355026b1cbaf9b2358bbee823ca06a55a839525ca738441a41800f7d9374ffe59ac7df6bd36e82143ec0aa83108f2435f5d03d8d9501e6f0267daf3a9bbfe15500"], 0x13) sched_setscheduler(0x0, 0x7, 0x0) openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000340)='/selinux/context\x00', 0x2, 0x0) ioctl$BLKPG(r5, 0x1269, &(0x7f00000006c0)={0x1, 0x0, 0x0, &(0x7f0000000800)}) sendto$inet(r3, &(0x7f0000000180)="a46ef51a81fc732fd9ab70e594dba1c83f78cf8a38a516f2ecdd06", 0x1b, 0x0, 0x0, 0x0) ioctl$TCSETAW(r4, 0x5407, &(0x7f00000003c0)={0x3275, 0x0, 0x1f, 0x0, 0x16, 0x1, 0x3, 0x7f, 0x800, 0x8}) keyctl$get_security(0x11, 0x0, 0x0, 0x0) write$evdev(r0, 0x0, 0x0) 04:03:57 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:03:57 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x1) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket(0x0, 0x4, 0x2) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540)='/dev/zero\x00', 0x10200, 0x0) write$selinux_attr(r4, &(0x7f0000000580)='system_u:object_r:ld_so_t:s0\x00', 0x1d) sendmsg$TIPC_NL_NODE_GET(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x204000}, 0xc, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x80) sendmmsg(r2, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) write$selinux_load(r4, &(0x7f0000000280)={0xf97cff8c, 0x8, 'SE Linux', "8fcde7b91e0a0a201180ca9f2cdcb0535608f3d21c2a00d1b63009a5cd02ca91fce985abb6b8a4aa28d0245f0c91a2d8ec3d6d52da9a5422ca1eac0aa607b283eed6972c6e065416c473d3b242fb3366b271a2ce5fb027a94f473cc8bd597d10e3b42681af1fa85c667f7ce6a72121c96d866a462e1a6f1a14a9476ad6d228051f98341942eacc98edf1e2d87d3afd7473154d28ad2590c2477fa6cb1e4894d32ec2f0427fe1bfcbf3f667f4a2110e7e3cfbf1c11976f1125ee069c5aca42b9d8442d2565b0fa2eccfcc540d799f67e617b2b3cfd4516894fc86c76ffd4eb8f8f457d5a0e7f17664f41a12d6ae53"}, 0xfe) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) [ 2436.848060] binder: release 20540:20564 transaction 448 out, still active 04:03:57 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) connect$inet(r0, &(0x7f0000000340)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x11}}, 0x10) sendmmsg(r0, &(0x7f0000001800)=[{{&(0x7f0000000180)=@tipc=@nameseq={0x1e, 0x1, 0x0, {0x43, 0x1, 0x3}}, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="7028f293f2"}], 0x0, &(0x7f0000000380)=[{0x0, 0x101, 0x1, "9f9c4469caccd6e9ec1a8b3ff53b6631bfcdecc85b8941e84a209a36ff8358df733ab8cd13e15befcf872b70d148e0c5aa32710af041e7e58ea18a51f4281fd689f0cb60b14333ada1df3533d728a820fd065ba7414b27e49a19dd5831b4b375fa0a927074c86f6af9d3691233269d930cd2e791f0f0bf6de1ef8b8bba3f828b0c3c913a0cf13f3c55ed8f9f20e9efcb9f166cf870bdc17999d2bca7db73617815b1532d364087d5da56331cca68c76b91401f0658df844197a0bb5e2cdcaa2fb304cac653d0c8040b92d6f28a0be5c479a9d9fd5c05929930ea71b70a27de133876645ad2c985"}, {0x0, 0x118, 0x3, "74f11d27ac2e579494a637f6f620eae7b47a45f8832dc05f57d68440eb81128069ad625ab687a9ea72ab11641673822c60413d30f7a45e0bfad35e7c3667a67ae9191e0a64648ef04c487524476dddb975bf1dbf704e7254dc549d2f5ba4ecda0e9eddcd1b1e90ed4043626ee2ea658a9fdabe0e48da44178ba2fe8bc46bd06d5d4303c4387232c0a21cc815a78ccd849d2e8ba9dc78629721a95de2c16963aee6bdcabad8e5437e8156155073cbc4fb34b5a545cf5d3c8a1900ee7a2e4b706c310404e2e3cdae59aee6f40457d23c3e9783eeb848ce3b956770b22b0b2df1be6d34c6ee542b487030be26326c37eb30b25978a01c9434dd15458d9ba6ab8915330123413ae5bc23656d5e8cbf4514e64ea58402916530dda990f459791f11f278dd396f3aa3d1ebfe9b1678eaec9ef3d11abcd37bc9bf74124f59527c6714fe481839df6d7f4af8293d16f4b2cea3ac15209290c62a744d95a89b15d64cde05ac09b1d88bd2fa7dbdb7f085daec8b8b775308a799f2077c07cb8358aa491b24578ca21a978ac28f3825d8fe0e1c4a43a7161116a694610148ce8d995d885278b60e397cebc35ef139abfa520ae03fec9fb11d7cfe0c92e55eb689ec791cecc2018f5ce690f642d7a3f758202ee1c06b76c47578aa5338a82c17f9272bf46549107e15dfa9083b1c85f3fb6c6a8db8fefafe6fd3df94679d5dc05e471b5b028b461e51e85dde0dcdafd2ec680f08239ec7872f5a81c1bb967a988a29f486b0a6266eabdde115a6c77d64ef2035234ec5f742a48d4003a7dd7dd48ea184cfb1179caa1819d80e62ef5e830664795b7b4c74ac720ca9f3d5538a12a4e46a6e0e189e32483ebe1dbf09f4cd9f9236c034927ff20235054c31525442f7db06ec6cf438daadbe2f43dc7a2719309acb2c757c6695bc9abef696bd6397a20f65b597345dc620767b3584ae4abdf2d4073b41c837d3cea9cb5d173a45d7da56f6f6bb4e8b7c7e399b8ef9d229c1256bd6dea68b9cc09da5c1d50ecd79a1821c8bff4f1eae7a89adeadc13dac4f42ca1b4f87803779c27f1580c9f5cc6e2d6bcd6ce3c9ebbc5b848b82313e8f37311d113df563640eb6420469a6827cd9e4c1bb47f7455a3cb691327301a697d6f9de1fc31c447291526f4ab1dab0e383090fa4d27e2bbf9be30f9b88873d89ca406fad870ff6370144a34ad0deb7835eb1fad0f0371af4e97eeacf165173bc1e99e632a7f555dbd2235d9a3eefb6999e92618b147b3ac70b9623dd8d7372fee6bbae2c7a4df3e0ff5ad2988eeb7efc9816bac02df2abd949f75291909efbffb798b54dd0861ac55ef56e6a0f0821a56e6d3c921e540eed1e8ab5a7bc5dbd5f2355cb543818232a19324172ba20b019eac19cfb5f203fd173fda3530846446f3519f9139d643f734bf9130414cde5ca8518e8a2906712e12b01813b5b6fdd808c134e09d16bbdb4fd842b6544b08729e7d5f8beeffa158c69dd2f51788710c1e26be7afd74ebeb191944136660d847807697c9d5627ad5c63ff4cffce73a3001339dfb880625dcb96991108e1f25d199faec2156dafb4682c2fda813bbdb9b4a21542eb532a238367ef2706eacfc92d34b1393eadb257bcb690017ef4ab679ce89095c3cff0cabef1446a24080b5b5047c0c3fb278bc7be8270e8637eadd1673d0e5e4087d2c9e6a06ab1e1def5c7ad29f5df6c2eb20ffdf9e2e150460f977e8f57809895677bfe0d41db1a7ad182f17e91062a1b076bb0c4f52535b081d331ace47e5fb2b6e6993d3d9982cc642c7dd95600446d00ba0be54350d65c6fa28199b2695c56acea802e05ae370cdf143b0e3182bd758654658cd11dd454e1e3133c3e9366a948b3e18644294cb2555eaada1434a7a4c929965a3c62ef07a3a9d3bac174cc14e65f172ed314cdc9c430013d7f073c9c5a5e0a272b14a33a2071944aacc0001ac113c31e6e243427ce3a939963d08ae2a884503a0911aa088157902712c10c4af234f90f25dab349b58eea95e8457831ebb06691f0efe2ab458515a0a77e4afb1db2d90335cbc9423621202927ef4e7792d7b3658b39d84352a1d63700388751749de221477d10300ca93600f0d29503d03e8784211f689dedc079bd2ccd80780ee85b0ba79da4112f8e7b4867b49c526e8020908fdf3a21c863d4169e93d0da87c6090143bd6fde8e1500eec64477b0558a090ae3bd6a94ba2e3780c985bad5a8b06d97ce53d805050bcde4c929e286d92a27ef29a73182f6b493b4d327c21bd44c759f7d3087aced6e3efc9374052327d77a28a01e603d9754cc248b88d8985a0f5b9e42806953c14a696a435baffa304d7d904dcfacbb48802cff8113a7d9916a25f48b3f87a79d095ef993a02723e85e98e85c25a936fcb5a21465a0d5da8fb756ffa2f9d1e4f86f14c462ccdbfabf85ef08edc6f776fbead3456c1342789b263f928c9214980c7fe697704ed639a931547222b661cba7a981c6a6b49295ce8f2fdbfe551763e94e184a8117e50c4fcd7adbf41b1c51f286bb79a6a84c6f1c55209b5261be2fe9658dc9f60ac292ea75bfebe2a4037f65fc94686f6ee9df3c53974ae60e283c27bb9cd896e390c231597562bd040469d846b8b25328ec997d72576578bc7395af749de9c52794c2c5e021c8f0438cf75f6ef7e155ffcab21db7f58fc6e71b3f51c252fda7390e6eecbf8c2cbc26e55b36d486a7fdba04f8be11d3c1c98a71f219e35a312438b8710337c452676a372b5170b4207e5fc50d730f7d7c0d29ef6d670df3212ba24d202899de72144633f2669cb9c19472d7ad0e72a45d3d11feb5b18f843715f6f5eb0cfb6038b4369aa5ef9c96f9587c89c86ea2407a4ce600275a823f6a1c1ee68e46351110bbe0f06cf8fefebfb8cc0302cf18d0b097bd5d427322bfe358e52fdf36dfbabbd52ab500d1cfac9df27d5c4730cca7076902d40018ac0d853b0462ba0db3e7c86a5e9c160c9178b9a6276bafaa9c652cf0612533e8438f1076ff7b4b29ae12d744b2de3c09839b3c8da5f21c98dee1757650220b0c605dce35dda0204c26c2e94d218bd55d99531c83620ea71f5a575a80842bea5704c95fc1d040de12e5f10d68fb1d78b6bda83d68f6449cbd78d73182ff171499806d57a48382fcd4fd281d8a6d5786b233228eb9f44a972f742811028da9f54ccff6fd2d347d07fa8c02e21cd9dd3735de7f055acdc0975522efeb783bde37af4e963aa98f906227078a9caff61cfcdcfca6a50ae1e97635ad24c41a9dc5f8cc1dc3617c94c6b288ae11be779f34493d46781bf6ab6dcb057672474df9c2b180b8571cdcd8b70588853ed9cddace8ba99a62a439dd9a31392d8fe61d81c2756414dbf9d18b33ab6d256859381cb317caa3cd25b8b36e87905a496548f2e2c791974d81375048dc9258bac41979df9807a0c8cd2d1fbcdc73d371a8e7756da380fa61fa001424400094cd145e94fe04310fc72c78be79be506a4b79c9dc80ccfd54a77d54fdb91a7cef31c7851fe676839171c3576f45a0a4da8cff04959cb9590520d9b7b8633756bba0d447f7d8e0d9c367e4b7223d2b29ce4ddc7c8ecbf72a900fa34e133ec3df19855755bf672fa8637f049a6e8d1371947387b68f53840ad02dc24758021200042f491a4e803c8575df57d45431c5352d0b5ed06654e5c8b18d9e02fc866ab665bf267de8afa25e17a1bf8966a125a7c90f8bcfddf2190de9048eb3205be0665a4e3bc71deebb7452d494c5e49df2c44dd60016855f263a7a87261ae89295675b061e9ffdf3b4873e354ffe939779a9395023d6fd89e834052603c19fc9ca806babdbf7738b6a44f9b418116bc3dedc75b1cd7573c8d657b0203e1be409936c6331803ca8089a4088812513571a51e95e64b817a71af2d6d15fa790f79f81c767b3ca20806afa42ac21a43bc66f7281ae16316863e23fe5931339c4f80040011acba6c789f772a4d2dd789982affc4ca65b08467cd3f0b015cb13982d5b621099b1fdf51e0615c72d5ed7c681ef3196382531c6b443dcfc7c730c9c415c3c51481f1828bd9d9ab447c6e85bd393eb8da65137625c205ef0e4524b3f29c8c82d3265af71ecdadf15b48e1f60ac96819d9b1e58c99d06aad937b441298ca716a0e5fc4d9f4ade9c7ca2968dc178a3981bd9a2541852af846cee4b1218b5a9200ed8032dfea5793382a6b96fe16bd102f81041b95db9f8ef8f20f395935507310434def9da289b938a24e5d8e17a6b99eda5d88a831f6faa218e09c8856c33acaaa4227e31f73f22939f9e8cc74dd4136539109b3f8e33fbf4b4a621c8600670075ec264c65678134faccf9be83eb650ba5c9495835856e4d74c402266529d2cdb8e6dd0282ce3678221d91282ddcdf04c9d98b69391d75f2ae7f7169029c945fd470c6d29af951d9064612a2ec96c75fa9f148b96e4b4c83ac3fb04fb8a9762f5030da6e6d97bd8b27ff8fcb9cc4d3a5c90ca2c3ed560d5af3376d56762cea695bce438a759c99c10b88f88956b51dc43ac34dcb3f430a74e0a30997a57e36a0ddb00204cb804fdac1e9dd478b9db50e90e63d2fbe0ce871c87256c903d5c476d364c18c73c756d4253b5b97a2147cb7eda34e58f295ed60e014b00c1741fd2f4f3c4687886c3f6d856de085c1cd5dce60ac7f97bbbdf6327c9a3602c8108647f0115181ecaf888f5a8ccc78d8c4ee2e5c91c37e89f3ccfd36fdadb7ff1c212c3fbdcc13d8be2977d5871638980a4867b30368577432fba38e1d96a1a125f9567f067b946fe9c1a0b4c9c32ecffac5af4038864d10bdf8aa0b39e26122f096d90c645dc159e67599b083c8497ab76e409401b4413caca2bee7d93811a152e5dd40e9ecf4a44eb37f2fe1b4d6756a464debafebaeceb26c61893b51bc9f197a32452c45d8a518ef4ef04f29c6d1e3361105f02627c6d06f5e1fe69cd0e4171f8834ebdd5bfc6bfd43baa96861936cee9d28b9f15a5dde74e94f6a4ef362147f8b17b27d4305db5db88949f1c89651c3baca757dcbb280b30d52368e6bdf54ce4b4f928c6aef4ff5209d12984cbfd940074c0ca62d207ba87a9e94e601c94cd4317b4b2e6607432b6f4c948cc55eb8bbfc89c766fe09d2604157710f6cfcd3d5f2aadbe687cb665b359d77e90b7fe25c4ce789ba7477afa80ceb17e64a2f37fb3a9b6784ecb491f2f27604f8664d88fb3ba355bc9346c833ea5eb3aa2e724c8526277204370f7225c5dc790165ee8157afb7cc5225111a4062ffa14ab67209c91bbeb28185a81f8c72a79bdd3d53677923238ee5b423f19c9c8da19fe17047138741e05f93bf845c975daeb13894b7bde995d7aecbb209c6f17b2800df8e7dd64a6c6b4467f7f7a0807248f4a5a87fd8ba4e647dbc860f503e5c93e09746cdf1a06acc79494b025a74f7307d1a0994625e318cc14a76d8c1be93f4db9c22834f136c0d991af4764fceb6fa2b89164603c2d5caa321fcf4a30b84fca0a4065be80b38cf4eee6b4940e6ae38f7d13a59a1359e2a73a245c199d7cfd479b21c052a4d5d380aa724003f0399b78fbf0f1d6557cb5fe50edf818e28f024bbf7836eb43bf970699451703f097274ec4339bbb438298fca78690b16b4e2721aa38be7d7d6b63260c20ed2bbf52bc3cf1ab137b8095345ff9243a0ca98ac8afd002ee9418688814f3f9a998a4c1f56ea1a99df88a889f6219b406242447095c0528b7995fdd281cb53196589f6d22ffe7549d4cbc1f95719121a635829bbc30494bf22b11de693"}, {0x0, 0x10f, 0x1, "7ddef79091f44019bb607a5a93006132291d974a0fe7beb6741c7c67fb566e08102177cd5e67f7f969609f3805ed8d9d95d11a74530da8fd59ac2d5475c537f5ca15b280b69b006e1e57921c3da4d72508a4f1c82a9463f23ae237ea6821398b5c0d765a04652a22cd7ade977fb9590be44ee1a2fac6ed510af0db"}, {0x0, 0x10c, 0x4, '_n'}]}, 0xfffffffffffffffe}, {{&(0x7f0000000200)=@x25={0x9, @null=' \x00'}, 0x3b3, &(0x7f0000001580)=[{&(0x7f0000000100)="1795dec540b42bcb7e9986e833bf6070"}, {&(0x7f00000002c0)="b7dfa60c120efe51ac715371d831b4243693419da5f04a892a25e4dc44149608ce84e800ca855d671e05af1a8d2d310d65271ebd72fbaed3e3294cca24a7dc6d5ac788971de6707e13ef89747bddc232a7d500c5990157fb3946d5abcc4761137112ebe22c67cbf98e0520d7ef25b3c476"}, {&(0x7f0000001540)="0ccc9419ef12b36ef9da99c77d6597a467dbe4ecde5b8de311c55fee99e9d2e72caa960d754f1f7ff2"}], 0x0, &(0x7f00000015c0)=[{0x0, 0x114, 0x9, "6a807ffa00e702c9924ec39a58ae6b8867d67d8a750b3bb3f9762bc60443bcdb707983f31f5aa1729b30d8c308cf9f0ea724ab461bc2e1f51675d75c21f0759949a40d504ed9bca79860d073531c41b8444c8987b35c57789c1088a57d9a9fb03591f76a18ccd8b1bb785e9cd11e1bb7033db356e61036b35e8366599d74b93e651f5545d9660647d8f65dec0dbe181b572f3fe506963c241a0991d7158695abb9df7f2ae7b6af284ff34c663897a8371d43ce740d2162fd3f828bc2992f413dbfce56fb0be2fa9ebe3242cc4600ab81368f16f98b651607bac353e95e580eafede5353a4cf3fe"}, {0x0, 0x112, 0x214d, "23dfc247c3a495ecc06ab8bf9336b3bc14e50a168e258e1be7888ae3dffb12733a1aa36343ede2c3fb8ad7891fb2e565482c7f582f607182340c54de533dd7ebeb18c40111d336c551a66570291b77b8ef181c8e236beb9d9417ba8b4cca5aa951bcf7133ab59e744a7925e6a90d771eeba5973aaf8778a9de09f7ac268f965d953a99528f52f817f5dd036a98a6377943381a278e1b0150734eb2247c677ec3b84018b8df54783fd424cdc67a6b40567ae45c7dd845d510719b6ec96a1a502703596e8ece5b055b658a44198a8e1bff283257f53edd277c0d235a67219b136a9213b17f86bffcc72aad1fb131511c442a99cb3d2677364f97323b38fb"}]}, 0xe7b}], 0x40000000000032d, 0x4) 04:03:57 executing program 4: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, 0x0) r1 = socket$inet(0x2, 0x800000000000805, 0x22023) r2 = fcntl$getown(r1, 0x9) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x26e1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f00000004c0)=0xfffffffffffffffd, 0xc11b) write$selinux_validatetrans(r3, &(0x7f0000000880)=ANY=[@ANYBLOB="73797374656d5f753a6f626a6563745f723a73e7736c6f675f636f6e665e743a73302073797374656d5f753a6f626a6563745f723a6d6f64756c65735f6f626a6563745f743a7330203030303030303030306e66696e65645f753a73797374656d5f723a696e736d6f645f763a73302d73303a63302e8631303233000000000000000000c6164e443d999eafd4dcd76e5ca19d3d074aba7555570766c468cf71c8f7b3fe601c1db777a57220d98c045133727d0c21755369e4c14b141eafeb4466226c57bdf5da25008880337cde201e3fff7533b7c97743c14a81fa3f213ea28ce019a87e88f1225d8289417837a4fe956ece7c37bd09b92c67a74c0515c506fbdc6b58b4519b87030c3afc7433c723320a8995872367b825114580fc851f8a22de984a0c0c80060ac85ba2bd72997cff44edb47cebd9ef8db7283a2a8773d07af5a913a3ebdd27053a982de9523bdeee23802e530844e221c7b10737e4952b1dc8c0e744f7470f68a2e54a0154b1f9be80d6188ad51de3070fb2103c1792a3415058fb21ed1bfee156cd2190984dd54b0b67471543949f3b5ed90f697b2ec2f0c4ed89439ebf20da4edfb101c4392773658a01aac91aa1d414f3c804a56afe9100287eef13b3eeed3f844ac473c0662c1be76a98c37f940b5666fe052ad93670f21960fce47cb0ea628cefc38d6e5cba6fc3a374f0e46ef39bdf48"], 0x84) fcntl$getown(r3, 0x9) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f0000000200)='y\x00', 0x2, 0x2) getpgid(r2) syz_genetlink_get_family_id$tipc(0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f00000003c0)) getsockname$inet(r1, &(0x7f0000000540)={0x2, 0x0, @remote}, &(0x7f0000000580)=0xffffff4d) write$binfmt_elf32(r0, &(0x7f00000006c0)={{0x7f, 0x45, 0x4c, 0x46, 0x20, 0x2, 0x9, 0x0, 0xa2b3, 0x0, 0xdf9d405f75a5c344, 0x9, 0x33, 0x38, 0x1da, 0x2, 0x200, 0x20, 0x1, 0x1000000000, 0x400, 0x6}, [{0x7, 0xffff, 0x3, 0x6, 0x0, 0x0, 0x7ad2}, {0x7, 0xfffffffffffffffe, 0x100000000, 0x0, 0x1, 0x6, 0x7, 0x200}], "5ec7bb666063f84798a641c139850b04f15b37eb23524187ecc0cdb1d7ccf17bacb2b6b548", [[]]}, 0x19d) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40086602, 0x400007) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r3, 0x800c6613, &(0x7f0000000100)={0x0, @aes128, 0x0, "39ece9f508aaa92b"}) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000680)='memory.events\x00', 0x7a05, 0x1700) sendto$packet(r4, &(0x7f0000000a80)="c5c3660e956872cd1aa632be07d87078af29dec1d00b284a55f2c51a53e8dd71351ce18018104477b461005df4cfa5671e2f396a3ccab009b0e56c999bb270b76345eb498041efcef77e34329d205d64b98a555282f3854a4c5ef5b9a8ffc4993caf89cdee92c8504a2308a6242e580777cced95ea95b74025b4e62358c32830b7836ac6470cf61ce7d534cf4b0ceddd3a7cb3bf3d24456306f629d5787ac9f982ccbb71d6b309326e8324b7e11071ae4aa4b5e2291ef993f91051672a8ad1e5ea152ff0d4b2fb01df47f22998907a82123ff3bf04ae08d860a43d1c5ea78b531b22817acf208b5d96b91098882eefed6498fac734aa140d16707b6ffa6969edfda5bfeb281c03556e5f5b1e1b985367ee320a5a8b75483e54e5612f8b98e8f1b4c4ba91d279e545bd1d97db3ea54c4ed9101af81064189aebbaa3653dcbc86b794922afd2af0713f2b28d252127797510cadaa8ed22f6c42b9604a5589bc8323678d24c061412ad8d77604ff42eae336bebd8ce6c1c8d9b5c4919e5c2680c77432034ae77a349e19caf9524a12c1a8f4a3a47538c9fac25ae66f85b31bd193af6b682cac47105b14d201911e52c88ce53dd980503e0ad37c20362ac659f4137e36bdbac6c54bc01b95fd336dfca92d419970b46207c7f66c6d622e31147af230cf5c5ebf29f42f949e7c896e7c03c7dea56e518fb2940e3cc4b353884e113921535b025ad6fffbc3ddfbd2cfef937cb5218f09c9d6d56e7e16178a6a7ec94caf02bb6d95e2325575afe17262a9108db442834d9a3bca3a28d7a69ff488d0e40c2061610dbfdde7dd9b505c2742f9e6ba2db1d7500884568901de7571998533e3876d96f105ff0106a5d550c7dc814775b1539a3572f5f679f5292b338d29fe34f4c6cf0deb09342fc5da70db568cf2ba67c8a707928adf9c7094930d612e37dd53584c8957c6ea3a4e299967c8e21d3c44c0905be49bb510f43d9c110aac5c57ddcaa8698cc30f75bcaaa87dabda7b903d001c5412394e2b59f822cfa08fb4a58845e53531798663bfba56df0fe24e99fc0b50210380349f072bc4011b1b9bf4aa6c8bccc055cae66f0021748f6905e37ca17d944a702f9cd8f47e7b6cfde22e08208c54e996f362ed38a1037216fa709e4ebbb8767fb85fb971b75cdb6e524fec6a304f92f193a5c9d12f12d377b73d8bdce4abaf00af5ee5424002bdd1c9b1061c6459104deb3c7ec3b03ef6cff417143d064e5599e44f6cb8ce1a466bac83c16a70c1c3d741c85372dd059852079f46a457c54f74a7ffc9fc3e4d97dd34874c82c5c20803b9fab542f6a585087f348afde72ea8b40993aa887f13244c1584b9698101ad0f648c87093cdf0bedd30b155ab17a226678d4175b06defe635ebd9387f78698b0531914bc4245814984585a0d8ebf2ff3d46cd3457d62a09391ba0228b797315e950690983a26c997f0c9ce3accb9d793d1eb2c99c67b78a2e73c91376832d00a8bb58a1c627b249a4f8b9ecc82941ceff360c50b79c57e6447c9dcecfdd5aca61446cc42d03360934d07ae3de9e2e3a12e58592d697d341ca90a889e37cbabaad48d5ab8022f963a96fb400fd64b3e7ebbf154093e2f08436f06d271c2f870ab1f8430df1b772ad42fef170ef4ac8c0e00296ee36755e67c6e3800a7a217a337424340262371378e87524913d2ce565e8cbbc93ac4802ac8ebf69211eeed1da9baaf78fb505ba46bc1c6d8539ef3f7938969b5a24cb9f90a12d7d1d4689c8366863ebe88265d5be11db6764a8f9a01784cc3ada7c9b363b926d7b0a686d6761a2e12867cad3654cddfd68aa274ac32f66f99442cb934d325ffde947694497ce7198e95d5077255f433144cbd9b8a7c2e25e5bdacdc030ad93fc7d17401c41d9343a31b1bda79b7ccfe43d52d0df155d1351b729053eb5efc97f7643a0aaa48ae979d687a91e8d639f025abf622723bdb37bd81c9237f2d8858af2bcc54cfd221e1a93a050ca03602c3fd458e2a4978390ac905e83be6e58d140c49574e879e2fa3c9fa9df64add9da9fa14e5535118428637858028d153013f9d6ebd7cf30c319b0b7f8969bb402eeff033a8604486f1e927684715a6b740ff8331491562db396bdcdc82b7d51c00a9697c29a9a8013b56503aecc5ce3a80786a493c1c879dcb630216944d5ebbd2fda1c597c53f9a8fbdc8ab059fd1826a4289400ba411aba782f692710bc522a631053945f0c6bff5bb20d99ca3f5e5a4a1d69c4444243acf373a920fe25d4c8f3199c5503331b7e20026f8988e8b1d4987006c9cc44f4ffae7c5b3acc72d834fc6562220f3d24e1a99c4273ef60a9bcd76915d1428f27cc790b1c9e44448096d03e77bbe5071afd582a6a4a3ca8b048ddc90da4363c6ef8c8fc71bd62b9c8a3284c24a334a2238bc880ce7640b3a57869832884ca0ff0becdfd0ef97bfcf1bea0c8f9d44f8ab71c832ef14bda8720eaf25b26206a0d0ef968619f673ce307ae730169225e5a160db52dab043e89e517a48aa012e314cdf537e96765e5e0d4cc1e2c17e2c0a62e62a773c3cdb247817a7d99fc3b484d2d9453f26c3fb51343d54311aecdf0f9bb5251138a8ef3b04cf457e02e991e2742d363469a90fe9ffe6f36b28112bde55ac8792e4e25bb356167356f2305c26b94be5f49693a5ded348ed1001a2d1390745bf842bf27ce19a43832e6adcb67a70b957993f993ea14bfeded1c34ee8aea52092bd5e6ea5e74f214934e56b8d727e14f388adb28f2d825802c1a1cde844b9a81497f2676fc17a891229e90c44ed82d0c049e087795cd16447bc4428aaceecca33aa51aa1316ed476499284bf204dacd53616cf4115dee74d29c7b409c401919ea6f8c02226aa3cd9ef3896de0bd73c114955d68b68ec62c0b645d9f547f499f658b0426af3fa11e8c5f517eeb1f16a47135f6c5a6966496f7a80d3823f90bd4c27c977dd99218853cd762540241dad51101fdcb50c4470568aefa2c8339f3af83866f567ede24806f5da4642db37c110f89b9893faa6f2904252c89f58bb138f9be9f9c2377613d8b76601d56f2e4aec8b626acfe320440748857a0cd7d2a66748872cc3d3486f0a0b57e07931ce97457dd4f5e510333ce62d2fa35aebf3a50151a7136310a4acbdf132e4e823794a49fea5b9f3e8d54ca4f785c19f0273b9d7a84712f7d83e8aeead9096851ad3bb45af56435ee6b204a5b5c14d6ac73a4b05ffa0610ceac627c416376bea4532fa599b17b623dbef4e642614dcca812e63059218cc173e0d65cc43decaa40537b366f467aabd66e4b9b1b0bfc96779680ded7604ab47e189503ccba0a13e904e8926aec630b3c1a1cffc543798849a3a2a637fbb231b3ef15c15e12a0185dd019471e2a0ccda48c1ae67320dbd06e9099a6984bb694ada7c2170293e8e11ed865066820829aed67b4b57ea6634f1ce2b819c0015f05d802f149ce7771e99331aa509ade3182b63d1b8a5bc8c6a9e5e8b961174cbfab01a719b7255513466c580b1054abbe2715144337ebd0c60f77897d4438bbecc880c8d0d7e8aa45128460d08336aa2dafc0c982b770ae17f206f6cdde61a9541a2d2d8c798f30c792491a88a8390dbc954e40f4753df3215ef35e0b444d8c18db33b84807103b6d92aa2ae3b68a49a9061e55552e09086697693d2dbed0c0e08db2b3b5b0343357feab5263e43044546c025c8d67a037fa9654021ec2f1f6ee9575efd7bbf34ea15a45cd64c74b856468c07a1b2125abb20497a77f8ed22240bbfd559aa735c49fc6ef75451adc9f015d2b024eb9bf0fdc0cda1abd27730f9e5c3cf5fce19cd0fa6580f7b7d91bbddcafca2f0859f8b8a4052386e12de70a24a050dacd7ae8002cf46d5209c8fac0c5ef5570d02ddc51ef18d21d9104def437e19e7651debe4bfe1d026c3845fa5f68eafa85095560305b029faed7451bb9666ad457ba236cfeb5bb0ef07b25bbb107b51d50fbef5c79666651837aadb2ba43fd9f990cc3886c31b39688029b3e992b47688872978f6c455db9d5c85e4b0b692689f6f43ff70260b834a4e188a444f6dee8e30e011c4919f4625002b3de3655130874d8dedb16e69ef983a7b8846d592c546ac62a1d311b496d3bfdcde8c846d85996d6df5f1245f26812dddec55cce272a48f0a5b3226b175d70442c8b27437f75c0160b73c923c501c2bd2813e61aca7659f5b2250669440923adffc4cdff809eefe0667c98c0f1e54cde0f47f3d7d93c7bb1309bc3d08b94f7089214b15563971787d2b1b532fdf13723f935518f2549533bc075118b1affba75f857595530edfbded7dce229fe443a0f72234d3c2ca7ffe205ec33a89b93c85182627b5c096c371811446fcfc2ce5c93cf4970d15901e2c0e8a44e7bb93d13dc3b571b61bc1039605b41d47ec9ce8a690ef878bb39e01cbe64de1ef477bef2835332085f23fc755c9d31d3eb531eeaf84bc19adb9363fcea16c20c75e9ed04d7e534ad488cd49c71d6557ac3b57450e2880781ce552daec4dfe7b5a9bf3f85c1be9fb5da80ead00924e90b110669b1647460ef8345dbf337b6336e6f77c72095bf1f027b80aa5e05e900d660af017dfaf9752936b00aba0116022ead68a954cbb02198afd53ec722f6f53b8ac000da11d521261e8075d5d136e29dc21d18ae6ea708c3adbc2b4634c8917f870c02b78381b624092f6ff655c78070e74d852567f68c57ed9d07657ada06093805fd9d814c43286aa18a4c54e4632378a1e05f6162b381527fdf53c18f34925b8e157559d69abff65c31298ed09bacd70e68a5df74b86ed39f91aa301b6393ca03682a183f0439cd7c84f864a916a84a4cd69988bb0605886b3c60c0627303c00c71ffa0167e6ff4a1155723f1429ad87d9b4caf3d8360b8585c11debbd2587dee54211e76039684c363e8e1157df2ff83567c7532bac6028bbab4c212dd29fd590b6ed91a2c782ecfeb7078231a1c2fcdeb0f3", 0xdd4, 0x4004000, 0x0, 0x0) write$cgroup_subtree(r4, &(0x7f0000000240)=ANY=[], 0xfffffffffffffc58) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x200327da) ioctl$EXT4_IOC_MIGRATE(r4, 0x6609) fsetxattr$trusted_overlay_redirect(r4, &(0x7f0000000240)='trusted.overlay.redirect\x00', &(0x7f0000000280)='./file0\x00', 0x8, 0x3) r5 = inotify_init() r6 = open(&(0x7f0000000040)='./file0\x00', 0x200c2, 0x0) inotify_add_watch(r5, &(0x7f0000000000)='./file0\x00', 0x4000082) write$cgroup_type(r4, &(0x7f00000002c0)='threaded\x00', 0xfffffffffffffeaa) write$binfmt_elf64(r6, &(0x7f0000000200)=ANY=[@ANYBLOB="654a895ff3"], 0x5) sendfile(r6, r6, &(0x7f00000001c0), 0xa198) socket$inet6(0xa, 0x7, 0x5) 04:03:57 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newtaction={0x34, 0x30, 0x503, 0x0, 0x0, {}, [{0x20, 0x1, @m_simple={0x1c, 0x1, {{0xc, 0x1, 'simple\x00'}, {0x4}, {0x4}}}}]}, 0x34}}, 0x0) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x8) r3 = gettid() ptrace$setopts(0xffffffffffffffff, 0x0, 0x0, 0x0) tkill(0x0, 0x0) ptrace$pokeuser(0x6, r3, 0x101, 0xfc8) tkill(r3, 0x12) wait4(0x0, 0x0, 0x0, 0x0) [ 2436.986548] binder: BINDER_SET_CONTEXT_MGR already set [ 2436.999262] binder: 20754:20771 ioctl 40046207 0 returned -16 [ 2437.007038] binder: 20754:20771 unknown command 2097152 [ 2437.014233] binder: 20754:20771 ioctl c0306201 200002c0 returned -22 [ 2437.021659] binder: 20754:20771 Release 1 refcount change on invalid ref 1 ret -22 04:03:57 executing program 2: r0 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000000c0)={&(0x7f0000000080)='./file0\x00', 0x0, 0x18}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x9, 0x7, 0x10000000003, 0x3, 0x0, r0}, 0x2c) r1 = bpf$MAP_CREATE(0x2, &(0x7f0000000000)={0x7, 0x0, 0x77fffb, 0x0, 0x820000, 0x0, 0xfffffffffffffffe, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000380)='trusted.overlay.upper\x00', &(0x7f00000003c0)={0x0, 0xfb, 0x34, 0x2, 0x4, "92ded7a030d52c65a9b1a03d0ad3c545", "560885954c3d67b67a612691424d2b7b2d745172964ea4acb52164b4e91476"}, 0x34, 0x1) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) clone(0x110000, &(0x7f00000001c0)="95d3fbfe4c9612109cfd60d128d4359b15e660ecf442f502daa5c71b59854816a5f472e6e04912c747cfa1ff7daea477d31b80a6424e723bc5a7935525bbe71393ae8840fc9004a6a72e9b3ec92c3fad0d08b38bbb", &(0x7f0000000240), &(0x7f0000000280), &(0x7f00000002c0)="ba0d8bbae7855cdb0e317e5b5acd52bbbaf2861aabce9b467f1cf9a8552d6b9f55b45fbe629be749e27136a7074209ff51350e0a72192e830aa3caad96fb78ae48771c3b81cd1a49ff73af66dea2dc9d121a25aaf0e9fd9526722f7195020beeccc0da538e779e8c2a02c404083ac276721ec65e01a6dbf63d93e06f55d58b0cec50d9d190a746884d26753800008608836d") setsockopt$inet6_buf(r2, 0x29, 0x2e, &(0x7f0000000180)="f2876b77cf7d5b6ad55160f4d788e9c6e6f49b0c82110dc5d0c1f84748fc13593d9aa46ccf8e26afc28cbb70d57a01620346abca9233654620f2", 0x363) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000140)='ifb0\x00') [ 2437.057374] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. [ 2437.076071] netlink: 24 bytes leftover after parsing attributes in process `syz-executor.2'. 04:03:57 executing program 2: r0 = socket$netlink(0x10, 0x3, 0x4000000000c) writev(r0, &(0x7f0000000280)=[{&(0x7f0000000200)="1f0000000203193b000007009e00068100023b05090002000018ce015769fd", 0x1f}], 0x1) r1 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x8000, 0x10) r2 = mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x110, 0xffffffffffffff9c, 0x0) r3 = mmap$binder(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x2, 0x10, 0xffffffffffffff9c, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x34, 0x0, &(0x7f0000000040)=[@dead_binder_done={0x40086310, 0x3}, @free_buffer={0x40086303, r2}, @increfs_done={0x40106308, r3, 0x2}, @acquire], 0x5e, 0x0, &(0x7f0000000080)="4c02e63430ec99712fd714a924bcd4841790b8c21d26c9e72fac10637a25a3254a4ec4d486c651a77995ad74998c2bdae3d00dd01c43b323dae1d1580c17958c36c56fdccd3eaaac68219ca439e441e93debe147f5cc3bf30d73fb3c1afc"}) 04:03:57 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:57 executing program 2: lsetxattr$trusted_overlay_opaque(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)='trusted.overlay.opaque\x00', &(0x7f0000000240)='y\x00', 0x2, 0x2) wait4(0x0, 0x0, 0x80000000, 0x0) clone(0x220c0500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) wait4(0x0, 0x0, 0x80000000, 0x0) r0 = getpid() pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) ptrace(0x4206, r0) tkill(r0, 0x9) time(&(0x7f00000002c0)) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000000)=0x102, 0x4) bind$inet(r2, &(0x7f00000052c0)={0x2, 0x80004e20, @multicast1}, 0x10) mlockall(0x2000000007) clone(0x20000000, 0x0, 0xfffffffffffffffe, &(0x7f0000005680), 0xffffffffffffffff) r3 = add_key(&(0x7f00000053c0)='asymmetric\x00', &(0x7f0000005400)={'syz', 0x0}, &(0x7f0000005440)="f84e0cad4f825044c5b3ce49e3b957cc3997c30212fea77bbce9f3d7851d4d53fc", 0x21, 0xffffffffffffffff) keyctl$clear(0x7, r3) r4 = open(0x0, 0x2, 0x40) exit(0x7fffffffbffffffd) recvmmsg(r4, &(0x7f0000004ec0), 0x0, 0x2, &(0x7f0000005100)={0x0, 0x989680}) syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_NEW_DEST(r1, &(0x7f0000000140)={&(0x7f0000005140)={0x10, 0x0, 0x0, 0x80043fffffc}, 0xc, &(0x7f0000005240)={&(0x7f0000000800)=ANY=[@ANYBLOB="02042dbd7000fc0005000200080002004e200015080004005f000000140001000800000008000900770400003000030414000600005a45efe7060000000000000000ffffffffffff08000500ac1414bb0801080600000000080007004e2100005d000407fd844378fd536307379e023b0057cc8d237c282918bf40128fc86d3b9ac482627a4173f3d26080b3c8d5c5f058fbaf5db704622f62cc1af932e0528eb34a90a84ac1c603a85d273d347ff41a975e64c21e090000001596b3a3b5cf68f308b7a38dd4b1dad82a3b87278b21c0492bed58e01e7d47830500004ca3b4c5fae463800000004f469722e95dada1f361a949d0ee460e313674d470024bb54db260eda4974fb622698c2fc2596bdaa96040ca178df4d5757fb1257c3001000000000000002ca33d107e770f50c11f8938e560522aa795b7c84cfade19d16e42046de61e3775326e9ab668ac894a6598cd1b85c9e18cef07fd016f12c89e37719a5b39777f18a1634fa8772cea025e11d36fda12a3359a014e784ef0a0ca7c41feb23ac0926b953c9a4f9a7f77e64e49b083559a2e4f7014d036968a351fb5f8c3abb2c251422c041c55333c62f53c4517256642e0c60a2f21a9da44ed8cece4340b64894d541b108defbc81d515bf9f417442683e97fc0a64d7000000000000000000783695a650146ca02515c46cef2992460034dd006bd9644887e56e029f1a795bcb81efef6a1adec444e5e3a33731c23879b51086eadaf0b2e44289002d65530e560e33bf80edc8223c19823d1a977f6c314e77674c572a49e84593cc9208920e26a9d8e1d559e022"], 0x1}, 0x1, 0x0, 0x0, 0x4}, 0x0) mlockall(0x1) r5 = accept4$inet(0xffffffffffffffff, &(0x7f0000005180), &(0x7f0000000100)=0x10, 0x0) setsockopt$sock_int(r4, 0x1, 0x3, 0x0, 0xffffffffffffff2a) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) fchmod(r5, 0x4000000149) munmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000) getsockopt$IP_VS_SO_GET_VERSION(0xffffffffffffffff, 0x0, 0x480, 0x0, 0x0) 04:03:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 04:03:57 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000000080)=0x1, 0x43d) connect$inet(r1, &(0x7f0000000040)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000400)={0x0, 0x0, 0x10001}, 0x14) write$binfmt_misc(r0, &(0x7f0000000100)=ANY=[], 0xfffffffffffffdac) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f0000000000)=0x1, 0x4) splice(r0, 0x0, r1, 0x0, 0x10005, 0x0) [ 2437.474169] binder: 20839:20842 ioctl c018620b 0 returned -14 [ 2437.533323] binder: 20839:20848 ioctl c0306201 0 returned -14 04:03:57 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2437.693403] binder: release 20754:20771 transaction 451 out, still active 04:03:58 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x1) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket(0x0, 0x4, 0x2) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540)='/dev/zero\x00', 0x10200, 0x0) write$selinux_attr(r4, &(0x7f0000000580)='system_u:object_r:ld_so_t:s0\x00', 0x1d) sendmsg$TIPC_NL_NODE_GET(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x204000}, 0xc, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x80) sendmmsg(r2, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) write$selinux_load(r4, &(0x7f0000000280)={0xf97cff8c, 0x8, 'SE Linux', "8fcde7b91e0a0a201180ca9f2cdcb0535608f3d21c2a00d1b63009a5cd02ca91fce985abb6b8a4aa28d0245f0c91a2d8ec3d6d52da9a5422ca1eac0aa607b283eed6972c6e065416c473d3b242fb3366b271a2ce5fb027a94f473cc8bd597d10e3b42681af1fa85c667f7ce6a72121c96d866a462e1a6f1a14a9476ad6d228051f98341942eacc98edf1e2d87d3afd7473154d28ad2590c2477fa6cb1e4894d32ec2f0427fe1bfcbf3f667f4a2110e7e3cfbf1c11976f1125ee069c5aca42b9d8442d2565b0fa2eccfcc540d799f67e617b2b3cfd4516894fc86c76ffd4eb8f8f457d5a0e7f17664f41a12d6ae53"}, 0xfe) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) 04:03:58 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x2, 0x0) write$selinux_validatetrans(r1, &(0x7f0000000200)={'system_u:object_r:textrel_shlib_t:s0', 0x20, 'system_u:object_r:restorecond_var_run_t:s0', 0x20, 0x9, 0x20, '/usr/sbin/cups-browsed\x00'}, 0x7c) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f00000008c0)=@filter={'filter\x00', 0xe, 0x4, 0x310, 0x140, 0x228, 0x140, 0x228, 0x140, 0x3a0, 0x3a0, 0x3a0, 0x3a0, 0x3a0, 0x4, 0x0, {[{{@ip={@dev, @broadcast, 0x0, 0x0, 'veth1_to_team\x00', 'nr0\x00', {}, {0xff}}, 0x0, 0x98, 0xc0}, @REJECT={0x28, 'REJECT\x00'}}, {{@uncond, 0x0, 0x98, 0xc0}, @REJECT={0x28, 'REJECT\x00'}}, {{@ip={@multicast1, @multicast1, 0x0, 0x0, 'veth0\x00'}, 0x0, 0x98, 0xf8}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00'}}], {{[], 0x0, 0x70, 0x98}, {0x28}}}}, 0x370) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(r2, 0x29, 0x41, &(0x7f0000000040)={'filter\x00', 0xd1, "33e952a994d196c0542a5bdef195fa575ad22c5bc8091f11f5f29037da06401f5ce17392dfcd27667d1a0d31815691aa118c2404d65e3a41cd4fc3e6113c991b6739b63b02cbe1a5939f7d5f9902ac4694ffb52a2ab2f9141ccbbf3d4969c7ae7852e19e29fb1e9d10dac204a4c6117acde6e29a4482f3a40650e44e8bc8fa7f2465b4ee79e1168a50e0aa26d360e1e47c00f436a26519ec6af67d739acbe69ce472edda25f6fa9f41c8e67236c500e02018429e3e8af3f716d9962ce201314207694c5c399791f3847accde434f0c39dc"}, &(0x7f0000000140)=0xf5) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000180)={'ipddp0\x00', {0x2, 0x4e20, @local}}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 04:03:58 executing program 4: r0 = socket$inet(0x2, 0x4, 0xfffffffffffffffd) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0xfffffffffffffefe, 0x20000802, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r1 = dup2(r0, r0) ioctl$EVIOCGEFFECTS(r1, 0x80044584, &(0x7f0000000080)=""/52) sendmsg$TIPC_CMD_ENABLE_BEARER(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)=ANY=[@ANYRESDEC], 0x1}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendmsg$TIPC_CMD_GET_REMOTE_MNG(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x1c}, 0x1c}}, 0x0) r3 = dup2(r0, r0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000180), 0x4) 04:03:58 executing program 4: r0 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x3, &(0x7f0000001fd8)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x2d}}, &(0x7f0000003ff6)='GPL\x00', 0x1, 0xc3, &(0x7f000000cf3d)=""/195}, 0x48) bpf$OBJ_PIN_PROG(0x6, &(0x7f0000000080)={&(0x7f0000000000)='./file0/file0\x00', r0}, 0x10) [ 2437.973715] binder: BINDER_SET_CONTEXT_MGR already set [ 2437.979069] binder: 20883:20888 ioctl 40046207 0 returned -16 [ 2437.987160] binder: 20883:20888 unknown command 2097152 [ 2437.998641] binder: 20883:20888 ioctl c0306201 200002c0 returned -22 [ 2438.006707] binder: 20883:20888 Release 1 refcount change on invalid ref 1 ret -22 04:03:58 executing program 4: clone(0x4000003102441ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) pipe(0x0) dup(0xffffffffffffff9c) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x80, 0x0) r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x400000, 0x0) ioctl$UI_GET_VERSION(r0, 0x8004552d, 0x0) ioctl$UI_SET_ABSBIT(0xffffffffffffffff, 0x40045567, 0x0) rt_sigaction(0x17, &(0x7f0000000140)={&(0x7f0000000080)="c42241a8a60b000000c4a179d62fc4215def8803000000c48265296509673e67660fe2bd04000000f267410fbe956f000000c4817b2db4290f000000660f3a0e8800000000fe8fc968932ef3430f2b3503000000", {0x80000001}, 0x0, &(0x7f0000000100)="8f2978c372758fe9a09288a50d000064f00fc138c423d9684110f380a90000000000c4a2fd414a26360f3806cdc4e16c56ffc461c8162f460fae87edb53722"}, 0x0, 0x8, &(0x7f0000000180)) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xffffffffffffffff) 04:03:58 executing program 4: mkdir(&(0x7f0000001c40)='./file0\x00', 0x0) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/raw\x00') ioctl$sock_SIOCGIFCONF(r0, 0x8912, &(0x7f0000000180)=@req={0x28, &(0x7f0000000140)={'team_slave_0\x00', @ifru_mtu}}) r1 = creat(&(0x7f0000000040)='./file0/bus\x00', 0xbc9dc8fbd81cb4b5) getsockopt$IP_VS_SO_GET_TIMEOUT(r1, 0x0, 0x486, &(0x7f0000000000), &(0x7f00000000c0)=0xc) fcntl$lock(r1, 0x7, &(0x7f0000027000)={0x1}) write$P9_RSTATu(r1, &(0x7f0000000080)=ANY=[@ANYBLOB='R'], 0x1) sendfile(r1, r1, &(0x7f00000001c0), 0x1f) ftruncate(r1, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000240)='TIPC\x00') sendmsg$TIPC_CMD_DISABLE_BEARER(r1, &(0x7f0000000300)={&(0x7f0000000200), 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x2c, r2, 0x4, 0x1, 0x25dfdbff, {{}, 0x0, 0x4102, 0x0, {0x10, 0x13, @udp='udp:syz0\x00'}}, ["", "", "", "", ""]}, 0x2c}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) 04:03:58 executing program 4: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x8000000002) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={r2}) r3 = timerfd_create(0x1, 0x20002) timerfd_settime(r3, 0x1, &(0x7f0000000000)={{0x77359400}, {0x0, 0x989680}}, 0x0) timerfd_settime(r3, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000004c0)={0xc, 0x0, &(0x7f0000000340)=[@dead_binder_done], 0x0, 0x0, 0x0}) [ 2438.091848] futex_wake_op: syz-executor.4 tries to shift op by 4095; fix this program 04:03:58 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x0, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:58 executing program 4: inotify_init() r0 = open(0x0, 0x200c2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)) socket$packet(0x11, 0x0, 0x300) sched_setaffinity(0x0, 0xffffff24, &(0x7f0000000500)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, 0x0) r1 = creat(&(0x7f00000003c0)='./file0\x00', 0xfffffffffffffffe) io_setup(0x40000100000003, &(0x7f0000000000)=0x0) io_submit(r2, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r1, &(0x7f0000000000), 0x377140be6b5ef4c7}]) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x2000000, 0x4011, 0xffffffffffffffff, 0x0) ioctl$KDENABIO(r0, 0x4b36) 04:03:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 04:03:58 executing program 2: ioctl(0xffffffffffffffff, 0x1002008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x2, 0x0) ioctl$EVIOCREVOKE(r0, 0x40044591, &(0x7f00000001c0)=0x5) r1 = socket$inet(0x10, 0x880400000003, 0x6) sendmsg(r1, &(0x7f0000000180)={0x0, 0x297, &(0x7f0000000140)=[{&(0x7f0000000000)="24000000150007031dfffd946fa2830002200a0009000000741d85680c1ba3a20400ff7e280000002600ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1000000000000237}, 0x100000) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000300)='/dev/null\x00', 0x880, 0x0) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000280)={0x0, 0x1, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, 0x10) [ 2438.322091] binder: 20963:20967 ioctl c018620b 0 returned -14 [ 2438.375766] binder: 20963:20972 ioctl c0306201 0 returned -14 04:03:58 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2438.601024] binder: release 20883:20888 transaction 454 out, still active [ 2438.724684] binder: BINDER_SET_CONTEXT_MGR already set [ 2438.750082] binder: 21010:21021 ioctl 40046207 0 returned -16 [ 2438.758109] binder: 21010:21021 unknown command 2097152 [ 2438.764290] binder: 21010:21021 ioctl c0306201 200002c0 returned -22 04:03:58 executing program 0: mkdir(&(0x7f0000000040)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f0000000140)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x1) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020700001000000000000000000000000800120000000100000000000000000006000000000000000000000000000200e00040e0ff00000000000000000000000000ada8008004000000200000000000030006000000000002000080ac14ffbbf00000000000000003000500000000000200423b1d632bd7b8200000000000c7"], 0x80}}, 0x0) r2 = socket$key(0xf, 0x3, 0x2) r3 = socket(0x0, 0x4, 0x2) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000540)='/dev/zero\x00', 0x10200, 0x0) write$selinux_attr(r4, &(0x7f0000000580)='system_u:object_r:ld_so_t:s0\x00', 0x1d) sendmsg$TIPC_NL_NODE_GET(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x204000}, 0xc, &(0x7f00000004c0)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x80) sendmmsg(r2, &(0x7f0000000180), 0x32bc45944b084a6, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) write$selinux_load(r4, &(0x7f0000000280)={0xf97cff8c, 0x8, 'SE Linux', "8fcde7b91e0a0a201180ca9f2cdcb0535608f3d21c2a00d1b63009a5cd02ca91fce985abb6b8a4aa28d0245f0c91a2d8ec3d6d52da9a5422ca1eac0aa607b283eed6972c6e065416c473d3b242fb3366b271a2ce5fb027a94f473cc8bd597d10e3b42681af1fa85c667f7ce6a72121c96d866a462e1a6f1a14a9476ad6d228051f98341942eacc98edf1e2d87d3afd7473154d28ad2590c2477fa6cb1e4894d32ec2f0427fe1bfcbf3f667f4a2110e7e3cfbf1c11976f1125ee069c5aca42b9d8442d2565b0fa2eccfcc540d799f67e617b2b3cfd4516894fc86c76ffd4eb8f8f457d5a0e7f17664f41a12d6ae53"}, 0xfe) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) 04:03:58 executing program 2: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x44c2, 0x0) ioctl$BLKFRASET(r0, 0x1264, &(0x7f0000000040)=0x7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x34, 0x0, &(0x7f0000000080)=[@dead_binder_done, @exit_looper, @clear_death={0x400c630f, 0x3}, @dead_binder_done={0x40086310, 0x1}, @acquire={0x40046305, 0x1}], 0x4b, 0x0, &(0x7f00000000c0)="625aaa4cc95b0769f2f8cc7d7cc784921b7e0ebf090c3ae73009896293f98b161ca173b96fef7fd785168b13cbd02944602da2f0462eb048508941391b4b5dfdf605e6a822e33250e2583d"}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0xffffffffffffffff, 0x3, 0x9, 0x3, 0x400}}) r1 = dup3(r0, r0, 0x80000) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000001c0)={{{@in6=@mcast1, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @empty}}}, &(0x7f00000002c0)=0xe8) ioprio_get$uid(0x0, r3) r4 = fcntl$getown(r1, 0x9) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000340)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ADD(r0, &(0x7f0000000700)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000006c0)={&(0x7f0000000380)={0x324, r5, 0x200, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_BEARER={0xec, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x3, @local, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e24, 0x8, @rand_addr="07067722987828605c3916c52eaff79a", 0x8001}}}}, @TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'bond_slave_1\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}, @TIPC_NLA_BEARER_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1f}]}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}]}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1000}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x101}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_BEARER={0xfc, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @empty}}, {0x14, 0x2, @in={0x2, 0x4e24, @multicast2}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'dummy0\x00'}}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe1b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @empty}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast2}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xe1}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xffffffff}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'rose0\x00'}}, @TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'bridge_slave_0\x00'}}]}, @TIPC_NLA_MEDIA={0xf4, 0x5, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xc7b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6800000000000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6a474367}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xb19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xdd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x95}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x41a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffffffe}]}]}]}, 0x324}, 0x1, 0x0, 0x0, 0x8084}, 0x20000000) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f0000000740)={@ipv4={[], [], @multicast1}, 0x1000, 0x0, 0x1, 0x4, 0xffffffff, 0x4}, 0x20) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000780)="d41901cd0b3f42993002d35b5242946a49da5864eb345f0555407ee51d9fc16dd916036cbe6e2d72e6f39d63517353e0114ae8e079eba8630ccb26407cd85ccf73a7776ae142d3001916602268f28d4375ee7a86213e6ffd018408285b9b8348f709dc9c1cce244909c088791850102c81c13a4fad5cee7e00da812dfdfff2aca388d68b436e17508c951309470e50718513b35d01e16da073fd739bc73cc320eae89b7d46e1104c4194b6af10f49273b62e2235a40aa8e956a24712200e0e3f0590aa74cc9040529eae6ca1588ceac6edfddf59521361a6a961640a652f6ef13086ae881005d769ca1c0c7dae873d931ccf0478406746200749f53cfbca6e2e") ioctl$SNDRV_TIMER_IOCTL_INFO(r1, 0x80e85411, &(0x7f0000000880)=""/120) ioctl$RTC_UIE_ON(r1, 0x7003) fcntl$lock(r0, 0x25, &(0x7f0000000900)={0x0, 0x6, 0x1, 0x0, r4}) epoll_ctl$EPOLL_CTL_MOD(r1, 0x3, r0, &(0x7f0000000940)={0x80000000}) ioctl$TUNSETPERSIST(r0, 0x400454cb, 0x0) r6 = getgid() fchown(r1, r3, r6) vmsplice(r0, &(0x7f0000000ac0)=[{&(0x7f0000000980)="056292fb5dbb9e3ae037f1544a39c8d3545331939094634b31fde791476fdb25f78e7f75deb8238e0c4c23676a13d2ba6effc8bd3ed4b68246e12e635a46015cbc1ff86d7bdf810f7e4d4c8c173b89d6056ce4815132ed884a03acd4fa8fe98ae56ec839c756a9af8140fb511255ba7cd34094fb12f3da2ce323bd289068cfaa4c12a400f38c3865148632bbd1b35a41bf306c32afa4363c31d8d51ffcd05aa6cbec69582a49e281c3565ffa9963d66846e6a0d88abcc1712faa2d11d6", 0xbd}, {&(0x7f0000000a40)="c085d7b5eaecaa96067fb04b50dc589dca68e1fda496f1f031f492ca1919a57872f36b8ba9db07af99a046135e2e05a107b2ff50639d96ddff00da0c46f5179b6a21cd68093e8d24a85335006a7c9aab9e7f4e3a5f6986c47b5c104e24bee0403d36950594a9aac36d99ef75d4bc5d55ab18cc", 0x73}], 0x2, 0x9) ioctl$TIOCEXCL(r0, 0x540c) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000b00)={'team0\x00', r2}) getsockopt$inet_udp_int(r0, 0x11, 0xb, &(0x7f0000000b40), &(0x7f0000000b80)=0x4) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) ioctl$BLKRESETZONE(r0, 0x40101283, &(0x7f0000000bc0)={0x2, 0x74}) fremovexattr(r0, &(0x7f0000000c00)=@known='system.posix_acl_access\x00') ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40082404, &(0x7f0000000c40)=0x3) sendto$unix(r1, &(0x7f0000000c80)="e9ce39001d00cafed3ab468b2886cdebc9e984f156ec774254d9cdefde326aa4f2ab94ec01ed1dd5f235a0d202491e792c5716caff34c217fa606a469154eed5e0744ccd0495409330ced3abdf3e0f59d40c32d75bdd131f83773cfcd12e235a8d531eaf9085eb5ad93077636f2fb9be833a3c8c1eb46ab2b0828367123d55da9b62c86c8646410a70e7f8c8ec8dd4a01e5e25209c761545d1f91f65014105a749607f0c922226888e8d9600a8e89d8e52980d9e3e65d8a289b69a3a2fcf9778018e18b492dc6c903528f9fe7923596c21a5992b675d2eeefcc8606a6eb0e7d244b7ad55c2", 0xe5, 0x40, &(0x7f0000000d80)=@abs={0x1, 0x0, 0x4e22}, 0x6e) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000e00)={0x2, 0x28ac}) open(&(0x7f0000000e40)='./file0\x00', 0x8000, 0x190) 04:03:58 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000040)=0x2000000000000001, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x14, &(0x7f0000788ffc)=0x100000001, 0xfdf6) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") pipe2$9p(&(0x7f0000000a80)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/enforce\x00', 0x44400, 0x0) writev(r2, &(0x7f00000012c0)=[{&(0x7f0000000a80), 0xfffffd95}], 0x1) bind$inet(r0, &(0x7f0000738ff0)={0x2, 0x4e21, @dev}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f00000000c0)=[@mss, @mss, @mss, @mss, @timestamp, @sack_perm], 0x154) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000000)={0x0, 0x40000007ffe, 0x80000000}, 0x14) shutdown(r0, 0x1) 04:03:58 executing program 4: r0 = dup(0xffffffffffffffff) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f00000001c0)={0x8, 0xb62f, 0x1, 0x0, 0x3}) r1 = openat$cgroup_type(r0, 0x0, 0x2, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000002c0), 0x4) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x10000000000001}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_PROG_DETACH(0x9, 0x0, 0x0) r3 = creat(&(0x7f0000000100)='./bus\x00', 0x2) fcntl$setstatus(r2, 0x4, 0x42800) r4 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r5 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1, 0x11, r5, 0x0) write$P9_RSTATu(r4, &(0x7f0000000c40)=ANY=[@ANYRES32], 0x4) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000000)) io_submit(0x0, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r3, &(0x7f0000000000), 0xfffffc1d}]) syz_mount_image$msdos(&(0x7f0000000040)='msdos\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) [ 2438.772003] binder: 21010:21021 Release 1 refcount change on invalid ref 1 ret -22 04:03:59 executing program 2: unshare(0x24020400) r0 = socket$inet6(0xa, 0x3, 0x100000400000003a) connect$inet6(r0, &(0x7f0000000000)={0xa, 0xffffffff, 0x0, @mcast2, 0x3}, 0x1c) sendmmsg(r0, &(0x7f0000002a00)=[{{0x0, 0x0, &(0x7f0000000840)=[{&(0x7f00000007c0)="106022bc", 0x4}], 0x1}}], 0x1, 0x0) r1 = dup3(r0, r0, 0x80000) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f0000000080)=""/134) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)=0x1) 04:03:59 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) r1 = dup(r0) openat$cgroup_type(r1, &(0x7f0000000000)='cgroup.type\x00', 0x2, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000040)=0x74, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x1000000004e23, @local}, 0x10) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x7, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) fcntl$getown(0xffffffffffffffff, 0x9) fstat(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x14) stat(&(0x7f0000000080)='./bus\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000300)={0x0, r2, r3}, 0xc) r4 = creat(&(0x7f0000000100)='./bus\x00', 0x2) fcntl$setstatus(r4, 0x4, 0x4000) io_setup(0x40000100000003, &(0x7f0000000200)=0x0) r6 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) r7 = open(&(0x7f0000000140)='./bus\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x1, 0x11, r7, 0x0) write$P9_RSTATu(r6, &(0x7f0000000c40)=ANY=[@ANYRES32], 0x4) io_submit(r5, 0x1, &(0x7f0000000540)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r4, &(0x7f0000000000), 0xfffffc1d}]) getsockopt$inet_udp_int(r7, 0x11, 0x66, &(0x7f0000000380), &(0x7f00000003c0)=0x4) 04:03:59 executing program 2: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000340)='/dev/zero\x00', 0x40000, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000540)=@req={0x8001, 0x3f, 0x8, 0x7}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000380), &(0x7f00000003c0)=0xc) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) setfsgid(0x0) getrandom(&(0x7f0000000040)=""/44, 0x52a1, 0x0) setxattr$trusted_overlay_opaque(&(0x7f0000000400)='./file0\x00', &(0x7f0000000440)='trusted.overlay.opaque\x00', &(0x7f0000000480)='y\x00', 0x2, 0x2) ioctl$IOC_PR_CLEAR(r0, 0x401070cd, &(0x7f0000000300)={0x8}) setfsgid(0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r1, 0x107, 0x12, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000180)={0x0, 0x0, 0x0}, &(0x7f0000000280)=0xc) setgid(0x0) r5 = syz_open_procfs(r2, &(0x7f0000000140)='attr/sockcreate\x00') write$P9_RGETATTR(r5, &(0x7f00000001c0)={0xa0, 0x19, 0x2, {0x40, {0x10, 0x2, 0x5}, 0x4, r3, r4, 0xffffffff, 0x6, 0x100000001, 0x0, 0x20, 0x8a9, 0xfffffffffffffffc, 0xff, 0x4, 0x7, 0x9, 0x4e, 0x9, 0x3f, 0x3}}, 0xa0) close(r1) ioctl$UI_DEV_DESTROY(0xffffffffffffffff, 0x5502) r6 = openat$rtc(0xffffffffffffff9c, 0x0, 0x101000, 0x0) sendmsg$nl_route(r6, 0x0, 0x40) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=@newlink={0x38, 0x10, 0x501, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x18, 0x12, @sit={{0x8, 0x1, 'sit\x00'}, {0xc, 0x2, [@tunl_policy=[@IFLA_IPTUN_ENCAP_FLAGS={0x8, 0x3}]]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000500)) setgid(r4) getsockopt$inet6_tcp_int(r8, 0x6, 0x7, &(0x7f0000000580), &(0x7f00000005c0)=0x4) removexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f00000004c0)=@known='system.posix_acl_access\x00') 04:03:59 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x0) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:03:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 04:03:59 executing program 2: socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x4000000001, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = memfd_create(&(0x7f0000000280)='[\'posix_acl_access\x00', 0x0) ioctl$FS_IOC_GETFSLABEL(r1, 0x81009431, &(0x7f0000000480)) pwritev(r2, &(0x7f0000000440)=[{&(0x7f0000000380)='S', 0x1}], 0x1, 0x4081886) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000580)={{{@in6=@dev, @in=@empty}}, {{@in=@loopback}, 0x0, @in6=@dev}}, &(0x7f0000000000)=0xe8) sendfile(r0, r2, 0x0, 0x100000000) recvmmsg(r4, &(0x7f0000002380)=[{{&(0x7f0000000080)=@alg, 0x80, &(0x7f0000000980)=[{&(0x7f0000000300)=""/122, 0x7a}, {&(0x7f0000000680)=""/172, 0xac}, {&(0x7f00000003c0)=""/86, 0x56}, {&(0x7f0000000200)=""/11, 0xb}, {&(0x7f0000000740)=""/132, 0x84}, {&(0x7f0000000800)=""/65, 0x41}, {&(0x7f0000000880)=""/61, 0x3d}, {&(0x7f00000008c0)=""/74, 0x4a}, {&(0x7f0000000940)=""/26, 0x1a}], 0x9, &(0x7f0000000a40)=""/87, 0x57}, 0x2}, {{0x0, 0x0, &(0x7f0000000b80)=[{&(0x7f0000000ac0)=""/79, 0x4f}, {&(0x7f0000000b40)=""/32, 0x20}], 0x2}, 0x3b9}, {{&(0x7f0000000bc0)=@alg, 0x80, &(0x7f0000001c40)=[{&(0x7f0000000c40)=""/4096, 0x1000}], 0x1, &(0x7f0000001c80)=""/139, 0x8b}, 0x1}, {{&(0x7f0000001d40)=@nl=@proc, 0x80, &(0x7f0000002000)=[{&(0x7f0000001dc0)=""/88, 0x58}, {&(0x7f0000001e40)=""/247, 0xf7}, {&(0x7f0000001f40)=""/8, 0x8}, {&(0x7f0000001f80)=""/117, 0x75}], 0x4}, 0x6}, {{&(0x7f0000002040)=@l2, 0x80, &(0x7f0000002340)=[{&(0x7f00000020c0)=""/225, 0xe1}, {&(0x7f00000021c0)=""/6, 0x6}, {&(0x7f0000002200)=""/17, 0x11}, {&(0x7f0000002240)=""/211, 0xd3}], 0x4}, 0x7fbb7c32}], 0x5, 0x10020, 0x0) recvfrom$unix(r1, &(0x7f0000000040)=""/4, 0xebc3276d6d4b1cd2, 0x100100, &(0x7f0000000100)=@abs, 0x930000) fremovexattr(r1, &(0x7f0000000180)=ANY=[@ANYBLOB="73656375726974792e5b27706f7169787f8de46c5f61636365737300c5acb64534a05890b821ad52948ba2e1fd33c28220c38f1675ef97ee290d9ca2074a8d810b58bcaaaa6dff"]) ioctl$RTC_IRQP_READ(r4, 0x8008700b, &(0x7f00000024c0)) 04:03:59 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x0) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2439.137642] binder: 21084:21087 ioctl c018620b 0 returned -14 04:03:59 executing program 3: openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2439.426959] binder: release 21010:21021 transaction 457 out, still active [ 2439.588242] binder: BINDER_SET_CONTEXT_MGR already set [ 2439.611982] binder: 21137:21151 ioctl 40046207 0 returned -16 [ 2439.641699] binder: 21137:21162 unknown command 2097152 [ 2439.649467] binder: 21137:21162 ioctl c0306201 200002c0 returned -22 04:03:59 executing program 0: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000100)={@multicast1, @multicast1}, 0x8) socketpair$unix(0x1, 0x100000003, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x32, &(0x7f0000000040)=r2, 0x4) clone(0x20886100, 0x0, 0x0, 0x0, &(0x7f0000000400)="3084d353ff070000a0b4a234709b1a65db") 04:03:59 executing program 4: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000100)='team\x00') getsockopt$inet_pktinfo(0xffffffffffffff9c, 0x0, 0x8, &(0x7f0000000180)={0x0, @multicast2}, &(0x7f00000001c0)=0xc) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000200)={{{@in6, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f0000000300)=0xe8) accept$packet(0xffffffffffffffff, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000380)=0x14) accept$packet(0xffffffffffffffff, &(0x7f00000003c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000400)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000005c0)={{{@in6=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f00000006c0)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000700)={'irlan0\x00', 0x0}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000740)={@broadcast, @multicast1, 0x0}, &(0x7f0000000780)=0xc) r9 = accept4$packet(0xffffffffffffff9c, &(0x7f00000007c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000800)=0x14, 0x800) getpeername$packet(0xffffffffffffffff, &(0x7f0000000840)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000880)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000008c0)={{{@in=@initdev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@multicast2}}, &(0x7f00000009c0)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000a00)={'rose0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000b00)={{{@in6, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@initdev}}, &(0x7f0000000c00)=0xe8) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000c40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000c80)=0x14) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000cc0)={{{@in6=@mcast1, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@mcast1}}, &(0x7f0000000dc0)=0xe8) sendmsg$TEAM_CMD_PORT_LIST_GET(r0, &(0x7f00000011c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000001180)={&(0x7f0000000e00)={0x370, r1, 0x0, 0x70bd26, 0x25dfdbfe, {}, [{{0x8, 0x1, r2}, {0xfc, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r3}}, {0x8}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r4}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0x1b8, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x800}}, {0x8, 0x6, r7}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r8}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r12}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r13}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r14}, {0x44, 0x2, [{0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r15}}}]}}, {{0x8, 0x1, r16}, {0x44, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8}}}]}}]}, 0x370}}, 0x4000) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000440)={0x0, r0, 0x7, 0x2}, 0x14) accept$packet(r9, &(0x7f0000000480), &(0x7f00000004c0)=0x14) r17 = socket(0x200000000000011, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r17, 0x8933, &(0x7f00000000c0)={'sit0\x00', 0x0}) r19 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r19, 0x8914, &(0x7f0000000500)={'sit0\x00\x00\x00\x00\x00\x00\x00\xd6\x00'}) bind$packet(r17, &(0x7f0000000000)={0x11, 0x0, r18, 0x1, 0x0, 0x6, @local}, 0x14) ioctl$sock_inet_SIOCSIFFLAGS(r17, 0x8914, &(0x7f0000000140)={'sit0\x00\x00\xff\xff\xff\xff\xa0\x00Q\xfc\x03\x00', 0x141}) 04:03:59 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x0) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2439.669940] binder: 21137:21151 Release 1 refcount change on invalid ref 1 ret -22 [ 2439.751556] device sit0 entered promiscuous mode [ 2439.757872] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready [ 2439.783979] device sit0 left promiscuous mode [ 2439.789756] device sit0 entered promiscuous mode [ 2439.795509] IPv6: ADDRCONF(NETDEV_UP): sit0: link is not ready 04:04:00 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(0xffffffffffffffff, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:00 executing program 4: socketpair(0x4, 0x80007, 0x6, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000640)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$tun(r1, &(0x7f0000000840)=ANY=[@ANYBLOB="0000000003020000000005009e0f0001dc27b4d3dd120e7cb96216bbac832ed700c9ccd13bfac7434d6d415b744d02871b6884c92090898464fdfc84b06b1a6e75f7a4a6a84ef6e9f113a19241fcaa6081e7133b06c210557d96283711f5e45fb57d228443b40e55e452d91d5106da944c35a77e5a879614e0616cddaabf364cfd778df00f01217c23d4e627549f6b0458012ce21d4e8cfce8ecbe2bef3c657359156900cc319aa0305e960fd1a5a0ccb8800dd0e529a0e2c536281954621a296c49aa5e9445d83d143c6941dcaffa0cbc957ccdf93427d298e05408ce5264a7260024c9a0d936b7f6b544674ea7c6adba465406617a3e7dcc16ed6491a418c8bf27551ce7edcde2190cdfdb74c99f6f7bea704fea2f6292b3638c0a1c2dc3678b074888e75c56abce42bd66c1a3fe63780d08fa7afd4c27367f70c760445d20e80a226917c46bdd62ae8fd18d7d490cf94781b0095b53b208b06685a83ba1cb72bd32dfd11ec2c3a05bb0bc6d2c7db3ca210d09d8b67f522d7c1d0d0df2b2"], 0xa5) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000500)='/dev/vga_arbiter\x00', 0x101000, 0x0) ioctl$BLKROGET(r2, 0x125e, &(0x7f0000000540)) sendmsg$IPVS_CMD_GET_SERVICE(r0, 0x0, 0x20040801) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='ramfs\x00', 0x2010000, 0x0) r3 = socket(0x10, 0x40000000000008, 0x8008) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x1, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = socket$inet6(0xa, 0x2, 0xfffffffffffffffa) socketpair(0x11, 0x80a, 0x8001, &(0x7f0000000280)={0xffffffffffffffff}) ftruncate(r5, 0x200) r6 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/policy\x00', 0x0, 0x0) r7 = openat$zero(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/zero\x00', 0x2040, 0x0) ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000140)) openat$random(0xffffffffffffff9c, &(0x7f0000000240)='/dev/urandom\x00', 0x200, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r3, 0x10e, 0xa, &(0x7f0000000200)=0xffff, 0x4) ioctl$BLKIOMIN(r7, 0x1278, &(0x7f00000002c0)) close(r4) ioctl$RTC_AIE_ON(r7, 0x7001) close(r6) socket$netlink(0x10, 0x3, 0xa) r8 = open(&(0x7f00000000c0)='./bus\x00', 0x141042, 0x100) syz_genetlink_get_family_id$tipc(&(0x7f0000000400)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r8, 0x0, 0x4080) getsockopt$sock_cred(r3, 0x1, 0x11, 0x0, &(0x7f0000cab000)) 04:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 04:04:00 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(0xffffffffffffffff, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2439.979593] binder: 21188:21191 ioctl c018620b 0 returned -14 04:04:00 executing program 2: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f00000005c0)={0x8, 0x100, 0x10000}, 0xc) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @rand_addr=0x8}, 0x10) clock_gettime(0x0, &(0x7f00000002c0)={0x0, 0x0}) sched_yield() futex(&(0x7f0000000500)=0x2, 0x9, 0x1, &(0x7f0000000300)={r1, r2+30000000}, &(0x7f0000000380)=0x1, 0x2) connect$inet(r0, &(0x7f0000000640)={0x2, 0x4e23, @local}, 0x10) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000840)={r0, 0x28, &(0x7f0000000800)}, 0x10) getsockopt$netlink(r3, 0x10e, 0x40000, &(0x7f0000000880)=""/156, &(0x7f00000006c0)=0x12b) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000180)={0x1, &(0x7f0000000340)=[{0x6, 0x0, 0x0, 0x9}]}, 0x10) rename(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00') r4 = fcntl$dupfd(r0, 0x406, r0) bind$inet(r0, &(0x7f00000003c0)={0x2, 0x4e20, @multicast1}, 0x10) statx(r4, &(0x7f0000000440)='./file0\x00', 0x6400, 0x200, &(0x7f0000000b40)) sendto$inet(r0, &(0x7f0000000600)="c99a98f6f3490805f2c08465ff7cf97fe2953d6304d217543f6f3f448f28e95818", 0x21, 0x4, 0x0, 0x0) fcntl$getown(r0, 0x9) write$P9_RGETLOCK(r4, &(0x7f0000000140)=ANY=[@ANYBLOB="d4fdffff370700003cead743a181eeff01000000a56a00000000000000000000000000"], 0x23) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000680)={0x0, 'veth1_to_bridge\x00', 0x408000}, 0x18) write$P9_RLCREATE(r4, &(0x7f0000000400)={0xfcca, 0xf, 0x2, {{0x1, 0x400000}, 0x7}}, 0xffffff25) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioperm(0x0, 0x800, 0x4) ioctl$RTC_IRQP_SET(r4, 0x4008700c, 0xb) write$P9_RSTAT(r4, 0x0, 0x0) write$P9_RSTAT(r4, &(0x7f0000000c40)=ANY=[@ANYBLOB="4d0000007d020000002a00010100000000000300000003000000000000020000140005000000ffff08000002000000000000040070707030040047504c0000000b00766d6e657431776c616e31a8b30400cdd1820bc735d6dbc7b7db03c07951006bcd8f93547b8f750ed99b86af4d206a907123685b01361e376406e8a98b21fd78f444ec08d33ec3a6e339dfce610eae3360d14b28bf3cd73e8f1aca3218554a9d8251883507255b4774b18cedb5d4fbecc5b1efc82f1bfb7c07178e72f2c41bac74973cd10223adef97558e0a6a9b72864f261ee81dd009de074ee30294c8e4d8450c21de5e6826ef61df94574c419a19a68b2fe6d3621088eb5d009d25b589d7888eb04c19e13ea57d05edf150709e0ffadf8a56364a4580401891a5d7d61137ab01b906c35c944672abe15de328a4eebadefdbdef98d4c3f3a686652e9c09a69398ccdda5efdcccd60d"], 0x4d) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) write$P9_RSTAT(r4, &(0x7f0000000240)={0x49, 0x7d, 0x1, {0x0, 0x42, 0x0, 0x0, {0x0, 0x0, 0x8}, 0xc3b40035e9aa48e2, 0x5, 0x6, 0x7, 0x4, 'GPL\x00', 0x0, '', 0x4, 'GPL\x00', 0x7, 'ppp1em1'}}, 0x49) accept4(r4, &(0x7f00000001c0)=@xdp, &(0x7f0000000080)=0x80, 0x80800) connect(r0, &(0x7f0000000480)=@nl=@unspec, 0x80) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) 04:04:00 executing program 2: perf_event_open(&(0x7f000001d000)={0x8000000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000080)='gid_map\x00') listen(r0, 0x0) mkdir(&(0x7f0000000300)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000280)='tmpfs\x00', 0x0, 0x0) socket(0x10, 0x2, 0x0) ioctl$FS_IOC_GETFLAGS(0xffffffffffffffff, 0x80086601, 0x0) chown(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) lsetxattr$system_posix_acl(&(0x7f0000000180)='./file0\x00', &(0x7f0000000200)='system.posix_acl_access\x00', &(0x7f0000000940)={{}, {}, [], {}, [], {0x10, 0x2}}, 0x24, 0x0) chdir(&(0x7f0000000340)='./file0\x00') accept4$unix(r0, &(0x7f00000000c0), &(0x7f0000000140)=0x6e, 0x80800) symlink(&(0x7f0000000800)='./file0/file0\x00', &(0x7f00000007c0)='./file0\x00') clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) lstat(&(0x7f0000000600)='./file0/file0\x00', 0x0) get_thread_area(&(0x7f0000000400)={0x101, 0x20000800, 0x400, 0x672, 0x7, 0xffffffffffff8000, 0x401, 0x10001, 0x7, 0x24}) ioctl$EVIOCGREP(0xffffffffffffffff, 0x40047451, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000000), &(0x7f0000000040)=0x30) mount(&(0x7f00000002c0)=ANY=[@ANYBLOB="1c6465762f6d643000"], &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)='ufs\x00', 0x800000, 0x0) bpf$MAP_CREATE(0x2, &(0x7f0000000240)={0x4, 0x5, 0x77fffe, 0x0, 0x0, 0x0}, 0x2c) 04:04:00 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(0xffffffffffffffff, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:00 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x601, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = socket(0x0, 0x0, 0x0) getsockopt$sock_int(r0, 0x1, 0x27, 0x0, &(0x7f00000003c0)) r2 = getpid() sched_setscheduler(r2, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x8000020, 0x0, 0x3c5) dup(0xffffffffffffffff) socketpair(0xa, 0x0, 0x7fffffffe, &(0x7f0000000840)) close(0xffffffffffffffff) ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') creat(&(0x7f0000000100)='./bus\x00', 0x0) 04:04:00 executing program 4: perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x400000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff) r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x0, 0x0) sendfile(r1, r2, 0x0, 0x2000006) [ 2440.282129] binder: release 21137:21162 transaction 460 out, still active 04:04:00 executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000001480)='projid_map\x00') preadv(r0, &(0x7f00000012c0)=[{&(0x7f0000000000)=""/111, 0x6f}], 0x1, 0x0) ioctl$UI_END_FF_ERASE(r0, 0x400c55cb, &(0x7f0000000080)={0x1, 0xfff, 0x28e}) 04:04:00 executing program 2: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x5) perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0x800000000000012, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_GET_TIMERSLACK(0x1e) 04:04:00 executing program 3: openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:00 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0x0) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:00 executing program 4: r0 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) lstat(&(0x7f0000000780)='./file0\x00', &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(0x0, r2, 0x0) add_key$keyring(&(0x7f0000000080)='keyring\x00', 0x0, 0x0, 0x0, 0xffffffffffffffff) r3 = socket$inet_udplite(0x2, 0x2, 0x88) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000240)=0x14) setsockopt$inet_msfilter(r0, 0x0, 0x29, &(0x7f0000000140)={@remote, @broadcast, 0x0, 0x6, [@broadcast, @multicast2, @loopback, @remote, @empty, @loopback]}, 0x28) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000280)={{{@in=@empty, @in6=@ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x26}}, 0x4e23, 0x6, 0x4e23, 0x2, 0xa, 0x80, 0xa0, 0x3b, r4, r1}, {0x9, 0x9, 0xfffffffffffffff7, 0x4, 0x9, 0x4a, 0x9, 0xf80}, {0x101, 0xe43, 0x3, 0x3}, 0x5a, 0x0, 0x1, 0x1, 0x3, 0x2}, {{@in6=@mcast2, 0x4d4, 0x7e}, 0x2, @in6=@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x0, 0x4d3c31c98d6ad2fb, 0x3, 0x7, 0x3, 0x3ff, 0x10001}}, 0xe8) ioctl(r3, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") setresuid(0x0, 0x0, 0x0) ioctl$EVIOCSMASK(r0, 0x40104593, &(0x7f0000000040)={0x16, 0xcc, &(0x7f0000000380)="0a9147f606fe4e11f3b12f45c6cd36c6ae3435d2f63cad0a69ac3f65834a357e1b034000c3c5a03c33de1b4f3a32e61fbbefe482393dc9a3fc3f39e6fcb49cf22a6c5b86300f1b3f8f61ea69906f9f3dc0dea4ed232faf703e4d498ab16bfb69dfdf6fdcd56a05d0e2e620bde1b8906c1be7a3d7899f62b2d161df3590c1f7b20daf9550e37b4bf6a1215acee7e0f109c72557f9cc6d6cbf40860843a86dc92e7e1dc4a9af3d840af99e61a9c04e4c86d72b2099e6bbe58f112db043cb495872cc30fc1a8e594575daafa162"}) ioctl$PIO_UNIMAP(r0, 0x4b67, &(0x7f0000000100)={0x0, &(0x7f0000000040)}) setregid(0x0, 0x0) [ 2440.696497] binder: BINDER_SET_CONTEXT_MGR already set [ 2440.702423] binder: 21232:21244 ioctl 40046207 0 returned -16 [ 2440.709925] binder: 21232:21244 unknown command 2097152 [ 2440.715744] binder: 21232:21244 ioctl c0306201 200002c0 returned -22 [ 2440.722869] binder: 21232:21244 Release 1 refcount change on invalid ref 1 ret -22 04:04:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 04:04:00 executing program 4: r0 = perf_event_open(&(0x7f0000000200)={0x1, 0x70, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1, 0x10034, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070") r2 = dup2(r0, r0) ioctl$EVIOCGLED(r2, 0x80404519, &(0x7f00000000c0)=""/139) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'bond0\x00', 0x1000}) 04:04:00 executing program 0: bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8, &(0x7f00000003c0)='$md5sum\x00', 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000004c0)={0x0, 0xffffffffffffff9c, 0x0, 0x1, &(0x7f0000000480)='\x00', 0xffffffffffffffff}, 0x30) capget(&(0x7f00000001c0)={0x20071026, r0}, 0x0) r1 = syz_open_dev$sndtimer(&(0x7f0000000040)='/dev/snd/timer\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000100)={{0xffffffffffffffff, 0x3}}) r2 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/relabel\x00', 0x2, 0x0) write$binfmt_elf64(r2, &(0x7f00000006c0)=ANY=[@ANYBLOB="7f454c465f010981040000000000030000003f0003000000220300000000000040000000000000002c00000000000000010000000000380002000000000002000300000000000000090000000000000003000000000000000500000000000000ff030000000000000200000000000000fffffffffffffff4070000000000000000000000008400000800859b917a3bc6dd323b94b8e6040a000000000000b9ffffffffffffff00000000000000000000004e041f0400a50c00000000000051afd927c7ef556e414479061eb95c8c0c49e03871dbf0db8daea363c807493fa383703d92bb17ea9a2ef4db7c34ceb38dc9d0755d75f4e3d790b7baedae007e4dc86974511b9c1e14c660ecc2ae97ff2521eff25128cfcf29f2783094a0869adb0073a8c154ff2e9db6392a5d1729cecdd8b37cafa0e6cfae8a43ca772c005e920dac05c8749a28e56808fc8abf9ec853efe58bcc71b9cdb7969ae5cb59d39d034eab1c111dd4b01786fa1f1c5940d234ff14a73b0a325e3f67566ec67f3597be29abc5f829ecc54d2274299d92977576b888607ae83589ee53c50750d3591d883b939ef644fb6d6a16ae3a57c18a0caa1c2ad4f9212003f0d08631c70ee9ad79cd91ad19ddbf821fa82b53ea23aca68220b9070c751b1f5ec05ac56c927a806442d499481d4dc5a9b364957b938f4e1d655fcd8a0c143827a413eed7e7697cb1d821"], 0x1a0) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x6, 0x0, 0x0, 0x0, 0x9917}, 0x0) mlockall(0x41000002) fcntl$getownex(r3, 0x10, &(0x7f0000000200)={0x0, 0x0}) prlimit64(r4, 0xf, 0x0, &(0x7f0000000380)) r5 = creat(&(0x7f0000000180)='./file0\x00', 0xa0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x41, &(0x7f0000000640)=ANY=[@ANYBLOB="66696c740000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000170000000000008000000000070000000000000000e16695fedc612a7b44f82f4f4224ab7e3f0b06a6351b2711a9f3fe19e746b15fa40615db151c8f783a035e3d9c6848cae0a3"], 0x1) write$binfmt_elf64(r5, &(0x7f0000000080)=ANY=[], 0x1da) fallocate(r5, 0x0, 0x0, 0x4003ff) write$cgroup_type(r5, &(0x7f0000000240)='threaded\x00', 0x203) syz_open_dev$binder(0x0, 0x0, 0x802) fallocate(r5, 0x3, 0x8000, 0x8001) fallocate(r5, 0x3, 0x5e89, 0xfff9) ioctl$EVIOCGUNIQ(r5, 0x80404508, &(0x7f0000000280)=""/240) sendfile(r3, r3, 0x0, 0x3) unshare(0x40000000) ioctl$void(r3, 0x5450) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r6 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x2) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f00000001c0)={0x25, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00633dd06b404000000000000000006be530ec00000072a32be84f8cf4ee0a318d080000000400000000001b60df78e8aa789c793bafd489ae8ec98d9dd28074e31a2c7c1f34a600ced9c926fdf41a035c2f2985902b9925e48087f6017169ff803210b0313246157020cfc872293856fb59b2843c9648f34244c04940796105d6d2ba6483548d0bc41f003dc66ac696f89ccbb81d8178e81e325c6479ba700f64b6e7f0b40e9c818d4029dbd9ef64e4a0b2a95c1c588f6ca9d994b9149feafb89575cd29812c4f7eb4a7bcd40a976b6ac103fe2672afbe570487296b082af9ce146f7c34a778fafd48eed36b7a4b5d28a19a8717e01975a4f4f930c118a32dbebe8a1638b4a5ececce2508f6453110d"], 0x0, 0x0, 0x0}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, 0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000080)={0x0, 0x0, 0x8000000000000, 0x4}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x208000, 0x0) inotify_init1(0x80000) 04:04:00 executing program 2: r0 = perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) ioctl$FIDEDUPERANGE(r1, 0xc0189436, &(0x7f0000000380)={0x6, 0x280, 0x4, 0x0, 0x0, [{}, {r0, 0x0, 0x80000001}, {r0, 0x0, 0x1}, {}]}) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x0) 04:04:00 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0x0) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:00 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) connect$inet6(r1, &(0x7f0000000080), 0x1c) r2 = dup2(r1, r1) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000440), 0x131f64) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_int(r1, 0x6, 0x3, &(0x7f0000000100), 0x4) setsockopt$inet6_opts(r1, 0x29, 0x0, 0x0, 0x0) [ 2440.817583] binder: 21254:21257 ioctl c018620b 0 returned -14 04:04:01 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0x0) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:01 executing program 2: syz_emit_ethernet(0xffffffffffffff5c, &(0x7f000000a000)={@broadcast=[0xff, 0xe0], @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x7, 0x0, 0xfec3, 0x0, 0x0, 0x0, 0x29, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}, @multicast1}, @udp={0x0, 0x0, 0xffffca88}}}}}, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000000)={@dev={[], 0x11}, @broadcast, [{[{0x9100, 0x5, 0x5, 0x3}], {0x8100, 0x2fc, 0x9, 0x2}}], {@canfd={0xd, {{0x1, 0x800, 0x401, 0x9}, 0x16, 0x3, 0x0, 0x0, "76214cd2717ac0178fc24962a2b35feb953879768ca06b5e30be3aceb05b3c2e8ac25483fd97286e371a8ced82996a628c5fcd11f790891805833bec6126912f"}}}}, &(0x7f0000000080)={0x0, 0x4, [0x24a, 0xda, 0xc7, 0x3f8]}) 04:04:01 executing program 2: syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x4, 0x4000000000000000) 04:04:01 executing program 3: openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r1, &(0x7f0000000040), 0x0, 0x1}, 0x20) r2 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r2, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r3 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r4 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r3, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) fcntl$getownex(r2, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r4, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r5}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r6 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r6, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r0, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:01 executing program 2: preadv(0xffffffffffffffff, 0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x3, 0x100081) r1 = memfd_create(&(0x7f0000000380)='\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00v\x8e\x05\xf7\xc1U\xad}\xc6\x94|W>Zi$Nv8,\n\xa6=W^\xa3Y\x7f\x8b\x17(\'~\xf7k0TM{\xa9-\xcf\x97\x8f\x1f\x81\xdc\x1b\x7f\x8f{4Q\xda\xda\x02\xec\xb4\xf1\xdd\xcc\x8bRA\xda\x89Efn\x00s\xc2Zb\x01\x00M\xbe\xa3z\xab\xd3\xeb\x98\x88\xc4\xc6)A\x9fP\x93zhH\xe0\xd2\x81\xdb\xeeV\x8cM\xe9\xa06\xc2o\x19\"\xf6Iq\xd4\xdf\x97\xfb\xab\x04\xe8\xceI8\xb3\x1d\xcf%\x9bK\xc6\t\x01\xe1\x86a\xfa\xb8\xfb)\x88\xcd+\xc2`\xc2\xf5r5>k\xb0\xa0\x02\xfc\x16MO\x18\x9b\x06\x80b\xd1\x01\x00\x00\x00\x00\x00\x00\x00@\f\fL\xa5{Tk\x940\x17.\xa56.\xe0\x14\x1b=\xf0j\xd25\xe8\x15\xd8\x9e\xea\xd3\xd9G4\t\xc0\x9c.\'\xa9R3z$\xf2\x01\x88\xc0\x13\x12<\xc01j3\xd8\xb4CE7s\xe4\xa0\x9e\xdd\x801\x12M\xee\x13\xce\x9cu(\x8f.\xc83\xc7\xe6j\xf5\xb1\x9a\x00\x00\x00\x00\x00\x00\x00', 0x0) pwritev(r1, &(0x7f0000000340)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1, 0x81806) ioctl$LOOP_CHANGE_FD(r0, 0x4c00, r1) sendfile(r0, r1, 0x0, 0x20000102000004) tkill(0x0, 0x0) ioctl$LOOP_CLR_FD(r0, 0x4c01) getpeername$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000180)=0x1c) mount(0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0) mkdir(0x0, 0x0) chroot(0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x6, &(0x7f00000002c0), 0x4) mount(0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f00000001c0)='..', 0x0) umount2(&(0x7f0000000980)='./file0\x00', 0x2) r2 = geteuid() setreuid(0x0, r2) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, 0x0) 04:04:01 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2441.414212] binder: release 21232:21244 transaction 463 out, still active [ 2441.523415] print_req_error: I/O error, dev loop3, sector 752 [ 2441.529940] Buffer I/O error on dev loop3, logical block 94, lost async page write [ 2441.539365] binder: BINDER_SET_CONTEXT_MGR already set [ 2441.545401] binder: 21284:21291 ioctl 40046207 0 returned -16 [ 2441.553408] binder: 21284:21291 unknown command 2097152 [ 2441.559147] binder: 21284:21291 ioctl c0306201 200002c0 returned -22 [ 2441.566721] binder: 21284:21291 Release 1 refcount change on invalid ref 1 ret -22 04:04:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 04:04:01 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000000000000033, r0, 0x0) unshare(0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480)) syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0x804) r5 = creat(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000240)={@rand_addr, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000500)={'bcsh0\x00', r6}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e) ftruncate(r5, 0x2008200) r7 = open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000680)='./bus\x00', 0x0) 04:04:01 executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000200)={{{@in6=@local, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in=@empty}}, &(0x7f0000000140)=0xe8) r3 = getpgid(0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000001800)=0x0) sendmsg$netlink(r0, &(0x7f0000002a40)={&(0x7f0000000000)=@kern={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002a00)=[{&(0x7f0000000300)={0x1428, 0x21, 0x100, 0x70bd26, 0x25dfdbfb, "", [@nested={0x10a4, 0x78, [@typed={0x8, 0x53, @u32=0x6}, @typed={0x10, 0x77, @str='&system*\x00'}, @generic="0ab60751eab1958b3d54e837be5c7341e8699fdb1618176fe26312bf8ce699e86d51eae49061969800ee1292983091845f13449e3148270f60e3e2e5658003fe72042189ea09ed0d1b69525cbd38c1320bc06813a5544509afdb9acbb68aeed4b452d03e126461212093996dee9770862a787d955853d19349663d9b77d9f82603a68a940af447", @generic="d3f380fde6433427223bd2e52afaa007577dceeba245f46e161f344e8f766a54a78e2074cfa700a9392eccb3c3de01a555f18061ba72dd5eef5630dd84e59ee467f59ef5a9a688611983e7e4644c9436bf0de58e08003e242a506d34283b9f2115f9a164b808e563bf11c8c536795bc2620940eb32e95b005d4ac9753ed784336f21b071a27230feb521393162f52f446ac44cdbecec7bebc8dc777e60e24f867fe9beb3b07cb547f03433253ddcac6207b0022e06afcfb53291e2054fc1c1690f25f1f032088188598a2b320280ac12ae4eca274e706d6282f22050706fdea8fdbbcfa65a75067b61b9ec8c32f3ce397158ef0e409bda159b293bdb748a9a55db59bad59953eb703804146e371c2fc5e021b92ab14bd8b0bbb28aef4a8ac72b136bb6f690b533cb55809be526b17927c08f62c55850614b8bfd508b6e3ce5e47878161c4bb88bf3664c44770bb4ab80da3200f6412f6638e9a0df15a21b14adb19aa2219e45937aef3a0be6d04d2950b3cef7bc90c84bb104c66715d0b96b923b505dfcb44d182e7842bc03305ac6e09f5440cf384220522d620faa25a11e60e95220d6db9691320e5bc014b5827656278fdbc237aa8807b1bb17a99e99a9b8c691b870460eddca3c83253b4a772a3be4659f52773cbe88da443bc1be40d595496cab3e6937d90d3e980a38bf53d3f06889a1698ec8c6f160f21b822432e2e1cc098981929faf1eb3cd7263ebd56e7d3b41dabed40c580df9230e027c538582229d597a5dbc0c40c46106d0f9fa6562f7caf6a4ca4408040a67e4fd0647441294af27d24c83c8dfe0e451211fb7a2237ff0510f424f5f158771418c0e88777f745b2fe73976578974bc860a1043226b2b8086446792b3aa9923899b5c3aa1d1dfd442c663917284e0d07a2af3d15ec084bbb1176f92ac0784a91f40e8cf3e2ed53e4ae975c0a439d5144673f6bad8de6dcee028d71ababb827b90e94f54a48c50c8f494cb1d0d47187a804d23f95b0cc1077deb5aa10f3a1506f96312cfab9a5c95d641c5a83b73a913759db6ed843f5a9647972ae423a1e9b5176b1a0fd952d9273c52e6440fb7259317585ed194e991cf388f306154e1af96d3c225ac3e7da22c310cc65595b19724561183296533d1edc5a8eacb1f8f33e4b17740d7a3631dc770511ad1c06abdf6f316f0d581b56b84bd676e269864091cbfc5acba0d7e7c3ac6eb622ebf981a9cdf78a83e4e57a12d85e0331226123bfeabd194d76f36d7e17616fa9a5e092a3508af4cd5616261419a9b17c5dcfd82315ce867d9b6d7399ad8fdd0fa861254c9202af494501960d5358b19dbf88ddab52ae98e0a688a780ff07e6e6b94aaf68d61603679a4585a4785855d16cf110e808f50078e8c975d1e03313972d0877dd10929bed9af4bef9d640e84e6fa68d6b9be9a3fd54d6d917a6c232ebb1631fda9cacced906500e2b5e974fc6e4bc1723c3db5f208895b7b4a407e9e0e2b9164d4d11d3a50e823e2427fa94885de70f5d2e6145158beafa07c2b2edfc4d85d283d1c70ca13c70becbf30ff19e1c2205cd9791849d2b74dbff5064f071d444c317b80aa9a1a3748bf56f89af8ba3bb8bb299e5ccc2ec070f5fba7e29d3f52ea7342cea4cbfa3a6700ce86415a029e68710f320ff790e8f6118913e61fdfa4bde2d3527ba009fc36c78ba91b4c2f100d8395552fb36b13c4748fbd6f0270646c4960bf3a2db176940bff54581122152ecd7f28bd9ad84b842d9d0ee916d09bb0e288ab8322654f10530f3673c4e57a55309c11f1f9fd0784893986dace281fd07d1d2cb45518b4ba3c71a2433de97799ac8d931a21921cb6c9d74ab49209b6643bf38a60af4d154b62f8359a20ad4940975d38e3ede5ea44b9b983445184f988846a709c01d6971846e71456130266c1133fa8377fa366a032291116442898e7b47331d8e9debc481df88437b15bfff4e2043ea557d998da75f162bef08d6bd2dd123a21853161915dbba392adbcce86ce25b90e7c6e5d572e711fa0131a6c5c5f652522e47846547bcef1820cb744addaa199ff35ad8879708d760c490bc72baa630efe6d01c3b5f2fa70f0812883a06af53154119ce74e7581154ff3702b4063d52f7493fc3aacc5c73925aef3ce1de13e71125dd83d88ab2b0c076d4af8cf1e51c706854916675abec59fb6c7b5fa86a706bbbebda32dca2df010aed2936d260dedc994c6eb77fe4f5ca7cb621bc4e4cb4491ef3be5736a662a6f0df135c612a187f7bd9c30d9e11dc7082a4ceccf414205b0724f442893b20b43112a34636bdd0c96c8e5a449561b9e0e8590e90b24f12923e1723937935d772245dded63c9b32279f53ffc7a1cf49aab43cefd60a5c3278c7944e1010e89ea82568619f7c3eb968322437a49175f713981d53ac936d97e6ef59bc60649821ef8a0510476295a4c34196df647cf69286fc684c4835448bfda2c2d72b8b099dd0d2fd412f7e2399afd4e4b03e71cfcc36f5292d89d4f95e527057bf34b35d9ae580552b1b0f134b9111c590f0414554759377e577b6574807a71990e8bf7172dc7101b34ff5b45e1336c3551ae2c1f850233c40060ed4fcb88a1df4a18140d3873776712fd4d8f4f67f73e4b3882a0d9ee5488466662239280f4c520ba1368f896304a1d6aec6df65ac8260a819a35f6482c89c3e0f0fff72d29e59b6e20a0d030183bf424ffae52d871f6bd9c30c9f798d08e1e85c102970f5ee084b533a039ec2f3c5682cb15602863105c27e922dffd85bc482d366c23152788e4ac732976b5611abdef3d68b2674db1e4e3fecdb9d0549f45e67a6700a40db1476b38322718fc3257a2968e6a440c8dbfd074532c8acafe5ae11c9b48166caca332593c9dd68abfef380375b8ca9f4ccf6e1a265bbb104aff8b518a33efbea4d27f928a619065fea902df7372ed7c354e00856707afef93bb9ff58d99f3d05383c730416e78725f0563361dc45e84dc8c0fe04d32e7674585f33bbea2ac4034c7f7648fa847384c5764b82a2918ca0a2c7a78d808ae5ee645a311f328b5186b53d4ae8a46a51abff7eaeedec88cf4145c9abd7d489c9333ffd9ef443f4114576a28035a3805890554302649f955ab8fba66d3fba864381c0c97c4d1c5d278a739f0daf466f127b920b40a4303ebfbccd13ac81137fb454b26e1e0668c93da86e9784076f0fead41030e9a9de0f5e40a2c6360d3de6be7fa93fc65bd1be489ee8fcd595ed68311e4f61ecdb21f6a59e6f6bb91ca751facc588251281e4ad66655219f0391ffb0c14c029e59ebe4c5cb5eca2e8bafa27152982fd4b9f4e9e1befeefe9a62753783028a9dd88f8ae83fd43b9fc4f3b1c10a4bfc54f81b44cada7728c1e98fa6383918f57627f4cfbe054f39db4cace8dfc590c8bcd838a49bb1d9962492a69f19c992e5a0e9f22795ea6a197ff4348c7a6a1b20e439b9666a6b3e2d71a7f6f1bf03a5304d693eab36806090ecc9dc498c8dcf6cb654b8c9ed1acc49cdcfcc92d8af5586f805ba2c8ef98229d326d03d927aea9a11b302712cd0973af2db99424f363a6f2590323ffe8a98231941380ec18cccc6c41132ac3fd668c060039abf0ea83d7c5e11c6e67ef5e61579f0395b5c3f59112d8af0c847f23e9369e40780d6396ab4c58dc4e8315f4a4951e6aa09739b51fb3a90e642ccfea42125d510d3f6596ccc188bb5e45b2cdabf6252c6ed3f36dee4a73920a6f794e20694dc61ca3b80f98300c9b0e6e316aae643e8454ab68239a347015ae48e63d8cecb66ad3c4dde6e92a7304a2621d100d91b8c9a558eac8531db2d83e5f7e86d3249c163adffd96f7e5701fe18eb46f74e0dbedadd580488986b0b0cebeb6a4857f57b712481d9e53424e07ed194f84747c2a5d77bf1bef4f997ec2e6f44fa4c57d75e6d76585171d488ef7b8e65412c31f86f2335d58236145f69cf745355f4c02674793d98c6e1fcec0d0a8758cf90cf945cabfff82bb4d5412fd7985e262ed6ef6e562a8315600d1b708edbc313c4795c7a1b02c622604b952c1957c3b848c389c7d7a8b7b59e6096d771dc26d72a0782f8b37cbaf1ec6832d5a79a6d49bca819c02849fe232cfcb15a598affde8b9e985f51807701081f9581ad5e4c4968c3d77c074156cb426389e5c0a741444f7ab78660d55177606bdd477fe94210bffe747e01d1d99137220a6ab86b24cc240df63d7224b74ad6c3777345c8f2626fb9379c64121771faffc060dbcaf03aa423a3a16450e912a1a20d5d8519826d8e6bd96945f14483a495e28a13c35aaf14cc4b0cebe7e07372560e4255e6faa36e9dd8ef61e2387bb2837e9e1406f4b4e5e18903bd06cb67339750a5d7f8a124185e9e60ef84ae4db1addbfb5b6592e04f02fcc0abe8a56eb071c01ee1bbac5a4eb754f5bd6a39009285dcc86b17e15bdb6204c2d69835837b6272c884b0b28f978b0b1cb8c224f86e4b7af8bb258f535e3599521c848958355987a222a17d3e71f4829fe028bae1b6ceac596adfbe9793b9aa81867bdca8c67df370288da5e5657450c859572fbd4379f7932bda151dcf21503a6c4108b775df5c2a10af0007d2b9ea5808aea4b1cdd68d285929de9c49b2a17de61b95511441011a446a2dc9096f8a51deb12e57a549d25883a7eb8346aaf774bfd49dcab57fc365700babc8e25e8dafb9eac04ff1c9570d5a402cf2f27b5cb2cdb9e7c1131e8f8a8900713c0bdb5dfa273fdfb09c5778ce766bf0e86cdb0376dbe043a3464999096ba060de3726606936043a174238603bad47fcd98c4726782a93ed6f15f1efab3cbf6dd61b02d67eff6e5f168068707c4fdc7f425f2be7b61cb0edd9cdaf7b51911a4bbe294ea4ef7d9f9ae96551ca157ee6b442b7cd6f9da2a64a1a2d4bfac6b12e97065a1c81812a3d307a095d55644c4f64d0ece86d034413491c26754f9e2d9824d1c5e8e279846b6535b42739b6b5108e8ba56b183bd87fb0add163583b86a573475f202ea9be3de6d8b49e27c1c285ae7d43c1f5eb272f298fc382905241c6b7aa81bb29f9459965d5edbfea7bd095d7cfd6d99b00d371349613693c9dd54da39cab2a18c1c5e42ae2c1d47f6a557a3a1560af7cc14a11528053a9b4fee8f9d87e53464549672064e83828d4adccc55074ab83334b501677ad6e517bb621a8ea6a766436885b630ea0f3939004b2307353b7a4059485cbd692aed00e4874f10198a0fd8cd63acafe9f87a8abd7b723fa9ac0250e4fd8230d4a5b256facd02a4103f90bc32c08dca7dca0091366de938972695fdf571960c1acdd7b25d915fedffb5bf70425c6690bb767a06d0ac4bceb82075e3bfefd0ec39a8f3bc95c57324eff80280bf9639361667b7ebdc31a443c06000aa2b4249ae6ad55a80e4f4e676b14f194894e4356ed6c08ba16bb2d56e387ccd2f6953b4e51dbb549e9fb2bd19daa88c031a4ae7823026da09195c7b4eaed4e4da7ffdc5b363f24c2efc4d482434384eb015b737968f7ca250138a5d37d1f294bba041d05ea1968fc8d44b8788e32d23932ec3510666976c65ed5f74e9adce6d3170341422422be821d1a04236d7f2e149f2dd4647c72e9279f85b365d96d74a47467b67e6e45e921b21677170232c1218f4553133b5082bb611df3cd03cd4a2083edbff64cbcce90b54f254c69a47440dddfc6797741144ef874b695413e2742ae21d6b343d967e2f2ff250f7b15d1ab4eb89e97f828ec595148430c7506cdefc5ad9fadae8eb175446ef1b14b9622828b"]}, @generic="15ef0aab0d5a9fb23857fc5f97cd628c7214e2575943545128a970ae4c7a01a0830502ef009f0bb95c4315a1fb0a245e25f465c5dc183a3afb4a0e7df7653cc333ebde4b83b14a820087047ad6288a9c082c795a78", @nested={0x254, 0x22, [@typed={0x8, 0x8e, @uid=r1}, @generic="34239aeb4606fe94dde86c25e5f63dec72943f38ce2fabd6e93e26e5cf1c9e26887f8ce32db4b9eddb881b66a76dbdce7edcc88cadb5f46cdf5bcbc0a9a2fd7183c5de377a3180a8df51ce963f505e956780999f21497ad463aa9c0b251223966d65b7", @typed={0x14, 0x35, @ipv6=@dev={0xfe, 0x80, [], 0x18}}, @typed={0x8, 0x54, @ipv4=@rand_addr=0x5}, @generic="12911cce8a478a4e97c5db23017a24b5f502d9a52db301f36b308522597eae934f01845e376d44d9b54f621d0040d42f07acad4989c43b1341cc4b57d25ab9dc6b219b5f9d85c4a0722389f65d7740fc54b0321b0022718993ed9bd219b597f21b8ec8197e780910e79016a599e1e5", @generic="e7804eef5d9021c24da430773bd0253d12e87e806b141a63482ae90d873993aefd71381eac49a8e501c1f5d882bdb930064963a71db0f51dd6cc5cfcac0c796ebe0be17334cea3fb0287f66afb5ee7e7e0a2f0c234376f01d369d25fbb1e4d4983ea2176f055c26e79998bee19ce35e8a7a8c8260ff54db2a84ad23f25a286b01bd06759193ceb342931c124516b5cca254f3a17fd640eaf79f9ef7651598f957edcc4d60458df4d15016f6b1f99f5d3e19f1ea4f5154164a53bb79abcd5d6fd225a117a47abbca74e872d7b56a5db56", @typed={0x8, 0x72, @str='\x00'}, @typed={0xc, 0x22, @u64=0x1}, @typed={0x8, 0x7b, @uid=r2}, @generic="f7c18a56f91d4be921d2f4607f2161595e8dba517220473646a374d1daf77b8364e55795b68a143a356b0a8a952b974c44f5608737905991e66bd3970a6d60d429dafb875ebe6e5d8ebc4a0d211b5adc173ecf07cc20ed3e0c983c06ead235f604bda5c21de2266b56475b"]}, @generic="e00ed8c4bc48790bd2e6ceadf52b94733a27d7b66cd95c748ca3ebcd0087f9bab205fa4dd20760c9aa811afac09f6280323ed727f183da3875d0aa5a1555b674b4969b0f8c6813c9368b3c2aca0738d8d10af3e57cf888f0e60d2e6444c9bd765171a6d7b79186d67d41f9c3d43b8373b5871373b67218e8ff5882979aac3cf2da93f5cc5e03655885acd872097eacb9c3a1b933e55c94d5119398eaca423aca5ed4abcbf19202a767d4ad5de535", @typed={0x8, 0x85, @ipv4=@loopback}, @generic="44e6f463edd8fba5e2ab46", @typed={0x8, 0x25, @pid=r3}]}, 0x1428}, {&(0x7f0000001740)={0xa8, 0x12, 0x904, 0x70bd2d, 0x25dfdbfc, "", [@typed={0x24, 0x52, @binary="048cf639701b545e8a029003cc9470d6e65b8175798055358dec5eea496a"}, @generic="83c2e6481b7f6d171f9ba483fb41a970f5acb9ee406c9b434f312fa136e9049e92463fcd", @typed={0x28, 0x1a, @str='GPLem0)vboxnet0ppp0vboxnet0proc-*.\x00'}, @generic="b758f628e3eafd6ca5fe65cc460897c4c42f87ef79f951f449fe156553d746f8a451cd874be2"]}, 0xa8}, {&(0x7f0000001840)={0x11b8, 0x40, 0x100, 0x70bd26, 0x4, "", [@generic="dd7b159f365741488d30d0825b9d86de95810808618bc50d172b6f22293fc06c83010d6e382f712b50c897dae3fbfa8c0abb41651eeba42f608f404ccd8d31c81d170ea481158c154f10324a874ee6b762045b21adc4845589ca", @nested={0x10, 0x4, [@typed={0x4, 0x13}, @typed={0x8, 0x5d, @pid=r4}]}, @nested={0x113c, 0x19, [@generic="2deec244556321f3c979dea2814286a33ee70340fd56cd23a141aca777b48bf409f959b7f3e4773548ac1b68cf9aeab1eca26168ffa3de072c40b219968b631d3b44cdf0e9a67e7d676f1f44dca6eeade78f588a7d791d0dd134ce1cd4c024b35ce861b76e92ad40c45f8851aa54fd3bfbf8630793f7a366a9ed0d2ad609c57ec96d503188b71e579acb24cb7cbe4e781ad461df0c6db91071e58a35edcee3026125b7e76a020e4104c43b93da15ad59cf38d6add468c65278ddbd7476799807657d358134168e9570d25b55193eeb3bbfb207e60768966b99b22fc03205572d13e290b4c2f9baafaa1b2a1c1baa8a6ba3f67896ec6368e374c4f977cefd2b7f682cacf6354257e3493df1e0d7c04ffff5327ab87dc57e7552547c6fa64ed7f77a244285b677d723582f2d0a91c01fca8b2d7d1c9d3b00f7a25fccb70d52962b5a5d980d22eee44aa27090e44837c24d22dad7132fb604a014ad0acf1c9fd6fced6b44364cce34900c837fef338ea24657a602eaba17366d8e2ca72881a83ba54f90f1a61befa3c91e01e3350dc1063123c8d21d77904fe31bc9521444761042c218eac733e3b3b2b4c3b21180cf20d97e9c9bc0a4c3b93f6412a4d11ac49ffee51f39477abdcfba9cce7843c63fbbf2e4e192d5b88b57d723a1a2deb0b7c5cad140bb1047922ea483c42252ea71c5c3b115f0feecf26be60072b304ff17a516755f37deb5d7079843030546445c2ff49d803a51774ace6d3359703b6825a60662fa8d9c66424ad4ff1de90995d5b1b8ab466b263fbc49e85ef990b173e96a5e33fc4d883e41f27805cdc1f974cd306e85429e9586fdcb62c3d6f0e6004a0ef03be41e2c7650aace1af3508b12a34314e3f1ac428d1af2d6d1b92af7a4be82ab40b05df5ce324c7e1aa99577c36b5a2848b0f9f049f9f6cf0ad01a79c170de4176f0b8bcc4f60eb6533b0e2eba3323f8d21ba3674050f185e683df87d2a4837cc1e054095251037d9fec644e2618009af74827cc3f1d2478a7a9f84e4c8bbe856034121a8cd7e2f1a2476c1f9dfe30df9f3320c77d01a29f890df91021cd7427e968fd5a01fb3370aa3b068d1aad71744e4c0d0c467b2a807601777cbfdd639471d2016f6706e03f3f8fae8a7a536165b96ae09504fdade3872fdd1c0fed03c59a3bfa2e20f96bf4048915ac5bfd540e55ac923aeba724663cfe458ff69f4c989b3138d3d8dde014a0b4b7c7a6504a0422b59d9cf2f5c6fc229662f6d9ea9abd39267763b9643e4a05ffc3bcb7c3890dd9becdfb31ce29efdde661a2c95997b485e0be1cdf2d4499409ab463b184be011c4d04e772c89723645d0a2ace912f11641751f03675e0fd096672131575ebda22c4ca0f2088bf92a94615e5f761bd4f2be8ef43bce2e7427a8adf051053bde24d33518aabdcbafebbf55cb195ad41f2f889fa54ab31b357633c1f7ae041a6f3c38428a11dba3b98824f0d2052b9ac5693889387ca1635c64eee453ebc7ad0477504a7b9fabfde03e0e16d5f413f1e32a6747a272733a131a8a981c78dd5b1b5db8b3ae7218be06c67b88e14c30014ca6e8c8b4712f33f686a424589eb2694e918d682b01da64b146d10f01fed4d56adfeaf5204de3cc9c61a0ca0f8cc8ba34604a54cb61f034d9c4395b037a62222bd0927460b3c23472ebc9fe0d56ffac81cf724764419aa90076f3180b4aebf74fae53a7a7a381c97b116b4e81dce11a612031059de0b284bb2b7345d17d197212c8a80b999416c07d93c3ebed9515189060024d9393db2b2f1129504a176ef9534d306ef1580b9930d3ac92416e4b9a6140d9bf13ba49cb799da42c3f21f63be68d4188d7af22137da84e69d33395253a39fbb55d3a4ee8fdc70473d91ca7aff307c881e3490ddb1814b4c010b5e711fbd65c73cf728cad22b3ea2baa39502fc9a1dd8e53be354fb8ba76d46a8c2347463167b99d1c33c73b56ae2be04674ebb06bc1a45eab7fee58aa41c9a6a734eb31017de4556018c1f50f5f828afe5d0503e82ffd46db08af7512658420c35fa31776a9c6131b2618a842d012ed775bb92634e2ff74e22fabf30bc27f92704f8c496b083d66c6fff19ba4778abc20768cfdf387a731343497351b27af015da5ba5fbea587bea686a5be4c09de18832e8050fe6bf40b867814bf28cc6f8b52535f0b181d7ee61de17ddf86a44f3f2a813cb0a2b5e8c28b0859ac0004d55d9670b3de12d9e27ae03b2b4e1219acc9494f7a17e8b8efe11b68c3009674f4d4de5875c4d63ce13ca114bdc6c76a7fe96b99f641746601be729dc2236675e1c9ae53cf6c01f467a02f61eec7edab58e98616e8b08ecaa0263e8f803c2a4af207a7f3796310a64d440a99501c56c117bdcaa9181598492066c89a3bec8fa77c0b68596852bc9bce6f5f890f75e0ab46d060c4ac59f04f5e47425f2caf4c6728b1afd09a5ab39d0e014f56d0e2d41ac46e6745ba5c2460287b5a939c534c6e870774dabafd4858531931790e6b7e763b29638fd18af223063b80eaf991884a0725082fb05fc335d035a63f789bb240c7ba675992fd5ebfc52267e76c9f3ad5362c1044e26ce1b853d9751fc3851f45d6427708837c861e638681a0a8bf020df731de61efda2a265c83bc4687e439f6bf0c33c7abb2f5353e49483a45916359abee24f5fb371b2389cc083e075fc782b503cfea3a5cad8acc16d242ef8716478e8c7eab5112bc3417ea75177d47309e241eaf57f6712b92999651e5b164c126d1dd94dc94fe721c0892f375ccefc6ab41a55b88131a304aef8ca49f41c9ecb505d2f3a81aedc1b9dc7a7b198a835d68577f269b80f62c57fbb9712daf8b249db17ba35286bbda18b598842c889bb2cee9756479ee932d359f3e11e0ee20c10296fe8916975824b8462161a9833c619b277e70c145e532c2aac2654222845e21d34809f392fe058c269c2269830106c58156a2ad42d5f488f9980e0c44deacce5723f8215832121ddd1a0d376ef4b8d0167a606eb2de461e31d2fbc105b0a09972115f92c2b3d0641b5c3ac609cc45b298d66f51a69ded03f604d461da0754ace04b7473c84d269ff5ac41fd80f1a0b300d7dbe8c339dbac153343382813cc35630267251cccbe1cdf3aab1fac78cf41004d679b1e096483da7b30b5993355b864f0092af4150e97eb1eee83672f6535ae8bf9ec6899a871d01afa0b45a4de4f7fff62affe919c699c0652c14a064c4c5b7c14bb682f04fa7f7e32b00918332eca41dedcdcab2eeb94eeb72156decc17d2f7b325709797730f88708e48df939a5cd74f1b2c098240c3fa194634f69f22903a8dc45fc75e2df7812fbecccf6f8ddcf6315daa8b3e57a22b010c77c344e7e7bab3c9bc4a6528495df506c8e73ec0052eaa10ce86141653d812645cb7f17853e97ae2802163a5968333975544918bdeb91b41ce985640ed6b1497e6f95d3aef575407e05e6b9a16875ceabc930f97f4ef39bbb2fd60282fd179cb1c520a7b31a6ca02e81201fc561774e0a10fc27b2f354352c2393cee4fd2b9381560b60abc34ea4377919fdaaecd61ce1a7d66e3c21d374aff24ddc05c552277528632f26e2f5769112a34360ffdec04261b3d1e19e058a9a9da3b1d9d62f3ff9fdfb384d425d9e1e70ce61e78498df8eb3383c1ead6afce03324173fd8a91fb119647eb098362c00148518dfa3527b8c16994509e339d048039d003b68badb84a7f8e590331701ff0c7b0cd85c40bef2d38c5ebd660d14b21d102ab49baf788332a82563e85ffe005f158ced8c91a44f8bae9c4b06ded1dd085bd9a31b8fcb6986c0a12e281665e27b3214fd8eb77697693b7a46ee788bc4a026c38a423bebbdf75632612555dfc9a090b920b1b927f8bccfb8c9c91499cc6c8861d4880ed7ebcf6c25b419e96f9f0bf3d22e31434934f7a0da65630a8a280ae319586e0baf2cfbb3077cb9e05fa74dac0f2f39f9d5a8b1ebba5f4d5447425df370360ab0d887cf55c4d5b817b76a30e5e0588ce189d32f5882874dd40cdf6f5a4d13d66cce5285079325dd4c31867bbb4219ee785e7afefe5b7ea7c235161adb1fd844d0671cf0da5efcca2fef52385245f81e94bb6c08dae48aad20e5ccb2fb355bc3ce552bdf950a8d3899651d2c9541233ca494067d6c4df3d7d912be998321cb8f20f5f4b97ed8a0f3e223cd53eb3b51b5167b97607f9d71913ef00d9560ac36ad9f7ef2ccb7baf6f12a134f6af2ab596a93a87a30e357854bc762c82be1f6f7a1d8fff378d354f660773d9ce3a6e1ca08c1832c34e82a1146cd0558246f01a8e07bc2b8c9ca4ecfdaa388900fc38482ce3db6785cf533566f559c8e7d4f2e0c47d6aa9ac8599fd5ccee83c8627cb9d2ad59bbe984f708b729ed44dafdffcade842063dfde900345d5f20c86f96d0539e9f34e7629f444b5f851fb23d458c0076c15ed86de2d253d731d5448b95d3b1eb60413c8cfc2bcfd0254ca8df6e92c1c275e8eb967402726e74c3f559a13e3b9f3a35d09641bb4b8f7357a994244d519cd5c55ad6afc1ce52904d92744b163c51e0aac0b8dfe87bbd9c42a266b5326a40c909a2390450fd089933dfd89a23808776b92527e2a74210406dd316095a74609e216db2256463fe44ac7c1ddb7cf828946288ba1141e5ad5315546f8bc4afc59d32b09ecd6165227acb0808a386d906056122cf344103c48656829b6d34dc7beb9faaecf8f5658ac4e1f3c1f3770e0c66ecf6769812268e966baef51c45141e085448b55aaac21a0988c50ced02dfb22cd545a7fb8f5674f601a166913c57445981f49293170fe9557f949cfe488fa0041be9f72988c7292bb60b13c2a9346cf8f8ce31e93987415babffb73d642b8feb131bd12e9c875fbf42bafb0e827b926c1f5e311f740910428bcf654845dc3922bd653acc67bc3a75f1bf402648aa79685269ce6ecfb51eac9176379b04c4538c8fda3fd75cfbdf16e60eff8befdfcd7cc9771e788b7adba692309c7a1b9e3eb9de994476f491e18f6096145ff835fa27e3ae10979b5123df8ffa931330eff13d56b8b898a48a89017ba45e0376f1a30de48dee4ae3b02675bb5d31b622cb75a66342b912614a2200f164a1e152f12b9c661473abe7883e026029d96338f590364b1787380bbf2efa6f1b1c0d0780d76e4861e24ce88cf0ad8f02ad9ee9593b1fc107c3f5c88e05431e67798fef1cfd0abdb87f8126e59601583c32ef5fd419f8a7910da274bc2625a95bdfa3db4c6d96190104d162e9e67077a251cb52210ac74371fd755ac39e3ff4b914e148bc9d980b2b481d103efe1fba7d5513e8240aca94df65fa2e9fea6b4570d4da5cc74a4c68264e3259cb70931c4fb03db78f09f35d6fb8d9b40afe33502654d9cbb863f404b539163547223f21e4e12a9c4a1694f8ac7e090358fd6671f6afd58d81b90adf9fbd1995bd13cce1443e7193fe686c231c70859cf3f08448d1568c2a9369a71425681d766f8ede8d0f401ee98b958e151035b58184db4366cfb59e030e82d2e6e9e4f89d2e29e9f267be92d61d96489117a63350ad0347201a7fd27b5544dacaadf0b96b5352f736e06ae09deb83d9f1245081a7a58bf1b05d5878037dec6e315cfba8648ec5aefaa638d2839d6942ebb0fc9437d7efe821de338e22967a8cbbe615048534290dc481b76d70e8b0b971f254d0e4496aa41ade4ffe58552d0388c6c8af717feb865afcae4905eca25d684944dac9b97ab35e074e32a959eb29518e7f3cd2d44d8a02b56e9ab", @generic, @generic="190d27fcd23ee621b29c505a2690ec70b4dce22058eecb981b499e10e38d51f771a0564c3f9cbd0d02e41516b31e33194fc00689a82c4e55b722a694d4830689c5cbf67eeff64916f3844d3b3793c25b7d116b5545b4df9e2f68e043be98baf728973162fa58e507b2594891b7ad67f5289e37722ce9451d0929df10bb81d73b061f38d54446bd8c1cde1b977e9fe64c03809e5b7ec2b89c0817d93b42785c884f767938924ca06a340635b0bb1a4cdfdd52128756efacf7d1ce76da63b948fdbed828a8747753e11967a6df36e71f1737bb67a4ab2e04dcd9fd2624dc49486793d6b979584d23aa089957372bb5e6d2aa7c4a039f255afc", @typed={0xc, 0x40, @str='ip6tnl\x00'}, @generic="7a6b757439cd64ca15c91dfc09f77913385f35ddfd0474874b139dda89d5affb193ee7bd42d765f2341c0d57607e0497c1e9"]}]}, 0x11b8}], 0x3, 0x0, 0x0, 0x1}, 0x800) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newlink={0x3c, 0x10, 0x707, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, @ipip6={{0x10, 0x1, 'ip6tnl\x00'}, {0xc, 0x2, [@tunl6_policy=[@IFLA_IPTUN_FLOWINFO={0x8, 0x9}]]}}}]}, 0x3c}}, 0x0) 04:04:01 executing program 2: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) shutdown(r0, 0x0) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000001640)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r2 = dup(0xffffffffffffffff) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000001600)='/selinux/commit_pending_bools\x00', 0x1, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$loop(&(0x7f00000004c0)='/dev/loop#\x00', 0x0, 0x105082) preadv(0xffffffffffffffff, &(0x7f0000000040)=[{0x0}, {0x0}, {&(0x7f0000000300)=""/226, 0xe2}, {&(0x7f0000000500)=""/4096, 0x1000}], 0x4, 0x0) prctl$PR_GET_NAME(0x10, &(0x7f0000001500)=""/197) r5 = memfd_create(&(0x7f0000000080)='\xfaIhFlK\x99F\x17\x16\xa5>\xd3\xc0\x93\xb5.\xda\x06_bT\x1cB\xdb\xf8y1\xe7,\x03\x98h\x86(\xa0m\x87+x\x14i\x88\xcd\x89\x81\xfb\x86', 0x0) pwritev(r5, &(0x7f0000f50f90)=[{&(0x7f00000000c0)='S', 0x1}], 0x1, 0x4081003) ioctl$LOOP_CHANGE_FD(r4, 0x4c00, r5) fallocate(r4, 0x11, 0x0, 0x100000001) syz_open_procfs(0x0, 0x0) ioctl$KDGKBMODE(r2, 0x4b44, &(0x7f0000000480)) r6 = syz_genetlink_get_family_id$fou(&(0x7f0000000280)='fou\x00') sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x40004}, 0xc, &(0x7f0000000400)={&(0x7f00000002c0)={0x24, r6, 0x310, 0x70bd25, 0x25dfdbfb, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e20}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}]}, 0x24}}, 0x20000000) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x200080}, 0xc, &(0x7f0000001680)={&(0x7f00000018c0)=ANY=[@ANYBLOB="000228bd7000ffdbdf250e0000002800050008000100657468001c00020008000300ffff00000800020003000000080002005f000000c00004003400070008000200840600000800040070ffffff0800010012000000080001001400000008000200ffffffff080003000080ffff1400010062726f6164636173742d6c696e6b00002c000700080001000e0000000800010000000000080001000c000000080001001000000008000200020000000c00010073797a31000000000c00070008000200000000002400070008000200000000000800010002000000080002000100000008000200000000000c00010073797a3000000000"], 0x1}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r7 = socket$inet6(0xa, 0x2, 0x0) epoll_ctl$EPOLL_CTL_DEL(r3, 0x2, r7) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='net/protocols\x00') ioctl$sock_SIOCDELDLCI(r3, 0x8981, 0x0) ioctl$EVIOCGSND(r8, 0x8040451a, &(0x7f0000000140)=""/247) ioctl$EVIOCSFF(r8, 0x40304580, &(0x7f00000000c0)={0x57, 0x3f, 0x0, {0x280000000000000}, {0x0, 0x6}, @period={0x0, 0x7, 0x6, 0x4, 0x24, {0x6, 0x9, 0x0, 0x8000}, 0x0, 0x0}}) ioctl$RTC_VL_READ(r8, 0x80047013, &(0x7f0000000000)) 04:04:01 executing program 0: getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000200)=""/153, &(0x7f00000002c0)=0x99) r0 = dup(0xffffffffffffff9c) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000140)=r1) readlink(0x0, &(0x7f0000000340)=""/166, 0xa6) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0xfffffffffffffff8, &(0x7f0000000100)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00') ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000300)=r1) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, 0x0, 0x90) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, [], 0x1}, 0x4}, 0x1c) recvmmsg(r3, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000040), 0x4) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, 0x0, 0x0) r4 = syz_open_procfs(0x0, 0x0) getpgid(0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f00000000c0), 0x4) [ 2441.656826] binder: 21303:21306 ioctl c018620b 0 returned -14 [ 2441.693108] device lo entered promiscuous mode [ 2441.730685] Y­4`Ò˜: renamed from lo 04:04:02 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0af51f023c123f3188b070") perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0xd}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$inet(0x2, 0x3, 0x9) sendto$inet(r1, 0x0, 0x0, 0x0, &(0x7f0000000280), 0x10) sendmmsg(r0, &(0x7f0000006980)=[{{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000006c40)="e5d1e4e625b79c88b5b312519b97e224a812f31f408ab3c3e7873e5b7e98f6c30ef0db65a23d1064feea738301919285862888f40b4f959f0e9ab648e3af5480ba45a19c8356ebc224b89810f2fb2e3e3b97261f", 0x54}, {&(0x7f0000000500)="f8bdf9d08721fbacc8908bafcee9c512d087c43ebfc107b77f8b5ad128dc2e901f270f3756c1119009e012768d8592c446c5d4b1a4b44f006f836f386f54033049e448d9aa5af448e29d56f2a99d7036cf968db89b56472deb2d68ef5b5ccb2ef1c1a1501363b36efb83dd7260d847f4d5ff8ab0abaff5a411e0334b1b460879071275ea1cbf173f1da1ebcdd518faf5a0ad7b7c1271575761ef7eafca474d404da7e1bcd0313f5d12f6f6faa323a88d665f7f06568e809675a0a4d6c1259681d8d5b8c56fb10bdcc82ddd1b63d8249dc8c65b6e99e4e3d19b3a2f3dadd61cfe27f4c034d626b4f17e1bbea1fe80acbaf3cfccd585f93fec830a7c9a249a1a7e5afa3e4585928b6590ca9a643816a8376afe4034bce9478cdbae0817b16f720331ae39957c2de62c4159aba0b920c3cff0738d263fd03399f63558992aba5ebd5b82c550abcc6861e8bb0ffe4752d25feca5ff86302f104a0b36aff0596cf153d90348fae7f2baef1913ed7745bf40e371c01f41627247405504573b677d99e0497b413ddd8b010781b87321800126969e37adb2c57250c6aa971f8be8731f7b88b142943a3d5294bad8ef4647b7fe7a2563a16c04378256027f9ded3c9ba0a70101d0681804cc2fee13c06852b221c444bf2475de906e0f671fe2f481b7baada096a8cc13e5051ccd3456d8efaee5a065d31c4f5bdeb8441c40bf64b7f2f836863d9288db0edb93d155ee63c0dc36a3340d0c90e11d75b00ea2bdbaa5c3ca6c1ef13c9cb354df0b9bcc8a6ebaee7fd6011c22bd970ec06cb26ae1a0ac08b562dd8a2ad609ee24b4533cd7f51d80a621e1141ad642a6fba69c80e22e17f5a4cb1ce57587a82bdbd8da97e57dd91f7fc2da9d4107bbefa9397a73e51553734f5f0a81f7750374025020687ae4c0f942e0a61d2de6f12d8b718af1f0e3758332707ae711580dbabb32640089c92959aaef121569deea816a3dc123c74ba212e6f03bc6b3b5d0b8a67dd9e0f1fdc5849075a78cb17b180ea8de0f215edcae5b2b28d6baaa4035f5cf8cb053edb80c7bad5a5a1c13ba3e6b3d660b4ce4201f3cee3248468fec809a3cca3b133a6388607f5e950543e9175ca55034752baf88575d0e79ecd27c41ecfa3edeecbd2193ca6192327a60d68097257b45cb093844d7eda7cac251f9e34bff3e87710be02159c2a932aa60afcf49dba8becfd6fc8f37ff001b20599f68ce0b8c7137e41b45c02d0fc95d1a3170efb8b786e3af97ec4b22b1711433bd35a11beb9226149f35174340d298a83645360df8867802a59f1fb79d626b6ed8b2598f732c99f0373548e21f167a6e41871d04c66813f1e3351aad83f35b1050d0a4718351af9a0d0ae3f558b05b08162717f8fb82311b587b5f65d9f1e8c98f061a152a968342dfded5f1ca60836c6fb385bb7923cfded52c2cf7350b9cb04df790fff83ffb922bd81db61495e9b3942302f13f49d80076fe28088060656e5cede48b9464f5dd7e62a91ba1ce9d62b00db0fc615dc1e03fd94d770129db4674bb85b4f3b09ca3f8e62a77527ae711add89b901c7e47d5c2d2198f49e6c5323cbeabdcacfdad3297d8c6db330d28b03abdde7f1a2f2ff18ade0f2c4c0105face8650fb5483115169866c2224ce93d2caccf50ecd5573c7c1a7eb7a20cbfc6eb2256aeb60345d6d1f26454098b27c41b07eae002bf30ec8072dda13ff048c01166d63f5de5e4e91ca03b5dc88213462cb407addebf736c4ee815a4200daa8d10b8a2a671963fd15db52bd3f0bf71ecebabc918b9f1b8766b86210466cb271db79296eb7207aad99072fd61c0a4b757b9bcf62cdc11b0746353ebf0ef2db499f834cc980cb1f3bd6c6fa8f9eaf0c12e1866a95c29bb5c3d18cd98ed2f25b78de97a5dc3cacb54a79edbb87a7d21d3d9584dff8ecbf3f94bdc235d55cbf990ad391481466cc2fb8aa5e225277244f2aae499864fc1021295dbbee36d55420e0a4f227b71c5d06ed5084543fa25fc661dc7a65accc411f8c4996407313ede61f8cb516cb33953e6154e81a6a94acca2bac3efb0013a9300b59fd5725455cb90b1caa7f8a3a7163d82a0dc85be9dd5c1fbe7206261b7cc10de57d1626674e9d55f2986d5b656f120bd6fa05c59a159982df17429823ed9165a2b5fa095aa17765f681144b05b8390cbe9c01452f5ce620b263972e3520336b91ce22dc5a0f655bc64b4040e61e70b61551183317be4ee35fc69a45c503fc3a9451255f688f97d6a1e7a080c0581ef8a2af61cb593276c8e8921c6156607c9420a519b3bcb36fce8b8d15dff02cbbd2c096e0ece9f2a94c9ff7943953b0a4302ea9872ad3d78abd869c2d24f86005ffa7bf640ad8a3f18290b1a323197a1fe72c2ad2cc41cc3a0dd6970019a07cddc2852fc0b8c68dd4f8cc6551a7e7b1dd14242701aab47b72fd676be9d7ad105763a332c4325953846a46da89fea469a05463081df5a7eae256ed44c3017a9f8d13776be9384b35e16f1fbe8d7b29bbe3d9cc7ee67fe56512073404822df8574bff85c8fa3ba20d1eb81674301577f9c70114ec76144434e8e83620c78c0c936ec5369584ff647b44c82606c51d2cdd5535a496ab5b34f16620efe9f0025e29001215e70e656b60ad66905e792c20dbdf84b105bfa7370ba451421200d482d00e159c4f7b36bd0728ea695befe2a00c330207fe55eedec43b49cfebc1140572eb7af6293826dae0ea6b43f132f0bfae24d78b814d37fc341bcf1a368ee0d0cec598d4e8b1799f5e09d092b690ecd9df119b84ba051d785f98a78a1479b77317698773467979cf03a6214600cfe6e8cf39b41e916899867933295d6d91a65cab57f1d9b848bf546e4cbed152f18f42992cd7a9b8defd2632546e25368ac011681c38c2e7e87b2cb090bf45300595d72963a4fddcee40975c183b6396ff6a87dad1f10fdc475ff2a154a65a3c46e209cea153424cbbeb4d01d0376093612b8d3fe82b30aa5b4571cd744537318113f0f08fa3c710f16907e2c6a3e8a5a97fe459e79e21b24aef041d2b57b5d94036f4b63ca0e4be2cd6462263ef36a99cd50111c248531f316dac2da89a0f6a31861702ad80cc1c89a1b571b68b53e471f248dda7c686ed4da76a72fc03613698e4414d63e53dee9b6e2d0f2c945da795811894b2d13164a6ef0f22ab379f1e4ecd6717479830fa714d5159c02dbd7424c747eecee173829b403c78fcc4db0190ab207b93831cab85898c8f7b2256d16c910c205cb1076a70a48bfa2a21d376dd7172ee7d405fc4919df69fadf82a2f08b3a52e8c06d6c10e47941cc75e15ec94a3d4282f34f92cd1ee49d4f841eb1e3ec18296e118be2c8506202f71f0f5ed0e8be77119b5a9162941aa83d5a94aba5f7a6b3bf0146cc24c9376259adc1818ba2178ab5bfb8a97c78f24ec0562777c654dca637b723569be91518aea89f5fcc7c8b3564666dffe7b665e134d9784006c8fb01815c267da82f40163d846eacd1091cd286258cb469584b20ec43e15620b1ab54f63ff35b924587656f996f04d89368d4c96b9cf865385b34b6b7b236032534053923ec269204c2d3bc5041eef64e3766bc55a63c1ba9774574716fa69e1617ae514676bcd2524e7955f0dd9e6be45711ebbe06c0c87e90423a2b4364d2e5089dc76f087d93d60a09dc0f4f8f916f082dfe2aa983f5a95c1c84624cca793f14f2b1909ed41ec265d9693ca94ddad815aae6e8bd09d2aab39759e962680ae20f303a9db9c929156f23b421ad9504f36a3cfdfedf15a03e4f08f61fe72178341fc4a9c6ad8d2f6b9307893609fbe5f6f1b6bb6bebff1540b9322c14a1d572754089c8277103b43ec33d25885c805145c7f3fbbddd3584489d6c707c0ec934cf5ebb5c7830a163599a2de657917559900d0f2ef48be628f6a7ad945303f8c238a484f94e9d901f3ffb25ce57be554e64a55edd45f5a4b0bd6bde3c718e890e1adc11d314c48b068240a705ba94d934e22aeddcb5255073b5333142abdb46f67d7d924efed4512fb970baf5b41d3851b9668d075a6ebf9268eba60ca7d681cc15ddf50c1562d347f970dbd8c22255d52b36de2af35b572cb78b6d8b8ea9b006fbaa1b76075f54042b5a66397720d04f2210e7044099f2e2f88f5a0336c4ae103f56430d6b6af00a29700b7ee76eb07bb57692b7f9696aac1408e29ba7e7edd7fe206fd8375ea45f8753b0413b7382ce20ec621512b8d3a7ded6f087ba33f288080977054279f1fecbbaf71a420d9a6b5c4a046b1521bd1a55a86a840ddf67da263634b6525b17df3e1f565633a2c0655d6e18fb574e85468521200f3697c51e397626bb03b3add400d3a962ab1e5f922afd52375fd92dd351b32ceaf700c59ad047211dd010c7a5fb2a92daa1a0a3ea6f52470ddbf749898afe2772a7ea106d95beafb0e37100c4554ca7f65e96dcd0037c8a5ab2418e7ccf3ee55d4878c07becd99824a1b03da96b20e15e691d15a46e0d85d97cc817d2a46d94818cebf3b547bfd8461cce3dd8fcf25b6942b6660d285d447db6ff50a95635f47dbba1e7ef90b8383356cd882d01ed621f34e5c2c5eda907488531315f131ebd99a3a38e74cd51270fceebe1f916f28b22355f38e5e2450775e4582a203dc4a107017375ce8b10f3db18924128bd5d21908df9b56ecbece1a09251706898604b7b08192535b5d726306c6af2b419c256b85bc6f91ad63d61e4883947e6617d44157164532ee0d649da78013c877d7f99848c7c6a5597ef7625a9b649be5da8bef5de9a72dc9ee44b95ab7c168984b0bc8f30fd288502f48be5a69831be2033891974e794e7ac155faf1f3d5810cd66449ff211ada296caa65d49f223f2dcac739d29a0139321f04c84adcde7d1436f6348aeb53dad2bd4b732b4cc50a6b4930ef34fd4828bdb2d6959d08a375a1a321eb690117703266ee32b9eadea3fb86f68f0c8f4fcbe60091f0e97e9455ca9895834ba73e2a085b4656799c1deda887105c1f6e36f784c355272e0d452539049338875b1ef3b452dd8ed34734e55219ff8c9887bd1b38f3bb5290f46a0f7bc48a176fe8ad7462227ec48f94012c19b1a5a10ec4e4f01145d32b46e7a280391688796130bdfaf78f5416efc252b822fd7f3a753e456908bdc95c870b18577dda3fef2a89f0fc03ab7dfa2d420c29baaa4bfe326f61b61fb39af8fa9446c4281c9a62427d479bfe50e4cbf784d10a9c3fa414ba0b7bc8df9b7e8767e01a81f1d7f77154ddd9a72e5690e288be75772cf7ad20b22bf12d35bdb85aab3b590b5e36c895d9a1cb4860865781bab6f06f6990f8f673f508d53dcbe8384dbdc57556099cdc21ddea95acbf5d29bc6afbbf9ca3e0ad510be393a506dfa7235c79acbdcd3da48785ce097c590b30962417db88994b6ff2a5da17fe37d612faabca0503293bf2dbf4b31bf6c86744a6a3095c41679d2552a7cffa4a74927bb24eb4929c4263c8f60253431562bc3171c88aa65c8426f890998da6ac06cc05a013d4dd8ef417871911943227d7d8d3819e11a2de8292ef70bcdd4c59760f84c0dc6d4dc5e016d1baa2000f1af6d1e27b8e13addbfd5ef17988b036a963ed8c4b0b4c48e195d7eddb80b0d446d7fdd823cb7cff5b7dc6555bfb0aa295720fea994a270dc237bfa03085b4425c7e7b12c42e573c0e96c760e452f04509b58048758f37fd45cedaf7188ed03242e831bcd86ffcf23f1d426f7722171cb5b188a8069be710f592d76a99a5e5b650f1790af4e967e5f5eebd72", 0x1000}, {&(0x7f0000000140)="8cbb52efa9393999b97eaa84b5700a160c7eed698ffcd94ec68cfab947812ac09a1c88b950c33af9d3f4d6eae9cd90d1d85590cb0c18d03c5c19ac9e82362df9d7076a89eb3fb7edc4aaf0bcae54af8d41f889949f4dd4f927f68d81b00fd72dcc25e32968c7ecae8d66699901d71e303f6fd83a9e19c10987fe6a8125959f921254ed2217c91e0e4cc36477c0223783a7c5fe79dd4e9ec36f4661d04d2b21e9b992103385e43c23f9d99b6cf0", 0xad}, {&(0x7f0000000340)="0e4e136c3c2ca574e2b80d36f210923cd4f6f67675a70af38058a9f90ade2beeee96ee8077cc4699d33ceae294039356b0cec170989df2f1eeca378e964c51ca4573459311677b131407a3b38a968ad21b73084b24464df4c51bbd8496136d180d1212d4a95f29a8024977a0f8ab79df53d86725b64dc14ea5cf28d7da256bc06c5a7ab176bbbefa9577d5833bf4b02377de3538ee69917cf92a5751260805367631129a1f0f5792765df65faf532ec78c78ce9c8f4b18d9fc5131805ca5c2f323958c28cf0cd149eff5048eeba8a7197ab40154ededcd54a5c962337827e9e2a874111f93e054c56bd1ea5d0859afdd2fae920319f023", 0xf7}, {&(0x7f0000000200)="5de9e95fbf5311916ae3b524f6de017b6b8addadbc9950855d982d199af33ac2cedef09411a156cbc7d8f203bab8ce7db79a73938e629851847acc82198e7b6914d7be15b4679c87cb99946319f14c6b918cea9157f45fb882302d5b8e89d54cc744e40f", 0x64}, {&(0x7f0000000040)="9aee1b0f539e89035ce31e68e904b321c3925b49399627edd1236fb8867bab223c0924fd2649b48ec212984ffd3c", 0x2e}], 0x6, &(0x7f0000001500)=[{0x88, 0x11f, 0x8, "6858402dd7d07772e8e7c9f4f6b692f2c920bbd358a9111121e2acd0b9693b4679e25e99699ade65f70a790186655d0fab4edceb0a06a53ec6dfed5b7c7a806f0b7f0d6cbd29296e5267e56aa521c1e912fefc5f4ace18705c8d98b1b7e7f0d6b9433251eee94a72dfe50df8c08c8c78f4bad3ab"}, {0x100, 0x10f, 0x9, "2321f1a544f474902724f643eddfa21112077c33f577bcaa16362796cb61c96b4688d4dc396202dfff6dfaacba517ed08713cae7d8826b368866427325bf5cd3cf7041e382ba54764c1fc3251064c21a461ee2ac56eefc94d8f34910440a2890d36a63d8b3b8724bdc2b79e3aca2c1ef17387fc550a9e5a0c782fbbbb1f38a3325b7d792dbd9d6a7b3f6da7cb37c877bcc9692306c7edd620ec4a4049dc91bfd00ac5a88c2da574999bd13ad9e99ab5bb73fae8ecee59e6d47d1b7895cc498aa049b1c13491be10ca0f15ea4436e76fd3a2253c5a38ded70dc97f2fcac1d0cb7dd447567bc3dece07f7369a555d27d"}, {0xd0, 0x1, 0x1, "b3af21041c8adf7cecc27849f901160a1458b0097cade97e43c9ea54d8bc1b5e72cf99076381c0f7d67ed86690fdd16c8845e4ba9ae452ece798ec32c623c1c23210fe6490707674af888e3672b52f27cfd9eb9f0b52d9f7c6093310c2734e6618a2ea8bfe03687dd3159c9a47c9818bf67045ce8a108d411f4ed478af71cd26b379b3457d4006dae064a410513b3b3d94273b7eebde4f18bcfa039fd6bfe92275e290c898c3d02505d0f2764ed567e21530873760e702b224ee"}, {0x108, 0x3b, 0x82a, "104501c0271de2dbf6bdef9aac14d73c79f3c46b5366fcbb731459b7e471464674ac0b3b8f9784a402ce6012b78075b5c8ee6657138cf7551bc5ec4b04ef3c17482ddda61d62c81818c35b70e10894e5212a885836557d908a83643017e96a12a7b11b523943613c205be19704c3cc8e0f46db66ff42b4b85c5eff27ececd33b375978d23fbee44d4faa05b9373b1349f7f4f3a4a3d4b10d23d702ab9bbd41fc18b7ae77043703768a0ee6d86aa1147b844f489111037397c11e07102f547cd4c9f32b0ddab251cc94ad266e97fb118dedab4b7c92bc71c4a4d69b603d48b21e89fedd86592b3635413808a12c5bde1743e77c4864"}, {0x40, 0x11f, 0x2, "3669c63dfe6f9fa6bf928bd62e8f0a52690cbeaa5ef178a08d3648fcf35086a0442a0eafb14d910d336bec12dc07dc77"}, {0x90, 0xff, 0x4, "7661227728316bd690132f728be4af4af356f6bcac8bbccf0feacf4cb8357ab298813e3dd27317621e81e928a89e8ee6a535fb77bee027b33dd412578eb4117aa9d384ad97a3eb22332bc60454fa69569a22d3fdd913f27998fd71af224317b8ff0b703deda5b9dec566d4e17f58843b84c5030c873420957545231549"}], 0x430}, 0x1}, {{&(0x7f0000001940)=@pppol2tpv3in6={0x18, 0x1, {0x0, r0, 0x2, 0x4, 0x2, 0x4, {0xa, 0x4e21, 0x8, @dev={0xfe, 0x80, [], 0x10}, 0x8}}}, 0x80, &(0x7f0000001d00)=[{&(0x7f00000019c0)="2ce082c312e6d65fb01b2dcbdcd0c99624f00075a2038f7ab6b1b51de7c66d6c3bd2a05c8da54952d2996f647fdd4f05f7f7ef5c602e4c8392421629d10491f1e3cf7d2a4d214f0fc3efde33e5de85a264dfa06ea3923ecb4d0d4c4327a4a55a3958b7e3c96e98c6ccd969f9cd0cb62b8c45a991396fd3d532dba00c19e5d55b514036065564cbb60c34250f0e2ac6429839dbc1239a413ef91811084436819ec800791b3bdc0b915b59e2912ad7fcd929", 0xb1}, {&(0x7f0000001a80)="43234a6949ca04f968c396e336e05545cb955db5d127ba1a0d26b9a731d4c3b61a439bcc5adccec48dc8bd78bde68866b015e9c42ee24c49f1f15667b50a218592e3d00818a03b1164f4135930d73514d7fc1e1b5cbd052ea7b9105d01757194c7857d987eb72b5c1f58a4938a50feda27f4d0", 0x73}, {&(0x7f0000001b00)="1f4c18f9535b17874f3319ff69ee296df9adad31fcd904d57e498896638ebc9ae34385af1bd5d95f18e276b661256e04bb20bc5cb4a22b2a10d7d86acf3c3becb40cd6b27bd3ea44ab21f08719f6b8457af72f1509aa7c13e6eebb481f8522c3e9d47805f7b2632eb8f0734ff6335ddf3201e38ca028650f620d2cf92b546d6ba3f6b88e2ad89485ac05d70becf560a811170bdc707e1866673b8ba541cc527173a3874f68ccdfad9f356c7ed331c829b56f2b87cf8d2cdf6b67a13d77c7925e31c82ee363df4bbabf9c592aaee736de048f61a9f162d8f2f8c73e71", 0xdc}, {&(0x7f0000001c00)="fa1f94969f78d85c3c5f69356c72633f72075f5940a409bab74e007737815b3e565821de60bc124ab04230769d77acb73a93fe5988ba69d8f84581f6fd40077ea014acc4edaa2596137577f119e53aba7fa087d85d6148b55b232ac84c1611409ccf97f185f3d9932ba0b2da68e486eef00a9bd2431eb6a68ba038c63adaeb9027a9fad47e1b00a16b70461c08cbb1c739edbad809f6db81e0580511c35eba233b1317e0692f0407057d059f6ac57862b9afca9a5de964304c6875736fd1b9cfcaa1df24c108fdc4c1f7a1ab5e7b74a7f37e8c885cabba0c15b3f59a", 0xdc}], 0x4, &(0x7f0000001d40)=[{0xf0, 0x19d, 0x4, "a46775ffb0822ce0c5d6fa7864bb0a40186f2f675d831af6a0663beb88daf301e1f488572d83afb9b2812aff9222448bf98d148513e7d5de7d6d68431303dc370d1be6e99bd979f8d316f3465f61a68f038484f0aff06f74f97ed765c60659a7b9b278a0d746dafccb284c740f3541f8c0ae4841e8ba62bd27efebb046e594c96bf9eff095197e2a9206c8a7aa8c0c620e3c2395259f363df5beb9372f28045889d5562cd0571fd51fb5f8dc7f96884caa7c726af4dfcf3a9ac2cebc73e8cdbede5ccf74950b5a2f17dc566f6fa7016516c5857d1531d4a8db6d59fd8c6689"}, {0xc0, 0x11, 0x6, "b3e9cbe39e3791c7f791800e0ee8c4052744906c92bf98ef1c51391a2e772915cc892d38e9dc839b1f042a8817b18ccaad0565591cb252307a0cd8dc9b815edcf1e12c542d6474847bd7c0f9625c58e8eea9d3c4eb6e4068b89b55a113b44ae50fa6bbda963b69d54aca4d7b2434b86f701df44698849393e52ee111c8616cc0bc490ffde253c74e481719b0a2165c355db9e77374b4ff1f0889e5f274190b27662232a124eb228dd750aca8632e6cc2"}, {0xb8, 0x19f, 0x6, "a46d369944d6f5ee334a97a611c1ba5108ed3254cfcb3c942b5ec48b1bd28528698e764d55676f9f86cfcab7be54f596f16fb297c99cccd75f49143393d778f6b1a844954f0f2d0df081f0ccbbb57caad7254ca001885b90ee41ca17eaa24b90cdd3afd086803e2234f52eb4364fa69aa28b4e367dee8eb9631a013d1dd61e29e65431543c14d6a05d79ff88505da1fc20e3010cd8827b0678104d8226deb329d9a80502ab65"}, {0x50, 0x18b, 0x0, "a2dfd5fa4d795bea0ab2e8d4c5ff87b0f3c3fa43b2fc0869c7a8ab452404fec4474fa5769bc86955988634efdb2cfe6e4114a42829812398813819"}, {0x88, 0x0, 0x1, "2925a036456009dcc7c5e646cb7afe459bbe0370ad5add7abdd0dd5f56e5d6718ab1f2ba5b960cb54603b211b636733c8a2ef9bb1a4a75d100674e94637d66e36ee599318d9771624a6058a42e9247bd68d209cd1e034c62bbdcd18086ff7066a72e022da579cd4c513dc9555397b694e05896"}, {0xb8, 0x105, 0x7ff, "246691da6e39114b9e24de500bb16811cc4caec33795d073ffca83601d73a7252582a899e74a0e2ce85334fcd88ee8da928de79163ca7d379113937173c2c9c5563bc5943491302163142b0b073ed7c1e3ff82642be7b4b8b84d2ef5b1d9e06ecfd31f4d7d6745b989d89a51667348c327666ffd25c13e873008b3c69a3fd7fab0fabd856f1cd7961a2654bd49420751d3c4ee4e5958a6b57dfd235f4a7ad9b1a9df57"}], 0x3f8}}, {{&(0x7f0000002140)=@vsock={0x28, 0x0, 0xffffffff, @hyper}, 0x80, &(0x7f0000002300)=[{&(0x7f00000021c0)="2dc84eefb84ff329bbb7b231bfbf582eff4704e3806ca772255370213bce128bd2", 0x21}, {&(0x7f0000002200)="0afd90b98da84eb2c43e974ce0018c44d2bac39961803eb62043475c95614dc54b8a8e07a345b687a86782d07483f4ef3d2b590ffada97e478f88bd530613d03c909f21974427b6300da6818852280aa0306d7427911c5b73d7535afb589683bdbe89ed0dfd3feda89dc1be8787fa4959521345e233e4771994bd67ae7c929c0e558b3bac5ae928c0d3ed28e3cc745e9f2d58f6c57db060a35abe3a9c0abf766ce09e77997724a74559caae17575350fc0ae0fbbdda04244d9a516b725a0c5f6bf893d510ff9eb21dc4c203e4a38640b8e8a56fcaa0f3e3ed4f55bdc60cde817ddafc8ee76646cf4531598b98b8260d524a82b1f", 0xf4}], 0x2, &(0x7f0000002340)=[{0xc8, 0x11f, 0x2, "4b565a7898aef7382c095a66fde6c455a0d474c9b009da555051aee6214d789476c1d7238d91cef84e4fbde4d101d192bab4fcecfae4f2b0ca309d3f640e2cc05d8f3d154b5b67716e62eed5752b54537218700eabbd433b21524084f666c1b314f998c528a31c64b2e32fe1082739db99342796901dbc737ea231b41c20f4a5689269ea9500dcb1e821da745e0a3604c67616a35859ed95c5d198b8e9bd59ef89ca832c30b7537c900bb9244f213de352255b2507"}], 0xc8}, 0x10000}, {{&(0x7f0000002440)=@ethernet={0x1, @broadcast}, 0x80, &(0x7f0000003740)=[{&(0x7f00000024c0)="ecb7d1e75ad3b448594ed1ad05dccf856932ed1cc3dcb84bae84f0ac0da815a95ac712a1a1b54a1a55eaad301bba8596de4dc0e8052c5cf2b96701f377d098b6831cca6593744f51ff8e5dab4c5d9d469185af10e3fb0a23a01bae267290613e75c082188a0dc518b81b6f76207eb3fbc09d3f7534c42a8d496ce5bbac5313f1f8ce131eab0b815114ceb079e35de73a867456f8d205e5e2fbc0cb354c420a243cad97133eb9ff233452", 0xaa}, {&(0x7f0000002580)="70ffb1c600a87b6c", 0x8}, {&(0x7f00000025c0)}, {&(0x7f0000002600)="cffe13ee31f673926fe07530ef7f0077e1e221d50d132625a47e5023aa4641da177ec17173b8467b9cbfc000d2014e81c0a166670906f946950cedf21db650ffe40122cbfcbbead6898ed63265bf76110352718f52731577b73f0d8e7af6ecdbdeecd86a0b4daf1be0f152481026b58e2558f151d555512de1ab882fe18d9f5e03ccc69cfb0c135c819614e83a92fcacda988d87be56481289eed0c65f4aeaaf3af76c9ce87ff5903e9b39f8b433de5a831bcd6cc10b5ed85fc853", 0xbb}, {&(0x7f00000026c0)="250fc38cb9373e7e2172641e5fe452b74233bc96dd6613e4c74762193fc1cda86e464928db961443e1da53df975b86b66f897b3e26985b75eb94b960b64e76e50b753d4ad7684e0183e4797c3e29e9911d3cb6b4f0c3b86293b2f77d0d368e7ebd15c23d4a93446f01fc9acfd2a496c3b74f86d4c2fc93c6f9ca7202807314cc9913aa64bdca1aec36da4fbd46c98b51dee79002be95499eed9ff2a9827b9bf72860a7032f2378744e8ad6c1761254f00d903438d96d2fdde567049d4a42d1daa9e1bfdcab6de2e00f757d02e96c8106e9c566e65001e13cff7ffd55d89518dafc0447ef03377475282f6d5da31920ae1b98b516c6f2061a6c12531b5384a638238b672b3076c6881eff7915126d51262a552b7e114f158b3f0a77917a529eb9b836aa8c2e93e92fae2cdbd76990c05b061a93a7c5222799f3f2be4fe9bafba26595fc0ca0650e1bf8041ec725ce0691548196bcfdd229eb41f9183ea7cb735577d8e909c8e2bc8776b15e02ff5f4a5c2f36f92025841ab8c6facfa0b5b49f568fec9cc8dfe639405d0c082b01a4a7667d521c1a646e911a95b146e6ec23eadb0daee5a3f1ef8bbc315c7f67d972fa9b6e0a43c9d83c369f99f30927e5215996cb240ef5aa4c2675598127c59d1d43205c69822544b474db27a4816af40623d206cdc688b14cbdcc12880ed3883d548fecff57b97f56ab89ede06f7beb1d0f0c89fa858d80d23fb5364c04a66363aa5cc749e3587d06cb18b6ffaa0244f4fbf1852d21f11a0d5b28e7c1a08c7ab5e59a6692ce3714edea3242371bac9ec9dbab0b40120044aea11d29328df7479eeedafce8b1c97862706cf358cc72c3614b2ba1180e4ff33c514b5da5187823fa82b689336ec66fdbc683ced8cb9dc4cc07b8a3795fd5b639c8fc931ad966fc3b6b0fe00a2bc3613b5c25d5176cbf797789b3dcbb9df383b27015ff0f2e840fd5b40718c362d667a9511f6f28da8d9e67f0b8b030488d5d1cac379b34c2dbcb7be511e551f9d1f23e121f3fcb83a739b1eadd3406ce3ff05ea1aab67661c833805701ba96d0841efaebaa6b0532914e24347cef940286dcf8cbfa14c4a2e68d400e1d9cbd335efbb0af241d3be94ee8353e543d87268ec660e7db8e3302946ec6fbe4b6eb1372f3fc4a5ba8e5177821928fe19fad82d26f88631262af94bfc5be77f743c056d9f24ac80d2f7d4de17ceed612656414e1403fea8e6b6d6ddfe015877681cd96209e08c79055d53693cbc1b33aec33c09d59590b74b0a9b0342e84280dd3362125f7ded2bbee5269c321f8ded0a5dc16cc286f56542af4de928e8009de3572779bc6ad9db10e184dd54f832b2cdf01cd2bb92430c7d0cd2bd9ece8c320efaa506d1278d572326ad578906bd274fd821ad9b72c7f702b48f7854ce1186730502132ae8279365bfc5d4deb1e5c65af9f3ac174a9b71c06eb6c0c0349bfa287335ddbc3129764ed1dec8708e6d6d942abb3deab212509a64400876c2c559abebfac6a433b3c0e7f109ef79a919901b27d74c5beb0c85ce4b6b9a0b576217be0f66602291b1250f3d22a80dcd5cb00f2c94ed6ab3100fe5a3323b045274a9e5b48bc92e70c58a18e1670b2d4db060ca3a2bfb12df931af52f662b048b05c1acdbb6bd48b438b4eaccc564efd0930334de53665d398fbfced7b4ab0610fd2dab956a68f2e99db4aacf766a2f4daacabf643c16ad718f8fb56279170cfd239b4604ec83c0780a7ffa09c6befa5f4a167994e7f06a7da74698d0cd1d1b3fc7bb27f29457b1414525487980871fdd594f422ce44a4e41f9778458a816d22a02574281276a26bc6c82645e0780b73f30270d2cfc0bbf8704a3399b0f9b702edf7bc2b3b7da51cbe4065d42aec3939570989a18cff9dc9e4e5f285e0d8d277f2935398820292bfaa5a3461164808c4eaf2110fe37d43faf415271595b8b7c0ebf268bd252749875b561d3944820ce5837b872581d783f2cee7e6d590aadf79cfbfbcf8b715b2ae7855da94696f8443d792fbc7508dda5dee56eefd408b1b0d740174f4a4be28af9ba62b793b5dc69e3821383ece38e7cf192747b819d646b77c502e788c645f739fa84ed18dba5c32830d25e820ec219612f457a950d09974cd02749dba7376e57a9663bbf6cff2ca92cd208f95f66deb6b687c48652b96f207b3c96699690b5182d0a6909360d1f04ecc0576f53d2fc69c8d99f470b965f43714f11a233dd334cde37d9d6e288a23d561f53e451535d29b2e6caecbaf381a52be39dac3bead1f421b41efe22dc3f0d35743f3d344763b77c6611fce224b51838c7a446dbe405692590345011cc09e97c534147104d36aad64fc623acbef383b1e3946d2ec1bbe2fdd67f67387457012d172396c7dd36276d439914d0925fa645373f12e52b7f66f3f49c028c167f0d875f33d427b695ab09a005f9deba2ede8d67d80fb6020f427bab65e28ccaa21bd88f4d1373d9259a54efb45333d020d8e9edae154f577652261a124ff9fcea3a4015059d420470fe07784df05a731029c6d867735252407c6b61473ae081f709eb2a90d280441234a7e27cd22042fa329032d543f3244af6e9b2e365f605f5a959ead40992ae4aea83770896f40dc869e87e01f84c1294925efb604b63cad0eaf46e1081f67a3ccb7bb60cc704f5063164880566a75b03c049e0b4197da963f54f35f490529b7b0a0c5f2b33eb91fae9654f07091162091aa1239264f73054642c4c0c6456fb5ffa4216247ce46ff37046669f53bfe3d7ebdaa3650d955cd0fed7663566e714cab0b9654de79e08153e3403219648b02c4b0ced444e2aad1266970fcff587f53efdb0d90460907457ae17a81abe6eaec0aae7fe364b4b880daa089652a6f2f5265bb105fe2af1aac42a519f6f518fcd0e3b50cf1bf3ccc466924d4ac55b01df43d2f0e6e2e4af5bf9bc0cc2b36718877e0cc994fb4877f36b3b04feb4d4061c957a4c5457e06f9d42d5d0a3b68b4100f5f440bf36659610a6e53bf177615f2ac94b1a1381c2f4c2fb4c279ad7a712bb9259d5d4cf42c41409f301bbf76939a3c4cca9e927cfbfdcece53460d8287d95d84931e6361dcc9ddf40f8c933685c6e9bbc016c104d6888e57057c9f8384f38ff81ae61145759236d38f475a3d39b23ab4441eca057224a7509b67bbd015afc7df040fdb56fb3a7e19181855a31d38f6af29ad300e10d2e30c44a3b7ceeb733d82cc430304ce4f78584b53b3ed29ba4c62dee811306dd9b2e52e137b937d2625c2a405d187a3170b84b7985638708157807db56c8eabdeba2f40a155a7b6d0111bf8e56d97faf5167c24b49e637403e11c2fc7de83f18a8cc5518b314043b7c6ebb846e9451ed49c792fad641089fb20f0d6c9eaf90d8a63a7dbda374d9b3af9734ac515e6244fbdcd666c87d57eb34e04a4c42a6ef95ce56aa25e6fffa9d84aaae8f9d4f2dc5b57646c0186a7ad6b8705bc04a7d2a1b84f7b7cf0ac17f8af100eab761b774183973e9ee684beeb28c046b37bb28194c6f64c1b109dc4b3eaef3f52506061df0963fc44fab0c0f9cc6068a4f6c31a0f1be8156d0888e6ba3dc9a0c262d38082151825d10569fd3ea173e2a42f8ad24acd877dbeb448efec66380a0d1538ea863be89f5b9169ea05c9d13158f9e44a67246aeec5eab2bbc47246084e52fa4e397d04239f3ca1ae2709c0ed29892c769f3f6ff8f6a560844d600d909b122c923b72652c4fb7b6a06f951d82fb18289960ca17429225a27c0c59ded5fdc78927c553f4877c872fe76a90772882b9f35fdbe3ea7d9a92a2f85df6931b9df478b2ed2f0f95b98eacaf607230ee702e78dbebb188b46fa8693bb8bccbcb11af6a0033ab27a23b9367c10aa443c1b0e3924bc4703759b74b61f5e9a44d5da4ff70dec3d4652768db86315eef36b9dee5cd5c5faed7b642517d38995751f48607579fe3ec10f8a1003f0eada4f98ab78367a908116d1ea17088eef0ce998ec9b574ff6580a016c418f182a2261a7d28d81bab0f2e8c840617627f99cca9d540344fe084e63e82061b8ecff3ba2270b57f600b201c8949c6560b8d22658c8d302d8dfac51897ba4caa93893e9ac3ec79ad429a6ced589340ca4b33c69457c187cd9fcbb06b4fcfdae95e13fe64d95c8b695634057f823429d22fe6b87bab700def50ed55f25f0f3238f517fc3f12c2e37c776a3d7af56121eaceef67265de9345a7396b0882bb762d4b8f236d8ada195fca8788b9753027d72e003fb03178e87c5cab69a823e9dc53e21e0a938a9f221cf6d693aa83e0885d7da2f09a8991fb2b3d7a9b7b71244b7c9f92ba4215d0ef82edaf95833688ce94d1837bdbdb3a500d3fba92c9f500b04252f7416b0144c0a7b3709c65bcdbc2662dda46c91666dcd883afbb5732ad07fb7d85b4cfa344dcc034f5ffb6dfcab8b8f01490dbd5be4d288ffe32039415a4e3053492e954731bcbaffd7c74d95566f959a7ff076a4d102b197c9d5548db424aab550fd97c5b0bb6c1707f01b5a15b98ca42286456c28ae86b88fb109a22271ca8056f07868d5f93966ef2dc4eb56b593bd43770ad0aed50f0eb3dca3a74419d88a3d8484a859015df3d360c8cabedd0550c54c15aeaa691e236ecc7f1fcf8aad5a4a93732c99477a25a69a85ffd93068377fd63c5446e69a815b994a3ef89631873aa139970a4d2a8ec35b3f6c81ec2104b2e76fed6ebd632e0ea57fd6a420500f22db007e6389931fc01a64f90757661b1819640eb84c7a5afade2b833598ad933c94a34a44539ae499a98c296c22fcef72b29deebb5524a3334c0b659dacca9dafee074713683a3208f48e57e3cbd71e4417c82310e731ba65586863596f61183ca60af4cda91e5da7f761d894cb86294f1ca66d06e50a4c9ced2e9d6030485c97dda8b521a70f91d8ab3b5369787c58a2bb7d05990286342c07c57e3700481cfbdd3bf6495b17aa7aa13436e70e640b51d1db463026a028a43eaf97a5a73b184f2a25713913bf5329ed4fb349a1ba9313c63fe43a8998687a98fa953212257f33bfe9ff38c25d04bfd58eac5fe36420ee61ff23cc64c1c13f4b87f7ce55a5143b8a9511826b66dbb9a5f882531700530b26f38f0629534aba425802be467847c451c2562f87b9e395a31d33090c72dc9de42ec3fdf72b449c50bcd0e1361b2794930fabe7e9301dfb67b5984febc5025a6ca1ac48e664e35fa845995c08fa4b34f52c152d8c1f3a81c125248abb4c0684cd0c78c156e319121a2131574ca3e2754951f43a0a346a4809e9da29f032926955388d88aaa7f2b212ed96a199ccc6863803aec254015efc799c1bedcc9ac70c72820cf9fbf3e17fcf2ee85b91c4b409e8978c019d3ea718bf99c551324b5d9e95964d1fbfcb4f0433907125132211838b2f14dd74ef88963e83504ac5cf68f63e8f97d447d110e1627cd2c5376ea1a5730a582429589421071645d4d3a66b6050383f7aa08fd5a838c5c70d01724be67e538dd7804ff9e43f423232267ef81d01a6093cca09147ce0e115ca3a94ad7ed77c38102886eea0dcbc3ebd033acd0f03807e694a173ec37b3d59b89ffbe8de5beb0535db0525fdc3a14df0c32413659803e561a7e71a19ac445bbd374f899a281850cc5c3b7dc39f448e53543c159513380c4a5fae68b6546f8787f38de180719c4bf6c2ddafe7406ad06179b710de4f5b1496f30f67b664dcf68b4fe4d76d17664fb617589ad9e1a8c3b4e2bb13d1b0569e710ce9da95465cfaf59a8ee3", 0x1000}, {&(0x7f00000036c0)="b8f42f50a4fb4086faeaa26cc5cc0091c81664a81b8f5bbdba5192e2cb463134d9f3ecf24cb1169964e12a43bf7381b93a7fc451fcd3d19ebbec10ecf69586c272533af4b8c3f8ec0e69c7", 0x4b}], 0x6}, 0x2c1}, {{0x0, 0x0, &(0x7f0000003840)=[{&(0x7f00000037c0)="4557a6b2b70701decc9acec9ea0a8d41f92e5b820f7dfa499dd1e9c63a27d38b9463187658a51402ead026d1e4bbfd9171b8f2060fd2eaf12e8925bf6856c55f93690ae96527ef336d1b8b7cbd36e04d683014ec6dc8eb1548f7a1d7cd806f25c46f7cd0a8a5bf1ff57a7da9cf6cecbe734cf6e7", 0x74}], 0x1, &(0x7f0000003880)=[{0x70, 0x10f, 0x0, "c5ec060a6489a1b62e9028dc8967b2d85569a47a9028a599316bb4fa13000f57c5305c22a490a8a67732e47e2185ea272cf83873d4d3629c2103b7e8d62893b768f2fdd0af531c18c2a4942c77ab87ec5aef3ec83e2ed4e6cd711ce0"}, {0x80, 0x117, 0x8, "6abb6c96f0ed386d8a8c2bd3e2311f89f9eb536a12228bd81810413a400206f88008152f1f3a15c09df0479fd5269dabb02b67dd537868d000f619d51e72f5660acd516ca85f3bce78c791e48fa379a5ce0aa9830a92e304d985625fc2727d820affab89f786126128eb0b30"}, {0xa8, 0x13f, 0x80000001, "c3ea01fc3ecfe641b38abe2d29ff3d8cd32824286a0db840240dc6a45e6e35d443392753c03880a300f879c98afe6f2a8509efc63188d0473c6d37469f0161ef92bccb5c85e017f40af88966544c6c5b44952feeef560e2d865306a8797709ac69d5beca96404b094322b938a14bc8464258e446472b7f7909712303fa6cc3c807a518f4452d80a652c4a3b3d7b0b8b0fcfe"}, {0xe8, 0x13f, 0x1, "d7e3c81182c38439724e54b48e50a518a20950a4aa2188dbc6d080b21ce106ce252092c218ea5dc6c4cbbe7dbc274481af5354e2c4f239dc6c0c59b84b3263fe890337c9973268c7f7b8ecd2276916ffe7ef76325c4714e9d520ce4f2cc5192fece9fcc6cc401a12eadf45d9e37fec0fbe339ece279520688715539041769631e82b0ff990df9cfb229e375d517544a62e2b56dde6f7e9f9c5580d3395e8d551743d5de1bc058d7d1dba9f76b3eecfb87ed2135426b8e5747a1e4ed6d11c140003b424686d00de9a721279f5705f57cf87"}, {0x48, 0x10c, 0x2fe47651, "ce50a7e285fc76bba85692d9d5db4fd5684297cdbd8e769835a165c4b30a9ce115d3a18f52243ef47b80d29e50b3b675541ba6ab46643385"}, {0x1010, 0x11b, 0x10000, "f62669674fb6b45371586d0c0b1fcf0d53f5799089063ec6b9c1635c09d04f8e6a2b124f2fada6725dfa9126d6be8ed26c355653901ebc3109da78ab3f79573a28f17c2adc502a19f45ae410c9b560cec2109a727c6c82ef3d58ada9e47505e5dca69435326371d430758e5eba3d271678ce889e5fe9467f2c311b612afaa606f09ed45ff0f79482bddf2094bdd3e082a03ad411c4622ccac8439c5446b2bab97b10e23a676b6f33a8484d145df03d252c1e3221ad25eb601770e82a45a291f6db7a29a6e07c9cafe674910590bdd8406d130ecdbdf8158dd978d73c3f68240df4539ea56ba32e2bcc19ff77f725aa028f7fa9336c7acf867b18c8bc63de29da714186b03cc99d27493c2dd462c3a65b0f3d52e8e15828d7566cc430d512c5e7029922fa37dccbe17990721c0d06cef90d32edaa50e0c60cfee777aecfa895729a7eb81ad8ca900a86bd69c951581c618bcd9c9eb2b816fb99a777c51798db8161842884d043304daeba14d5ee6624593abf6b866f0ed07e2ee9c0c1c1b8c72b4e4166bb0726e1fe6bff5884782ae2967d22fa1b74daccb4510d0ce5adedbfca7f6707152cd74d0c0fa1261b415570ed584938785ad0f285863889c4aa8fd9683425af11bea9478a9874c15d6eebd0bd4db8602190d942f5bd190979dae231159e4ecf135a3b16cf2d502bc60cf7e6f7214879568ae01d4c79a3ea1b8bf8295f26f8ecaa1107ede200708828143266e3cc977e035373e686badea265a3b36b88e00bb30e9037eb01ad32bb9a9918aa92a5900fba2fd9428f95842d5431e0a75e4c3171e125d0b3655db29eec02eb4e40b9ffb13d9545da2bec92daea17c7201288f434ec54670b875307b482e5e6a62e76da15b28b0e09ea0f11171da63ef48f854c0e9a3415812d79c00f967f508b3360a595f6d9c357ead9e4aa97fed0640a88fa4dd66c9ff3c10e351ed69a0ebc82da1ada8481aec78a64bd4b0b91473b4d94ec7f6adbcca523fa15974301d1a55137bdc40efb042874bbb3d6ec5714f2c15b21185118245c00d4ddaec64cba65d250736094768705de12caa57179c6b061080483e1c2fa13c594c7b7480cc91e557e591999cffd670453e89acdcaa529425df53e5e80ef22cdfa4be333237bf4d89beed87107a5c5c579856efb02be269fe644367b5e5d040fa994fb247adce237ddf564de5cf5572e7e266f01cb2cc6bf8240afee07336d23671a663caebe222f50dbdd16457d3f62f318388995aacea8c798d44c8f56f0837a822e2423743701c172f65f7bfa228014f06edf3e15c325b118bf6dc06acddda842aefbef1a31f0d72498ff8f829b8d6885fa356f75901d07029faac7b2fc754579933971b6a1750cff72ee79ac4ad30cbbd659fcc8fcf3929d79cb35dc03937313384e1739aa70e4553d8d2be5d8ae0ee1c25cb40c85e43958888c6bc393157f39e6e7c7eab409ab407cdeb1b5809afe1e8b61d7e531527b2d6ad7421687ff78144608b99b6276fabd16ce38c3e4e0e704c4bd16549193276b0233ac1d75f315a54b7bf2e8b547e75f9ac15b7baa7eb394b0871da33c0930caa076e549d7579e064e83343110925601440261edb927010a800af01946033b03e96e4e307eec94afb2d1a1403c7439d7530325d1e68508a8d65f04cbd3843332541c2f2e607f32b2dc71ca8d567d25635655b39b96ba70822dc5c3102dbae40c10ed679a09ee941c08df1c15a406f71cb52ab8d19c0c865c973977664526c21b9aa603fad9c4931b5156a987fc5d982794538e8dc7dd781dab361e7c44326a312ca92c1ea6e7e32cb75d6b708f5fff13dc093b334df8d3ca44772e023748f52aaa58aa56d87ab095628d337d3669103f3c66dc6a8b42b34f019d1dac5dbe98130e2ef295c4b9bd95cb11787b26e206870078bbb2fb88bdba17c441a349bd4c6b415dbc6e413f456adcbc503bf8ba6249646f734c4d2a4039d419285e746e879460c4f284bab472e53da386e5f2e2f21474f11413f6f87203aab48fc8df22b86f52b16129e1901a03cc503ce702b17a9810b012875ddea6a1b4a79e904cd9bdd4515d8820befdd4d7bfdb83e5407d95c222556aa6fcfd06cca69e89eabd6c9fcb684481a955178eb481bbaeaf680799b97a15a1267bedb401fa906b6dadad76589555bd5c6b6f2026199a51506c1b570331bc2bc8ac0f6dde6126d3fb8d96629ebea4bc37a893716703b62dd078444867182404f52ae43687ee5e553070c906890a7243e0fefe56eb9e18d7c81c4113d6a03a14cb43d29a80f27f1efd60603a8f146c3b4fc87bc1a4a1dfaef5acf5fdc849f3123c093f5dd1ccb4a2828e73e8cd21a686fa4bc63f86428eb58bd56e2c9d629888d764a1b937a254f81779194ef448210e89070b9ebd7e9d9c450fc7825331ae2d0ba79424cb8beaf478f0327b1a0ef5faeadefbe5f424e8d9ae23a3da02d7b34b4247c00854e1b0f5cae97c807f307086e99391adb99e48dfc65ef743f3cf8e16682f5dbf6514858682339b3aedd5aa4401a5ada09172c51ec2ead311cdae48f05317dbf14decdcab7e0a502768f0985635b6412c76be7e3b770284b217c9777558432fef09a07b1c72f73a5fe20e1c1fdeb9bd0088dd98e6518e09f19bdc99ff0abd771c0122bd951bfb87734080cd59bbb327ff52dd5defad5d5f7416984f9f89479c45061bd0e2e63ea11fa821f34aeab7b9d5bf5e0031d8eb9eb32533fe11113dff164123603b12496d823bcc552e4c90213784481bcf1ffa7fa14e6d03d40a12c5c6b582c040e6025b32c4b0ed1c6e4aedff0188db25ec33537cdf89814247151f35ba0d4d464e1caa383ac7ca3705f7b9a545f86795e7addb90f57044847ce10594576d2d10bee9176796a431b7f7f849608cb5516c8933ae334b9ee831a1e04b4e543911566b9ba8a7622b3768af51ebb2b02870c2ebfca0124abe5b3e5333bd0ed2154868f9e3a1501a5c4a20cb70d2e470c44f2a847a90f3daf8b0429acc6ebffb19490594ff046286f09af66b7ade9e359b730d0137528aa4fcac9505ca21066178b1597c43bffe32bb5587471cb90349bc48a15a2a860938cc26e974cfed40c31eb331a2a2f228bd9777de100f93eab45afb2858545d442375e121721f2ba229036718307f350eb6bba9529d86d469689531b5eddb00247bb7c22926aea8beccb52a5eb4601b209e86107c8e0e54a57849c2d91bbd49489bd34fa19ba7b0f1489af07f0f00fccfd8177fce8b887fc312f50a7220856c6a9844d13c5f8c1d14eb77a9ca5dbcaec8424198d2109dc540733d12bf790e75aa7f15767ab06f594093611d3aab687d1f43bb4444d2e5e077ac1af40fc7f1279520a872b34f283037f9f64ad15d1fb47ec9843cb2e8476cff32c0370bf06711d210cfe1ee0d466b2b8a1247f218525fba7a3d53e14c46f697c5dfb4285b01f6d7c7a930aecb760cc2a4c4d8bb98958a691855ec04a331cf751e5b0505bfab938d045797819c882c940c71ef1623dfc79ec4f0ce9cd49a1f7d7f87f314758ff34ca7055a329a39cbda84397718f48efba9466f01ade1e083681dcde70349521340549c9821b98d2496c9d884d522893f8415f0019c32bdde343963690f798ea14b3ddcec8ae0504f3546d236f0757bb8301a856140874d8c1e9cc79d96fdb0388e52c483e0e72fd27f4dc18461dc2346b071494d7c716a159f38fbf705e887f87290873fc126d77938e4da2bb2f9df58be3951606aac9989bded4a63d3040c53ff1db1b6dd923496c1384316a2a6980f73fd48389040f9f81c54fad533eeb965a978d67ca7140a54c9ac0d48ae0cfd52113312c9fb1e9d5b7d86f3ee5c3629896562c89886d111f0cb8e67619905c40d1a7d9e4d02fb7a266230807ff04d75696c9b7086d467f5a180f631e07058358e2507fc8da24f533d1597cddad2437a9834766d58757cce214786d1fe89a53b7bd1d8cc7ba8314d78d9f0c400dd2980cd62f9f61274bc5d5f0838a17c998eaf9d5706e62e8910b4bab8ca778823cc75a033e8ddaf87ef300c59d4c72551f719d1d715624011ef3cd44ac8109a9f1e256ce183c1eae924225b5e39297a0605e457d18a1056cb4aa59a8c2def4d4b386549f0020b8ec0f6c9ad75349714c18fb3d49540b583c67a57740afe4b0290b11c438f8974c2e80099398c7e7235819b6bd8a865bd1b4e8cf58101e4a01d109f349272baa6c619244fd45474d0c54c7ceaa753ea9e7a80ce3d10228bc573510116961ee95f8d5b4867a6b07477729842ad30e4aaee52d31a5d8d6660ab593c714e0d55cf37aa58185c15e1d970897367cde4b08a6272fba74c443fa38bd7be3438c87f296f4d18305de1844be0db23bcf01e9253c793e60edbdbdf8f2bb6f12982fb455d6019c8c3dc8f3ef1418f7cb2c81ee7a3e98a906872982926bbca6fa40b592674ad83fa9f14d29e224de5bd295da982d2855d1ca6035795c1a338f495a72f94ad779b361c99dae05f63e0c2c7f1966476644c150e83e84a3cd12d1271c8422659c3966bf54dd7c2cb82acdfb4f7ccb4d8d7f034521639728775771d0893de6930a57f4125052d66db0f5316eff7f2ccc41a1072b2ad0cc19ed7a4ca58d0e9c404a07c0cb565fe4965a26819ea118a946621efcd544184faab4aaa6151a756a8ba269667dd6f273974a8596639c45f40689833c9f573d99cd5c8cdbf9cf133467822e9430d9717d2a70425dc824252461e7772499257bf1105cad02999265db903d99cfadcaf5bd110709b0e27b7a80242eb03691c00f1260ccc14d2f74afd9554fb5f065f89ba1efa24456faa1fdc32f2ef56b54717edc262232a0e3df7bfa379e4f9197a060b90363d3dc7a332ff367adb01abebd651a558e786ac3867247e4125eb3b461adcbc116222252b43a057899ad585a7ca98a0d26522ca0520d95075c3c01457ad74739b027b7d025f64697a8670c9e6c0925b55285a8c7c39e8f4d852db073b60224058b398347e2d652a7a8867f764296ffd94683319362da01408280af0678dcd026ce0cb45cc2a50bb66d575225c5f710bda91b8f99acc3719e72eb25718cac84d6d9a1549aa43441de5f3a2b7801dbaa3981a5626f319603ca5abd2bab139073488776313d6c90b07a855acb6586915bb7c6aac0d5d340d773aed431bc531e2cb96963f7ca0dcfa87f7c6f70653a3c85daad1e27aa8739f06a140078712289c39a33e46e7ff5c89126b0ccb08f455e69bbbec2f66499e785d9693a4c4877a1543e7e8643875574fc768cbb653aede440378dcd1c630856a14040d95749a7968baedb8234c27afa2acd5d3e06717ae423617d3f6102431f312e015bd8c63c1a1f1be35eb217d139d5e582468e98a24aa5e1186c50afcc054bfed11f35d443cec3b804047e71102e179ebf95d5c06a1ff5577e3fed3d9ab948061e5179b288ac54d1a2ea8a8f18c99fb34f7a06405248c662511656e19930849bd6100571c7f662046003440377eadc75d957927fc3633b27e33d8b4bb2d72c52d3fbd8a267fa38a64d6d0e6d2bd7575106db7388f9fceb7946455db6dd32373a9e009049e6a757062cfae65bcfbbabd7d13899aded23aa1037367e00d5c168cec0706a8b75027f70b57fb561ef2a1ba4899fdc0c579a1210ffbbb5c8373eca3c3c7d215dd68fc3e28bd4b7be60db75c035bc2dc8c883ccbde17c66043e7521b91cfed5a6d233e7973549b9a4324676eede1c0a863b466f9d845e22389a292de834460ae0467e0bcc134abf14e9d18"}], 0x12d8}, 0x101}, {{&(0x7f0000004b80)=@caif=@dgm={0x25, 0x8001, 0x3}, 0x80, &(0x7f00000050c0)=[{&(0x7f0000004c00)="57f36100323e140e07d1aefd5bbae51a7575ba25e1d981714d10fedcc42765e41abe45e39b7fbd83d2255865818c7dfb88791a6a6dd893b5ef6785e0b4ca389f934979a5df0ce9d89ba36119e9988b7e1c1dd06bb209d75ca3c2c5cf0357ed3b52a9adff1fb1f108674c978a22580d0e8bb8f6a27e1d37606950ce3bd3e606c31967873ea91863bfe298be5f12cd0ca462b765598b2b69dba88bb5", 0x9b}, {&(0x7f0000004cc0)="4538b74e775c387efae469bbcd25b8a5c6a6100a37f4ef8513599d0be2d40528c1df0924ffc5bcccfabd285dd7e2b054befa66a3bae439bb81fe0292a6482378f84de23d7e577bd86afaaa3a980e8c486a599892fbdb76b8b11deaef3831149097c976c4ef33fcaa97282b1d1325624db12c6e4e0385312650f423c45e11bffcaba350619738387f37d995b6fa89006f86766be0c842a4ef3fab95c5829da16ec7fd3cd0602b6d", 0xa7}, {&(0x7f0000004d80)="ae4cc48c81b41fb083911d5250738c4abdb23e8aa3aee5a5acc4c5c1f74c040b544426caf48fbe124db718c79328fbaf6a67a4b40a8878540fc0f82e212ce494f5e377ca71079985f6f11b426b1cde91fe9f23e5dfb557717b339e371601a079485fc44561c05fd99c0d2ae4305bf1a3c473bf6b902e162876bf70f4efa943", 0x7f}, {&(0x7f0000004e00)="a6c1a73fcac55371050c21d359e6c42f058f32d84cca5261fad9d6da76ca98ff526bc2c59907", 0x26}, {&(0x7f0000004e40)="01cb677c2dc27c4f757789879216e40ee1e92e14b478accbc4b9505c75e13d24321b4ec628f818778149a1c6258009e847aa99943ed5e46dc1c625f684e9328521dacb5dbb1ef664fef0e12c47aa17d116e0bccd996f2c60aa797d2c68a0471d6816c0a78e2bbc01ce07965076a3e4914f906481941b6cb09a4489c95a1a67eaa79b78bd521c5220ebf15974d8d0939bb44751abcdd4c3cc25", 0x99}, {&(0x7f0000004f00)="00cd292b6606b4e2d4fc7bc32c95aaa72ccf6f97fa4f54f47a3460b90c7d6a34748e4b9e5140ed5d443c0e2fc79d4efcb2834a0d4996216458f05cfee1c49e3da1e06c61ef122609ade13b6279a7ae02e32cdaafae2585923b7f838e175d3f7cae82b7ba850440b51e564ec1451307fd5156c0f9d27fc54be6e890a2081b3d30989d4ed8", 0x84}, {&(0x7f0000004fc0)="88b1c05b81d1ed7b2f659ae003e1ff150cef86d0fa28d5089c2cc83bee21022b9896d07b2d9139bf73d8c1678a00fa45c508f5b704f0475a3ac4d9a6f348cf91d9b889a75e743a1046a32c8f7a1a12ade9d2ab3ee2631bb9c2bec4a76ac376e059a5587a7d7097f02c19bcb19f2326d252530916db205b77d0dfb899d63fa486fd419356606d930884c0d12d5498b557349121c00845e1b45a2bbdecc1e76edb9fb12d72ea5dbb620fe038530d969d45f9b18863d923575c6149699c12a07191d1cec09411086a3cf24c61d99a821bf6bbff905906d3804033f9d5481d1bca031690dba2686dcdb5b0f7e120efd186a4bafe7e1a94230672e19a5e80", 0xfc}], 0x7, &(0x7f0000005140)=[{0x1010, 0x116, 0x2, "65a6570d42c7a6aa8df5d8661c2810b74083d79fed25b459fcd11e8b602d0021d2ef8ec214c5fb79f5319523e7ef56d3c6bc765b68556876728884452d7c7acfed50a9e787dc76e3465164546c18c5968628e151c29668d9d6e2ea22bf2b05e2de43c8adee145c0a1f2e89c63b44968d75154c41d37aee848e71496d15cc0187bf7bf68ab0b6fb71206c6df300d9eac0712507ef956a595de55f4d228f10db312bfe104f3c524cef6fba1dde0c2fe685bd2a4723fba80e5a981504a84ecb7dcb3532dc055059f11d5fa5918cba528fee3dbf758d3fa037fdcbb77a53859b7d286c03686c436c70bf7e4af094afe5d801293e43807130bee4e9f60cade23272022465e56bca3b4b92c9596c588ac0d074d34612b8fd54edb0586f313ae0c3d7139a6c5d874e12aa46957c54ada3bd6c7dd054a748481806b1984c7f5768faf754241d7c702de71ab45c5b18274e49b9aa678a9f81e4eed8ff9506ade6265993f4fc2008e433c2ab75c85cb2e44b9534a20ea77eb7cff140f5a0efaab65775030966377dd642cdbfb48c84294e5e5c263b4c9821e9d27f47d529a913cc683bea31649eb58209a818422f909e3086abc99ef0f0a67a12b233a595c8359b4ea320139f79dce746217b61aea12be0c9aa424daaeeccb344f4e0ee5ef2fcf2fa4d5a14af0fedca25f5f86b8fed7882996750d8532af02a54b1480f71abbcdaf16b47e7e2629251160e75b8967159e5d0398ed34b8e01f70c3bcc1c6189ed7d60f5fdc2c0351fad3b184ba8afe8c8370e61040a0c6fb47ba21916c0d7701fbc1b71721d75b275961acebdc0af1666147a6e6cd8ee829e219a5b5884c4b7041459867b1f50be98e2488b9966f46e6cc90f3711d378d4bff509e71ca846e6e813114cb706919c69937cca6b3626361291a5ad48cac6dc92e52baa43323c11ca56cad82c138cf57fa8c549638d278efe80e42dd2705946ef77187282ee2419b35e5c8c8da8e1b89d958f6fbd52d41e8f70e0e4319529ebbbaf6234a609d3f80f40accb3102c8a1787d694065005bcce5fdcce40ecc39b6fe83347e52decbdc0f079374987bd763792c7da0a1b8ca8f89c90ad7f004122a858df924690ecd9a1aa8b04d05c30528935151fd582bc2f316a7d0f0e43a8236c25f4e731617602a3c4ed38b89710d75dcf7e812d8940bc704cea1f3739b5cb832e6c6d8b3a7b6bcc34946ec70903dd4ee695ce5ee22dd310f8ed52afa4f6663779537363bf1d625a94d8ce64aac40d55b0d08b42eb1249a948bd07ec9875b38e5b2ac827c0382a68e7b8c9d016de8434cc0cc465ea08e5538199f8482939e2c7664979e48f994d47524da7822cf91622b223ac4e74a4ad7fefff3902e9c4f606f6c86cf645e427fd4e6e6e3ee97cca6c2fd7c21e8328efc466d9dd2077e9ae98b4bfcb0168faa6f984d39b716736aee39072b4cc1816f690d96b25c13896c7ddd8cdfb0453681ff2ad86d2aea8f7eef12cbaf758617b0f97ae352f39bafb2d2dbd84532ecb71dbfe510f52b04934a6f00e85447dfa504d9acd5b62364dc9bfea030a93021493fc7a2f539e9db55fdee0a48f43c91491810a29483d5c0bc1f3fcbfaa429024faccbaf7084d2edbb858610b3ae83dfebda9f5cb7ae91f1571cf551fe271e7505214356affd429b3e39d0cfff8169422b1ae9ba08eaf875f0f08664e61c25cb22579269919f1ba3d352360ebff031053c67019d845beb4b9aa35058350a566c2d3132ea104baa96c039b8f3ec37f1068b9455107a942eaeb4745f8beea7c053254358521045cae694731a925194603e3d1da8ef7d7a0b2770b95966527aad3be69b23c769224004f44109136dfb9d031a5410700bbc9ebf137b399e7400557f590fbf3a26af84f663512a4f4519ab32478303bcb2f504f73d4a48f23467a725aa8214e0404a4e9f3b3f152b1dd04ae9ebd8c991accc2aeded80837c036d5e4b5ee433b853e28899c5e5b3901df8fd55c543c2737f60680d6ff148e55f27c59a401516ee30423802ffcdf8ed3911ffb280cc2511f8a270def8f76bb695d83411f9e7dd3301f55b89b3c5deefc0cc0b47a95466213ebb9a6a0936cacc45f62b22db62104e2a6ba6988c6ffe5e61e9390890c7c5bebb8f1432f2f81e6b9f6fb3f5883123d09c17969c96f7c12058350560e17a7c71f294c85e85c0ea7f2aefdd5ad21192cdc9f59cdab9d3e57ca01661f886be9a22bbf951dc5355b176993d60fb459929f656eeaa368cb93d361b95e8880d55562dd8f9b602904ddc754cf62f3addb71b51f5690b78612c83501e812829951490aa939c5dd80bb91da20acd16806aeb03a1fed6b7b96cdc924e2c79f376fb575e170b477d384b97c18bd64fe5b4738428d269aa65fb57dff1303aa6066b9e19c2eca454a7149efd6d2896693349f2486e1b4be17dc6dce701b4abd1697e29098972b6d6b517a8f291d994eacf5af37403d7a511a955ef8f477e7ac8d617fc7abfc8fdbb5cfeb481c1fd857f5e3e29d31e74bcfe2a536cc3c81eec09b2df0f72ec2bba958d878c1d5ca83c7e0028b774e30d110d389bb1bbcea96f5cf51ac1d3af1728b541377d092b1a87f7828e29b9a9aa6d669011150c499eae8b43eb909aaaa48a859d5faaeb452bdddbe90dcc66a86773a2e04a76abe02d0aac346d5785a698cb01917b32bb92d5caccbd0fc4b8dcf9cdd4a1521915cc8a9ea8d130d57a5b0e5e9c96ca35a57b064e82f84d86bb9285c6903de18a75e706a582822d387641dac86da1a245a0d22697e2ccb0eeb2fa0236f3f3e254b4288af9e0531f22bcd91ae775cf6b475f6305210a1dc8625dc2dc543f6f7bfd5c83aed1923f959eb6e882370e1e18473775a6a54063162c1368ef0b35be5bcbac6efa0e8532de0b4fe516172ddc234ad87a5df7201aabc6eda5ed21161f414c6a0d1d7547c5a97c1e9622c9ab7742d27b8714a09b7ed07cd222d982cf4dcda67c688c03c0001356ef7764398298830a3477e80d6280cb1db36b47bc202133566b0b9d60e33bcb8748d79afc3b00650a602a0b1de806077eea52708e68db4a4f173733eb2bc443cd5fdb97f31eb0f4a7cb8c66c7fea317caff71b1fd08d2228473db969c370a06a3dce86a7e7c93cd2f67eb33fdd5bc5fe453c73644d3e503cfc9f0f0a8c00b61c57e5d8e9e93cbfe9c725633580f61bd0a265ed7f19e2f3b48d9ad907e15801820c174ce23d278ba13bfe85afeb647b219c689512d9d0a75f83868b04dabab0230eeff0d43b24a5c5939d4046441cf25277a6a30f795f3b80a4c8c252f619e44b5505f5cc3d62ec734dd43a20744a2b91e7ff53c33720067d219fa02dd76b27b4b3b9a1f95dece014e6879ee0c62fe29e67463346264d50546d25363f2bf41903e09df26dc49a7ad51b314481b600cf33f6b56e8a734d7b121d90a9a671302c8da2e017b25cf9f59537a31bf2b6ebaedfc760a49fd832fc501f0693af20bea33b274a3fb369b677d0ec99eb9718545d66c4c435b0c5fc709791095f6df314214e58aec9338d54f17be619ebbbc65cfd01aa1772a623fe6e51469fcf4db2a4037376535bc74876964e0c3e0fc12776306d3b2463b5f60b30330fac68ddd80e37f295aa151bece405015ca5f0092195c99b52af0350036959e1081c4cee5b760f2e1009552a6c6003b176e51ae2f4c2901a1782db49c32522b24b88b153447d9407006022d4a528b479e47c09f42408dde8eb42aa554533a99aebd6288733f410a79cc8b7b613e8720ddc0304a840d6b087de3f6003cfb8af4185ed08990e10a8911d68e1f941f77a92da8eeaa36e6e47f9bfd07834a739d46d5bc07347f2b8110dc74da43cb96073afa79d9779d73d707e71dbb601c58cebee91a67ff9dad50cd1e44e63f960cc4d169a41bb2dee638c1ff37fb7bfc131f9e2ef6948ae781a89d2ff5386b4813348db0a0d0c4f37e410a37a81733c447a9edd7bc5a7c341d7d07e2bb1cc5b7f22ee36a1b2dc36399e0c7d3f091e625a4d20f1906bb07c19d7b221812b98fc9cb35311067b41cdd47746b183fd886f1d5024915c5fed0c4af654ac21647508714ed65ea0c128acb7bf9f307f9572fca55c8838007f70d4bee43bdcd8ec26e589fb094d383c2c7c943646884e4fd831055f7926c6ae65fac23522058dd3fb9d76ac3bed15c00d8cd329b28090712c292948649c227abcb21e86230ba351c9d621974ebae4faa14967e55688540a83da8a19c4d0c4ddccc36df031510c64497a9c4062072fd628360a9a09039742c8e746dbee5ab743e83c6e0af13f000b3204a9b6d73195fb5bff9a16ea513393e36ee78d8357e1adbc2d0ddb2f37edba44ece2cc5b8b77675cc0279f3e953261729247ffca8f3ff120df4a6aec552c084c9bb74bc9070b8c1786d906d95c3903c1bceafb0499b0d5c90461d7facd04efb4c0d5b3ae20cf5c2114727b638fc0951a6b13a181e5fb099ef0aaffb234ea94b16fe0aa5dd4ddf078926a888f8e8bdc3c2a5ed3dc1159751a77e2a3546691936a34911900f00be1815acd624f3998592dbec2996e7775d71351fa7730c2e0b355d141edc259182c7ee0cafc7f0e4e5db71f19db223a911d71e53d888ce3410bc0a7c30c2790d3c9761d9a1e781f806c7819334b81e7e4286f2656a32b266c794c1adec17eb8e991e7469aa5f4a10f884fe93e7e2422f219435eb7ab24b1aee7d0acdf5b2d2af57927835a7e49911393bc1a69debaed21e7613795246122d3966ad36e951664c0eb2f0f42d67adfd4d3b80dddb13eb860543a9f9162e9c8bfcfb852e033c61ea6bd24f0e8828b655e781c094b749129e6772f62ec52e98f419ce0999e01d823a8d74fd89eb76ce14e08f70bbd11abee409e7c827a1caa00aa14c8d8eda1f4e28cab42eeff3954e86419f28794b5aa5d5ff8edcc51120e60ae0d619f0da8f81f389e73db0199b7b05863bffb2dda25d2c898f13dc4f6c957fa7533310a13186a66bd8a161b8400cb33193cc5f73c32ee3f39c43842bc2405e37c09eeb56f38a7b7f1a542500933bba798a27553435d9133965405dcbda1a802d95e71708d39192d9362bb340e3388cc22b26ab6943bf208c24c85838bcf56055d1e585acbd5dac34a2d6bc1ae380875ac8db1bf4cefcda8b9178d0a34158aeb16d861c4a4e2d4b3cc53c4b68bb41d6ca33eafe0739bb7cc52da22dc17ba691f93550ed596f00891433747022ae82bf0b43f388968810814c9a68a338b1c88f98aa4be577618a76a681545994378e3147bd1b3c3e24ba5c855afa4c6e9f659d828ead83b42e679b9710d6047c4a1def5b87885408f8ef328d79f1ecac3ce924519d3a0a57bbef3c3413b6bb654754524369f9204e62471df71257cb97fea926e9d5dddef083c3edfc094819a81f5bc6f013adc7823e6ae7edb439fc990cc147efd69f463259c75cda2872ef25bcbfff5b9e8684ca2b7ca269f789033b0f184949cda8566de350fcb7edfd6a3fb9b5fc27d664193ecb3c9f33270741efcc49471c1b76c733e05d96f900fb2230ed525032af016dff8d7e4edf71b0b7fdb4d53054d400e0b0dae8130e3e634a125b8ce0cdbadcedd808411fff27acc7b734dcbc25b979dcd9fcd51f333c8f960be6ae16ca198726f962e88fb94f7a6a8731c28a2ccceb1f79a00e262ed569837425f44d1f422364ccc7cdce0d8e3f9b33153e36be652169718a337ca68a03dd637a50cab4c1580b24159ff924fd3a58860552f69fd0f7d4409c8b12d126024a60e684ebc5124e29389658c2"}], 0x1010}, 0x7fffffff}, {{&(0x7f0000006180)=@ethernet={0x306, @local}, 0x80, &(0x7f0000006600)=[{&(0x7f0000006200)}, {&(0x7f0000006240)="124883ef887ce88f8650eced05c15cba3b66538f", 0x14}, {&(0x7f0000006b80)="50d2e87b0a59424448c249dd162c1c199cc74499fb71292d8018ecbdc5c2bb0dc846bcba884d07d42b87c2d14471aafc0cf397fb3a5dc6fc4a6e7fe519c70a41901f58850b25f09a3641985c7a806a2370fa7437d7969c0607bce2b2b24088ab35b576c1d6e4c6aa37bb368400d56eabd5d760b1ac0c32d763945f845035d27526ae2554f69ae226c9088dbd16caf358341dd454d1022bfe1bb7ee836f2f7cd3cd50e10182fe614ab5d44a7ab1edb7f1820c7f170f2d", 0xb6}, {&(0x7f0000006340)="09e87400a7d06daf8c457a7957cf90143699b3bb0c36f8faf9116ccc7371eac6830779729602589f31f0d352", 0x2c}, {&(0x7f0000006380)="577f85c3255e0c814635bf6ec017118f823963e5bdfae037d8ccbb63a3a96a09b10d7ecf4db0fd8bfd6dc9fbd2d6f041ee6eac1ebaf41d9fdd89c44ee1151a49894709006b8d45fa78af3470f485e61496727699708aa403c469cebf6d298383bb4aca1e6c9e9136be3389500f0f60ffb27f8a6504d1ed4e746db2613542d656bb03e3b917cc7f54e8d5e89ec818d493f37ed852fac7084e086cd060acce3d202ab3c70f", 0xa4}, {&(0x7f0000006440)="5ff4758d9604ad9896fcfa5c61bef77bcd40472b12b71b14868bfc84a95f5d088515ed5009ad49b5952671f904f38ec6b4c7a240", 0x34}, {&(0x7f0000006480)="39223c42d401fc27a033553e4695f4e4df00529e63669fda86d6072128e6d64fe896df14a2499cd763ca256e3f7e12ee1160e38e3debe48ed096b4c2dc4a719d7a8cdf4ced253dc91ef6d6d1f1b89dfb306f5ba7ad4ec721f09a170f3ff0fd1d37d6c6d934be6de42cb3f7a0059d1d3c4faa73c5e41303f3e4482c6d7d5ed6471dfb27dff56622ed72348a1456bcc42f853ebe229e59ce9454e108a6ae94a95153a9c2fc5c", 0xa5}, {&(0x7f0000006540)="eb8a16b906add35e70576ea8c1a97bd3d9489ba49071ecd0edff1ab6501cc4a4", 0x20}, {&(0x7f0000006580)="9f670abe73cb878eaa98e1d690ffc57f4cfa99bcf548cfd79456d6e1281aecc8b57f03a954221c436daf36eae8093e3a8caf26ee74f3ec515df6fad961399c8b2753", 0x42}], 0x9, &(0x7f00000066c0)=[{0xfffffffffffffe27, 0x113, 0xfffffffffffffff9, "933c30d60aa809df5c7a309233baf3dc75f9e8014d044ece97127919ab301a076fc17d7338c7352d08efd89c8053a333daeb78ad2ba696c8c1eecc0e36ce831c4b6a0f6d8b44a6f55a695bfd19eb93287c0b636e07fd5acd53a755703dcce4e874587b69e0a729f9890a720f742b7eecdb3e76e7d7a0348ac4b360"}, {0x40, 0x117, 0x0, "39374c3df1eb09cb20524fd2a1816a999241186e1b1794afc0c814da07e8c3eea8f99e78a82c37c0cd52f8cf1585"}, {0xb8, 0x115, 0x5, "887f105ed53441f686d258c9057f68c6bdf8099c09a81cf5fa4e61fa5ba7cf778f597a17b4467faade202626c6036a3cf114232a783fc208e66b29b0f0c2e2af41095b8800bb05f9a74f7eac4ce36c2e913c6f1298e9c96d07a365411a71ac6074021fef2d15fd88d800d277f66f829ec01e6a101d0a32095f392e32fb7e9f5047f5e3ee8190b1d068e96acabd156d418c0dc9b23f4eee6edee3095bf944e1d4210cbc0e535a4b05"}], 0x188}, 0x100000000}, {{0xfffffffffffffffe, 0x0, &(0x7f0000006940)=[{&(0x7f0000006880)="468dcac43567e46e9942a628ed5a364ddbf074b6ec22b0027c7ff8fa1bf1fd16f5969e95def98cb90cfa6637628ec29e9ea170581b4c2d89fcc162b8691a77252412991cbf828cac1f1c09f9bf762debcc14cd0c6368f771ae189c329dd5cc2205ba80b5a870b2979ad449ce63a79d455bfcc6b7f7ab028c7c935a8d485f28eb13b6d71986e1", 0x86}], 0x1}, 0x4}], 0x8, 0x4000000) socket$inet(0x2, 0x3, 0xb0) recvmmsg(r1, &(0x7f00000004c0)=[{{&(0x7f00000002c0)=@ethernet={0x0, @dev}, 0x0, &(0x7f0000000480), 0x0, 0x0, 0x381}}], 0x6fdaec, 0x22, 0x0) poll(&(0x7f0000000000)=[{r1}, {r0, 0x2}, {r0}], 0x3, 0x0) 04:04:02 executing program 2: r0 = accept(0xffffffffffffffff, 0x0, &(0x7f0000000000)) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000140)={@in={{0x2, 0x4e21, @local}}, 0x0, 0x7700, 0x0, "29e95569aae5e3fa7f55fff23e57bd0a1996495cc846aefb06970a7fad107d10b34d7b17675b0d8381da448a3963e7b626e5f960df99260da69fca256ef382f9398e47a0dd72f38e05bac316488dffbb"}, 0xd8) r1 = socket$inet6(0xa, 0x3, 0x7) getsockopt$inet6_int(r1, 0x29, 0x4b, 0x0, &(0x7f0000000100)) 04:04:02 executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f00000002c0)=0x1, 0x4) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000280)=0x32, 0x4) connect$inet(r0, &(0x7f0000000000)={0x2, 0x3, @local}, 0x6) sendmmsg(r0, &(0x7f0000007fc0), 0x4000000000001a8, 0x0) 04:04:02 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:02 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:02 executing program 2: openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") fcntl$setpipe(0xffffffffffffffff, 0x407, 0xdb45aa1) capset(&(0x7f0000000100)={0x19980330}, &(0x7f0000000140)) pipe2(&(0x7f0000000000), 0x0) [ 2442.269165] binder: release 21284:21291 transaction 466 out, still active 04:04:02 executing program 2: pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) ioctl$GIO_CMAP(r0, 0x4b70, &(0x7f00000000c0)) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0x4, &(0x7f0000000100)='jlo\x00', 0xffffffffffffffff}, 0x30) write(r1, &(0x7f0000000280)="618b2d4b49d75fcb6e8175496b25ea513f5a45c9a6aafcf15fbe4ee633a7c98b48f2b66e32f472128eb1c73c5f723a349cc96b0664b98159c9ef2afab7264162bd35e31ce78f94475aa124472998d76ccd7f8e762bc4c8efd3d0c5", 0x5b) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000180)) sched_yield() bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000200)='net/dev\x00', 0xffffffffffffffff}, 0x30) r3 = syz_open_procfs(r2, &(0x7f00000001c0)='nets\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00') ioctl$UI_END_FF_ERASE(r3, 0x400c55cb, &(0x7f0000000000)={0x4, 0x7f, 0x5}) r4 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$IPT_SO_GET_INFO(r4, 0x0, 0x40, &(0x7f0000000000)={'raw\x00'}, &(0x7f0000000080)=0x54) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f000001bfc8)={0x0, 0x171, &(0x7f00000000c0)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x0, {}, [@IFLA_GROUP={0x8}, @IFLA_PROTO_DOWN={0x8, 0x4}]}, 0x30}}, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r3, &(0x7f0000000080)) [ 2442.384073] Y­4`Ò˜: Invalid MTU -256 requested, hw min 0 [ 2442.415925] Y­4`Ò˜: Invalid MTU -256 requested, hw min 0 04:04:02 executing program 2: r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/policy\x00', 0x0, 0x0) read(r0, 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x8) write$binfmt_aout(r1, &(0x7f0000000b40)={{0xcc, 0x200, 0x7, 0x17d, 0x10f, 0x6, 0x155, 0x9}, "3ebc114adc08856734da579f6920a89ae8c72144c9fc3519239c81d11515200b8631030daac7002f8f7ef8d38138d4527a5aee355e9cbe5730978d9837d1d4fd02a3e5ad537331054bf7d71f7347fb4bacbd0394681efed172bf1e655346746c66879cc265445ad6cd699c2389067351ea5e38d758bb2d82b7c140d7ac19fd29cae2952c52d94f34c53a4b24e8e5e6ea84af45a3335e0928670a8e9bc252", [[], [], [], [], [], [], [], [], []]}, 0x9be) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x4000000021fc, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f00000000c0)={0x3, 0xbc, "adb8726ec4b6bff3825e011afc39c6261ea9bd2473471f7ef8ca209ae94cd34a4e2b70928bfd15579cc4b85656759e5d1a469c34763c5b9962a87daf19233bf4d3c0e309df431ea486de6fc91e89bff79b4a5a252e78b9b119900561353a584163cf451e58c6abab0a043c3324385a661d128b71fa56df11862a4a813b420062176687df6757141da263d96446002aae04adc723ba59af8b8a7f2eae8d9480a0a56181443ccf3095d68d79c19ab5fcc3fdfae2a828900fca95b0519b"}) ioctl$KDDELIO(r2, 0x4b35, 0xfcb) [ 2442.538430] binder: BINDER_SET_CONTEXT_MGR already set [ 2442.560756] binder: 21334:21354 ioctl 40046207 0 returned -16 [ 2442.581946] binder: 21334:21338 unknown command 2097152 [ 2442.593948] binder: 21334:21338 ioctl c0306201 200002c0 returned -22 04:04:02 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000000000000033, r0, 0x0) unshare(0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480)) syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0x804) r5 = creat(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000240)={@rand_addr, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000500)={'bcsh0\x00', r6}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e) ftruncate(r5, 0x2008200) r7 = open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000680)='./bus\x00', 0x0) 04:04:02 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 04:04:02 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) setxattr$security_smack_transmute(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000200)='TRUE', 0x4, 0x2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="40000000549b23a38665ec2cb6f7d6e3a100989e012e53fa3904cf4612de9f9b0027b2cd90e39d256cd6bc1fc3f9ae22a1a187ccb7025f33500a3c0fda886a0d80e3983b3f622f786fafcbf8e2133e165ad31f901fe7ad3612e8c8fc0d239ef0244f4df2c6d130d2d4a35925a5a0ec3ed622040898d3f90fe615e6aa125a146c471e4eb6b03b88"], 0x0, 0x0, 0x0}) fcntl$dupfd(r0, 0x0, r1) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000008fd0)={0x4, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="4a6e429bbd2ff6c155ffccf1bb39642faad07c488ece46d47951d6fbfb53f0fd9d755985fa858573bd1ab55d7462bf011684829f958ea2b66160438725de8c63220e3ea720bfb25507aeec94b505a461940e07da9a09d4a4cfc15908cf59f5477dc01f2447b9553b6710e413bb01784eb393bffe9cfb953136c1b325de10ffe5ad557338d7670000000000000000"], 0x0, 0x0, 0x0}) 04:04:02 executing program 0: getsockopt$inet6_tcp_buf(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000200)=""/153, &(0x7f00000002c0)=0x99) r0 = dup(0xffffffffffffff9c) r1 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000000), 0x4) ioctl$TUNSETSTEERINGEBPF(r0, 0x800454e0, &(0x7f0000000140)=r1) readlink(0x0, &(0x7f0000000340)=""/166, 0xa6) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) clock_gettime(0xfffffffffffffff8, &(0x7f0000000100)) perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) r2 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) syz_genetlink_get_family_id$tipc(&(0x7f0000000440)='TIPC\x00') ioctl$TUNSETFILTEREBPF(r0, 0x800454e1, &(0x7f0000000300)=r1) sendmsg$TIPC_CMD_RESET_LINK_STATS(0xffffffffffffffff, 0x0, 0x90) connect$inet6(r3, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @initdev={0xfe, 0x88, [], 0x1}, 0x4}, 0x1c) recvmmsg(r3, &(0x7f0000000200), 0x38c, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e24, 0x0, @ipv4={[], [], @loopback}}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0x0) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000040), 0x4) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, 0x0, 0x0) r4 = syz_open_procfs(0x0, 0x0) getpgid(0x0) socketpair$unix(0x1, 0x0, 0x0, 0x0) setsockopt$inet_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f00000000c0), 0x4) [ 2442.604454] binder: 21334:21338 Release 1 refcount change on invalid ref 1 ret -22 04:04:02 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000000000000033, r0, 0x0) unshare(0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480)) syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0x804) r5 = creat(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000240)={@rand_addr, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000500)={'bcsh0\x00', r6}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e) ftruncate(r5, 0x2008200) r7 = open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000680)='./bus\x00', 0x0) [ 2442.658876] binder: 21365:21369 ioctl c018620b 0 returned -14 04:04:03 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2443.131920] binder: release 21334:21338 transaction 469 out, still active 04:04:03 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2443.398577] binder: BINDER_SET_CONTEXT_MGR already set 04:04:03 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000000000000033, r0, 0x0) unshare(0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480)) syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0x804) r5 = creat(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000240)={@rand_addr, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000500)={'bcsh0\x00', r6}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e) ftruncate(r5, 0x2008200) r7 = open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000680)='./bus\x00', 0x0) [ 2443.421996] binder: 21391:21398 ioctl 40046207 0 returned -16 [ 2443.455798] binder: 21391:21398 unknown command 2097152 04:04:03 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 2443.481745] binder: 21391:21398 ioctl c0306201 200002c0 returned -22 [ 2443.501114] binder: 21391:21402 Release 1 refcount change on invalid ref 1 ret -22 [ 2443.526013] binder: 21407:21409 ioctl c018620b 0 returned -14 04:04:03 executing program 0: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.stat\x00', 0x26e1, 0x0) ioctl$EXT4_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000001c0)=0x3c) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x40042409, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r2, 0x801c581f, 0x712000) 04:04:03 executing program 0: clone(0xb1dfffd, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) lsetxattr$security_ima(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='security.ima\x00', &(0x7f0000000080)=@sha1={0x1, "e0b2607982fdd859136c1826bd143abf7bb49774"}, 0x15, 0x1) 04:04:03 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000040)={0x7f, @multicast2, 0x4e24, 0x1, 'sh\x00', 0x8, 0x46b, 0x7f}, 0x2c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:03 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000000000000033, r0, 0x0) unshare(0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480)) syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0x804) r5 = creat(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000240)={@rand_addr, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000500)={'bcsh0\x00', r6}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e) ftruncate(r5, 0x2008200) r7 = open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000680)='./bus\x00', 0x0) 04:04:03 executing program 4: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000000000000033, r0, 0x0) unshare(0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480)) syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0x804) r5 = creat(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000240)={@rand_addr, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000500)={'bcsh0\x00', r6}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e) ftruncate(r5, 0x2008200) r7 = open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000680)='./bus\x00', 0x0) 04:04:03 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000040)={0x7f, @multicast2, 0x4e24, 0x1, 'sh\x00', 0x8, 0x46b, 0x7f}, 0x2c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:03 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000040)={0x7f, @multicast2, 0x4e24, 0x1, 'sh\x00', 0x8, 0x46b, 0x7f}, 0x2c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:04 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000040)={0x7f, @multicast2, 0x4e24, 0x1, 'sh\x00', 0x8, 0x46b, 0x7f}, 0x2c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:04 executing program 3: r0 = socket$inet6(0xa, 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:04 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x0) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:04 executing program 2: r0 = syz_open_procfs(0x0, &(0x7f0000000040)='fd\x00') recvmmsg(0xffffffffffffffff, &(0x7f0000003840)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x10001, 0x1}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlock(&(0x7f00005b8000/0x3000)=nil, 0x3000) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080)='/dev/uinput\x00', 0x2, 0x0) mmap(&(0x7f000060b000/0x1000)=nil, 0x1000, 0x5, 0x8000000000000033, r0, 0x0) unshare(0x0) r1 = getpid() sched_setscheduler(r1, 0x5, &(0x7f00000000c0)) open$dir(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f00000004c0), 0x2}, 0x0, 0x0, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000340)='memory.current\x00', 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8914, &(0x7f0000000300)='lo\x00\x96o\xd6Q\xb9Y\xa9\xc8J,\x00\xd2\x97\x04\x03\xdc\r') close(r2) ioctl$PERF_EVENT_IOC_SET_FILTER(r4, 0x8923, &(0x7f00000008c0)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\xfc\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xf4\b\x1a~\x91V1s\xe9\xbe\x9e\x9b\'\xcde\xb3\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1cO\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xf24\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ') socketpair(0x2, 0x2000000080003, 0x100, &(0x7f0000000480)) syz_genetlink_get_family_id$SEG6(&(0x7f00000003c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000440)={&(0x7f00000005c0)=ANY=[]}, 0x1, 0x0, 0x0, 0x8000}, 0x804) r5 = creat(&(0x7f0000000200)='./file0\x00', 0x0) getsockopt$inet6_mreq(r5, 0x29, 0x15, &(0x7f0000000240)={@rand_addr, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000500)={'bcsh0\x00', r6}) arch_prctl$ARCH_MAP_VDSO_32(0x2002, 0x7e) ftruncate(r5, 0x2008200) r7 = open(&(0x7f0000000140)='./bus\x00', 0x4000, 0x0) sendfile(r5, r7, &(0x7f0000d83ff8), 0x8000fffffffe) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp, 0x0, 0x0, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) creat(&(0x7f0000000680)='./bus\x00', 0x0) [ 2444.008421] binder: release 21391:21398 transaction 472 out, still active [ 2444.093304] binder: BINDER_SET_CONTEXT_MGR already set [ 2444.099158] binder: 21451:21463 ioctl 40046207 0 returned -16 [ 2444.107942] binder: 21451:21463 unknown command 2097152 [ 2444.114033] binder: 21451:21463 ioctl c0306201 200002c0 returned -22 [ 2444.121787] binder: 21451:21463 Release 1 refcount change on invalid ref 1 ret -22 04:04:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 04:04:04 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000040)={0x7f, @multicast2, 0x4e24, 0x1, 'sh\x00', 0x8, 0x46b, 0x7f}, 0x2c) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:04 executing program 4: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rtc0\x00', 0x0, 0x0) setxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.capability\x00', &(0x7f0000000100)=@v2={0x2000000, [{0x0, 0xf08}, {0x7fff, 0x1000}]}, 0x14, 0x2) read(r0, &(0x7f0000000000)=""/64, 0x40) ioctl$RTC_IRQP_SET(r0, 0x4008700c, 0x12c2) r1 = getpid() r2 = gettid() setpgid(r1, r2) 04:04:04 executing program 2: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) openat$urandom(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/urandom\x00', 0x20000, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000000)={0x2, 0x0, @remote}, 0x10) r2 = socket(0xa, 0x1, 0x0) clone(0x0, &(0x7f0000000300)="0532b0b4b38cfbe54fe2b81963a8f89a2551261d81886fd1b5b44f0f55a2b35d9e1c5ee687c703923dd63e3bb54f8e9b7ffde5015902fee7ccf3016b8e2b267f55605a25643ecbcd58015c932a44f92e1a48666dff22314bede4376a9734", &(0x7f0000000380), &(0x7f00000003c0), &(0x7f0000000400)="f3b78db41710b4678e733795fbab830183f55f2c09c6e2615dffddbd0bf5ace1a79ad331eb3debca39a6ca733a187cb65ddae8df2dd1997e27f4116fe062dce1b6") setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000040)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$sock_int(r1, 0x1, 0xa, &(0x7f0000000100), 0x4) setxattr$trusted_overlay_origin(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='trusted.overlay.origin\x00', &(0x7f00000002c0)='y\x00', 0x2, 0x1) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$VT_SETMODE(r3, 0x5602, &(0x7f0000000180)={0xfffffffffffffffc, 0xb9, 0x44e, 0x80000001, 0x2}) write$P9_RLCREATE(r3, &(0x7f0000000200)={0x18, 0xf, 0x2, {{0x4, 0x2, 0x6}, 0x80000001}}, 0x18) ioctl$KDSKBMETA(r1, 0x4b63, &(0x7f0000000480)=0x4) 04:04:04 executing program 4: perf_event_open(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x4a7, 0x0) clone(0x500, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) keyctl$set_reqkey_keyring(0xe, 0x3) keyctl$join(0x1, 0x0) request_key(&(0x7f0000000000)='user\x00', &(0x7f0000000080)={'syz'}, &(0x7f00000000c0)='\xd1?\xf3\xd7v', 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) 04:04:04 executing program 4: socket$unix(0x1, 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f00000003c0)=0x0) ptrace$getregs(0xffffffffffffffff, r0, 0x8000, &(0x7f0000000740)=""/90) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f0000000000)=0x200, 0x4) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) clone(0x802122001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000d80)='/proc/self/net/pfkey\x00', 0x0, 0x0) ioctl$VT_GETSTATE(r3, 0x5603, &(0x7f0000000d40)={0x7, 0x8, 0x8000000000008}) r4 = fcntl$dupfd(r2, 0x0, 0xffffffffffffffff) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000440)={0xffffffffffffffff, r4, 0x0, 0x1, &(0x7f0000000140)='\x00', 0xffffffffffffffff}, 0x30) r5 = syz_genetlink_get_family_id$nbd(&(0x7f0000000840)='nbd\x00') sendmsg$NBD_CMD_STATUS(r4, &(0x7f0000000a80)={&(0x7f0000000800)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000880)={&(0x7f0000000a00)={0x4c, r5, 0x2a, 0x70bd28, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x14, 0x7, [{0x8, 0x1, r4}, {0x8, 0x1, r3}]}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x80000001}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x5}, @NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x3ff}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4000}, 0x8000) getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, &(0x7f0000000400)={'TPROXY\x00'}, &(0x7f00000007c0)=0x1e) getsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000580)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@empty}, 0x0, @in6=@loopback}}, &(0x7f0000000680)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r4, 0x0, 0x10, &(0x7f0000000900)={{{@in=@loopback, @in=@multicast1, 0x4e21, 0xfffffffffffffff8, 0x4e24, 0x0, 0x2, 0x20, 0x20, 0x3c, r6, r7}, {0x1, 0x4, 0x100000000, 0x800, 0x8bb2, 0x9, 0x3, 0x3}, {0x800, 0x7f, 0xfffffffffffff73b, 0x9}, 0x1, 0x6e6bb0, 0x2, 0x1, 0x1, 0x3}, {{@in6=@rand_addr="35e2b69ded1bbb4d43244f77fd8ac22f", 0x4d5, 0xff}, 0x2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x7, 0x3, 0x3, 0x1, 0x6, 0x5}}, 0xe8) ioctl$FS_IOC_MEASURE_VERITY(r1, 0xc0046686, &(0x7f0000002340)=ANY=[@ANYBLOB="010000102b316104cd39a3e9c6007c05381f50f7c3d2d3da7ff763f79ffe2ae9bab382a561b8b5f872b68c2ccc8e9b472e3fb0bd3f6ab9052815ccedb21126275089dafc50741400429a97b900c53db5f08408188cb8ba43e535b3114b8027e47a43ae9bde2e39a8a5b12475e53534c3012493a5f6e03d43a12c9db2174f7327d71bd6770246ea8ba07b2215a25c643c1636884de7019768f23dfb33db19b5796b7d4053fa6c82eba27f5f48f7f63bc7940cea0cb33b56a92a7f1911266e1e976acaa4f9ecaea3093d4ba4f08d5509c3a8bb0a6528c9d9a8b1aa2e99388509836f1b0ab38e4f3c326518cbae9ff3289d2b81c9de0f63ca2c80f349bdb80bb5bbc2e8208cc83fdf94519fb333a18c6d45f3f14234b4f0da114252449c8728aa3d5385a52722e46cba95648675245042f53313254fd55dd24351b82b67dc6ef058011afc196c8151fac295473334f7ed286cd7e2147a0797fb3d0ba65de4055ebdde21972fc64c4065abaf82314b24f77a224f3b509bc3fba9ff3722000127813a86951a236ef5c8abfd4c25c5ed33a9feb7b6f781c34d103eb707c5e137c6dfa35d726759951e76a886a8126b09bf5f20a393786a33b248d029d1d2643747c0ae8f2f718453f0de3535e9e5393f877804a83398b51182117121e942c1ef462009ccda9ecbfbcef67766b1a72cfe77bea0a4072792b33fb4f2eeb2d088046bd397940cc8a9af877e2e0603b8ce72bf06e123fcf72b41ae4e7bc802dfbfb2b3c92de6793a9c3187377f6ff9a4aae82adf35dbeb2c528ccaaa21d273a29a6830b9cc0c0473f3c91e627b966d4edc4db050e86fc6bee4ff346584edb6b0cb5ed07e153c226e0e45dc0b6535e0f56d5e610a96dd2e195b019926c05d0fa62230750db22da5f49d0850bc6d608b64ee8e9c6fb07a37525a8d28faf0c1c93ad7d7135afa8892b247f5d74d52d94ec0c5a6757cd028668bf4114f625cde39ba5eec30a4da63512f57996d5bed824d47b8996c0bc2d223d5686591337f62d29cfc89b3ae50207faa9bfbfc0eb2ed44fee51e5483373f552785cc9337e8b462e58246b4f1291ee55a21fe362a56714efac87e403368a37f197ce40630a8ae1f15de3d915770abc8f6e4d9e5b78cc76cf36d14bb7672e8f1df62650a2fe82a9d92dd30f2ae4e51e59fbaa2c9fd10399e22428e90cde44dd5e38257944be36ee02a07e8036c13d190528724dec9b623a0ea5258cc1672067f5723fe20ee4db77a7d7c95089e5e1c83563b3f6d54bc24e484cb72726b40c653f4c9fadb940d258cf3415d7ff570ca7751bedcdf22bd8609fd6ecfc43bc7d16aa72d4f8dd38a5e7faca5cb05335bf2c095514152b50d0b606b0583e4abc7299fa2cb1a94165a25a44e48df1ba79157ed46445d2d3d30cc8798892f32b2660617006ee80c3bc6b9b22535acfef8e1aaa7aebca4433bbd91c7cdee42a5d494bd964f8dd44606542844b2320f3feec29815036d6cc23b659193595465b69500a3447d0866eb56d9750a2ee3b335c4434c86bddb315c82969ad1ca9155ee935356787753fa56bbebc20a2626ad612862f1157e9209d5c352e626ae9cc7eee48f0fc8bb9435725a92b9035f9c0522f9fceb401b88aa36a05d465c2466a7743d7a4948d5e206ea8f272fc77fecfb2c3f77453947bee85c562a7a746840f2ad686437895b50f341640f7437d45b3f4dd978ea4079ec095af2096b53ec0a07d69b10890b1b97eb6812131db2839b7b9196d96c1d3cab1cd60176e68a93dde54ecb21c9aa48d46c581efefa075f6f9c8a2d3af8b95ff546365f15147a78cbab29ce2047369cc00c069f19f64b26ba1fe67f37e6edede8fa2f3489a26ffd4b9f1b02c1e56e7d68fea0429e372d8fe2071406b67f4edf7905759d431d73f04c38366c0498730c896e684536f97f5411454618b138b09a768925ad2d39bdd2a566e1cacce10a9263993a7d7272fb04ec2e1f5e905805ac9579edfe21ffac7074577c94e1eecaa38193da1fcbfbd93a545855c38f60e90377ab03fbc9c551090d7cc9108c4c29bb9f53333fc50ba57c51445fc039f48910802ebdf787b05f892c2755bfe0f74163770df8a8aa84e9d08113a634b893df475b04402437f7a17df60ee6d25c2d61e73786b0e42702d9cbf15cdabf96991a6924b48e16a407f8752f33d852fea59fe7ae821ac1bd94c12044d0df84c0e1dc87dd12c214ab7a6251aa9ecbada9d788b8087c1189592ef0b7dc6746ac5aaf2cb2db953bd00f26cfb7bf15ba7a0dce7fbcc886403b57f642a99c4b301816ab4730b0cdaa25d6fec76e97b71adad648883e6ebd907ad572ecf0e2e555a362e1e477ff26d4a00e05cb506aa2c41f02d5d60d1380d0c6742c2e9024a91cc0e168aba6d5de1571b99cc66b9043eba91907d73cfece67efbed3ec78b76ea52b02a2cbbcc574178626ebba42443f28efd002b01d45f28850b08b10fb8f4f2152ab2113ca0daeae55ef07a84f78f651207d0069c24d46946854ff768d79234d5e17957520d093dddb5f9b6b19be9ec43ef71ff56a5d65189e8adcdc53b57c0d513c3e1e8cf10975242d1180cc271a6cf00eccfd74734525d5315dfefecd3b34a41ac61433d4df7e886fe3c2cd9d2b32687504f7011f33b43acb16853f534a42f473c72d7503ffe55650d16f0e55c519515f4c48073cb76cc31c2225818d7e3752c0c33571399ef1191c446f388ffde71689d05f4c769f6973d83c95ad577ea97a9f51b44f13881e14e3e71c7bc85b152059557435143d234c6a39f1d8b1d65c9de1caa14ec5237b95297ca691df9839710d0c342f55fff289f821f0a670639eb947d5af459733f1aa505dfb84530be3024176c5945ee7cd7950c942fda8ceb9e0806604e06e51415d2ea608840a4334daaa4151147303d3a2e60418bd5e1d5ffe33802f75991a5da04ee965097b0b3ced487ea1969ae9b220a816e202dfcd4e2584ee135878b46a5dcdd2dbf40cb40d91d27cae4bba85c3a58b49afb32a77ebc801906d1cb5ae495941c38cb4722c9c419913aedcf71dc0a2ea11f2b3df344ada323cd4251affcb173e7f74cf1f582be029497c3eee4a284a480cfc4c9fd6aa42c6b5833ae2b2707899a8f354c311f8b7491e0e7dd553c4750a2690b8c6f9732ccca0852502be63f94b31a7888fcbb132e56a08100b559d5107156c8876343c9b53f18433542aa0018ec3715a483583a18e1de3c2c667f965d67eed1f2d70ccc56bec1c9a72745886161734d2419477d3e758a302aed640ff311a1fc0f3af6f367c76fd16888b89f98ea0475cfc870c2f00e49e7568226b0d2b5ee5f5589c5ee80e5b49af44483ea12851655af830edcc25edb0619e0d1dbf5c446055175a122527479c7edf97602341f7636d52efb6e2e8f6facb82cd4cd4351d174131807ed97fb79f9fe66d41edb46bdd19ce4b2458a72fb0486b40d4fc743c7d410a54fd46a73d7c501d6cd2982e0ada9978d13e2046beb7a26e96ec3b8e1ee7479f05066c7e7694117cbaaa14477a34e57ee04ad27914a8c2dc6e82801c70b23406c71d72f61bdb41aefc6eba96774dfc855d4bc56cb23efbd2bf9d783d2471c9d8f1af22f2436df64be47bdd4df3f9b57a4390251ae02231d896c1c3bf07efe5a99d31599d88a668262a6b6a7bd8abfe582c217c43b0a552167a14821b7f46b7bf9a405305af2a36a859ccbb6b27e238013c9f9f5ed3f0a89611c18f6a6a4e0e28b2106d332ace1fb2e06b4b6565c86a984c34bc66785b1082b23a47275ab4c18bb1edea63176b93e5df6e9bbe9b27934d6d6dc657214d3a88988de904966ebce61c70a946ba8829fdd59ea1ce50318af518e5d0c2568836d5e1125ee1debd0511649a3fb0b4da6c51b8ef2eff1bd35a743b469f7f2d538c2e3d5d94253a2e131ac8ba7d0f4e3ac3c1a886c1ff9040d28d32a846bb7259c98cd747b6c692c3edd22fa0117befed20ad43383620317934dbd1a8f94100c0424a0f5a8604ddabc0aeed705dc59f0525f03c8f0df566907fb05ad016c3a598b1bdc47c7380e860213294c7746ec7e3fc7cb67ba3458cd98fed433bcf70e972f09da2bfa339584610a8cd010a8c7b6e631cef98d8a69e3d8fa2a085f7c5d62d7df5f3df9c658525bb1a0882b033638fe49b0cacc9e76fb6b04897e1eece028cd4b550ed99f9a3907f2fab567b21a1d09282c739b53b6af166edd4e99696f71c27361a94fbe52fa549e4083d0d175fd467ce36045455444b10f4c7468236aa7f5d3a9d8d254c175d04daf214c6571fcc39f9702b12000353fc5f3f2161adbf97a50396a4fbfe7cd24b268b79508438c377355f7075c1a12c3cbf104fe6cf32925bb79a7fc7550878183ae13d2770d5113dfdf423a20039c32aa0f9c0e9726e62e29473bcac7da79b9746cdcdc6319fe747ad2c7e12ebcde4e67f7e593326acc3b6bb1a2fb9c8b755b2819d652e12dde0bdd519800c96330ec15439f21beaafac46f9deb358df9584e62cd3f922806c3e53a7615e5b7511837de73c84c561d9b6a65eb08ec7482e27764b89eae79ef838352d820c58c0dcdc91bbcf4bb44f124967a34456a42089781a19fd421cc16416cf07a165fa60ae9a3e9519c5a385736f561a097d2cae0906d6c2e2b1aa9aa23d653da8384bc073aaaa7248b96ce8a55955d2875a2fa96ec03a19d0e8671c35e9947aa237734b2f06c8630b5b3ca60d6f995848bd51537ea63da05a50009baa9fe314a7c97ee22862ed538181bd54c362407a08000000000000005a76cf38ac31238b1a34bc3dbe7929caef1488398b68731ef4e345a4afbbb7161f90d52314cd70f9f45050ea41eb31842a96a72ed3202bcc309f84ea42f3bdafc497b8bbf0d49c8289eba8bf70143441fdeabdc8181dfb1823d5de43d533b612afb0f28d45d5335dda54d45422be14b987585bd110e9d5d7ed2545b107ed855fbcd9d830bd7566573c1cfc435d191aba9ef508f2eee10cc3e73ecb7f8669b44618caf80715570b63c6d3659b65ba4e6ea3d180ac2776f3b62a4232ef51f2da56c8c4da0db938dc1c0c3c95999ad4ad0e02677e5f385d20ae0f9d1da3f079ebd0a119739b7b743dcf5d9c12969f8f9b04e7dd86aa1b07d980a1cc16963f2c3ddf6848d9dc21fd5bb0a56d894c302cad1d14bc238fcf5235b92f1532390f09a0b4433f98c0fc029ed38e6aa4e7d1eb7ac766065f07b56f840b78bba55863592612c251067d3f101e20efd3a0beae6d93b66fae0a261dd3680f3f3569505a075b020ec31b5cb05fcb289736c0ac27bcb2346ce3d79f50fb914d8c941c8ba9d53fb11fb56b39b1cebeef58fabc78bfc941bf51d8c487dd046e450b94fc92c74446eeb4c175743141896e2142b3dc030450f0cadd2bd1bdbbb6bbf18e1b94c2db05d8588b6f79e55ca475c283030fcbe2aea9a27d13ed5721db2073b05d1f11b5eeaa511f28e3750864c1140afdcc3d2e0f0595459ee60ad28f474d894b1c9c76517db6917728e8814482b9ec8d8940ea9f8598d4307f3576cfe20ad417f70c6b457d067cd8597863cdd7f1a3606240d76cac0f7fe5a52f955be790e0be238d0e8bd41866a20aa698832cd5f79ecdbb50aca7947fa6c9df808b79a939b0d00b8c60ed2c3fe6b657405e8344fb7227ca84d24a1797fca7c5237ec00bdcdb6f67dfd2d2c44106eb6cc1f5859edc7e5d77db596947c6e43e59dd9aef8edce5fe6b7c7806570a94b55c7a87f730b3536da7fc8643d871898d912d5aad43ff85890fb91600a1bd6a71a6f118914347028bd5d10284ac3a02bcff7e1a244d14cd42584df0ed8eb4bb8d8886e33f04fc5f0a70f4d126e43647e68bdcc33de55d61390b9332068c7dbf7f67ba64cb670d6851191b5a26e772db8380eb313d5264692533aab5b241cfbf13d403a6c90429c7f8"]) getresgid(&(0x7f00000006c0), &(0x7f0000000700), &(0x7f0000000280)) write$binfmt_elf64(r3, &(0x7f00000001c0)=ANY=[], 0x35c) setxattr$trusted_overlay_upper(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='trusted.overlay.upper\x00', &(0x7f00000004c0)={0x0, 0xfb, 0x93, 0x4, 0xfffffffffffffe00, "82a66b4a380ab8993eabc59492297736", "e447dba2462a38e2b031fc93dd3f6d87d564fb21eece515d3901207fbcf6f9aea97d5338d92707cf579be1fe54d30f51f44b430a5e265ace3030ba282827549a3bb0b747d0be91f07c156e97223cd62f7196b4b1668586938a96ee3a5ca1e3a1ff164fc95bbc6ab0fb4b982b451ab5f0332e896364c043c829492c4f2dd7"}, 0x93, 0x1) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000400), 0x0) bind$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f00000008c0)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000100), 0x4) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000040)=@nfc, 0xf012, &(0x7f0000000180)=[{&(0x7f0000003ac0)=""/4096, 0xdc00}], 0x1, &(0x7f0000000200)=""/20, 0x23a}, 0x100) getsockopt$ARPT_SO_GET_INFO(r4, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00'}, &(0x7f00000001c0)=0x44) write$binfmt_elf64(r1, &(0x7f0000002300)=ANY=[@ANYRES64], 0x1000001bd) 04:04:04 executing program 2: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) fstat(r1, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl(0x2, &(0x7f0000000040)='./file0\x00', r2, &(0x7f0000000080)="f21df61615807e8497a57bad1050975aeaae24ae61e16817bf6c0a7c59e99954e470b5c75e08") ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r3 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2, 0x4032, 0xffffffffffffffff, 0x0) getsockopt$packet_int(r3, 0x107, 0xa, &(0x7f00000000c0), &(0x7f00000041c0)=0x4) [ 2444.347256] binder: 21470:21476 ioctl c018620b 0 returned -14 04:04:04 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) socket$inet_udplite(0x2, 0x2, 0x88) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:04 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2444.416856] binder: 21470:21492 got transaction with invalid offset (0, min 0 max 0) or object. [ 2444.428672] binder: 21470:21492 transaction failed 29201/-22, size 0-8 line 3348 04:04:04 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:05 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x0) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:05 executing program 0: socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2444.826051] binder: release 21451:21463 transaction 475 out, still active [ 2444.909619] binder: BINDER_SET_CONTEXT_MGR already set [ 2444.915698] binder: 21504:21510 ioctl 40046207 0 returned -16 [ 2444.926497] binder: 21504:21510 unknown command 2097152 [ 2444.936144] binder: 21504:21510 ioctl c0306201 200002c0 returned -22 [ 2444.943420] binder: 21504:21510 Release 1 refcount change on invalid ref 1 ret -22 04:04:05 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x200, 0x0) epoll_wait(r0, &(0x7f00000004c0)=[{}, {}, {}], 0x3, 0x0) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x0, &(0x7f00002d6000/0x1000)=nil) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e20, 0x3, @remote, 0x9}, {0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x0, [0x0, 0x582b, 0xfffffffffffffffa, 0x4, 0x6, 0x0, 0x7]}, 0x5c) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f00000000c0)={0x1, 0x7, 0xfffffffffffffe01}) preadv(r1, &(0x7f0000001400), 0x0, 0x0) r2 = syz_open_dev$loop(0x0, 0x0, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0xd0, r3, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffffffffff8001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5378}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr="55997aaadd2e99adb1547d2e64fc50d8"}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xf3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x401}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffffff7}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x28}}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0xd0}}, 0x40) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = creat(0x0, 0x0) prlimit64(0x0, 0x0, 0x0, 0x0) creat(0x0, 0x80) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) fallocate(r2, 0x0, 0x6, 0x0) getresuid(0x0, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000180)=0x0) sched_setattr(r5, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) unshare(0x40000000) 04:04:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 04:04:05 executing program 0: socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:05 executing program 0: socket$packet(0x11, 0x3, 0x300) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2445.145904] binder: undelivered TRANSACTION_ERROR: 29201 [ 2445.165726] binder: 21517:21519 ioctl c018620b 0 returned -14 04:04:05 executing program 4: getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0xc) setreuid(r0, 0xee01) r1 = fcntl$dupfd(0xffffffffffffff9c, 0x406, 0xffffffffffffff9c) syz_open_pts(r1, 0x40200) ioctl$EVIOCGABS3F(r1, 0x8018457f, &(0x7f0000000140)=""/225) ioctl$KDGKBTYPE(r1, 0x4b33, &(0x7f0000000100)) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_type(r2, &(0x7f00000000c0)='cgroup.type\x00', 0x2, 0x0) 04:04:05 executing program 4: mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f00000b8000/0x4000)=nil, 0x4000, 0xa) 04:04:05 executing program 0: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:05 executing program 4: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, 0x0}, &(0x7f0000cab000)=0x7) r3 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r3, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") setresgid(0x0, 0x0, r2) setresuid(0x0, r1, 0x0) ioctl$FS_IOC_GETFSLABEL(r3, 0x81009431, &(0x7f0000000080)) ioctl$sock_inet_SIOCGIFADDR(r3, 0x8915, &(0x7f0000000000)={'bridge0\x00', {0x2, 0x4e20, @empty}}) setresgid(r2, r2, 0x0) [ 2445.223399] binder: 21517:21528 got transaction with invalid offset (0, min 0 max 0) or object. [ 2445.233495] binder: 21517:21528 transaction failed 29201/-22, size 0-8 line 3348 04:04:05 executing program 0: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:05 executing program 4: openat$selinux_avc_cache_threshold(0xffffffffffffff9c, 0x0, 0x2, 0x0) poll(0x0, 0x0, 0x0) r0 = epoll_create(0x143) r1 = epoll_create(0x10004) r2 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, &(0x7f00000000c0)) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000140)) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000000)) socket$inet6(0xa, 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ptmx\x00', 0x80000, 0x0) 04:04:05 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x0) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:05 executing program 0: setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:05 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x200, 0x0) epoll_wait(r0, &(0x7f00000004c0)=[{}, {}, {}], 0x3, 0x0) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x0, &(0x7f00002d6000/0x1000)=nil) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e20, 0x3, @remote, 0x9}, {0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x0, [0x0, 0x582b, 0xfffffffffffffffa, 0x4, 0x6, 0x0, 0x7]}, 0x5c) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f00000000c0)={0x1, 0x7, 0xfffffffffffffe01}) preadv(r1, &(0x7f0000001400), 0x0, 0x0) r2 = syz_open_dev$loop(0x0, 0x0, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0xd0, r3, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffffffffff8001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5378}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr="55997aaadd2e99adb1547d2e64fc50d8"}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xf3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x401}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffffff7}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x28}}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0xd0}}, 0x40) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = creat(0x0, 0x0) prlimit64(0x0, 0x0, 0x0, 0x0) creat(0x0, 0x80) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) fallocate(r2, 0x0, 0x6, 0x0) getresuid(0x0, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000180)=0x0) sched_setattr(r5, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) unshare(0x40000000) [ 2445.649972] binder: release 21504:21510 transaction 479 out, still active 04:04:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 04:04:06 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:06 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001300)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0xfffffffffffffffe, 0xe) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f00000002c0)={'nat\x00', 0x0, 0x4, 0xc9, [], 0x7, &(0x7f0000000140)=[{}, {}, {}, {}, {}, {}, {}], &(0x7f00000001c0)=""/201}, &(0x7f00000000c0)=0x78) fstatfs(r0, &(0x7f0000000340)=""/152) r3 = socket(0x8, 0x8000806, 0xfffffffffffffff7) sendmsg$nl_route_sched(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=@deltaction={0x30, 0x31, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x1c, 0x1, [{0x18, 0x1, @TCA_ACT_KIND={0x10, 0x1, 'connmark\x00'}}]}]}, 0x30}}, 0x0) 04:04:06 executing program 0: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2445.970170] binder: undelivered TRANSACTION_ERROR: 29201 04:04:06 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) prctl$PR_SVE_SET_VL(0x32, 0x249a3) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffff9c, 0x0, 0xa, &(0x7f00000001c0)='/dev/ptmx\x00'}, 0x30) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x400, 0x0) dup3(r0, r0, 0x80000) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ptmx\x00', 0x3d, 0x0) write$binfmt_aout(r2, &(0x7f00000000c0)=ANY=[], 0xff2e) ioctl$TCSETS(r2, 0x40045431, &(0x7f0000000040)) ioctl$TIOCLINUX3(r2, 0x541c, &(0x7f0000000080)) ioctl$TIOCGETD(r2, 0x5424, &(0x7f00000002c0)) r3 = syz_open_pts(r2, 0x0) ioctl$TIOCSLCKTRMIOS(r3, 0x5457, &(0x7f0000000200)) ioctl$FS_IOC_MEASURE_VERITY(r2, 0xc0046686, &(0x7f00000000c0)={0x1, 0xbc, "6143831ca8380997d98f5f1e0494f90857a9793d3776c7fa9519f1bc7d7ac4d2f510c1ff7f97593417fd2aa9889b0c8fe406ad4c0b72c2f678b3af67c3a92472b990bc93261cacebe6259e041637d4d800ba9af417b2b191f2299d1eae7c3b529a4cd6fdcba0d23efe4034d5031baba8ff9dea771a8922975e9125a87a97733f149d02c185a6672d6256dd8767757b1011d806dca03d957a32195a3e6cf77ad8a9da1f6c7c904fb3f2461d0d8d4a41dc6630e3e425b6abf2efea05fe"}) 04:04:06 executing program 0: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:06 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x14e, &(0x7f00000001c0)={&(0x7f00000000c0)=@getrule={0x14, 0x22, 0x401}, 0x24d}}, 0x0) sendmsg$nl_xfrm(r1, &(0x7f0000000080)={0x0, 0xffffffffffffffe3, &(0x7f0000000180)={&(0x7f0000000040)=@delsa={0x3c, 0x11, 0x101, 0x0, 0x0, {@in=@multicast1, 0x0, 0xa}, [@srcaddr={0x14}]}, 0x3c}, 0x8}, 0x0) dup(0xffffffffffffffff) mkdir(0x0, 0x0) syz_mount_image$ext4(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) ustat(0x3d, &(0x7f0000000000)) r2 = accept$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x0, @initdev}, &(0x7f0000000080)=0x10) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000000200)={'broute\x00', 0x0, 0x3, 0xc1, [], 0x1, &(0x7f00000000c0)=[{}], &(0x7f0000000100)=""/193}, &(0x7f0000000280)=0x78) [ 2446.017167] binder: 21568:21572 ioctl c018620b 0 returned -14 04:04:06 executing program 0: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2446.083372] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2446.097669] binder: 21568:21584 got transaction with invalid offset (0, min 0 max 0) or object. [ 2446.105873] netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. [ 2446.119910] binder: 21568:21584 transaction failed 29201/-22, size 0-8 line 3348 04:04:06 executing program 4: r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000880)='/selinux/checkreqprot\x00', 0x400000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000900)={{{@in, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@empty}}, &(0x7f0000000a00)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000a40)={{{@in6=@loopback, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@empty}}, &(0x7f0000000b40)=0xe8) sendmsg$nl_xfrm(r0, &(0x7f0000000e00)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x4409240}, 0xc, &(0x7f0000000dc0)={&(0x7f0000000b80)=@expire={0x218, 0x18, 0x200, 0x70bd2c, 0x25dfdbff, {{{@in=@broadcast, @in=@multicast2, 0x4e24, 0x0, 0x4e23, 0x200, 0xa, 0x0, 0x80, 0x89, r1, r2}, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4d2, 0xff}, @in=@multicast2, {0x8, 0xffff, 0xfffffffffffffbfd, 0xfffffffffffffffa, 0x42c2, 0xfffffffffffffff9, 0x368, 0x101}, {0x27caa953, 0xf409, 0x2, 0x1da0}, {0x5, 0x8882, 0x8}, 0x70bd2d, 0x0, 0xa, 0x5, 0x200, 0x2c}, 0x80000000}, [@algo_auth_trunc={0xfc, 0x14, {{'sha3-512-generic\x00'}, 0x568, 0x0, "f24292f2828a6ea476479fdde2a5b58b79ec20e5f8497e37a4a1aa87bad62162715d39a19e6903890f9255fae7418f28c24a351292fdb318b4d957132fa1dd521ae92c334b74dd7ac3f3f0bdb4d843d76b0e8d7b17e6a1fa62ee129795521e5a91d4fceb3436870f1d5ab6814d126aeb8886e2d1cb7f1dcf26ebee4ae61648f0df03176f3c6328da3cac568168f7ee1a92beb7f99e614f5eb1ec1af2378fd5b2ed698c026c08f63d0f64bcb954"}}, @srcaddr={0x14, 0xd, @in6=@remote}, @output_mark={0x8, 0x1d, 0x4}, @tfcpad={0x8, 0x16, 0x8000}]}, 0x218}}, 0x81) io_setup(0xe3d, &(0x7f0000000e40)=0x0) io_cancel(r3, &(0x7f0000000f40)={0x0, 0x0, 0x0, 0x5, 0x6, r0, &(0x7f0000000e80)="08a86b2d119a43626b66191a8eab91ad2729150fef1bf24452e59294b229b5c5d8c48e8887c42a386ccb73b865749a2111fd02c4923b1da4b68d6d96ae8d27b4ac9825cbe47073c2a7ea6f869f6950180337cab1eda53b15b24e9758b34ebd7b552f42dcda1b3fa9a8c983491f435ec57ca00962565da2506d72aa9faa98f9aebb3d742dd7a71fbe9ff4f4ddebbca4eadbf720c71f679bb548a409c92c929c16e999efd9b3c0074d4df85ca4985dcc211dd25c89448e612f55ef6a29c7778090", 0xc0, 0x7, 0x0, 0x0, r0}, &(0x7f0000000f80)) writev(r0, &(0x7f0000001140)=[{&(0x7f0000000fc0)="92acbd65bd43c46e7bd80444d20ee07cabc9c1cf232485b10183d1cd3263062fa801770955593577923bfb1dc09305d5f63d5fb8124dcf67a1016222b4d3312a2a902282783b60544ff55ac555f4995e5ea81161a7f388f920a605a583c4ac", 0x5f}, {&(0x7f0000001040)="66f02e6e66671a1a3865f852e9604bb57dee271b7cbede10decaf75ae64a228b216197252a642193020cd9eaddc0d3400d396f88292ecd4beb8b0422ed9ceb5b76ccaab2023bc43fe744fb122ec959929097f41631535ce8fce8aec8812ffc2d957c54bf2dfa6d4d1aaf61f6c47892da1b5b2945b4cac2f10309559e5967372590f00c3a47e510c3193d1cd2399b647ce641ae197af24c92dc662ef8a74ad28635faf4b5f461542fa59382a894a2e6757d88e4db12eb5a6a22ea5b1bffbf80c339fd324cffc15e58053ac4217e99ed60fb166aa5b8e763ac2e32ad9545f23f8240ccc1088bdecc5ebab74398627017e07763a4f1", 0xf4}], 0x2) ioctl$RTC_WKALM_RD(r0, 0x80287010, &(0x7f0000001180)) r4 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000011c0)='/dev/vga_arbiter\x00', 0x0, 0x0) r5 = openat$uhid(0xffffffffffffff9c, &(0x7f0000001200)='/dev/uhid\x00', 0x802, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, &(0x7f0000001240), 0x4) openat$uinput(0xffffffffffffff9c, &(0x7f0000001280)='/dev/uinput\x00', 0x802, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000001300)={'veth1_to_team\x00', &(0x7f00000012c0)=@ethtool_link_settings={0x4c, 0x0, 0xacf, 0x4, 0x1, 0xc987, 0x6, 0x5, 0x100000001, 0x6f, [0x5, 0x7e6f, 0x8, 0x2, 0x0, 0x6, 0x0, 0xfffffffffffffff9], [0x6, 0x5]}}) sendto$unix(r4, &(0x7f0000001340)="3a5cd4b867796a8385ec989b3fb071f19fdf90ec811c4f0c2f38f039acafa20f25fbc4acda341ee2f2a869f71c245b96ca5469d21de79c949cf4766d0416277396fb02382b3488087f6794cf3c05416db20502030212cff8605df8f51cd44534a66960b3c350e7c52354f7825ac681afd3918047492edbcb01b62818ab6ee2", 0x7f, 0x48081, 0x0, 0x0) r6 = accept$packet(r0, &(0x7f00000013c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000001400)=0x14) setsockopt$inet6_MRT6_DEL_MFC(r0, 0x29, 0xcd, &(0x7f0000001440)={{0xa, 0x4e22, 0x1, @ipv4, 0x5}, {0xa, 0x4e22, 0x5, @rand_addr="1471b4de68393c67a2da57f2c3c641bb", 0x7}, 0x5, [0x800, 0x3, 0xb3e, 0x100, 0x2, 0xffffffff, 0x400000000000, 0x400]}, 0x5c) ioctl$FS_IOC_GETFLAGS(r6, 0x80086601, &(0x7f00000014c0)) sendto$inet6(r4, &(0x7f0000001500)="03f3b18314c70bcc55dac5879dde3d74814c0fa01cac1467d1113a79953625b966d58fdaeaea58d58c11ee4fca079ab60126b1665572ff3522a7675732a7a651a1f5ffde6b995d2a10b854ba1ee53a42e02214774594c4b3fbd352de9f4e689fec7f4f1579a7844c4447fcbafd8d9e347fc50ee7c497fde62118e71c23e143726eaeaf9bcf54e964833f3ee4403be96b52e929804df614d3686f3d8c8e2d60ab4fe50c2685f6ad74cf17f1a248446403", 0xb0, 0x4000000, &(0x7f00000015c0)={0xa, 0x4e24, 0x100, @remote, 0x5}, 0x1c) write$UHID_DESTROY(r5, &(0x7f0000001600), 0x4) fsetxattr$security_selinux(r6, &(0x7f0000001640)='security.selinux\x00', &(0x7f0000001680)='system_u:object_r:apt_var_log_t:s0\x00', 0x23, 0x0) ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f00000016c0)={0x5, 0xe2a0, 0x1000, 0x4, 0x1f}) sendmmsg$unix(r4, &(0x7f0000001700), 0x0, 0x1) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000001740)={{{@in=@multicast1, @in6=@ipv4={[], [], @multicast1}}}, {{@in6=@dev}, 0x0, @in=@empty}}, &(0x7f0000001840)=0xe8) recvfrom(r6, &(0x7f0000001880)=""/4096, 0x1000, 0x2000, 0x0, 0x0) pwrite64(r5, &(0x7f0000002880)="f117c6639e14b393e87482b4d68a922fab8d0da98226d4642fee3cc82ceb491a319ba12b8e0864a670c63be2049463ed532ca11a1a48478028ef86961d9b13944aec0505b0ec241bea2ff2d9a3cf66a4cc70158990cee4f3023428010cc0496b8347cea5e865e8b686bb6af8616178fdb89467953d8a2668500ecf2fe41f4601bd02a6917f21a022881cddd21c3fa07a6ca590a3952a420f94200c53f8c2ac83f5f0acdf7d8b61d4c552bb581e443d7c9c236c30a581ed296cc4f0c36e64b5673a22", 0xc2, 0x0) syz_open_dev$loop(&(0x7f0000002980)='/dev/loop#\x00', 0x3f, 0x6c000) r7 = socket$inet6(0xa, 0x80802, 0x32b189eb) writev(r7, &(0x7f0000004dc0)=[{&(0x7f00000029c0)="00a2c438135c40bfab792c00fee2926ab82b4ed727be2d8bc6448d156bedb1cd854033b7c93c15437399dafe5ceb5b020e2cb14a78faea36ddb009fca043dd3ba7ecf448da233dd73e8476a62b36964b308a3c97444d7aeabcec3b2857547b4e91d6447b99ce450f66cd409949239f11e86f6ae12fd4c0b1180b82a0bbb7c755d42309e4e1b18d775f19b4d98587e166deac03afa92d2ec655008db39708bd46695f4f41caef3b4ac18ef527d469264fd00a77a5e1eb2dd1eb048048edc8ee63f3b267a80351640293d1e0ffbd729071b128f4612ecb87e8b21580398af8bbaa0b514a4d228e64207e0ad3a46b3c4f6ea54a72b9ee0aec0d9f33a8d2779ad519f17433470fadbcd22faa250a520793071afabc798bdccaca3e9ed3f05a330cead888e8d8939b7a45229a3ebf899d8bcf42e0f85b65cffe84e5a5be4cef1bbe826c0bb32513e8f60c985e144284996dcaeb55f11aef5af81ce8a816a907f58b5f80bbaadf31073e92b1208b4fdbeb3cefd045accf0dc879d21d0f4f666ead538e4eb09b562b49065c52439a8b0461288e90b6289d47ce04ba187a33fc2005afd0ed75ca9fc23e781acc5ab17ad7b3f3ed3943031ea76ebbab5f4a1fc30cc86b5b77d11637ef4d6f74a090ece531a34fa9cdeb14c920010af86a280e6b2626c39e40e00c14a83088898f4495a2daac81d888dd6d8aee9dfa09b0229ffee67ad16f7bf94235657100ddb97fb133334c6028d54a9278848c4ae03e6050a6f87b7457f7de69212ff217ec3227cb6a1b55428d35091fe71de307f7411d932fc4e2c7f017cae778bc8e29dd1785c92791490a89d4a64a71350ed7547de865c98987ba6d6daf8d04762f19a39515a8148b9960448ace92d19e5f9304d63e36f63d8db9c12f04fd760c220ced6cf70eac51cab061bafffa1451157fe40d5b3f3acee29dcf7a85ff02c185a6423e8f205f32b750e05a290c0eec3d293507078208ce520284c37ebe9cedec7e21799fe468e6abda53cae2b3460cb0ff87802231a89cf8f823cdd7d0f57aae786a121e0193f2078da24a438fb641d6f7de8a1df72dab97f3ea37d81e38792ae7bb98a54974670dc9a279f39e24219343ebe239c79efc21af53db3cf396cae98eddb11f5f0d1988ec257fec4098ecb6dbca01b3605563d7004edf805641758203850115c2ff6c13516d3b8a84d583a99cc911bf5740c16763fbfe08ee5a1ff2e107fea2f3b8d11c8fd568292918e141f9584269050348988438cc72a6266d19a4b59f15febf94c85cfba2275f62460aa6f2922a44fdc7104c1d6d6e240dfc47221842219ec3d43bac88246b9fef5dbaa28feb55382854be16d19c05093e162bcfda5692575ef30b42d3c9704ecb6467bf9b31c8055215393928046538df8f120c51ca1aae350ac58789daf57518c47e6891e4451b2299a2d87a1715e352f4baf0c3393b98cee09e842d2d3bf7c6a734d64706b768563cd3684174902a8d729007e37ccf1ef9414bca7d3fef051398d5e2f805c08b8633dc272c068b01e8c874406b0e96553a02e4af882b4d0a45df6f8bb3a7a113a8793d83cd667ec0e94783865648c2f38b8d21903846908073e669d220674e48ec33457486b4d24a580bf92e2c800dd421588b26ba41ec5ac4097510e6d33245c2a25cb974c68aa01cf16fe8be775b52d647d19a20c3b7e05a1cd39ba000a8ea274b8fa91938b270161e775e37a4946ac4c2b502a19f2fd6a79da930a6188c8994ebadcd72d7c7e65aee70542c933f75571cc69bf428ff7989f40ff61aad0a557d18a794010edaf8369e6bc1a72005a44ed9e98333a32423d0901deff8cabc446721e22248acecd7e4b325564fe7eb1f4f011627322327d6373d71188806ad77bbf13a6f97540fe580c1113ff41707537e8dc07e7270964142bec053cb8806c300d2f6cfe7604a86846fc72b2459f1157bb543dffdc005a3e17d8a6f69901060efac3c756c7539274b5c74478340c65c62741f6af473f46a360fe6c32fe0e06238f859d9053a982ecf460dfb12fb9531b1d5f4caf5ff4a5f23c68d38f97ece9c133eaacd9828b211004cfeda9a42f460bb44da64124261ca525718d0a0a0aa97b35c47edcf14465544c1425fcfbc174c1e5d48a8709937292c659562e656d73d3c6869e308634d0d75d01727393b4bcd29b8c530b96dadc956f140faacfc582df90cf0ba1f38ad623afc5ff8458a221a387263b5ecb8fab83c4b73c08718ed3e35883a3f2c985b0666494ac3e3a3b4e3828079c3498dc928aaff2aa22339332aec21663a968754e836fdaf838c0621d5a49e5723fd2257112db9450f32dcc247524f1d84538eeb931572846deb38ae09a23b77b9b45b7a4cbf203e6d4c43cb4d8f3e9c4c718074dd33ab4f51d2c6361b651da8e1055345dd0d3fd2c1a3b30f3eabee59c23073bf34a7a64de481bc715a2935cee21329a925f8691f1f41e98be09400b86119e48cbad64b854550ae75cbf03e82012fbb6e0a5fb9d228330201d9ee7a16bc6ffa39531b9c4d53da42a9ad840e0289a7bf43a729496cb728e1267319b862de696bdec4e7cd4f789f40671cf0af0f925a4e0f5500e42c0610d214b606e540d58db39e55a6ada09f54c78d455afc232e672b11e5fb76406570edf831fc2a157bd1238600c715c0d1c228de8103d6a49adebaab247954eca74e484a88f687c19fd0e9fa3cc4520f94f61dfc1149687750a77b6522d1868a0d7399b06afbdcaa0f0ec441fb0ed05f328454974ada50bd0ebd07c1b79bf3fe1adad98a37ed5bec8f4250d9c94dd56af71a94c98bf3eece56823616a1b13115b674911c610766aa3a574d50f5816db0a35f0845ed54b36badd50d4ec3cabc0fb5253111adc44918883cc7ea3d516cb4e423c934b2afe3440bbcb95a5d1aa9d547d1a9debcec2edb9bb259d143f4282306fa1c42e2b7f41d7421cb36301b009ef01949d71a79379cdea6a0a453164244fcc2281e32134e8db16fc4ddcaba3b1086f62b04c9adc4df2b91b43887b6139d79a0bcbb22eac15bcee87feddcf107106dce1b56d88ef491c4d28c1de520d94c3232706283fb5a3dad57caa13687381397ace35c329a83a8a3e80382cb6c1c4a6db0287d33eb74a0f49dd7ececfa3973836cb87e846b418b539511f0f8b44b768a21fbae2ed6447fe9b29961068392e49dd3dddc1bdb117222e56ec92c13369f01ef239bbe9d7e205e96d29a1015c0dafde72b55d52cf100dd2d4aeb816e190ee27c5c4d76ca6c2a1ddb81a5f87c232d58983307dfa108a5757f7bee0203678d5603430308f2ba10efc45c7fc9ad134765f085fcd6e370563758ae860c7ba145ef9e8e15c758fb39cb9a14ab040de86a77ffc4010cad2a0bfdaca918f867088feac99fd988d7b04d87ebd55c62d022cac55bc72fd4da4c9fc439c743d5aa4180b0ae353846879d86ec13e2e11dc94cdf5d05462769683b30ca61f62048e428d7675e3929b72ebdb20fcff9e87d41ad81ba5ba85a795d00ef721823d8b402ba0b36ab4b39825b10db6a0e4035694da1f3c5d26c84a5b697e44fd3add526599327dabbcfee258452611a9d4a919bb29e43139b9f8d979b488e2e23d8cda8e175f35f517e753025e9ffbee4ef0286746c34e9bb06933bd2b7fc6c6eb54bf2cde71a48ec62befbcd705f28ac951da033191d01e820a50a6e9cf5683c155101365eb6a66e3573518a4f1d2c45a77150c98b576b20af3cda10718375938452fc70c2cd8e403376b0f0f136c7b6060732a13c4f6194a75cc5b7b34b00e0bd19518af429c5e19da9e6c9f8c1c18f6ff75fd5483199f98550b17e247c2d8db836f75f0e49a28523793ab7f6eca08e3ec1db83f4afce936303d67b0ee944c408819e91df26217616ca453ab8cfd8f10500cabc1228d9510223c876edd5aef62c2655429ad4253535ef7ffff3453c1a75e45d5e6c2ad4be170288a92cf6491d1f16fdb7fd0cf43c19d2790c3b3c2c060fc4c7e255f85f17cf03e172b13d94cfd5e7b7d2ebf656e56935698051a1af06cfbbcf85b185ed25c97e990d4092449675c130d6d31b0c2484df42898ffb8c3ad62667c1115c9ed2c30a9f428b2c4a763028df69d86dd3c76e2606463b8f5ff7397dcf1f9e1a65c1481218b99667b543a5080a992e9253a497b04e80c8a20f5d5f87c765d25a194ade748c571f301a6f157b73011a38cf280f4da9adb8f0164138bc43dfc986486687302665c3f3984aa63728e313df786d6decdb86c995d519216a52c15ba582e9a5eaa592da7c08a035daab0b3cc2d60f8949ab65fdd9e890d749f0a222f7d96c5c9e58bb30bda6323abdc88636d4890ee7ce30465b3cc543069d57ab38b7679d9692307afcad544fdfc4c682ed8ba4aa51525ff14d1b4cd5053f3558c5b0c9c3690eeb0064a0745ddcf61562ad8c40bd13ef02ec6e5b2f8f271174cf1ae7b7acb21b7a8a17bd1e65087f07dcb471ad1c47f430894149103978b79d4b9ec128da5aa9f8be43a8fd14432c4ab63ae707c88043e08819be134b61453c24b7307b734aa21eeb7630de25ae60be251b78c84fbd2ffedb744b75c1e16545fe5986597f64e95e1a302d839b94352d06ac58c67bdd3720189b8baa9f51d8d9643374731fca32a38ed2c976923373f547ea218720928cb49e539b0c789795aff43cd5bc5b5f3bc7cfe12a66a1c6cea8feecc57dfde697564ea8d14ce5f41541bc350468ec11be493f30a001cdc5a42e37d25a2e7d67dccce849d49f5a50a980d9aac6dca7ce19c84cc7fb1178fb5b81cf2debe6ffb2e80ede46a0bae9413a55828c814b58bf9c982fe2b8784fa525c871db0e23d07f2b27b6c743c42e29d0615cd514887d202966e2c7d618e6212f898842f4a69110c429495ff3aecdd012b1fc3c280cd1461950211a5e55890d911c1040c354ff528d2bade6026bb44b1622cf82b94b8c5a5d718907bfc2a5eac0cf1d6c2d4dc7a66b309aa99025bd186355cb2112190f8ef5f1b68051ce4fa85c7208f786190ad018b36b30e226d519fad8c7a1046b65941ee3d4ce6e0b21f40b96ca2c0cfdcba908e87fc0f86c9f5d0aae7284342b042d0cfd1941411bf21c1cf9549bad72d5d8ec4512d405ba233817658adc5443d4680d6ea7655275d434fbb4bc9c80d566f0797ec626af8ce9c2ebfea4c70758439e0aa33e9cecd3f5a60ac08b56168f3226f0e3f46ca7fc7fecfdd1002943acba62afa623631c93a3f2f0524ee87abedad07f1bb4fd14ac1d2556884f390cb710a0fbc48ee9d3508bc3e5745f897ce620c04906bf7c4aed7d9a826137f7f770061acd18436b0568733453f2d64030d693818ae7b3d218f93b5c870c6ede9407a8709e297342a7a569e9631a8fb229db99536e7e0b75949d2f95e580293872f963acef03299c0f07d536d720f4406a53299493fa5820432fec87390af051858c61b5082319ad439400d48a105aca4bb0093c4e2599a5ebe06ccbf6812cc80fcd3c087c7a17dc4b98ed962d5e50ab6474d6611cacc14271ca0c6ae4f0f19158dc35a2b84960f18d5052b76be9ea6944043edbf4594c0fe8d2c70ae8c7f590bf02a1f1703013956e75c1231a34a35b58c113962f97eff80276e44c72c9fd15c5218df398cce2b00f8ca778a726b63a200b6af8aeda0b2fa4bd92c5196701e0d4d5a5bd5978e878f59992a263f43d461ac8ef324183df872f34914495afc8eac9aef7bce76dae8aebfe1b6ae5104e628526176c9ae88867f174757b9a6056b7bffa21b3a4909869ca1dab", 0x1000}, {&(0x7f00000039c0)}, {&(0x7f0000003a00)="714cf1d89dea2c07c452eb58a7a2ae8bf7ad87061c0218e2e91aad5756761d9e4c32cde5a3cca9d300ad642955326de45a3fff2e04a5eb733b89c93efe78b2e2199d55bbe7abf90321b2e86ef5005417c909f544f07b2f4e93bf1801af1cfe8f24863e8a3809595e2cae5c65dd6e1f9549314bd80e9a8d2bdbeee4043c63a30394db8e368204194f91add989a5", 0x8d}, {&(0x7f0000003ac0)}, {&(0x7f0000003b00)="04d6fd426dd7aae0012f667deb2c1207725ff2923cf84e93774bedbd9363a9759c", 0x21}, {&(0x7f0000003b40)="0299649c86a5be187007fb96a04ee5907574858f73641e80f2d52b9fd965e7fb1bd2268296e49843a9a47e76d79c6bc236092372f3344a5a1a95c6133128d15cb87d385af0f9e9d39edfbb6ab9640ce25647b82d23e9edb95e948b19091c08f0947bf8a5de2fe8d2841e78386eb9ef1a121d45a2b9c5350a2446bdd0f659e5744e3ce9107eb9085b487eaead7d397a3988a3d16f4a6736eaac45c68c59e583ba00d8578a0862356aa8405e9cef9d11bf5f3b1af822f100a18af1d98e61a3e64ded5f01386dc0a8b9d09f857f7071b3866d98a7e465300572703f9d57094d5f50b23d28da38d950756c758d46cdc6196e0d7a428fd0f3c1", 0xf7}, {&(0x7f0000003c40)="ceca50d3517fe38fb0ba7d61b531c1d23e9ecee8fd5fc9caa44c637c357d1a12f8", 0x21}, {&(0x7f0000003c80)="e353053798a0c417bf7641066b5b37c85dea71001f994c94fa5d6437971643b94c7a4fdd81cb98a96f6a65858e74ee3c5876194a4251c2f2dabea8439c14e3a2dc027be9ea1b22602f08814ec7cd9ce9a3382426bf8e55a61ab2807cdb5fa51c43db192d882bb30728bb313cb258b87ec0d7e8c4b88471d470c7556a32523e16a24457336583650b55c45cf8369f2943128b7e53c3b032ab11c16256c864b9f1b6f3a879e8724f980e9eeebdbebf322e4db94e9ac32a8e9f2e8d140f9eb484165c27c2f761e5e3dde3e78b0e95583fb4476271652597d0382e673f756ad23749f66801cc92433eedf150e3e05f59025a2cafab91ec1698eb814b7bf31d16ad6975283bb8aea888c61f3812f6a02feecbce32e5b2102245d50e5ea36b277032340bcac11ce020c8b211e689773e0a76354c89739e71f816856703ce0ffa2b6165335a0f7de6c9f6810a4bc6a3da3d63c932517701785e7f40e121ddadeda03283e5bf0a4aa95673ede9c456fef3b2fb10df7ae43d9f7c60fd624251f750e3818ada7854211fa87e5aa80ea711d5ecb64bf9f98c1061896d52c5b358e71240bb3233a60677f9a2df1a7e95e0da8e361ea90cc811ed1ba13785a333e5ac8eb41817a29cf638ab41e396fa770bc2bd1cedfe50e5cb9466ab4d1ac88f2d529aee3ec26f483ac8ef2efa05a3d7a89d125970480855a31cc5b4343f8f7c42bd6fc0fde9a81a0eacca59d740a551ea01738e8861efe3c0e29d13d88e389078af4ea97d4d1b806f0e8d48fc964b7bd331b1f5364ca2184503acb11389716c0757418fddc7b42f182358ee5accb729d50cadc9145fc5fd25b3c94a452cfe255dbf0fa1f1461d37890fa13c753fb72328490824698f6d57bf2ae4f5ea6d4b4efbee15366c488b2f5866083826cf68c8c8df6c3f1fd901f3c29773e19b591950524325b88e934d75e2762b83e99c5a46011fb5af295f6a57cdc5054e48facdff12bb393453618426f59a18cea95f40d47098044733d9ef8b60aebd1c16545e50e13e15fb329043a7183117cbb7a3de248864f1c432504dee9bfe7822da0bc7052d7001cc4b263bb0cf8c8e154d42de7d39007ca1ee4aa2f7b5d1d758f905ceb96088b5f8a4e588b2db22c881f1bc76c49e0e088d5ec4af8ce694a55d812afd8af13d04e83e2cb4a4e5d746eb9e05da544d66b044e90a7660c00439f0dadb17321cf2235b328a8700b6d35b52106565101cfeeefe6cc07803e99931e712849d5a8e4fb93a59745a2f73a04aada8fc53d4c539f98c6bb8d1ffcdc95f1fbe8dd336d7c30bcea553341070a9616a63a6a5dff42d808982c0e5c5765bd4abc4cbbe38f4efbfe7330e1e75a2761c783c32be24fe056e354533dc6863951678cc0ba291ccc17c85d20e5144ac80573c77be630561b62acb462b8acfb77aba851e7c56370b9aa5adf665f7546595a0583c58a1a7dfbca61f7558ee4d9eeb2dc69af175c32ac8b594b990e7982f6012bbeff47cda7c1da4a3f6f4ca544641cd169bb94ca41638fc464fcd0dea55d6c3a0622402a62704977430478258c1aa8c7b2a2d811c11bd26ad2d9224840d8a5e10317f2d01349081acbc226e48e354e734e149f5dec06aa86b4b8841e81176e12e7d5dff718b4045ef86fc8da03320515d3619685a2c07c8d65420e8e92226b7b9eb75b6a843858c1f2d6a5159c43af3a69761cb029e04ce72cf9ff86ed518974aea7beee781fc142877a165dd9f876c06e68781b912143cda7dd16234ce6ccd3c4834d36a7138009c5fd30214dc1f61f295910fb649876fb85e94a06c45e3fea42279c35856c04acf0c61bdc5196be3e9520a58b36319f1fa81f97ee4e7b6b9d725dbc6e65c2e0fe96da91b4847ed7d29104e445e189119d7333a9ce3855e0d85b979ddd40908fd2e979dbba8e8cef89dab2a2a301629d0e39b6cf751e450c0dabd08abbb1d8d5f14f8d089d956e5e3571600398d8ae988269145d4496aabd5d8f1570d93ecc8f70630fb15277db7d363597be7f1af9029841c3aa172777a0bf063116eb6c0dc4cb2e1ca80a8ee5c16919502a8d39b66e0bfaab46b072d208c040bfc72e7018d023b3248a2e2070600aace88d57d363a366d9dd2d0d97de9341402395b47f20ba0a7934fd030fd2e8b8bca1b6bab2d7d06a5f093e372be3d8ac4993a7003e4ca10f179435917c81a8ec26fe0b1b74716a87ddd2ad7603b35e3201b102e56b9d14e372d5d62e279fe2f86e2c76d92a7d8b4e1f7bfedc8c89e29f4e87453a614425d6002be09545d40e32b0110b0e96faeb5f4948ef1203d882734f54cd20aecbd48453b89b9963c11165acb33ccd583d32219a5e069b93a69a0d24b93dab5ab2f8c7f1b5b991b8b38c170913dfb24cce80e47d33de56bfd405736875b210ff5460459cb9f93621d04f5351de42e8073e78a7a45054f8d334c6d4811c204dc631c139de118fc4e5b15556d4d01db3252a9f84ec47330b458e9347e07cef961be7c2abd6a2a7204f9cf476b2e6b94884fbbe2f4c77b38f356b5e8770180c4ae31ba9c330f41eda8adb2e32126643d0f08b23cdf9172b22e306064793e5ec833b35c3f1f1e430876e8a83ccaa89dca416af5accc088f91314f463b77bbb632decaa77413b4f9d3c9e82a91be85f72a9c2e84fbbcf4a32a4f375ce405a4c56807aab97dc15552540b8b2172793f4d003523deb7ca3fba6ea14df6e93c359219280493bd8fc2c128b0a6b792b02090f1f347c506c0b9b73e1f7999bd7bea6f11042cc917a6e48ee6ce39f5dd0361b28b3838c52aa0c6c3f077b3dddfb33dc9a04c0ed2fb834acedfa57217a384484a508fc6ec42a4e2b66266fa30ed46c55b94c7fb49af294ad99aad6c2c4c8df9efbfa8f1e70047f80b9dea7f04bfaa7c9c2154649b6ec3bf4724264f6d467d7aaa545f15127947e77b491bc839b6ef1e994c3f9c0aee6f283454b935300a330113dcfe6deac9dcf2ee1d85601cbc3e0404e4bc4d0b9d3f1bd8bf8f5fdbd205932662605cd04d64a7986c920772ef2af9f6fb0e673e7675004ebbf36ac61e54e6567cb01e52365beb2cb38f416f428e8a6da4ba067215e527a29de7a07c7dcc04a224c101b875b44fb089f04fcfac7b2474370536a425097ec20b9c5f5cc4bf8b9b5881b3e1bdab35d6af2457602ad35033bc78f5810b652a80592d89ca38aae70a9e242030eba163b387190e13e9ef1723fffcbe536b5dff7cd1ed9ebca17f83c17f60b00a918366304498eec463d4e91bffb5eff641cce68b6dbbee743add8fab1c953bef15b3c90fd55872bdb557407f87b77b28af5b5fe4c9a5301da704f0f9cc9fe89558b2e358e9ada36aaf1201fb759b7b98a7330764f31655a887ebaa988c3478300064bb54cb16444752d38657d4931af9035da694401a44eb93158f360603c1a41e07e7b27deb53cf3f5db2ae89300c5d72549ef3a39b377d3aea2b54af0eafb33f1d75b9d3ec2edbf438823681ee6975cc2aae237a711ae08e32724f11658a32601aada91243f844616984f4a2023a30a313fd89e23a46c9da69215168df56ad4b4a209821a62472066e3c0132a3b7ddc0ae628c642ed1a1c40a80081647c1c51324153e9b4a865c378bee94c6ab2ac8b076114cfe7e8dccc7c4867553387b19960890d7022199cd2878a72ff72b6737735f82a9b4486f1641fea2900e4da3becc9111c14bc4d61d636c5f85c1c7e898bea38b7e0655daf0f8a802c1a367837cdf9f3ea44e721b14530487cbedf1cfe6f4bfacdf7b1b838bc5cd7edab6eaa59440ebd8efaf0953fadab2afdc75a30eb013463c3b6cb31c5d0241718fadf71ad63a6443bb7903b7f4bc3eee1011fc1a4cf25af6354833c800e1875ee596ddbfb6da73c31bb581e4090b87286e5e78a400a76068689c7c0a179847bf00a4c154718b8f40b11923aa885765d7c60b6f526c9372ecbd7fc123a23e0a1061c2345b2c920f5eec7cb3fd7d1ce87fb70e4cebe6ce92e721dafba64b1bc2264616798de773e54cc07155deb7a018f743ed49b9867fc088ea048bebd1780f824654175b53d9d6130ac3c35b59065821a28ccda00f1ccc0de3afe980779de62ddee572d1791b25d3d016f5193dc4e2c30176935dc448c52aac603de756f2e2afa46029e0e59abdce8237edd938e3054c0592321355ef9fcfa294df26fbfecbab7b7b5e386662f79f25e90f1dcb70033ce62a288fc10a41c837d2cfac3edf66d67a448a2c1ab1adafc24b8c7b1ad468df3379b1d6c21380080335f96c781f9abe2f71201cc2088f12e654f04c4a744bf54830b11ec7c62a83e34c50a1e47283b986d5ba22918a082cc0aaae9d17dac141924f2ba928574032d85d97938caf8f38901d987e4c007b3cfa65d23f08b4a0b6c94950a931fb716f2efbb71fb921c269602244f704d19f59a99129fef13fb510b5e90bf41b023c62773894651f63876137e94e92b433310aa92e3646b7028c7bf48a103a82ef2d72d14ea4c1e1024b57173af2acf4ccd99c2dcef90b0fce9912a6cfc86154441c6783caa6041a3685965a5236f1e0e701611a666afd8a685d516d4364f6f709ee75a67ac3ff167472c5e04dada46f6149e617a9eee4ff436732c36b147020d95e8d2addce1740e75242961e1f4517aeec70b70d89f4462ace7734d27fd0300944cb7e99714d4e8be5dba23f4b88582b09e6fde703455d226193cb82ef0715ec803d74f372ae7e9f39a6d7700ee2849c1a5ce85941a19e13d8fd9709c19826ad69e4d9776fead84f74a05b8a9dc235c03b228852a63f771ef88874d075b08a77be5dd86bb4cb3cfc5017d2e94538862b6028df2a36118208e33e6f83d53460461b52e5a4d481627a29d3916d17f8ae683ceee3272d5b62f9fa8e4560f3782bb555c3a1b9b9cb841e50df66bd2b1c3a2b58262a4725ff0b7358272327f3450dacf5e51104e7e29b71963c37df15dd121dddbf8c9b9400c4f838743b73ab72ed358cf646559044d6e1f20c93ed4cf90adea8e0c518b707fa463458d5c9317434b77e8e05973484f312d64af3920ae63227a969b48eb63dbd52c7cc06cbcf0d929af441b9cc934225c4f9dcd855af09b8c39b4289016f8d83e67f6d1f8847d1f605a41e91e1c5b9c139d2076fb72584a0b5bf4f38c9c3b95e2445bcd10ca864885f431f6ed9f38bb2fad87e5d2ff2063b92a47e088708cca6fd3de366fe936d8fc75e398677bec2c11140735c07022135dc8315b7b7e4dd360230f21ce21649f31fd76aea9b47e67c24635ab18957f849cb0efe54cbb7aa0b3a2f06c872b2471e768ecf5ebead456392d48f1071b9a7793eb79e13474b9fe527ec8ac6471997cd3f8fae0d305d7503104f50ae2d1fa03fc6d2b9c44061a01270f498dc5b4ea03e26462cab6b1dd13e80dc8eaa0bba115b361899f57095beed5163438d578902f0219d4fe4778ecdb23017a71ab46f3f6edb810ceaa7b092858cf6bd47ecc5d0e31650c5205719af75d629168b3fce5e80e2755c2b1bd60ce490b106d9ef87568de5803ee9aa16114443ffe8fc1d94019092454006721e50ae138ea3004d3607f2bbd018727b35876cdfa4145375e11809aa234692c8185dd69a0fd87c1da028ce9fc05c8c26a1bd2daaa38b7dbaa44c092e425fbd90dabe0574add72a273ae2700829e7690997f3a75c5102ef0dab38727f9f6dfa94d02f4d46d14413e5a61aee94919c43e8c8ad190efa7ef7de3fc8ff092e73d63b8cbf6ffd9f94b0a1a64b55948973737d0ce6be63505b56077888cb964d7073", 0x1000}, {&(0x7f0000004c80)="4596a7ffb69e51c7be501b2a9ddd52302f838d9a22a2359c1fcde029eb787752c5eaa4521ac5275c", 0x28}, {&(0x7f0000004cc0)="c7617bec8774789889aa94e6d0af8cf715ded75f14f5aa2effdfbdb30215fe717bf45fa0c91fbadaa499e4d6ba7e374e34cda0e7d4630c1005b3cc2a279c84d3fe0c99b54314a7ef66f8b056efcb8efe591ae109b96eeb4dc49d9b47d71dadc8b5285882d996a9a27f8fa2a141dd8eeff9254fe000e172677598261f2cab4c4eb138b01c8db8ddf30b071d2d75741486326e72d63df1e43fb800837b3b00d1b825e4b85792418eba2d4c1507dcf772aa495427c5ffaf490117610e2732e8d674180e1d2209e4d257511e089af0176493de3f", 0xd2}], 0xa) ioctl$EVIOCGRAB(r4, 0x40044590, &(0x7f0000004e80)) ioctl$RNDADDTOENTCNT(r4, 0x40045201, &(0x7f0000004ec0)=0xf60) [ 2446.129533] binder: BINDER_SET_CONTEXT_MGR already set [ 2446.154716] binder: 21566:21571 ioctl 40046207 0 returned -16 [ 2446.178722] binder: 21566:21571 unknown command 2097152 [ 2446.185940] binder: 21566:21571 ioctl c0306201 200002c0 returned -22 [ 2446.193684] binder: 21566:21571 Release 1 refcount change on invalid ref 1 ret -22 04:04:06 executing program 0: socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:06 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:06 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x200, 0x0) epoll_wait(r0, &(0x7f00000004c0)=[{}, {}, {}], 0x3, 0x0) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x0, &(0x7f00002d6000/0x1000)=nil) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e20, 0x3, @remote, 0x9}, {0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x0, [0x0, 0x582b, 0xfffffffffffffffa, 0x4, 0x6, 0x0, 0x7]}, 0x5c) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f00000000c0)={0x1, 0x7, 0xfffffffffffffe01}) preadv(r1, &(0x7f0000001400), 0x0, 0x0) r2 = syz_open_dev$loop(0x0, 0x0, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0xd0, r3, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffffffffff8001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5378}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr="55997aaadd2e99adb1547d2e64fc50d8"}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xf3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x401}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffffff7}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x28}}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0xd0}}, 0x40) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = creat(0x0, 0x0) prlimit64(0x0, 0x0, 0x0, 0x0) creat(0x0, 0x80) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) fallocate(r2, 0x0, 0x6, 0x0) getresuid(0x0, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000180)=0x0) sched_setattr(r5, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) unshare(0x40000000) 04:04:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 04:04:06 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:06 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) mknod$loop(&(0x7f0000000000)='./file1\x00', 0x0, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2cd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) r2 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r2, &(0x7f00000002c0)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0xffffd}, 0x6, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYPTR64=&(0x7f0000000640)=ANY=[@ANYBLOB="ce0f392e9766eb891d8d1a83fd67fb23e7c7dc1b8632ab5b6d99047bb42aba220b91031d91bea6bd2c3ad00a643753be813a061b541fb133917f8f9702d9036bf9c7b9930af3d0fe65666948af7b6e16f92f265dcdd8a33c612444e15b64922d27afbef08d54245700caa14680f3583e252031452df9ada4f9421d95f9932ee19b84e5364aec3ed67bb7ce3770f6e4", @ANYRESDEC=r0, @ANYRES16=r2], @ANYRES32=r1, @ANYRESDEC=r3, @ANYRESHEX=r0, @ANYRESHEX=r2, @ANYRESOCT=r1, @ANYRES16=r0], 0x1}, 0x1, 0x0, 0x0, 0x24000040}, 0x10) accept$inet(r2, &(0x7f0000000300)={0x2, 0x0, @loopback}, &(0x7f0000000340)=0x10) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) fstat(0xffffffffffffffff, 0x0) chown(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_EDIT(0xffffffffffffffff, 0x0, 0x483, &(0x7f00000004c0)={0x0, @broadcast, 0x4e23, 0x0, 'lblcr\x00'}, 0x2c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = inotify_init1(0x80800) fcntl$setown(r4, 0x8, 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000200)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x26, &(0x7f00000005c0)={0x1, 0x0, 0x3, 0x0, r5}) ptrace$setopts(0x4206, r5, 0xfffffffffffffffd, 0x12) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x9, 0xfffffffffffffffc, 0x40, 0x0, 0x9, 0x0, 0x1}, 0x1c) ptrace(0x4207, r5) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000580)={0x2, 0x4e22, @local}, 0x10) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'yam0\x00\x01\x17\x8b\x00'}) getpgid(r5) syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0)='TIPCv2\x00') getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x400000000003, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_ifreq(r6, 0x8947, &(0x7f0000000180)={'sit0\x00', @ifru_hwaddr=@local}) 04:04:06 executing program 0: socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:06 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2446.795563] binder: release 21566:21571 transaction 484 out, still active [ 2446.807515] binder: undelivered TRANSACTION_ERROR: 29201 04:04:07 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:07 executing program 0: socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2446.856204] binder: 21612:21613 ioctl c018620b 0 returned -14 04:04:07 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2446.912745] binder: 21612:21621 got transaction with invalid offset (0, min 0 max 0) or object. [ 2446.929223] binder: 21612:21621 transaction failed 29201/-22, size 0-8 line 3348 04:04:07 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:07 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:07 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2446.973259] binder: BINDER_SET_CONTEXT_MGR already set [ 2446.981825] binder: 21614:21624 ioctl 40046207 0 returned -16 [ 2446.989659] binder: 21614:21624 unknown command 2097152 [ 2446.995829] binder: 21614:21624 ioctl c0306201 200002c0 returned -22 [ 2447.003162] binder: 21614:21624 Release 1 refcount change on invalid ref 1 ret -22 04:04:07 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x200, 0x0) epoll_wait(r0, &(0x7f00000004c0)=[{}, {}, {}], 0x3, 0x0) getsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) vmsplice(0xffffffffffffffff, 0x0, 0x0, 0x0) prctl$PR_SET_MM(0x23, 0x0, &(0x7f00002d6000/0x1000)=nil) setsockopt$inet6_MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000100)={{0xa, 0x4e20, 0x3, @remote, 0x9}, {0xa, 0x4e22, 0x0, @ipv4={[], [], @loopback}}, 0x0, [0x0, 0x582b, 0xfffffffffffffffa, 0x4, 0x6, 0x0, 0x7]}, 0x5c) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='environ\x00') ioctl$VT_GETSTATE(r1, 0x5603, &(0x7f00000000c0)={0x1, 0x7, 0xfffffffffffffe01}) preadv(r1, &(0x7f0000001400), 0x0, 0x0) r2 = syz_open_dev$loop(0x0, 0x0, 0x0) sendmsg$IPVS_CMD_GET_SERVICE(0xffffffffffffffff, 0x0, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, 0x0) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r0, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0xd0, r3, 0x4, 0x70bd25, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0xffffffffffff8001}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x3}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5378}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@rand_addr="55997aaadd2e99adb1547d2e64fc50d8"}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0xf3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x401}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x9}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0xfffffffffffffff7}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_PROTOCOL={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x28}}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0xd0}}, 0x40) socket$inet_icmp_raw(0x2, 0x3, 0x1) r4 = creat(0x0, 0x0) prlimit64(0x0, 0x0, 0x0, 0x0) creat(0x0, 0x80) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0) fallocate(r2, 0x0, 0x6, 0x0) getresuid(0x0, 0x0, 0x0) keyctl$get_persistent(0x16, 0x0, 0x0) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x0) write$P9_RREADLINK(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r4, 0x8904, &(0x7f0000000180)=0x0) sched_setattr(r5, 0x0, 0x0) ioctl$KDGKBMODE(0xffffffffffffffff, 0x4b44, 0x0) unshare(0x40000000) 04:04:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 04:04:07 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, 0x0, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2447.660352] binder: undelivered TRANSACTION_ERROR: 29201 [ 2447.680351] binder: release 21614:21624 transaction 488 out, still active [ 2447.681563] binder: 21648:21649 ioctl c018620b 0 returned -14 04:04:07 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:07 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000), 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:07 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2447.758624] binder: 21648:21652 got transaction with invalid offset (0, min 0 max 0) or object. [ 2447.768077] binder: 21648:21652 transaction failed 29201/-22, size 0-8 line 3348 04:04:07 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:08 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:08 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(0x0, 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:08 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x0, 0x0}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:08 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:08 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2447.946077] binder: BINDER_SET_CONTEXT_MGR already set [ 2447.952541] binder: 21655:21662 ioctl 40046207 0 returned -16 [ 2447.961170] binder: 21655:21662 unknown command 2097152 [ 2447.966601] binder: 21655:21662 ioctl c0306201 200002c0 returned -22 [ 2447.975642] binder: 21655:21662 Release 1 refcount change on invalid ref 1 ret -22 [ 2448.481452] binder: undelivered TRANSACTION_ERROR: 29201 04:04:08 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:08 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:08 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 04:04:08 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2448.630570] binder: release 21655:21662 transaction 492 out, still active [ 2448.647738] binder: 21685:21691 ioctl c018620b 0 returned -14 04:04:08 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:08 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2448.719773] binder: 21685:21697 got transaction with invalid offset (0, min 0 max 0) or object. [ 2448.743739] binder: 21685:21697 transaction failed 29201/-22, size 0-8 line 3348 04:04:08 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:08 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(0x0, 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:08 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:08 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2448.816717] binder: BINDER_SET_CONTEXT_MGR already set [ 2448.852717] binder: 21690:21694 ioctl 40046207 0 returned -16 [ 2448.873217] binder: 21690:21713 unknown command 2097152 [ 2448.894065] binder: 21690:21713 ioctl c0306201 200002c0 returned -22 04:04:09 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2448.919899] binder: 21690:21694 Release 1 refcount change on invalid ref 1 ret -22 04:04:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:09 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:09 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:04:09 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:09 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:09 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:09 executing program 2: pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, 0x0, 0x880, 0x0) r4 = perf_event_open$cgroup(&(0x7f0000000100)={0x4, 0x70, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0x0, 0x8000, 0x0, 0x8, 0x100000001, 0x0, 0x0, 0x0, 0xff, 0x4, 0x0, 0x0, 0x80, 0x77f, 0x9, 0xffffffffffff774b, 0x0, 0x1, 0x8001, 0x1, 0x0, 0x3ff, 0x6, 0x3f, 0x0, 0x81, 0x8, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, @perf_bp={0x0}, 0x1c8, 0x101, 0xb8, 0x3, 0x2}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x4) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r3) r5 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) r6 = socket$inet6(0xa, 0x3, 0x9) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x3ff, @dev, 0x6}, 0x1c) setsockopt$inet6_opts(r6, 0x29, 0x36, &(0x7f0000000000)=@routing, 0x8) ioctl$EVIOCGNAME(r5, 0x80404506, &(0x7f0000000240)=""/110) sendmmsg(r6, &(0x7f00000002c0), 0x400000000000174, 0x0) stat(0x0, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xffffff7c) r7 = socket$inet(0x2, 0x3, 0x7f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r7, 0x0, 0x110005, 0x0) [ 2449.450457] binder: undelivered TRANSACTION_ERROR: 29201 [ 2449.467060] binder: 21740:21741 ioctl c018620b 0 returned -14 [ 2449.487910] binder: release 21690:21713 transaction 496 out, still active [ 2449.525790] binder: 21740:21750 got transaction with invalid offset (0, min 0 max 24) or object. [ 2449.535363] binder: 21740:21750 transaction failed 29201/-22, size 24-8 line 3348 [ 2449.708687] binder: BINDER_SET_CONTEXT_MGR already set 04:04:09 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(0x0, 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:09 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:09 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) socket$inet6(0xa, 0x80003, 0x4000000000000088) clock_gettime(0x0, &(0x7f0000000040)) syz_emit_ethernet(0x3e, &(0x7f0000000400)={@local, @broadcast, [], {@ipv6={0x86dd, {0x0, 0x6, "1bfc97", 0x8, 0x88, 0x0, @dev, @mcast2, {[], @udp={0x0, 0x0, 0x8}}}}}}, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x8000, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000140)='bic\x00', 0x4) ioctl$FICLONE(r0, 0x40049409, r2) io_setup(0x6, &(0x7f00000000c0)=0x0) io_submit(r3, 0x1, &(0x7f0000000080)=[&(0x7f0000000540)={0x0, 0x0, 0x0, 0x7, 0x0, r0, &(0x7f0000000040)="10", 0x1}]) prctl$PR_GET_CHILD_SUBREAPER(0x25) write$binfmt_elf64(r2, &(0x7f0000000580)=ANY=[@ANYBLOB="7f454c46070601ff03000000000000000200060020000000020200000000000040000000081eace76c470cad92eda73ef6e500000000d3000000000000000200000080003800020000004ca10000070000000000000000040000000000006e0d00000011000000000000000000000300000000000000fcffffffffffffffcf0f00000000000053e57464070000000500000000000000273b0000000000c10500000000000000000200000000000000040000000000000500000000000000f38750f6c66511c76da4f032057dafdc6ee2c5779304709cb19fa5ce5f1f7f72b96fbe140fb3b32bf1dda2b44193cec3ac19170c91f2cfb8aa4fa5f482a70ae0665adb3945df476afc135a53ed108123316f4befec2ecf53c8f48f179d1f8f8af9523c2ccac8cd609170cbf4805a21f0954c89bcde095af44360be2867024f83ca1ec07613691efb005d44339cb611aa9fba989e1148bffb4e0a5548a2c6486cedb655923b09c3de7906015e86267ea0b2"], 0x161) [ 2449.736112] binder: 21749:21751 ioctl 40046207 0 returned -16 [ 2449.757423] binder: 21749:21751 unknown command 2097152 [ 2449.778666] binder: 21749:21751 ioctl c0306201 200002c0 returned -22 04:04:09 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x0, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:09 executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x200000000000013, &(0x7f0000000280)=0x400100000001, 0x4) prctl$PR_SET_CHILD_SUBREAPER(0x24, 0x1) connect$inet6(r0, &(0x7f0000000480), 0x1c) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f00000000c0)=[@window={0x3, 0x6, 0xcec}, @timestamp, @window={0x3, 0x0, 0x3}, @window={0x3, 0x1, 0x1}, @mss={0x2, 0x1}, @mss={0x2, 0x2}], 0x6) setsockopt$inet6_opts(r0, 0x29, 0x39, &(0x7f0000000040)=@fragment, 0x8) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) finit_module(r0, &(0x7f0000000080)='wlan0\x00', 0x0) openat$selinux_relabel(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/relabel\x00', 0x2, 0x0) mmap(&(0x7f0000001000/0x2000)=nil, 0x2000, 0x0, 0x10080032, r0, 0x0) ioctl$UI_END_FF_UPLOAD(r1, 0x406855c9, &(0x7f0000000180)={0x4, 0x2, {0x53, 0x1, 0xffffffff80000000, {0x3, 0x80000001}, {0x9, 0x1ff}, @period={0x5a, 0x8, 0x5, 0x5, 0xffffffffffffffe1, {0x40, 0x0, 0x0, 0x7f}, 0x8, &(0x7f0000000140)=[0x100000000, 0x9, 0x3, 0x3f, 0x1, 0x401, 0x10000, 0x80000]}}, {0x57, 0x9, 0x1600, {0xffffffff, 0xffff}, {0x4, 0x1}, @rumble={0x559f, 0x4}}}) socket$inet6_tcp(0xa, 0x1, 0x0) [ 2449.791103] binder: 21749:21751 Release 1 refcount change on invalid ref 1 ret -22 04:04:10 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x9) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='mem\x00\x01y7swaS.cur\x89\xc9B\xab\xe3\xfarent\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x2001002, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f00000006c0)='trusted.overlay.upper\x00', &(0x7f0000001a00)={0x0, 0xfb, 0x1015, 0x2, 0x9, "6ee0bad6c58ab32eea96994c7c2ed2f0", "0f9e4dc144388d3fdc1976622f55c26418e8961531c93df28f8bdc706f4ac4a00656ee8c0d2f00e36b487199d37cfc0cedcc18d67289352e8d51c1767e9510c00ea9d060e05d469e0dfe7d96e8e92ac8f7c2d123d8f15bb30a1823141c4099b2168eadf369b9be35cc246a1468f47b7821aab9fd421079b737f0e507087083653217266d9ac17d7c505959cbf49378cc8ee51138a825aa71b4bfa710d531d81b452193eac90e02a4132a67d57496261f92e22dfc3834de80199d0a9c5f4c4b34cacf66b2e96b6a4cb3d7267fbdecb7958a2d9a01d09ecb9dc1af4409fa1b6667ec6cbd2c4fb347fe798c6fdd17e8fdddde16ca5415a9d34fd50ea104a31bb7ce10b05993b50d057299b31708d9e690b477f1b6791354366a3104160df6048e05222671bd54e8e16a4131f5b5cfc1ab69b9b014fd427bb2b0a0557738515da497c8b4a1ccba08c4fb843d83ffabc5f6d2b46d566772ba73b7d6129cd8d0dc043056ed47b2f4837439fd8de12fe2d721da60bd1d3bc210d0aec5a1a851b95acddc70225441fb4cb4966cab20299c5c483f3662b326b1109109aeaaa198b7b2b4f9a82b73c38789146e1b969992799ed22c217816f20d323a36181c8f5b8b0a28b8fe0ac048852aa5cfbfd32d5bc15b7d31b48a23ce5ced952a40d3b1084e5ab5dec36acfbc14b4d61b0a5c422585d692a46222708e2c863bbc4e084d39e8eb08728c01fd3210b628607c06e17a7f66d9e7f80a723df35033d279f6eed32ad184ebe5112ec2e9c5235daf257c976ea99b3e5b4a53f6e3f0e32d3245e40a2ceaabab1f1a1acd5a013f7c03238711ecc03e5f6e8d3e54fba59f5e48016c56ef0ead0671022f9a9f00f950d04c75cb2e93411c18ed03797b317604c5d9fd5079a67827304f4a2b6bc2f33bf7363a7bcdb567bba888f8c7ca317b41e72d219fbfac1d56e807c29384f7ae9f082b408982e17aabbc794f4bb5e23c1f873eabb6d31250e9bbce6b7faccb68075b8330f74f06824963b7080358ffe1ddc0a4da35cc44c0b048daf7be90da6ae6849a9ea59cc72643c4d5a378e2be268bdbb26c18565df2d7c6f50d399c2f2a4ee6b5ddc2cf0e0a9b54b9fd3566ef3641fe87a240c7cb9ba3b65fbc5ba95e9de6a99f76abc0e1660f197f13ff61b462e50cf42f76b3d41088aa1876a2a92bef5dbaa222fbf22ac789c2ea6f2f772d51158ba5272b2da48f4e0fc821f362011738115f0a463d7fc324f7277b43efd66a2a54e65a6ccfbd9864438aaa57625d9bb735ba8ecd12240f31d7444c8ca61e7393916e6f8cd9724d306f4a55b3cf8f2c007f6b2ccd65b67fd2c43f6e344df7ae84b1a40411668612d199042c43cf291c39ac686d8d8ef4ecb1a7d80a2e8f7c7a2da903d4e9521ce2f36cb7f9044f0c954e88e0ce77921483f712fb00a9ce21e318902532555851c1cf6f37982a01f72d42217545e5b7298a1350dce81b6cd765436a751068ccf7c608a6150283600cbef5142be3639c45fc4f2dda2e19493e88ddba5ba8c50675c02a79e83b28b338d06d414f19b44d467973aa1aa7a328e5e83d6507db0be6fb9c538bbf1d80e59f8ece1b6c20a792068b88598205144496d3912eff333517c16ba83625ea640912331a50d07ec9156bfcf4af96818e47458bcefd19c5bbb7bdd02f4cf112a68ee69b77b619805b4d17d2bcbdad9e51596eed7501ebc11cdb12bcf1d4f4d90e3547477ed1276f33a4a8a32bbf9c7da774452ee213aab9e734071b1d00f10376f083b87164e37ea19fbad88b7b657fc435ca4e7d7caa808d24af6b6cfed48f84a07cc0eb44d0afb537d3fd7d49be824e0d3e16b580cd2c18f8071345e1bc5c95e7d4dfc0c69a6d5f6f4f4129c0ae185b8342ea7e9aee61afa75df5442a2598bef3b3240c775901448c2cb984ff1c611ee7dac3ac20ae6870123f1e3f69b75444d25333cff343caaa19f196f10d88f5846f1be08d55beade7722daa42e816deaf72e17d7d30a5abf4167ed0842749244c196bf7400f7f47329d26f3a60c25392bba37a345702015b7e57e469319bc2189d4dffb261cde44ad00dc66e184dea1015270a7ffd50b31fe9b9e37b3195038c9e4a0719c652c933ff13d0de6b569f4df0410fd649ca277cb0c4439f3614c7eaa94641649dfd3705813ecea47d5d1184f5362cacde8a977e544a38230ab6d09dd7c4f01728f49e2163b49a49781750152782a77c31eee5aba0ce5b9ba1eeceaec11610288c49a83c07c5142aee1b9b367681890725f6965f3c42b54073f2bce66e0d7ccb531aaaf59954dfc28bb98476215151ce52165941f9a9c526e1b51d3c01b38969e4504ac96a2dffa3d06100c56902d11f4b83922492c6e7cd71c163027edfbbe37d8d96ab169d6a94a6d6372d884ead939902934947817999dc1b3c96210a275084c4b2bfbb382d1d152373c072863ae17923c85d6b48b64bf648af3e5972501d6fe084049c007466dd903b541db18bac26de4f5a8aaed31bc7d36f83c2590dffa7d615e2e88dc7385e473f30c912fdbcd62602fbd6fe6a8a8f5742271be41d7ccb9aac553f700945725857b3e24c3cdd399ff7d86bede746334ff1c7697a60c8b6dd7d68fc22802b9ab2262da6fcad2666c433c237b55ddbe13617de932b6950d1ddff789a3309753dccfaf6fe3a0c21186e15fe62c92cb45e73ee655a02cca9db24d7d8c27ade2342a77e6ba94fbf95c38b3641be5e409bbeb1e6b8f997bacace31ae8c9a621b2a7fdb5d523db12073690d91df6de235aa867ce8159b34896f9e7f89946d39756025515f79cb64371684c16f644ed4a73df5a48bbab2208f004d54023f7035ecd4dd5423965c615a2327ba9fc57c8918c6db7fe4fceadd358ca41b41693cf9d943ee2b762b273c9d54f1a921944adcf6f8d4206fdc8ec8d56f7aca70d2f9ad6c72d87967675e26540acd7eaa861f12fb4ada75d4e5fde965f33ff2c3e6ec4ccc52acd28df2187950aa92de5a3e2d3fb1b63062acdf73e8614b23add9b5010659cb28f2cb1d14cfd847eb695c53b2d256042c1e6ac2cbee413525a68f79b2fd1294cbae8905e7f18efe88c0d088a71e06700201463f81b9784bdf7bc73e16d2792eb749f86d3a82aed0b15490dacf4fb29f2d2cc1bb5faa7c739e13f33b344da4c1641ae31966ed02eb85f7b1733e32605725428d613d44ce2b76df8ad9924e7877aef679e4cd934fda93df78950668036ea6405692761854c7b0be55b662e71dbf9d029d7d4b9860ce9f375488faa683b55f1ac197255e8d2229b468ecdc67fa1c2c47e0d252b9aa4e934317dc2bbff952cb77a7c0e9ae43b3eb518346968389c8db15c9e2a779958cc17f5d5e95bf5894361c66405b1668f880b8c142cbe478000d7f9365e261a5377126a9b0b36b90e9127b29e6f1324c93d287be8bd3bc27c86c73c25d1ef8cb8ac51d7efb67aa4345e4bd75f28058ba35dc0629ccab37499132282efd3c3eefef10033e0ee364ae6a64cf288b9893e370bea0cd3b0dd8c4e06c1823bff56bdb84e1b41255f460f2033542703d2c2386de005dd083ee1c65a2fea3be36a0fcda91a6ad113937d2da273995af637c785e0e1c325c130721828349f3929443969bcdc5529dc3a89891a43c852828a1c4f80f4e18cbc1c26016b916be948cfb6c6511e39918a7c173a5efb0a802a302e1c9e7a2957298121884c6b6ef0e043233d16b7e8b270fcfaf4a6538b012b4bfdd0639a812e88a487ef336bfac378d7ce86b6aa1b24d0c1fb2ed5c206d4c123eb7d11ff1e209935e1fde695279d2780d553d1a028d1dcdaecef7024e3159c03674fbfb7d99045b38240ce02862bf8e6bd1034d143634470c5cfd89f3df07a2e59d7a038cf9b83f054d2fc76d2fdc4d4b60dbceda0b04700d63ece10ec6eaef9e4691013b612dc5530705bda1be58683eab221faee0e687a1e48c67a444e33fe02948aa0d7deb280bb10181712202e9e62b590f52ad1d2b62b9c0afa00bbef24ec01a29d1b88dc2015d5a05bf2fae8f05a4a07e070f9c0a0422b74bfba41fd1c1c987ebf16e62bae649fb54e62a9cc04642bc6db71b2a88f025873b071d71841c86fb9229c44199e6ed6ee767d62d5e4d20aba570fcabd330dc24525181435cdc0a0a951f1aaf296409cf19a4114faedbe8f6645319ce35535772a9e10a4abc264119286b95c3a4512887d2181813f149dc01cd7adae79a1a80b8330c8ea30aa4c4d993f5d579003b846cfaf99744ea048ad4eb3a36aa6b9a963632428706dd7f87f4be568896d82c353c4954c113f9e859c1662eaa6c857fa65cea7b27b0d8b0e8e0fe15c8bd81beeb85be9fd3321f6ec00858ad3b8cde8caa1b6650a9bd9b8dc99c07b02fd81af427aa2cc7c3bbb46e2a54fbdde41e823303509f482f6ccaa29c82b0dbd7838a1669c5b5efb9dac0deac5b3e8902a7aa8dc07124ea959e19389450c890133e21aa82a8c13ea9b1c51aa854b0e4c797ea2288819b7c8ffedf23452fe9ce3cce6e4357954b00f60e4eb9412bee2e37b2609d19e98fb1a6b4428095c0a8f9d5b1e04de81e2988ff1e7ce007bc87b3929593539b8dc0923accd3de5015a9e0535530090dc777ef341c2fe3103f8b4642e188b328e09d6845b973a1e59ac6dd33da088b790f88bc150f0422aca2073b6456359723377a7abe915a7ee4553f0f230594a97c96854d2ab61cb9c435f5245a1fc9deac65899d977617bce8d38552657a821bbc7178862ce6f90c69986612b49fe58ed108a8e3a2b359fb0f2b806d0bb9718938b0f24da0979b65d4bc3191b25f356ea2c179fad2e9caea174668ac643aa35b9f51e256ed7f843481a3a375ad4e90eb6b3258ccfdabf09524d22679728999378c8e30bb1b1f0483c3c336e95a46c2810a9390ff10d7d018312d1d4c90e2a8ba986ecfaa4e770a854d0387b4245ea205c51325470a733b03db99e65bf52c8c70b282f596cf8919f479f586a68c26960c3d5028f93280f839eda54e95f56c5582723284bea7e4855ca849fde0ab692d5ffe12e09306d135554bd50d9d0f18a75e2f055f929ebfdb3670b1c019e6cd102561bf9313f0355ae193582bda9d5a5b4e4ba76f10d2818a9281d40dbbfcd1051851feb40f8cfa6680f117eefea99ccc1abb2a6d7a07ac9bb3bc755a3ac9812917e6133c1a0e79588456c2d20a5f441e10f461615d2ce2589ae27ff3a43932c75d66f5a29c0488fd5dc09963d34dc842c88597fa1c88a20a2aea20b00a97f4bc9c881bd66017d5c1a10674af0e7cd46d2c56b0834ac9e1a67c736fb62fe43b70792bbd59553867af9ee61593aae2460934be8641def8df8de3589c8eade3ef5f15025dff85959eac6f2453b3c364ea79ed9188512ef7814a3955cbd3865866096f6c01f43b62fa752b2d4133d3928bb7057e279bdfa173b13d11c388a032a26c42ebef978a6f628e2b4c1a92137f26d62dfce9aec72010187b111eae7ebc261d742ed91fa4ca4623603d48a14185f55c8e27dabad91e912d132308535354ef23ef5235952c0b621b8008fb747d305e3aa5ae6b6066d01b331cba5bf73c1a1922ca867dff08c344af416e77c2691ebb5e73deef8bdf830d8556e636bc2863335723c13e8bacdfe29d19566a8dbbb4098df55d8a6976f7b34b965d4816616da2430ffdd0bb562484dbbdc2dc1c2a5a97870fcb1e0436d4bc9c3142998b40e98331746707533f7af964b2b57f1601378d16eba333090a949a2270225b4d1e1a377b7481227771f6d7997b6673186469011091de3bac4"}, 0x1015, 0x2) mount$bpf(0x0, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000580)='bpf\x00', 0x80000, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000240), 0x4) mount$bpf(0x20000000, &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x5004, 0x0) mount$bpf(0x20000000, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x588e, 0x0) r2 = gettid() setreuid(0x0, 0x0) r3 = memfd_create(&(0x7f0000000a80)='\xa3t,\x13\x8d\xd3\x84\xa0\xbfG\xa6\xcb\xcd\x1f\xafzf\x00V\x18\x13#\xac[\xee\x12|\xc9\x12\xd9\xf3\xef<\x10/\x8b\xcf\xdas\x94 \xc3\xa91_Q\xcb]\xfe\xa3e?\xdd\xae\x88(\xbe\xb7\xe6`\xcf\xd3\b{\b8@\x8e\x7f):\xce\x8c\xb9sw\x16\xeak\xc9\xac\x19\xca}\xb1\xa8\x008\x9cb$q\x95zG\x8d\xd1XA\xc3\x93DsK\x16L\x84\xa5\a\x9aT\xfb\x1aM\xb5Z0\xb9)?\xa4\xd3\x18', 0x0) mount$bpf(0x0, &(0x7f00000005c0)='./file0/file0\x00', &(0x7f0000000a40)='bpf\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r3, 0x2402, 0xf8d) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000200)=0x80d6) setpgid(r2, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f0000000380)=0xc) getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f0000000600)=0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x4440, &(0x7f0000000840)={[{@mode={'mode', 0x3d, 0xffffffff}}, {@mode={'mode', 0x3d, 0x2}}, {@mode={'mode', 0x3d, 0x2}}], [{@uid_eq={'uid', 0x3d, r5}}, {@fowner_gt={'fowner>', r6}}, {@fsmagic={'fsmagic', 0x3d, 0x75}}, {@subj_user={'subj_user', 0x3d, 'locpuset'}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@obj_role={'obj_role', 0x3d, 'bpf\x00'}}, {@obj_role={'obj_role', 0x3d, 'mem\x00\x01y7swaS.cur\x89\xc9B\xab\xe3\xfarent\x00'}}, {@audit='audit'}]}) getxattr(&(0x7f0000000340)='./file0\x00', &(0x7f0000000400)=ANY=[@ANYBLOB="1c6270660000d39ea615760fd8b2ee256649a3a5c1611762b49863e2f34786"], 0x0, 0x0) ptrace$cont(0x29, r4, 0x7, 0x1) getxattr(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)=@random={'security.', 'fowner>'}, &(0x7f0000000640)=""/95, 0x5f) umount2(&(0x7f0000000800)='./file0\x00', 0x0) umount2(&(0x7f00000001c0)='./file0\x00', 0x1) 04:04:10 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x0, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:10 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 2450.282692] binder: 21779:21781 ioctl c018620b 0 returned -14 04:04:10 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:10 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x0, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:10 executing program 4: r0 = socket$inet6(0xa, 0x3, 0x9) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='mem\x00\x01y7swaS.cur\x89\xc9B\xab\xe3\xfarent\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f00000019c0)='bpf\x00', 0x0, 0x0) mkdir(&(0x7f00000000c0)='./file0/file0\x00', 0x0) mount$bpf(0x0, &(0x7f00000002c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x20000000, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x2001002, 0x0) fsetxattr$trusted_overlay_upper(r0, &(0x7f00000006c0)='trusted.overlay.upper\x00', &(0x7f0000001a00)={0x0, 0xfb, 0x1015, 0x2, 0x9, "6ee0bad6c58ab32eea96994c7c2ed2f0", "0f9e4dc144388d3fdc1976622f55c26418e8961531c93df28f8bdc706f4ac4a00656ee8c0d2f00e36b487199d37cfc0cedcc18d67289352e8d51c1767e9510c00ea9d060e05d469e0dfe7d96e8e92ac8f7c2d123d8f15bb30a1823141c4099b2168eadf369b9be35cc246a1468f47b7821aab9fd421079b737f0e507087083653217266d9ac17d7c505959cbf49378cc8ee51138a825aa71b4bfa710d531d81b452193eac90e02a4132a67d57496261f92e22dfc3834de80199d0a9c5f4c4b34cacf66b2e96b6a4cb3d7267fbdecb7958a2d9a01d09ecb9dc1af4409fa1b6667ec6cbd2c4fb347fe798c6fdd17e8fdddde16ca5415a9d34fd50ea104a31bb7ce10b05993b50d057299b31708d9e690b477f1b6791354366a3104160df6048e05222671bd54e8e16a4131f5b5cfc1ab69b9b014fd427bb2b0a0557738515da497c8b4a1ccba08c4fb843d83ffabc5f6d2b46d566772ba73b7d6129cd8d0dc043056ed47b2f4837439fd8de12fe2d721da60bd1d3bc210d0aec5a1a851b95acddc70225441fb4cb4966cab20299c5c483f3662b326b1109109aeaaa198b7b2b4f9a82b73c38789146e1b969992799ed22c217816f20d323a36181c8f5b8b0a28b8fe0ac048852aa5cfbfd32d5bc15b7d31b48a23ce5ced952a40d3b1084e5ab5dec36acfbc14b4d61b0a5c422585d692a46222708e2c863bbc4e084d39e8eb08728c01fd3210b628607c06e17a7f66d9e7f80a723df35033d279f6eed32ad184ebe5112ec2e9c5235daf257c976ea99b3e5b4a53f6e3f0e32d3245e40a2ceaabab1f1a1acd5a013f7c03238711ecc03e5f6e8d3e54fba59f5e48016c56ef0ead0671022f9a9f00f950d04c75cb2e93411c18ed03797b317604c5d9fd5079a67827304f4a2b6bc2f33bf7363a7bcdb567bba888f8c7ca317b41e72d219fbfac1d56e807c29384f7ae9f082b408982e17aabbc794f4bb5e23c1f873eabb6d31250e9bbce6b7faccb68075b8330f74f06824963b7080358ffe1ddc0a4da35cc44c0b048daf7be90da6ae6849a9ea59cc72643c4d5a378e2be268bdbb26c18565df2d7c6f50d399c2f2a4ee6b5ddc2cf0e0a9b54b9fd3566ef3641fe87a240c7cb9ba3b65fbc5ba95e9de6a99f76abc0e1660f197f13ff61b462e50cf42f76b3d41088aa1876a2a92bef5dbaa222fbf22ac789c2ea6f2f772d51158ba5272b2da48f4e0fc821f362011738115f0a463d7fc324f7277b43efd66a2a54e65a6ccfbd9864438aaa57625d9bb735ba8ecd12240f31d7444c8ca61e7393916e6f8cd9724d306f4a55b3cf8f2c007f6b2ccd65b67fd2c43f6e344df7ae84b1a40411668612d199042c43cf291c39ac686d8d8ef4ecb1a7d80a2e8f7c7a2da903d4e9521ce2f36cb7f9044f0c954e88e0ce77921483f712fb00a9ce21e318902532555851c1cf6f37982a01f72d42217545e5b7298a1350dce81b6cd765436a751068ccf7c608a6150283600cbef5142be3639c45fc4f2dda2e19493e88ddba5ba8c50675c02a79e83b28b338d06d414f19b44d467973aa1aa7a328e5e83d6507db0be6fb9c538bbf1d80e59f8ece1b6c20a792068b88598205144496d3912eff333517c16ba83625ea640912331a50d07ec9156bfcf4af96818e47458bcefd19c5bbb7bdd02f4cf112a68ee69b77b619805b4d17d2bcbdad9e51596eed7501ebc11cdb12bcf1d4f4d90e3547477ed1276f33a4a8a32bbf9c7da774452ee213aab9e734071b1d00f10376f083b87164e37ea19fbad88b7b657fc435ca4e7d7caa808d24af6b6cfed48f84a07cc0eb44d0afb537d3fd7d49be824e0d3e16b580cd2c18f8071345e1bc5c95e7d4dfc0c69a6d5f6f4f4129c0ae185b8342ea7e9aee61afa75df5442a2598bef3b3240c775901448c2cb984ff1c611ee7dac3ac20ae6870123f1e3f69b75444d25333cff343caaa19f196f10d88f5846f1be08d55beade7722daa42e816deaf72e17d7d30a5abf4167ed0842749244c196bf7400f7f47329d26f3a60c25392bba37a345702015b7e57e469319bc2189d4dffb261cde44ad00dc66e184dea1015270a7ffd50b31fe9b9e37b3195038c9e4a0719c652c933ff13d0de6b569f4df0410fd649ca277cb0c4439f3614c7eaa94641649dfd3705813ecea47d5d1184f5362cacde8a977e544a38230ab6d09dd7c4f01728f49e2163b49a49781750152782a77c31eee5aba0ce5b9ba1eeceaec11610288c49a83c07c5142aee1b9b367681890725f6965f3c42b54073f2bce66e0d7ccb531aaaf59954dfc28bb98476215151ce52165941f9a9c526e1b51d3c01b38969e4504ac96a2dffa3d06100c56902d11f4b83922492c6e7cd71c163027edfbbe37d8d96ab169d6a94a6d6372d884ead939902934947817999dc1b3c96210a275084c4b2bfbb382d1d152373c072863ae17923c85d6b48b64bf648af3e5972501d6fe084049c007466dd903b541db18bac26de4f5a8aaed31bc7d36f83c2590dffa7d615e2e88dc7385e473f30c912fdbcd62602fbd6fe6a8a8f5742271be41d7ccb9aac553f700945725857b3e24c3cdd399ff7d86bede746334ff1c7697a60c8b6dd7d68fc22802b9ab2262da6fcad2666c433c237b55ddbe13617de932b6950d1ddff789a3309753dccfaf6fe3a0c21186e15fe62c92cb45e73ee655a02cca9db24d7d8c27ade2342a77e6ba94fbf95c38b3641be5e409bbeb1e6b8f997bacace31ae8c9a621b2a7fdb5d523db12073690d91df6de235aa867ce8159b34896f9e7f89946d39756025515f79cb64371684c16f644ed4a73df5a48bbab2208f004d54023f7035ecd4dd5423965c615a2327ba9fc57c8918c6db7fe4fceadd358ca41b41693cf9d943ee2b762b273c9d54f1a921944adcf6f8d4206fdc8ec8d56f7aca70d2f9ad6c72d87967675e26540acd7eaa861f12fb4ada75d4e5fde965f33ff2c3e6ec4ccc52acd28df2187950aa92de5a3e2d3fb1b63062acdf73e8614b23add9b5010659cb28f2cb1d14cfd847eb695c53b2d256042c1e6ac2cbee413525a68f79b2fd1294cbae8905e7f18efe88c0d088a71e06700201463f81b9784bdf7bc73e16d2792eb749f86d3a82aed0b15490dacf4fb29f2d2cc1bb5faa7c739e13f33b344da4c1641ae31966ed02eb85f7b1733e32605725428d613d44ce2b76df8ad9924e7877aef679e4cd934fda93df78950668036ea6405692761854c7b0be55b662e71dbf9d029d7d4b9860ce9f375488faa683b55f1ac197255e8d2229b468ecdc67fa1c2c47e0d252b9aa4e934317dc2bbff952cb77a7c0e9ae43b3eb518346968389c8db15c9e2a779958cc17f5d5e95bf5894361c66405b1668f880b8c142cbe478000d7f9365e261a5377126a9b0b36b90e9127b29e6f1324c93d287be8bd3bc27c86c73c25d1ef8cb8ac51d7efb67aa4345e4bd75f28058ba35dc0629ccab37499132282efd3c3eefef10033e0ee364ae6a64cf288b9893e370bea0cd3b0dd8c4e06c1823bff56bdb84e1b41255f460f2033542703d2c2386de005dd083ee1c65a2fea3be36a0fcda91a6ad113937d2da273995af637c785e0e1c325c130721828349f3929443969bcdc5529dc3a89891a43c852828a1c4f80f4e18cbc1c26016b916be948cfb6c6511e39918a7c173a5efb0a802a302e1c9e7a2957298121884c6b6ef0e043233d16b7e8b270fcfaf4a6538b012b4bfdd0639a812e88a487ef336bfac378d7ce86b6aa1b24d0c1fb2ed5c206d4c123eb7d11ff1e209935e1fde695279d2780d553d1a028d1dcdaecef7024e3159c03674fbfb7d99045b38240ce02862bf8e6bd1034d143634470c5cfd89f3df07a2e59d7a038cf9b83f054d2fc76d2fdc4d4b60dbceda0b04700d63ece10ec6eaef9e4691013b612dc5530705bda1be58683eab221faee0e687a1e48c67a444e33fe02948aa0d7deb280bb10181712202e9e62b590f52ad1d2b62b9c0afa00bbef24ec01a29d1b88dc2015d5a05bf2fae8f05a4a07e070f9c0a0422b74bfba41fd1c1c987ebf16e62bae649fb54e62a9cc04642bc6db71b2a88f025873b071d71841c86fb9229c44199e6ed6ee767d62d5e4d20aba570fcabd330dc24525181435cdc0a0a951f1aaf296409cf19a4114faedbe8f6645319ce35535772a9e10a4abc264119286b95c3a4512887d2181813f149dc01cd7adae79a1a80b8330c8ea30aa4c4d993f5d579003b846cfaf99744ea048ad4eb3a36aa6b9a963632428706dd7f87f4be568896d82c353c4954c113f9e859c1662eaa6c857fa65cea7b27b0d8b0e8e0fe15c8bd81beeb85be9fd3321f6ec00858ad3b8cde8caa1b6650a9bd9b8dc99c07b02fd81af427aa2cc7c3bbb46e2a54fbdde41e823303509f482f6ccaa29c82b0dbd7838a1669c5b5efb9dac0deac5b3e8902a7aa8dc07124ea959e19389450c890133e21aa82a8c13ea9b1c51aa854b0e4c797ea2288819b7c8ffedf23452fe9ce3cce6e4357954b00f60e4eb9412bee2e37b2609d19e98fb1a6b4428095c0a8f9d5b1e04de81e2988ff1e7ce007bc87b3929593539b8dc0923accd3de5015a9e0535530090dc777ef341c2fe3103f8b4642e188b328e09d6845b973a1e59ac6dd33da088b790f88bc150f0422aca2073b6456359723377a7abe915a7ee4553f0f230594a97c96854d2ab61cb9c435f5245a1fc9deac65899d977617bce8d38552657a821bbc7178862ce6f90c69986612b49fe58ed108a8e3a2b359fb0f2b806d0bb9718938b0f24da0979b65d4bc3191b25f356ea2c179fad2e9caea174668ac643aa35b9f51e256ed7f843481a3a375ad4e90eb6b3258ccfdabf09524d22679728999378c8e30bb1b1f0483c3c336e95a46c2810a9390ff10d7d018312d1d4c90e2a8ba986ecfaa4e770a854d0387b4245ea205c51325470a733b03db99e65bf52c8c70b282f596cf8919f479f586a68c26960c3d5028f93280f839eda54e95f56c5582723284bea7e4855ca849fde0ab692d5ffe12e09306d135554bd50d9d0f18a75e2f055f929ebfdb3670b1c019e6cd102561bf9313f0355ae193582bda9d5a5b4e4ba76f10d2818a9281d40dbbfcd1051851feb40f8cfa6680f117eefea99ccc1abb2a6d7a07ac9bb3bc755a3ac9812917e6133c1a0e79588456c2d20a5f441e10f461615d2ce2589ae27ff3a43932c75d66f5a29c0488fd5dc09963d34dc842c88597fa1c88a20a2aea20b00a97f4bc9c881bd66017d5c1a10674af0e7cd46d2c56b0834ac9e1a67c736fb62fe43b70792bbd59553867af9ee61593aae2460934be8641def8df8de3589c8eade3ef5f15025dff85959eac6f2453b3c364ea79ed9188512ef7814a3955cbd3865866096f6c01f43b62fa752b2d4133d3928bb7057e279bdfa173b13d11c388a032a26c42ebef978a6f628e2b4c1a92137f26d62dfce9aec72010187b111eae7ebc261d742ed91fa4ca4623603d48a14185f55c8e27dabad91e912d132308535354ef23ef5235952c0b621b8008fb747d305e3aa5ae6b6066d01b331cba5bf73c1a1922ca867dff08c344af416e77c2691ebb5e73deef8bdf830d8556e636bc2863335723c13e8bacdfe29d19566a8dbbb4098df55d8a6976f7b34b965d4816616da2430ffdd0bb562484dbbdc2dc1c2a5a97870fcb1e0436d4bc9c3142998b40e98331746707533f7af964b2b57f1601378d16eba333090a949a2270225b4d1e1a377b7481227771f6d7997b6673186469011091de3bac4"}, 0x1015, 0x2) mount$bpf(0x0, &(0x7f00000003c0)='./file0/file0\x00', &(0x7f0000000580)='bpf\x00', 0x80000, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f0000000240), 0x4) mount$bpf(0x20000000, &(0x7f0000000300)='./file0/file0\x00', 0x0, 0x5004, 0x0) mount$bpf(0x20000000, &(0x7f00000004c0)='./file0/file0\x00', 0x0, 0x588e, 0x0) r2 = gettid() setreuid(0x0, 0x0) r3 = memfd_create(&(0x7f0000000a80)='\xa3t,\x13\x8d\xd3\x84\xa0\xbfG\xa6\xcb\xcd\x1f\xafzf\x00V\x18\x13#\xac[\xee\x12|\xc9\x12\xd9\xf3\xef<\x10/\x8b\xcf\xdas\x94 \xc3\xa91_Q\xcb]\xfe\xa3e?\xdd\xae\x88(\xbe\xb7\xe6`\xcf\xd3\b{\b8@\x8e\x7f):\xce\x8c\xb9sw\x16\xeak\xc9\xac\x19\xca}\xb1\xa8\x008\x9cb$q\x95zG\x8d\xd1XA\xc3\x93DsK\x16L\x84\xa5\a\x9aT\xfb\x1aM\xb5Z0\xb9)?\xa4\xd3\x18', 0x0) mount$bpf(0x0, &(0x7f00000005c0)='./file0/file0\x00', &(0x7f0000000a40)='bpf\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_REFRESH(r3, 0x2402, 0xf8d) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000200)=0x80d6) setpgid(r2, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(0xffffffffffffffff, 0x6, 0x23, 0x0, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000280)={0x0, 0x0}, &(0x7f0000000380)=0xc) getresuid(&(0x7f0000000440), &(0x7f0000000480), &(0x7f0000000600)=0x0) mount$bpf(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='bpf\x00', 0x4440, &(0x7f0000000840)={[{@mode={'mode', 0x3d, 0xffffffff}}, {@mode={'mode', 0x3d, 0x2}}, {@mode={'mode', 0x3d, 0x2}}], [{@uid_eq={'uid', 0x3d, r5}}, {@fowner_gt={'fowner>', r6}}, {@fsmagic={'fsmagic', 0x3d, 0x75}}, {@subj_user={'subj_user', 0x3d, 'locpuset'}}, {@rootcontext={'rootcontext', 0x3d, 'system_u'}}, {@obj_role={'obj_role', 0x3d, 'bpf\x00'}}, {@obj_role={'obj_role', 0x3d, 'mem\x00\x01y7swaS.cur\x89\xc9B\xab\xe3\xfarent\x00'}}, {@audit='audit'}]}) getxattr(&(0x7f0000000340)='./file0\x00', &(0x7f0000000400)=ANY=[@ANYBLOB="1c6270660000d39ea615760fd8b2ee256649a3a5c1611762b49863e2f34786"], 0x0, 0x0) ptrace$cont(0x29, r4, 0x7, 0x1) getxattr(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)=@random={'security.', 'fowner>'}, &(0x7f0000000640)=""/95, 0x5f) umount2(&(0x7f0000000800)='./file0\x00', 0x0) umount2(&(0x7f00000001c0)='./file0\x00', 0x1) 04:04:10 executing program 2: pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, 0x0, 0x880, 0x0) r4 = perf_event_open$cgroup(&(0x7f0000000100)={0x4, 0x70, 0x0, 0x4, 0x0, 0xffffffff, 0x0, 0x0, 0x8000, 0x0, 0x8, 0x100000001, 0x0, 0x0, 0x0, 0xff, 0x4, 0x0, 0x0, 0x80, 0x77f, 0x9, 0xffffffffffff774b, 0x0, 0x1, 0x8001, 0x1, 0x0, 0x3ff, 0x6, 0x3f, 0x0, 0x81, 0x8, 0x4, 0xfff, 0x0, 0xffffffffffffffff, 0x0, 0x2, 0x0, @perf_bp={0x0}, 0x1c8, 0x101, 0xb8, 0x3, 0x2}, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x4) ioctl$PERF_EVENT_IOC_SET_BPF(r4, 0x40042408, r3) r5 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={'syz'}, 0x0, 0x0, 0xffffffffffffffff) r6 = socket$inet6(0xa, 0x3, 0x9) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x3ff, @dev, 0x6}, 0x1c) setsockopt$inet6_opts(r6, 0x29, 0x36, &(0x7f0000000000)=@routing, 0x8) ioctl$EVIOCGNAME(r5, 0x80404506, &(0x7f0000000240)=""/110) sendmmsg(r6, &(0x7f00000002c0), 0x400000000000174, 0x0) stat(0x0, 0x0) close(r2) write$binfmt_misc(r1, &(0x7f0000000040)=ANY=[@ANYRES64], 0xffffff7c) r7 = socket$inet(0x2, 0x3, 0x7f) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) bind$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @multicast1}, 0x10) splice(r0, 0x0, r7, 0x0, 0x110005, 0x0) [ 2450.335809] binder: 21779:21783 got transaction with invalid offset (0, min 0 max 24) or object. [ 2450.345097] binder: 21779:21783 transaction failed 29201/-22, size 24-8 line 3348 [ 2450.346180] binder: release 21749:21751 transaction 500 out, still active [ 2450.514541] binder: BINDER_SET_CONTEXT_MGR already set [ 2450.520315] binder: 21791:21794 ioctl 40046207 0 returned -16 [ 2450.529955] binder: 21791:21794 unknown command 2097152 [ 2450.538755] binder: 21791:21794 ioctl c0306201 200002c0 returned -22 [ 2450.550855] binder: 21791:21794 Release 1 refcount change on invalid ref 1 ret -22 04:04:10 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) 04:04:10 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:10 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:10 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:10 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:10 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:10 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) 04:04:11 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 2451.101085] binder: 21819:21820 ioctl c018620b 0 returned -14 [ 2451.153589] binder: 21819:21821 got transaction with invalid offset (0, min 0 max 24) or object. [ 2451.162830] binder: 21819:21821 transaction failed 29201/-22, size 24-8 line 3348 04:04:11 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:11 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:11 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:11 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) [ 2451.207482] binder: release 21791:21794 transaction 504 out, still active [ 2451.396644] binder: BINDER_SET_CONTEXT_MGR already set [ 2451.402403] binder: 21827:21838 ioctl 40046207 0 returned -16 [ 2451.415526] binder: 21827:21830 unknown command 2097152 [ 2451.423142] binder: 21827:21830 ioctl c0306201 200002c0 returned -22 [ 2451.431662] binder: 21827:21830 Release 1 refcount change on invalid ref 1 ret -22 04:04:11 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) 04:04:11 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x0, 0x0, 0x0) 04:04:11 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:11 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:11 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:11 executing program 2: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:11 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 2451.917632] binder: 21875:21876 ioctl c018620b 0 returned -14 04:04:12 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:12 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:12 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x0, &(0x7f0000000080)=ANY=[], 0x0) 04:04:12 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2452.047719] binder: release 21827:21832 transaction 508 out, still active [ 2452.233921] binder: BINDER_SET_CONTEXT_MGR already set [ 2452.243843] binder: 21886:21887 ioctl 40046207 0 returned -16 [ 2452.259479] binder: 21886:21887 unknown command 2097152 [ 2452.269848] binder: 21886:21887 ioctl c0306201 200002c0 returned -22 04:04:12 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) 04:04:12 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080045000024000000000000907800000000e0000001000000000401907800d7050200f534756a546014d3de8916e6bc302bab836f31b85e9672e7c51c007a5b5367571cf1112f8f0027efb6af6b4b272859b2bf426ee47681822c2f0be808455c2b7eaf0a577c1630ef52434f2b1f7f5bd034abf4bd98d402ef67930fbd547686436d3d7e37c276e0007315b91dd7a42a3c5d96f69de479c10205c1f59f8b70f0715dc4049306ec38680d6b512ae63a7ce1fbdc967c8c7d0b2a57ef1406fa84b65f1095fa884e47c0e4"], 0x0) 04:04:12 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:12 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2452.278599] binder: 21886:21887 Release 1 refcount change on invalid ref 1 ret -22 04:04:12 executing program 2: r0 = socket$packet(0x11, 0x2000000003, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x400, 0x0) epoll_ctl$EPOLL_CTL_DEL(r1, 0x2, r0) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:12 executing program 4: r0 = creat(&(0x7f00000001c0)='./file0\x00', 0x7) mkdir(&(0x7f0000000140)='./file1\x00', 0x0) ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000100)=0x10) link(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='./file1/file0\x00') 04:04:12 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:12 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 2452.724959] binder: release 21875:21877 transaction 511 out, still active [ 2452.735572] binder: undelivered TRANSACTION_COMPLETE [ 2452.744500] binder: 21924:21925 ioctl c018620b 0 returned -14 04:04:13 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:13 executing program 4: open(&(0x7f0000000140)='./file0\x00', 0x40c2, 0xffffffffffffffff) r0 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$FICLONE(r0, 0x40049409, r0) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f0000000040)='./file0\x00', 0x2, 0x5, &(0x7f00000000c0)=[{&(0x7f0000000180)="3d3a06292ef18d9e99e866ed53565b52f4e124e3ea883497b96498ea095474ced21641899a467f0403792692f4275a58bc347616f2de8488d2fbe2dc670455d11f4fdf56daa18cfc20a6cdab66cd9193c4bb70c6123ebd175244ed37589adf5f429af07799320d0564b38f4c159c9e27753d235047d31639d440ceb1c930c9fd97a3c5f2790e4aa420c65c7c25fe7ae3b7940026a726775c0bfc0396596035d1bd42", 0xa2, 0x1}, {&(0x7f0000000240)="88b5be4a61608b3f2d49bdf34da629251bfc1e3e61d09e47104919aeefab20e8ac00cfe1ecbd861b8c3723cd81f256b81083c60e0d804d84f29328c3c37a65a01e496d3ec7482107e708613f8af70b4962de50364e2baa3e9964781aa6917adce1479c6cdb9b496a1fb8b2d6bfdb9f6fcc18ec2288a44e91e9057e35aa3e564fbaf34f32dd5a57782cfdf79007483335cf1ee605b5c9ec84659c56067f12ce7de8e25f02f9f00bb95c3dd813d2d165528f09386eec00c60501ce5880df3de6e8e7aa951314db773e9873960f09ae42bfc98711b32c76c358751a2e06aa1c63f5b06e90746fda426e9454a636e65a136835eff5313497adfbfd05765a9e", 0xfd, 0x9}, {&(0x7f0000000340)="6dd907407776885bffbb618300ae6a8f2b04d8438840703513ba1fc1dc822ea585f1e1a864f404ded917831b0a9750256410069edc166e0d31aebad0868005bdeada7280704fac8e34fa10d5232b747e23679b523fc8658f550c7caaab68d99a74ff453339059df4933c8ca79785fa313786cf9f142f3f8df1641a06fd4f224149476823c03422017368a7de13d783a5e68262913f7f15ed9acaf8ff9c1d81504e1c1f636b84f5431e25f0408e40a59af69b2d46bf856cc9a0716a4db97c5c8ec93ff5a82ae5b8e0b576f64b81d1b4ea88e2ad8e7f210ddd8e0eb1bce55c7b380d8433f7ce8b0d0c8a32ef5ed88cd595c940f9914eeb2f47c2e37bb935e155c2c2c75c696bc318b517b62851956fac8fd6cc1ba130ef0fbb69051f14124dc4062e537a1566d887444b4c8f60908e4c5e6e8289856e576d12287e37497887bc4fa048c79b9f02bd94848ebab7d31cda66f3bc97b5d73ca51e4d90f8998ae175d6dfafa7c89cfcbcb3357e3197a7caa73b6a1347567c52b48d9fb42438a76766e6eebea15cd737fdc080481d2b89c35d30c297cc5ab7e8f7e57cd809c62880164aed088a499aa0bf9fe4a5145bdeec53d07bf85ab9c8e39f9cd59901d2872bad813640054dff715c2ca440e03665a59fe43318d0dfada81b631f0bc6b13ed0039145e05bd98b77b21526c14480dbcc613001f908999325918c1f58b0d741378fcf85d5f956cf26ff021927350ac36e4f41c289cd5d38c344f7f2fe9f0ffc2b82c16a4d0ab315c7fe1969acc4e99b2400f07df1abf03095de3161af413fce2002bb39b1f11dd9148d546d3be66d386db8f1e64e43c4a1155d5b6b9236f10bc813473ffbfc0f2b5f98a4d9af14f847f471a1dbb7f22f090c32d06e553f0e1ad56f2c2d4bbbac4b80318da423d02fd0f88ccbf6f55c7e7245452e6f3a18a3ac8f81480a34173ca963762bdf8dae2cf19dff39b2895bc912ff3014ab614fbfc3b786c7d0c12c93be65d732d861419958815ce40806e0197c3eff4e91bf47de8688e7e92c9b3c9013cfaa8eccc7ead988c275ea14a7729b59a1644cdf1fc1e09e5c1cb04d215d741d8968b0b110993e18e7d2866ab31cb9db3cef9f738375ee8720fd1980b731f743f1a4f96ee94920e0b0160ba317dc8ad523a48d271a68aa45175c0d75b0e8797b3da16964500e1acca4b6ccfc32423f09095b5037e8f51c4f8e2f7bb842b7ae88b9cb741293e3cb60b857e9135a9d2dfe3b1a02a9f9c426460bfb9ff456cd590890517d1cfdb6d09c6633ddaeb6d02903b893590bdc6d48b68d472c13be90fc812fdac9bd29f1ecc086f57505a2e9ee784f81c4bcd826390e6773dee85a52f7c6cfb36593ddf9f6896af3f1db1718a9e672f377e7fc9ae900be674ba3aa62b75179ff7f97aeead0a2e4b8a980f8f5f3790ab42667d58d12599e0d63f29ff10c3b194049f1f37a9fcdf12d98a9a7db2557bd253d4ab3e3206ac56908c670001b2b386994e054badb93270430315196de9f5e54c305349a88f0e4425bebfff168018738ca4f6b9b4376a7475e077d4a7c9f0dcac1c1142850515b733ba1f5881266080b74786cf3b98b9ecff20486a0ef72ccb1bd73b1a2dff7e379c1371e0eb2f4fd5484ae6ee2604b46fc78909f46feeee7c1b22d5e3d84f09e226c8ea0d4aa3e910c0095f24aa5b66f7e2e7a57823111de8b455cf31bfcb4d3ce347001b1154e11f35b73d0d16e2e7f094f96da8a5b04f89f21bbd3eb14ccf896203c96c3632a1700989ab72c6ae18c8a5e400029d4fc96a86eb9b0529660242dc3de97359f57f03694b315027fb059d8c0ed4e69040c6b2eecab41b33e5754b9fd5ad53b9a8b2feffd9f8c4c3ba2c7aa720ea6897d5a2a87fa53273241637b1031cb6de2aaae4aec218af00e234a66cf57035d9a4b0966d318ea104c39a09357948065f1680507be7bd15a53413723e1deefbdaf644f56a87ef8ee5b7ad988b750aa367de3e016c51fa6bdd183900def1dd913a8e3d5998a7b9e17192877a75471297919c23b905026033b780929a76a1e9fd1dfdeb39ae243e98a0f9934e6ea377032060aebdc539dd83fbf7bb50bbde18f0d2fb05069139d5538f7177a291efda6643492ec5576bc1f71a3877b00d645d70dc0c71cbd700c740700e2f728b99e1cd1fcaa04d6606698ab9c121d55993265c886aeeed9b4f36cda4e10e62437c01a3f4530d3bfd1c1caa4373ca94a459415727e210c7ea6d7fa39754cfa0a124e1d705ddbf759aa1ea93ef8d5251c24902ac1615bb5627053f6180368c258cac1f6f569d6644ab0c40c64b0192bcd2b013c5b8a49252a45092fb57bbd06a12ca84eefd9da9db8ea88d3b3c9efa2deb8e8a141151c4135dacb544146c268d369da1cca7caa6a0d63d9e73a5a90cfbe065cef73f5b8d00651123a2c8bca659ce30c1428e445e6bf0f5bb0dc449a3703d8efbd112178d69c9ac74f7b1fb75f2fcdf4009dbf23ada4edc10c3898425e77a2af9dec62227aae08a31a5cf694269d6d65e5acb8ff5928be06febfadb652755633f59f030e898f1cbc5ab3a751e6eb8a0a3416ddd5bfe23528c43d487c90f073ce9ba49b4a2873e18d95b5b804353f6b822bd8d6a9390d17418e26a356d98468534e46455a71a0c863cffbd558f952df02285f61b84cecf62468f997b3c19a18b7105ff9764293375b05bfa2076de5cb85d677f515781528e5957bf01d84b1143a4fd86d330525b33eb006f52c6ab210845683ebc3672e5665bb63659129372a6c38b71585113e264eea3373fb23275386c1e1dbfac08f82236d8d6dc3ed477bd2cac48d349b8e3e08490b571d23ef5483253af4028f9cbc418521ffb0c44e4ca708a98194bc38208cd825600feab2e8cb28b6af9db2cad40bdf93651f3b91bc0c37c58a6c993b6ca7910e58e19c3cadc765fcaaeeebdc2df5fc1a2f5d5da3cd191763c72d3fd2808a60bc55c3a6aeed1932cf37879f9f2f00fe383d34040c85428feca0f267aa198c498e099b7f922385244bf14931d206610e6c0ef3ad938544caaf0e4f9200df63feb7097ed7f95b32f7568fcc35135501003dfc4b52b27ae0f7559902941fec231e0ac8eb2797ff31abadb3648daf445c7ca8db1b498e433a45b7dfa125d7814d7dbecb27e9f4f92161a28d7ad0c10332b29a4c9fc94e2890e24b2a01250699b1d8e84b74641aefc9c2a39e2aec861611bb12faf9fbdcd8f6c43a57363869671183cbe467832d2969718454eca2201207c733b530cef00fd73f1e6f80a304dd0e376a5dcbbc1e9dd1351c0b702ba8971c83d5a990e5752b6ad88775818b86a47c711bd18e8c2a98ceb7d78674d12c948cc2f8feb33a485d8b0694f2b135a8434a5cf5cc64d171726bef48ecf91b25b0184bf7455b11d6c6182528597ad94d8e6014b6bdf5de389db95ba784cd32c729a3a147339a6e4bc7f6d793a0b84016a1eab7b941318bbd34a5b9ceffd310ac617a4ac261a17090ea4d77f0072504561313585201d56d28906c9aa6702b8d1cfcea4615718dc201ab09805a18cf0d071c08f155a2b98494d3ff08d861a3164eeb2f2cc906d02578543fa12fd7a4509fc4c717b03f64ac0b602e7ab0fdbe648ece2274e85c0d9eae9a61218709652ac86efc3a3a2fd9582277d0b91b19301025274a9ba52d4b1237f16895c250a7fe69b0e028dbf2cc7f3af850a4cd8a041d47c7299e70cc96ddd9d1a077386c42acf1b96db22307e96623138642b632a47c09b422ddc21408f58e7eaa3179b4853587cd4126a4d9e198be9d2b15cf17455706438a7a44141a99ac51b41c22d4c3a0b251895ff60bda485c64f9c60f1b40586f179f22f5ed463e1100c49259c0667d2938ab09535ee03493160f99683938f70bb7227f6645af68f36c5b1ba8f6022c6c7ffba1509348861d34a35f10274de362091c46eda0f56cfe74cb54a2dbf6c202710939f5b42d6724aa00ec5594645494fc4170f2cb88f3ef46a6e659512296e6dc4be1400f460198cffc03ae01da262dfa209786daf82780b25a1ce31c3e36a9d7ff33e71992650101b30b34ed3d2d157a6cf323d4eea85830bc8bfc04c26d85584af582d84fc306434324cb240f63bef880a16853d6da75fb53a4b237d6a85918eb8d3b8dd126925fb3c63ceae02ecda45116cf35bf56c32976b38a51a2cbfb83b4a64bd2a045317b088ba396a6f0343f14825eaa4522a6e86b8db8c051e89cb97395ef59beb7b07df00c7e53db8c2e4183a24eaf6fb6faac3b38f2e31386856bccd93d5c24e705acc7029f7629ca55102043d5ea02934d130c36ffc96864844cc0d5881f2cb2a0a42e995475eba2247cbccc9b9624be527221f0f37a98bb67a7549371c739b0845ce04d5785de3f92d0226152cdd148ada150571c7e0fe24336ec7639405f8cfb7fbb337e87328d21d803c839b73e0bba41a2e3e3d83dddf1dc921d338881fa0886aa6d88ba69513ca8cd32519077fd5e6864cb2e314fd7d1bb33bbd041abf85146b46ebde247fbd0a4b491ba869f0917faf47516e3e849deadcd2c099cb5f94e14cd443d8e6eea9225222572e2b07a17d1f241f8e54397aaa2f1378a471168352c2a22c05c3d5b9cbf9735aaf74e4d355bae69c0048962596f68287c2f472e5426c10b4f383a1ac910e610ed57f5d038bac8e9d76316dc1cdf70174eaf335ff847d91b514022d77b246fb5c3ce5e3db36537875abaf314dacf860f2a7bcbb7d4620b8a2a2c71a4728a27bbd8202f2c1ddf77894359b24bbe8d7172f49b53ef7c5001607f6a6271eb607dd9172ead5e01c6d45e0e754934ff2b12f87d671e63b5ba2df877482dd1d9334c84e9bb7b7141af6d04beab504f2d88890d4298920fcc5a6c12cd08587dd2f252ba96c8682cabac63988afc18f1d2d0d89baa4deca10acb0628625411fec44ba1f001f8440d290b9fca48fffcf443dd1aa4fdc2a5b7bd5bf5be65074902902a435a8a6022866389d1dc5996059773884cd2c27b1ee1ace821eb54a1325607ab86385d3b860b57cada4b5cf103369e7eb632e38e9d264b41466b807d534b1b3062cec194d1d94764d492dca328be91efb95e0e82860fbba371b6db354622565e72d4bf9a32c564109afe6e3eb2f7103e636417fc0835d9e5e217ff6d24085bdfd0475df72fa0028987012ae7cee6beac3605f943e14e022f6028d4f9186db1bbf8ae8fa12671d6d6ab2172100394792ec6be4c226cffcd22fcc4899deae31f4fe9dcda14e03fb01db18891dcea9bb3bf688cfaf55563ac66dfe11fbd893acad6981252e858a6e2adaeea01a03103db5668d47982f34d94d3792885b150389c100f6c3474c0041f212623efb5df1abdc4e6149b365874cd18f78ebea092d53c27190758628435dca05e38cf3dea1104d4d890d41234d520250f17dacbdc955bc0a329149308b4f73e823e51c415fded0d68ec16d2fd0706728695ef19fec47d282463565dcfbb6a690d32ba6598a092bf86ee0407c886ec251be936a8587c07f64e50bc0dcd41efa2cfb97a164940e8ccf61ef6905628e7dca4d9414dbe4a0b2d62f9d4578195b33ab7bae3c70ef23d37cb22295b59fad3e261d64de3b4761ea0e99fdf7c4f8adf44ab401e3ce8a97090c2de772e035d90b17e30f2f34ed5fb30997fbba753572a81c4ee5668f18966ddcf167a704b0d610fa525322e710b3628db5190f5f334fc01d737d3d5007ec1261e5204c6838d5e8b34f32b4832b10d107e7cdc0462042030b0828ad79264a614c2c35444038f00e3c9", 0x1000, 0xffffffff00000001}, {&(0x7f0000001340)="181f5de1c0ef5717d6bf1f737564a0ecba4ac60fedfde8459ac6a6283167f24d39596190d84edf2bf4b1714dcafae7df743e7ba48b5461d3edbb9f4b18f7e4298b131f51c67077db3adff6fabe2932de59331982360e4f37cd6164714a9bb8b3c86a9e8cbc6f807c690c4f39c58c717b5a663c3924f093ef29ea6551af0b8abc5c20bd0a6de1cf14", 0x88, 0x1f}, {&(0x7f0000001400)="b12970c15babad4244448841d81fd5a6cf06e618b2a817c1da0c82313692c39df556868baa98e86ed6a3445e8b5fb8a0e122e40d30173536c3eb39fce62774fdf4c056f8c561d5bdb920cdaa02f967e40634aa1013c6cf16e3e671759d797232680e6a0012cf4014125c3b3f2614acacebe53caecdca61bee31606c47a3e5c7c66b3315ae87409680f5c2f82e19914acbe69e83510ed9d24b5846a0f450329a6ad277988660d80bdcaed9866d2534964a91a1c03c3249ebefec07423a8ccf65e60334460dd4b43b7d03ab69de73dc5e70e2b5805745f144dcb4f72d937b28ab0cf701012515e9a", 0xe7, 0x3}], 0x2000, &(0x7f0000001500)={[{@dots='dots'}, {@nodots='nodots'}], [{@fsname={'fsname', 0x3d, '/--!{'}}, {@rootcontext={'rootcontext', 0x3d, 'root'}}, {@smackfstransmute={'smackfstransmute'}}]}) 04:04:13 executing program 2: lsetxattr$trusted_overlay_opaque(&(0x7f0000000040)='./file0\x00', &(0x7f0000000140)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x3) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x20000000000000b6, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:13 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2452.910296] binder: release 21886:21887 transaction 512 out, still active [ 2453.073055] binder: BINDER_SET_CONTEXT_MGR already set [ 2453.078528] binder: 21931:21936 ioctl 40046207 0 returned -16 [ 2453.089301] binder: 21931:21936 unknown command 2097152 [ 2453.094923] binder: 21931:21936 ioctl c0306201 200002c0 returned -22 [ 2453.102470] binder: 21931:21936 Release 1 refcount change on invalid ref 1 ret -22 04:04:13 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:13 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:13 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000040), 0x4) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000c4000000080045000024000000000000907900000000e000000d000000000401907800d7050200f53475"], 0x0) fcntl$setstatus(r0, 0x4, 0x400) 04:04:13 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r0, &(0x7f0000000000)={0x6000001c}) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) open(&(0x7f0000000040)='./file0\x00', 0x0, 0x40) 04:04:13 executing program 2: pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl(r0, 0x3ff, &(0x7f0000000400)="062b4981e42e249c92892cdfd5de2fe7d3a9fa81246a8accb01f03f2215b96612045a6bd9b46dc2b5cd297f240c0439127022084c1b7fcfde1dea0b415ac90d72e885c2b8074181353df8d1f6e96fdf5c8c529cf9397b195d930441007e3773f9ce81bd53df2a4") r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r2 = socket$inet6(0xa, 0x80003, 0xff) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet6_int(r2, 0x29, 0x16, &(0x7f0000fcb000), 0x4) dup2(r3, r2) r4 = socket$packet(0x11, 0x3, 0x300) openat$random(0xffffffffffffff9c, &(0x7f0000000080)='/dev/urandom\x00', 0x400, 0x0) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080034a5f4af0000e0000001000000000100907800d7050200f534756ba786b3f6fd3c833617875a3cad84a615f803f70376dae28f67b5589f3ca0fc990ac22c2c6da0c2c1556bc7ed326713db2bb0763633702ff559c2d315de558eee8d318efb5ec1216dc811e179f6d4733f2e15a1c91610de0200000000000000369ced1cf5e3ae1bef05299271bef0ae1544f177a2379aafe6f5101fc8831903133425544b418cdc90e2863b4828b2f25788b31d947b39727523e219a1c056938d659eaf807ca57986d1af4ec40c673f4f50d9dc60c44f13906c214c1e55ead6032472f1f0e1d9f090251ce99ff85ebf24f2b4240fe9dc7e4bdc5ef54842699a000190bb08afa8db1bc669874326aefd0b21cc9b99ea73c4c18f2c3ed2fea2a4e66eac5f5c6a77e1bca7ba081082b3bce8492e8814f7d00901e3b1aa492a4dcdfeec0f72744b2bd306f2910120b7c0f839265c51e645d10433a9a7b54f78ec9f6f992c09f98e6313326aa972eed973df1a308cf57550bfaa3f79c5e9f87e7c8fef4c35454245845492519204b9e08579840f94bdcfe53ad5c6efc5430212ac82998a7ee14b484008a7afda10efd0b59c7514b94b6bdf7913297885532e2b4a76989c2ca3a9662088e01b45ba615e3a0849ff502e2c3904de6966a52d3ef1c976366d31c99d1ad56892d73a13989ce6af31bc5dea8043bdd43515e0fe45d2187fb2af3ef43bbd53c149b62f33e051993869f67e027bfc35d3144ffe8b74d70873dedd92bd02ac8ec46f6a61993939c4d87c09bf5562c925529f2790cfe17e11345340186b0be6f6aef4e2f7ef0676eb250d626da7e9a15d573db243e8897d53e593c589146ea381e0ff7b9b49a2c3427708ddd3e71b68554b36ca3507068ebddbc25b75ac3519edd83e62042a8bd331d2b5e38eb054"], 0x0) ftruncate(r4, 0x0) 04:04:13 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:13 executing program 4: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000200)=0x840, 0xffffffffffffff55) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e25, @local}, 0x8) setxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)=@known='user.syz\x00', &(0x7f00000000c0)='{*+lo$selinuxsecurity:\x00', 0x17, 0x1) sendmmsg(0xffffffffffffffff, &(0x7f0000000100)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=[{0x10, 0x117, 0x40, "5821c589928f2fee6938329d78390b55a085f8ba4cf5e2d400f8d3c9193fe1160b334fb062b50992bb4a0ae6d0824dd5e660983a1df51c293c35"}], 0x56}}], 0x1, 0x44005) 04:04:13 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 2453.544280] binder: release 21924:21926 transaction 515 out, still active [ 2453.557311] binder: undelivered TRANSACTION_COMPLETE [ 2453.567126] binder: 21971:21973 ioctl c018620b 0 returned -14 04:04:13 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:13 executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000040), 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) close(r1) r2 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r2, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) write$binfmt_elf32(r2, 0x0, 0x0) io_setup(0x7, &(0x7f0000000240)=0x0) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x20) ioctl$TIOCSTI(r4, 0x5412, 0x0) io_submit(r3, 0x1e09328e, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1000800000000001, 0x0, r1, 0x0, 0x12f}]) 04:04:13 executing program 1: r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x20000, 0x0) ioctl$RTC_PIE_ON(r0, 0x7005) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r1, 0xa, 0xb) fcntl$setlease(r1, 0x400, 0x5) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r1, 0x400, 0x0) 04:04:13 executing program 2: r0 = socket$packet(0x11, 0x5, 0x300) write$tun(r0, &(0x7f0000000040)={@val={0x0, 0xeaff}, @val={0x1, 0x0, 0x6, 0x7f, 0x7, 0x1}, @ipx={0xffff, 0x8c, 0x3, 0x1, {@current, @random="4d29a23d1697", 0x200}, {@current, @broadcast, 0x9}, "28faa50c3b2433b097dbf89d1c113480f8be1bfd5fc7dda60d1ff55f67bad62a71769fd7ff04d9a7748fd00be620e2bcb64febae011247f81e45554e0ed6a1b4f571ffbaad941698ce0f80629fbeef0fbbdc49fab92c63e350b6a89e7f8210a8cca7628a2a122d976f3016b21c6b"}}, 0x9a) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa0024000000000000907800000000e0000001000000000401907800d7050200f534750000000000dd0000000034a5a3e2bd0f36e9085c8f86a080a3e2464f3c5d1e0de95a822c6556c2dd828455caa454f5523234a7d0c3bf499f3c61df0e64409cdad5f8d902c57786e95497078bf41a1bb9f9d42964eab5d5c5dc3f618b0639ed3eccd8dcfdd7d6a589f632f44b78513df474f0fdc2203ef13ca10ba46333e01b2e4479dd524a2c3d280862346ae4b82ef306faa41ef0bc39c450da3c2d32b307f6121805eb0e5b9dcd19"], 0x0) 04:04:13 executing program 0: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2453.756055] binder: release 21931:21936 transaction 516 out, still active 04:04:13 executing program 2: r0 = socket$packet(0x11, 0x4, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$BLKROSET(r1, 0x125d, &(0x7f0000000040)=0x8) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000045000024000000000000907800000000e000150100000000047800d7050200f53475"], 0x0) 04:04:14 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) time(&(0x7f0000004e00)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0)=0x102, 0xffffff95) bind$inet(r0, &(0x7f0000942000)={0x2, 0x4e20, @multicast1}, 0x10) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000005880), &(0x7f0000000240)=0xfffffffffffffde9) mlockall(0x6) clone(0x20000000, 0x0, 0xfffffffffffffffe, &(0x7f0000005680), 0xffffffffffffffff) r1 = add_key(&(0x7f00000053c0)='asymmetric\x00', &(0x7f0000005400)={'syz', 0x0}, &(0x7f0000005440)="f84e0cad4f825044c5b3ce49e3b957cc3997c30212fea77bbce9f3d7851d4d53fc4b6e9f1d822a65d07444d2bcf953b6827a4d0cda715fb3a32c410404bc5d", 0x3f, 0xffffffffffffffff) keyctl$clear(0x7, r1) r2 = open(0x0, 0x0, 0x40) exit(0x7fffffffbffffffd) recvmmsg(r2, &(0x7f0000004ec0)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000140)=""/226, 0xe2}, {&(0x7f0000000300)=""/206, 0xce}, {&(0x7f0000000400)=""/173, 0xad}, {&(0x7f00000004c0)=""/69, 0x45}, {&(0x7f0000000540)=""/101, 0x65}], 0x5, &(0x7f0000000640)=""/231, 0xe7, 0xfc}, 0x1}, {{0x0, 0x0, &(0x7f0000000e40)=[{&(0x7f0000000740)=""/221, 0xdd}, {&(0x7f0000000840)=""/220, 0xdc}, {&(0x7f0000000940)=""/252, 0xfc}, {&(0x7f0000000a40)=""/173, 0xad}, {&(0x7f0000000c40)=""/223, 0xdf}, {&(0x7f0000000b00)=""/125, 0x7d}, {&(0x7f0000000d40)=""/219, 0xdb}], 0x7, &(0x7f0000000ec0)=""/157, 0x9d, 0x6}, 0x1}, {{&(0x7f0000000f80)=@nfc_llcp, 0x80, &(0x7f00000011c0)=[{&(0x7f0000001000)=""/139, 0x8b}, {&(0x7f0000001100)=""/181, 0xb5}, {&(0x7f0000000b80)=""/32, 0x20}], 0x3, &(0x7f0000001200)=""/32, 0x20, 0x80000000}, 0x2}, {{&(0x7f0000001240)=@ipx, 0x80, &(0x7f0000001440)=[{&(0x7f00000012c0)=""/71, 0x47}, {&(0x7f0000001340)=""/226, 0xe2}], 0x2, &(0x7f0000001480)=""/148, 0x94, 0x3}, 0x4}, {{&(0x7f0000001540)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}}}, 0x80, &(0x7f00000036c0)=[{&(0x7f00000015c0)=""/212, 0xd4}, {&(0x7f00000016c0)=""/4096, 0x1000}, {&(0x7f00000026c0)=""/4096, 0x1000}], 0x3, 0x0, 0x0, 0x20}, 0x946}, {{0x0, 0x0, &(0x7f00000037c0)=[{&(0x7f0000003700)=""/173, 0xad}], 0x1, 0x0, 0x0, 0x4}, 0x8}, {{&(0x7f0000003800)=@ipx, 0x80, &(0x7f0000003980)=[{&(0x7f0000003880)=""/42, 0x2a}, {&(0x7f00000038c0)=""/174, 0xae}], 0x2, &(0x7f00000039c0)=""/3, 0x3, 0x8}, 0x6}, {{&(0x7f0000003a00)=@pppoe={0x18, 0x0, {0x0, @dev}}, 0x80, &(0x7f0000003c80)=[{&(0x7f0000003a80)=""/74, 0x4a}, {&(0x7f0000003b00)=""/103, 0x67}, {&(0x7f0000003b80)=""/245, 0xf5}], 0x3, &(0x7f0000003cc0)=""/4096, 0x1000, 0x3}, 0x2}, {{&(0x7f0000004cc0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, 0x80, &(0x7f0000004e40)=[{&(0x7f0000004d40)=""/12, 0xc}, {&(0x7f0000004d80)=""/16, 0x10}, {0x0}], 0x3, &(0x7f0000004e80)=""/38, 0x26}}], 0x9, 0x2, &(0x7f0000005100)={0x0, 0x989680}) syz_genetlink_get_family_id$ipvs(&(0x7f0000005180)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DEST(r4, &(0x7f0000005280)={&(0x7f0000005140)={0x10, 0x0, 0x0, 0x44000000}, 0xc, &(0x7f0000005240)={&(0x7f00000062c0)=ANY=[@ANYBLOB="02042dbd7000fc000c000200080002004e200015080004004d00000014000100080005000000000008000900770000003000030414000600005a45efe7060000000000000000ffffffffffff08000500ac1414bb0801080600000000080007004e2100005d0004074630278631bb35ba294313c87c66c15dfd844378fd536307379e023b0057cc8d237c282918bf40128fdd6d3b9ac482627a4173f3d26080b3c8b5214ac76597d9a4d5c5f058fbaf5db704622f62cc1a000000000000ef7ba84a6b04b7dfa0cd887987d45b4c2835c1c603a85d273d347ff41a975e64c21ed24b7c3f1596b3a3b5cf68f308b7a38dd4b1daf82a3b87278b21c0492bed58e01e824783050000004ca3b4c5fae4639ab635054f469722e95dada1f361a9eda4974fb622698c2fc2596bdaa96040ca176bf4d5757fb1257c3001000000000000002ca33d107e780f50c11f8938e560522aa795b7c84cf2de19d16e42046de61e3775326e9ab668ac894a6598cd1b85c9e18cef07fd016f12c89e37719a5b39777f18a1634fa8752cee025e11d36fda12a3359a014e784ef0a0ca7c41feb23ac0926b953c9a4f9a7f77e64e49b083559a2e4f7014d036968a351fb5f8c3abb2c251422c041c55330000000000000000000000000000000066e7dbaf936ca41d2b0f15259ac6b26ba6256face60a7f7d4c7eb14eae2e1d3c2b5a57aadbd3bab0cccf606f78ed2e19b0afa72451b3f6727800a59e4b6762245429a1aaa20a6082ead3c9e63df85068e7dc48749bc7837ea582a9ab6c2b64f68aa9896f4d2dbf167493708f4e015c6c7d7c5a2e122313fb1fa6b0befb20623eb35354ad7ad291869f2e99e536b40080e817b67cd307722ba977ff23c13d114a70771b96cd3e6d76d3c0b535fe9a1da57ac5d9817d9c6e2f405ea7c27c67a9b34e391c6e34eeb24ef902d49e7a3c2104b30639d9fb6af877116d1bec43431ca1974a6d2d32cd5d6d270baea898ab7d211144ea348aab6c399247b10b8b39fb0c3d39474dc06e843d9ec5a562f8a893b39063f1442f5ced1b15ec4d01392d13d67826844d1a2646a89532aa1758921d898810ab660eda6191ddc9abb1487dbf7e75cc8767b94ac004dbea8f0cbd399b8e62735d4711e803002d7ec5a927758d7d66d969f95b0e57eb031e3f5c1793d4dd039687a9a6fbc15ede74a4a273395932f80446151b3cfbd67fe920e7e49607a7ed941194ab8abe41b55ee120b7583af45b6e008a0e45f488908716459d77ce90d16fabc532ca4cd1c860d6"], 0x1}}, 0x4000841) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mlockall(0x1) r5 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0), &(0x7f0000000100)=0x10, 0x0) setsockopt$sock_int(r0, 0x1, 0x3c, &(0x7f0000d4effc)=0x1, 0x4) fchmod(r5, 0x180) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) getsockopt$IP_VS_SO_GET_VERSION(r2, 0x0, 0x480, &(0x7f00000055c0), &(0x7f0000005300)=0x2b) connect$inet(r0, &(0x7f0000606ff0)={0x2, 0x4e20, @local}, 0x10) syz_genetlink_get_family_id$team(&(0x7f0000005380)='team\x00') ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000054c0)={'bond_slave_0\x00'}) getpeername(r4, &(0x7f0000005500)=@xdp, &(0x7f0000005340)=0x80) accept$packet(r3, &(0x7f0000005b00)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000005600)=0x14) getsockopt$inet6_mreq(r3, 0x29, 0x1d, &(0x7f0000005640)={@ipv4={[], [], @multicast2}}, &(0x7f0000005840)=0x14) accept$packet(r3, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000052c0)=0x14) getpeername$packet(r2, &(0x7f0000005900)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000005940)=0x73) 04:04:14 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x305400, 0x0) ioctl$UI_DEV_DESTROY(r1, 0x5502) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f00000000c0)={0x8, 0x2a, 0x8, 0x100000001}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x6, &(0x7f0000000040)=[{0x5, 0x8, 0xc7, 0x2}, {0x3, 0x5, 0xffffffffffffffff, 0x4}, {0x6, 0x1, 0x30efc0, 0x9}, {0x9, 0x3ff, 0x5, 0x400}, {0x6, 0x9, 0x10001, 0x8}, {0x9, 0x80000000, 0x8000, 0xe000}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080045000024000000000000907800006d43caa6c5340be4a9357673b44e0000e0000001000000000401907800d7050200f534752295f885e637514de7568a722e7a9936876a4b18cf3b5d3d6f7c13c1ef812843a3f05c03e571f0c31df6873cf5b178cb6527d435dfefe17530a6a7c75af5e12ef1bd4067f56b7d8d93e9a80373b416171aaa7a806e0edf33f672a3fc6dff34140312331802229294a65eda47955b3fb7fb4bd37065c8b553062abde6be64badc9a039b9b86a7bf0c4dd0f7a8149794e705"], 0x0) ioctl$UI_SET_RELBIT(r1, 0x40045566, 0xc) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0x8001, 0x8001, 0x3, 0x9}, 'syz0\x00', 0x19}) 04:04:14 executing program 0: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000140)='/dev/keychord\x00', 0x10000, 0x0) ioctl$TCFLSH(r0, 0x540b, 0x9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x200002, 0x4) write$P9_RMKNOD(r2, &(0x7f00000000c0)={0x14, 0x13, 0x2, {0x0, 0x4, 0x5}}, 0x14) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000733000)={0x5, 0x5, 0x7, 0x5}, 0x2c) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0xc, 0x4, 0x4, 0x40, 0x0, r3}, 0x2c) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000100), 0x10) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000200)={r4, &(0x7f0000000040)}, 0x10) 04:04:14 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080045000024000000000000907800000000e0000001000000000401907800d794d69b883475"], 0x0) [ 2453.967058] binder: BINDER_SET_CONTEXT_MGR already set [ 2453.998735] binder: 21981:21986 ioctl 40046207 0 returned -16 [ 2454.015144] binder: 21981:22007 unknown command 2097152 [ 2454.023909] binder: 21981:22007 ioctl c0306201 200002c0 returned -22 [ 2454.032791] binder: 21981:21986 Release 1 refcount change on invalid ref 1 ret -22 04:04:14 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x49) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080045000024000000000000907800000000e000de00000000000401907800d7050200f53475"], 0x0) 04:04:14 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 2454.373836] binder: release 21971:21974 transaction 519 out, still active [ 2454.385148] binder: undelivered TRANSACTION_COMPLETE [ 2454.407803] binder: 22020:22021 ioctl c018620b 0 returned -14 04:04:14 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:14 executing program 0: r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/checkreqprot\x00', 0x305400, 0x0) ioctl$UI_DEV_DESTROY(r1, 0x5502) ioctl$TIOCSWINSZ(r1, 0x5414, &(0x7f00000000c0)={0x8, 0x2a, 0x8, 0x100000001}) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x6, &(0x7f0000000040)=[{0x5, 0x8, 0xc7, 0x2}, {0x3, 0x5, 0xffffffffffffffff, 0x4}, {0x6, 0x1, 0x30efc0, 0x9}, {0x9, 0x3ff, 0x5, 0x400}, {0x6, 0x9, 0x10001, 0x8}, {0x9, 0x80000000, 0x8000, 0xe000}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080045000024000000000000907800006d43caa6c5340be4a9357673b44e0000e0000001000000000401907800d7050200f534752295f885e637514de7568a722e7a9936876a4b18cf3b5d3d6f7c13c1ef812843a3f05c03e571f0c31df6873cf5b178cb6527d435dfefe17530a6a7c75af5e12ef1bd4067f56b7d8d93e9a80373b416171aaa7a806e0edf33f672a3fc6dff34140312331802229294a65eda47955b3fb7fb4bd37065c8b553062abde6be64badc9a039b9b86a7bf0c4dd0f7a8149794e705"], 0x0) ioctl$UI_SET_RELBIT(r1, 0x40045566, 0xc) ioctl$UI_DEV_SETUP(r1, 0x405c5503, &(0x7f0000000100)={{0x8001, 0x8001, 0x3, 0x9}, 'syz0\x00', 0x19}) 04:04:14 executing program 1: r0 = open(&(0x7f0000000000)='./file0\x00', 0x4140, 0x80) ioctl$TIOCSCTTY(r0, 0x540e, 0xfffffffffffffffb) preadv(r0, &(0x7f0000001280)=[{&(0x7f0000000180)=""/114, 0x72}, {&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000000100)}, {&(0x7f0000001200)=""/73, 0x49}], 0x4, 0x0) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) ioctl$TCSETS(r0, 0x5402, &(0x7f0000000040)={0x20, 0x81, 0x7ff, 0x20, 0x1, 0x731feb88, 0x824, 0x6, 0x7, 0x6, 0x7, 0x80000001}) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000080)={0xff6d, 0xfff, 0x0, 0x3, 0x17, 0x8000, 0x80000001, 0x9, 0x8000, 0x401, 0x1000, 0x89}) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f00000000c0)={0x101, 0x92, 0x40000000}, 0xc) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x800000000) ioctl$UI_SET_KEYBIT(r1, 0x40045565, 0x80) 04:04:14 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080045000024000000000000907800000000e00000010000000004015ff17ed5a934aefe70f492ee906d04699777517800d7050200f53475fe2b88000000007c46335f306415bc138042ff1b8ebc7f276701b4e5104c0c8ec5699b466813ce30716907804410fe6c2962a166402397d1940bd39aa86e2fcac1a5f7ccb3220169aa062bb1a99632248b92aae399de424a28987cb0c82393ebe99f1e848bf99c887127655a598797039200000000000000000000"], 0x0) [ 2454.611965] binder: release 21981:22007 transaction 520 out, still active 04:04:14 executing program 0: rt_sigtimedwait(&(0x7f0000000000)={0x10000000000400}, &(0x7f0000000040), &(0x7f00000000c0)={0x0, 0x989680}, 0x8) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) gettid() r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) get_robust_list(0x0, 0x0, &(0x7f00000000c0)=0xfffffffffffffd7c) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7fff}) syz_emit_ethernet(0x0, 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(0xffffffffffffffff, 0x29, 0xd2, 0x0, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, &(0x7f0000000000)=0x1, 0x4) getsockopt$inet6_tcp_int(r0, 0x6, 0x15, &(0x7f0000000140), &(0x7f0000000200)=0x4) ioctl$FS_IOC_MEASURE_VERITY(0xffffffffffffffff, 0xc0046686, &(0x7f0000000b00)=ANY=[]) ioctl$EXT4_IOC_SETFLAGS(r1, 0x40086602, 0x0) ioctl$SNDRV_TIMER_IOCTL_GPARAMS(r2, 0x40485404, &(0x7f00000004c0)={{0x0, 0x3, 0x2, 0x3, 0xfffffffffffffffa}, 0x3, 0xc6ce}) clone(0x40000, &(0x7f0000000180)="7783777d877b171af804198452accf8a18be0bbd083aa35d470874ab495c27299dbbe919a871fda1677178181b971221aa882ce0307fd4d966532e9a521865c737c70c79520000000000009a200a033b35196f918a74b4320529c7dc9b00", 0x0, 0x0, 0x0) ioctl(0xffffffffffffffff, 0x0, 0x0) io_setup(0x4, &(0x7f0000000080)) r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000480)={0x4c, 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="12000000000100000000000000000000000100000000000000000000004800000000000000400000000000000000000000000200", @ANYPTR=&(0x7f00000002c0)=ANY=[@ANYBLOB="852a747000000000", @ANYPTR=&(0x7f0000000280)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="0100000000000000000000000000000011000000000000008561646600000000070000000000000004000000000000004000000000000000"], @ANYPTR=&(0x7f0000000340)=ANY=[@ANYBLOB='8\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00x\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00 \x00\x00\x00\x00\x00\x00\x008\x00\x00\x00\x00\x00\x00\x00'], @ANYBLOB="0600000000000000"], 0x7b, 0x0, &(0x7f0000000400)="677966145560096de5b608f22b06b2c6a20227af513832b4db61542dd19d55ce09de6039570f426f5910f75a3767f004c0d48ab25fd54f803710440964f77ef774e7fca4f5e0122f827800d4de99ff2ea4bc2bbb4328f15ba18028bf2a720053aeae95f4196cbd646df0bb8b8dbec77fe10da21e0e8a6b908e2bd6"}) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) 04:04:14 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) ioctl$PPPIOCGUNIT(0xffffffffffffffff, 0x80047456, &(0x7f0000000080)) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@random="1391448ffb18", @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x0, 0x3}, 0x8) [ 2454.817442] binder: BINDER_SET_CONTEXT_MGR already set [ 2454.823166] binder: 22027:22028 ioctl 40046207 0 returned -16 [ 2454.836574] binder: 22027:22028 unknown command 2097152 [ 2454.855556] binder: 22027:22028 ioctl c0306201 200002c0 returned -22 [ 2454.863654] binder: 22027:22028 Release 1 refcount change on invalid ref 1 ret -22 04:04:15 executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000ac9000)="290000002000190f00003fffffffda060200000000e80001040000040d001000ea1100000005000000", 0x29}], 0x1) write$binfmt_script(r0, &(0x7f0000000040)={'#! ', './file0', [{}], 0xa, "78a0e435b01b4283acd7d98fb2a4235bf477ab3713961aca5b73520c6e5d022644aac755a66450816cce81d235b74a5cb3c3e6993e11dbcfa523e515f87fd6ae6164912438ae55edf89561ade626e202ef6b89b05e20f67128af98d159c7932a6e114d"}, 0x6f) 04:04:15 executing program 0: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0x1000002ac) io_setup(0x0, &(0x7f0000000040)=0x0) io_destroy(r2) read(r0, &(0x7f0000000200)=""/250, 0xfa) 04:04:15 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x4000, 0x0) ioctl$PERF_EVENT_IOC_PERIOD(r1, 0x40082404, &(0x7f00000000c0)=0x9) syz_emit_ethernet(0xfffffffffffffea3, &(0x7f0000000040)={@local, @empty=[0x0, 0x0, 0x14], [{[], {0x8100, 0x80000004, 0x670, 0x2}}], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:15 executing program 4: r0 = creat(&(0x7f0000000040)='./bus\x00', 0x0) connect(r0, &(0x7f0000000140)=@x25={0x9, @null=' \x00'}, 0x80) fcntl$setstatus(r0, 0x4, 0x44000) fallocate(r0, 0x0, 0x0, 0xa6ba0) io_setup(0x3ff, &(0x7f0000000000)=0x0) ioctl$TIOCGPGRP(r0, 0x540f, &(0x7f0000000080)=0x0) r3 = getpgid(0xffffffffffffffff) setpgid(r2, r3) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x2000001000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") io_submit(r1, 0x32, &(0x7f0000000540)=[&(0x7f00000000c0)={0x804000000001100, 0x0, 0x8, 0x1, 0x0, r0, &(0x7f0000000000), 0x377140be6b5ef4c7, 0xc00}]) ioctl$void(r4, 0x5451) 04:04:15 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 2455.156136] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26159 sclass=netlink_route_socket pig=22061 comm=syz-executor.4 [ 2455.170960] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=26159 sclass=netlink_route_socket pig=22063 comm=syz-executor.4 04:04:15 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00001400ab72d06e45000024000000000000907800000000e000000100000401907800d7050200f534750000"], 0x0) [ 2455.223782] binder: release 22020:22022 transaction 523 out, still active [ 2455.237457] binder: undelivered TRANSACTION_COMPLETE [ 2455.259953] binder: 22068:22069 ioctl c018620b 0 returned -14 04:04:15 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x10000, 0x0) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000d00)="22e8a98832208f8fd1158dbf50e6a71274611946c64ce6ee7db663e5a6c24ef3149026c6b7f12d35c1163579abf0f1e73667878d32957d2415f4d522f1052571f29dc3b41906df03a8ebd3618db06b47f76f7fbb68f950a849d7b364b9727a67bead27e3b63f506680ff65a0ccb2b8ec9f6b4efdf9abf2698dba4f16cdca696490910f6633b9160fd1da7c7a9417b63f9ff9366e5784b3027bcd56c30ebb72327d141b62c8b0ba23e1219461f8b1aae2fbca4fc7fef0e4b971df07fcaa0950406fd7b1760fef79f05d17139409f2a5efbc6e268499a2cfbd547ce63c10e3f60e331519c447a0d8195d708cc8adff761fda3dd51389a2d79b273185f13e9bc1716b4b6c47ddeb8d28ba0bc0fe75cc90a28965e7c517ef9fb6f6d2ca73cf9cf336d8defc60aed91a165fe7bee32ab6c0bb1c77328c06db89fec9cde998e87baebba9db5e53415597e6ce1b2087cc88374afc8548a64ef748292b40678329b0435731978e04466195d91a713d0ebe41097dfa9bbb169d37eb4e814f31d523a508ec7cbafae70d1e8cd13b9d793c391b2a7281e6d0cfafdb224ae6e794bb801359d2b830a349ff9b14ae1bddec2db7ceba130c8fd2b39e969bd283ba0664537acfdc9d6d44f366f1bed24f7633cd426195c35e51210de820044a5b87b1e29e2a7670c4b242f35a0e882fd04de4dc7a367c62f51f6a15300384a23d67eb4bb98a90c17c8c1a60e011eea73a300f4aa3b272d84505e5c35d9a9a0cddee4bd48007b716ab87221e854a1b8644c5de44d2677ee7a7f5c97cd9d6b7b6f9f3e6bee954fe0f742e315e66767aba06e44408132687c9c3dafd69e0e5f9b1931c12a83c5a905a32a50e7ac6dd871a3fb9ffb86ad1c2b7b84add54512d4f13907d57e3d00d351e0e20617207ca6cad65b7c9dcc5148d3f5403482c7d8b42a2c611bf6a415f8c1d0f459aead58edfca36b948216cec5b504238eb0c4350445e86cf41a69f323579c0337289f2eefd1cd1e85bd3160b666e47ec6a3e9f585a4b8d9e8c0197acc526556eb755c7ff2fd625d80146f9546a1669fa209a780e1104fd2610f297ec69fa76118132c5ea2765c4d1c8e3fd646d8b8bcb541850c5ca5f87422cb954f3f2e1b0f67cf5b3d78bf723f18255c726f67384d10bbcc0540870022a01ee28c976b2fdc1b9101cb1ef152786bc94bd6074d84c4a41ba013d11a1ec8bd682a3d597f2152f22db556e0db4bc531b8775cdfd19c01a6b256a66947ded092cce555d079a95b5ab8b2d6c43affa4e61819a90c8529640ad684d90c9367b4f4fb15873d0371bb3578982147210bde6988bf378aa89a357ebe9e21eb80a0b9e3d71d2af438ce7d03d326dd9295fcfc3dd00e8a9b02f147b490fc0dd3d7f6b03be7f781ff8e32941d4785c2c2a96e906dac61cc21e470c263d6730ea4a16bdb9948259522722470d4420368cbd2ce1ea53c8c052ff758949c420c961bdaa20ca361b5dcd400bf9d0bfba0a0f981ad5bb0f6f1ae9b75132d2046415b721e67fd5d3217f3e96bb26c7c466cb4883d9bde7067b25a42b6bd167d6ea14a1532d7c12d2761e4e22f06467aa22cbefe54cd1fbd57a3515addcf8fbf37f76ef7aeaa207279c8e2ce3a8a0e238f07085ecd842cb4efe35d345af8f5f318462e5223da2e10d4bd698a03d80c79f13dec74bcf1bbf5763d7df3d9412181c386e7bc5052dd08ed5e683d2dc2fb1d2b2c66938f7c40a56a8429466fcd7c5258f60bcecb9dd27a7ad0d1dc8be5076ee51da2d8ba23634df8394065e4ce7716e51039ecef1a7a8711c26a9e02e8ca71013f610b580cf05db006fb5a3695b331987707bea43fc2290f3faf6cbbfa9fcd2b70ec77d8e937c9e4c27c43c88f7630e5e13645b25b962bca71be00f0cc0ea27cc64458d47be811bcc75ea5400b646623c74dd4c81ffceda9e688e9ea17d539a9bd43b0717ff45f5d0da8bdaadbbb880fbe7964e6c8efeb4296e28f75ed375f1a65701e79edc255cefc285a06879ac9ff94478f6ef0344ba76c7ac854270496f4d3652fa49c35f75cbac4a70ed87c181a050f069375bf142fb396fd252c334f471a67c2f8258485703a2e39d92f79ad73c185be72601f0d9ab064a2ffcb1825153fba36ce7083fa8413ed66f5efffddf3ce2a46306f186e638f7643d79ff3efbf06675af8cd740346494d03383867890f331ae1bc01f0d77adafb3428b39996687609adaba06d923799daa26e03bf30c93954c46e89151fb166b1fa765c9ccdc6b8b3efa442b9429d96a3a281c32fe5158b6ae5b4b015203751f9c0c9c0efa6798c931092d6b53969bf1680328eb427363fc91e628e23561539d1b96d37e7b738a0b80b024279e6dcf12257a2a30d8da065e78e76673af46dc2d5941c62f3d126a41c851b3d60ac0df1af21757a9463383ef8a7f765c95d59419ce3ad55432e44d8f353c3b32306b7711e74cca4eb7b46a612166d28a80e5e530868b3e752f8a48c205342af150ef0f7f4bf9bf5be307b3381de10ec8158b7ed9de13f0269e10bd032d737fc549e9be1735f84f921c766a6c2c7bdc5c66161be867ad6234582a575c6aa6dfca75b6ba4216af19505f28c6444c53b8e1ad863096656976562944e7c120ee7d1d71d58f1dc96c8fd7381edf09592fa2ed9db04f834a68b4c3431147686b2e2b51dc52722bc20668cf2882d713b3740650fc479191bc28ac24bef9822b7a2079a580818818daa38e378dda87ef66a66a87e44589b022323a1458a43e4cecbfa6e78f7cbcc68259f70d927a87478e4a5182b1a9296db99494aa44e208bff6a27ebc5266af20f47cf68ed52ecbe4dea2cb39e75ad9a008451f3f3f5d0b6c48bf42f7e770a76bd0ee04ea1529cfc1b9f4376eabc6b6bb058d6908ca313d053367a46e3ee137c849cb9ab2a83e60ae6d64cf700744222dea87bc84878e1de69caed425b369b9ff85f9a4fd0c9542b24490a8cfa321bc047212619ca1b22369b0345cf789efc50606c468733565278b2526e00304aaccf45b436bcdd2288455b9e506e222014420b6cdef2c543643f6832c4d38c88a02256d4d3f0135afe271ee6d7bdf7476e53cb79c639f31518fce7163b2caa097eda8c03f6c5a13f865c5e9abd2feb0bdb0c3d83e653865b15aeca737c0f9ea049b59d31e68f2742a43b851bcb5a5194c9a9171e17fd61da7df99a51f84b41da603cbb7c7fa71015f394c9402c969a7b76dff1a3376f71a46bc8454ae33f23dc39e01ac971d42fd7f6a97126ccb422f8be1a9d25c37b03c4e20c885aac43a43d2fb05031f20cc96f6cd96eba89700dc7f560979b4d67338f1ef3e4d6e38550a999a3f8ac46fd488545847e66e82f8beb2a007fe316d44a355eb414bbffc718208c8a31af7ea0683f36954ffa4ec29edc2c201edabd587443c95b0d095426df93de9abcd19024857ab93ad9c63f6c3ef83cd18d5879e9e29fbf32fc5a64f2966a40c4aa52ef38de41813afbdee81249f30b5b7144f17a579f302bef48c986fae0040fa2c8d01a84aac1ac61bd2899d4c5d2f5e5f3cee90754c3ef62d570db2edaadd57b91d063ed09fd359ba1ec40535a5bedd6e45fe884b884ea0f2ff8aaeaf30678f325547cf9c5892a843fa96c26ef98a215ba4a5afbc84c7f9e164ef7ceb58f89b3e67067b92440d176a046616a0f3f3ef82faadf5fa62daac38b6e27f5ab61f5e4f99f415d1435d37fe8f661fc5b2046a2d8faf84fd5715113c1edd2ebf756da695673a3875e15a1ea8f02d3b52bad1126fb5a99345e4a2d6b9ce14f36e10efac89a92f5c156123315ea5baf6d7b23c6fa571160fde995ed73e44329ae5ab873f2a36233f514c65a363219ed8182bab130f0ea129f30ba338d69ef285ce6c2511fa7f1deacdfd48bba4fb6fba70f320f7c81bba55df8da29ef3690b51284e839dab9e3d233f57bd2c64a9378128d2e795f31dbd388f5f6e44bc6ce9659d234e7f1ddba01180b14e384bc4fd3a6b5ff340cd978eac80f74439e004f381c709525e40c39619da003d19b6970a08c885ea697cbe3e232371deb336eeb883bca4beaab67d6bae5534ae6faf02208936c8b53a92c5910e5b8dc7b2e63182a3e363b3b1024bd2ac0468ef287e07600cb9a11f4002cc17768796a9e0c96c2b700d4dc0d43190813f89127b8d7f50cef173c41a69615f1d684e05a070a096fac58f71f1c73415469e6336e14545c03df14d86b28570987ac7953c8db062609320e1e0cec50bfa15251d5c60a2dcc2c8df47916e12bcd007622763ae1951e76868f85a9fed10ca641101733a3f01ea2cfad4f56658244a3d661f338783d3b3d29d26351d8dc3e7aaa250a20f2c333d91899552da62ce35801a05837042c5e333ac3bac5a20cdcf3fd8599bbe5f0c69a240def667b19a2e530c6618f76b71c34af8b3a6dca48783fc0fc3f6ca98d1faf4ee297b822cf0b505b737a4d4a06e39b0cfb99e57e78fd9942d67ed360bac7df4f09d6e840e55a7fb8f30cc61d18d6d844b65b23c5da80948aabb95ad13e42f83cc63003d42cede857ca163bfb44461d029a7922369025675efabac3c9e0006b6bf7794db1e57e39943f679471d6322effd67bb2c47edabd1f0a9ef5a36a0909be5dbb2f33e7ab48d5a0abf331970f1b636f0373df8bbec2d1dc34a940cbe0cdd3f1a34ca455f27d942ab5f4a7984348412a55c34918e48898eb384d7eba4718cebc8d2492d9b65109dadf4dbe5ca25c360f5bb63d4e2ec1f4e174e3f143d349da49f5ba3223c88251f65fc39b1c917bbcb8e62941350d851936424455b14a84572ca9a3cd0c145bb8b6e323b8705bb60911178faa00791c7866985dd1f646b741c2fadde257f1d861524ab261610a0febbfaf0ccc4d1ecc1d58f6ee5176997764cd14f1cb91be72d6c1b9948e4029cb3407021abf3bf3a8ddbb14fd26eb664ea06f15dcdb52f9365d07c735e23d082aa99232a45de6a298f9eace6a1c625c42fa99e86fb2f140521598652d023a3cb00a9339b8624cefcf3166d854cb26a3fe329fb0aa09e58d9547c2264ba34a3b8d16cb00cfcfe5aa5c63d788ca5903ac226d19858e2a52a09101ecb41353a4c37926dcc97985427b08a2dfa0d96b8a892040bf164cd20a5ea4e46b1c66890fba59c95ff3f48b3eca0992792a03c3b9bf61290c0f5bab85d8e3e70c7eba7180fe7466ba7e728ffb86ce70c2e7e5e6ec59644f6e4ebdac9d588abcc09d9c8a2029817afc889cdacf5bff6e0b1e30b327fb3e0ddb262a267f225f827ee86d957dbb39029f3aef3a43c17f6f063e6321adff78bddbbf34e9ba9c4f2c57f85f040a76734a3a549455d8fc4c0ccbeb37f0ba0c5734707a8399b8565b8c06a0db72f34a910945bdae3a4385dafddee3466b453279764aa71dd55035479957a2c3991133a688abc1f74a2f5cdc800295f03ba3a597849018c2b53e1f4e9bcb6c0a909b329bf8d8cc4a0cf50fcfab90e2678d6cae81d6d1fbfd61308b50b95ed2d2707aa5fc9f4422e5d890cd307129045d2269dd8e4b7cac984a8dbc6e24487dd19c0701f08b7ecf5874900e71df2f59ed74b899cd30e3df114c365c90a95000a64289388f73ab148c0bdb5f5d6c31a48ed05d6a03db70a6cab09341bde5bdcea94d44a3b7e6f3f4676f23f44b95c4b33e2ee0020255ac42f7eb5e9f8a365239e6e38d53f899c55b694552c704b5b4b5da555ac1b846350846fc47b15dae578e4c98fac9f806d38d46c0b88463a472e502520c7aaf5e1e37893ff8b65c9cb77361969510667088555659d8f902f"}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080045000024000000000000907800000000e0000001000000000401907800d7050200f53475fe415ae88ad4a3365a9e45748883d33de5f39b74476a957c719295a25887cecde2d25d1488f3b5d47255810cdf4a1ba1cb915108a6e4a410fccc781a39e091478d88c5ffe3cdb562614f2a764b7a76df6e4594c4c6c8df4da1045bd12c6d538297f1a010ce9bb1531106e8332ad923831b0a9fa6d5453c74f0d2e65d938228be8f93e89e"], 0x0) 04:04:15 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2455.456606] binder: release 22027:22028 transaction 524 out, still active 04:04:15 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) eventfd(0x5) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) openat(r0, &(0x7f0000000040)='./file0\x00', 0xa804, 0x4) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:15 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa0000140000000800450000243f0000000000907800000000e000000100000000040190780057050200f53475"], 0x0) signalfd(r0, &(0x7f0000000040)={0xfffffffffffff480}, 0x8) [ 2455.579605] binder: BINDER_SET_CONTEXT_MGR already set [ 2455.591940] binder: 22078:22083 ioctl 40046207 0 returned -16 [ 2455.600194] binder: 22078:22083 unknown command 2097152 [ 2455.605603] binder: 22078:22083 ioctl c0306201 200002c0 returned -22 [ 2455.613087] binder: 22078:22083 Release 1 refcount change on invalid ref 1 ret -22 04:04:15 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaa2aaaa0000140000ec62821e31658371088bc883170008004500060000002db2000000009078fdff0000e0000001000000000401907800d7050200f58d41582aa1e6a32ee76468f7265cf8f3932398b02dfa43ade3effa3431fca25a87bb78dd761837f72c2b12845043b672939d43392f3cc2e6fbe7f8899146a454cbf3ccaf1845e47386c2832b6178897906b5d058b84720ef19aad3365dba1b7b35207d41247e64b09eecae4dca150eac00a30ba1882a5e7ce84df17f85e432ca9e6c6c858cd616fb087538af16cccd5ca976c28f2b01067bfbfb5e8c13c94e15d9974fd314b734ec4300bb9e71aa1f1e3ed48ea955cabe57b094002c6604dc48aaa0bcc653e6b647b49a579d2219d6482b7cd4b99728668062ccd2765d586284c1fcbb7946cd7b"], 0x0) 04:04:15 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:15 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) sendfile(r0, r0, &(0x7f0000000040), 0x2) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40106614, &(0x7f0000000000)={0x0, @speck128}) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:16 executing program 0: socket$inet(0x10, 0x2, 0x0) 04:04:16 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x0, &(0x7f00000000c0)=ANY=[], 0x0) ioctl$FS_IOC_GETVERSION(r0, 0x80087601, &(0x7f0000000080)) 04:04:16 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:16 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 04:04:16 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0xffffffffffffffbc) r1 = request_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='$lo\x00', 0x0) keyctl$read(0xb, r1, &(0x7f0000000180)=""/203, 0xcb) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:16 executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) recvmmsg(0xffffffffffffff9c, &(0x7f0000005200)=[{{0x0, 0x0, &(0x7f0000004b80)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000004980)=""/21, 0x15}], 0x7}}], 0x1, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = dup2(r2, r2) sendmsg$netlink(r3, &(0x7f0000028fc8)={0x0, 0x0, &(0x7f0000019000)=[{&(0x7f00000001c0)=ANY=[@ANYRES64], 0x1}], 0x58, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000df36a9627decb754390000000001000062db8b256e", @ANYRES32=r1, @ANYBLOB="0000000094183772e8b17210d9dcdd48ec3112561082e550aa100df891c201c5e8ec3ac55eaf43cbb774410031843af4ee0ccdfbbd068b40912de2a7ac66b5e7f13b5d7a47e0a2efc14969"], 0x18}, 0x0) recvmmsg(r1, &(0x7f0000000b80)=[{{&(0x7f0000000200)=@l2, 0x80, &(0x7f00000005c0), 0x0, &(0x7f0000000600)=""/84, 0x54}}, {{&(0x7f0000000680)=@l2, 0x80, &(0x7f0000000a40), 0x0, &(0x7f0000000ac0)=""/147, 0x93}}], 0x4000000000002ce, 0x62, 0x0) [ 2456.060385] binder: release 22068:22075 transaction 527 out, still active [ 2456.068633] binder: undelivered TRANSACTION_COMPLETE [ 2456.113486] binder: 22117:22121 ioctl c018620b 0 returned -14 04:04:16 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:16 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaafdffffffffffffffe0000001795a8ca42501907800d7050200f5347500000000000000000000000000000000"], 0x0) 04:04:16 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000000)={0xc021}) ioctl$UI_DEV_DESTROY(r0, 0x5502) fcntl$setlease(r0, 0x400, 0x0) 04:04:16 executing program 0: openat$urandom(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = perf_event_open(&(0x7f0000000000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x84300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000080)={0x400000000001, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1000002, 0x21000000001f, r0, 0x40000000000) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) write(r3, &(0x7f00000001c0), 0xffffffea) vmsplice(r2, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528ad61}], 0x1, 0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f0000000100)={0x7b865a07d3eab715}) fstat(r0, &(0x7f0000000300)) mmap(&(0x7f000094f000/0x3000)=nil, 0x3000, 0x0, 0x10, 0xffffffffffffffff, 0x0) 04:04:16 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2456.289289] binder: release 22078:22083 transaction 528 out, still active 04:04:16 executing program 2: openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) r0 = socket$packet(0x11, 0x800000003, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x1, &(0x7f0000000500)=ANY=[@ANYBLOB="aaaaaaaaaa110000140000008137ffff0000ff05ffffffffcf9e9611c287007f00000000942584f7310a0000651fad95399b3c23d9770cc44a7f677328da2fd234c3d3c8eb9c8d24bf4f0061b5781a4efa596b25aca8a1cdeeaec7f4864746add8cd8dcafad854b13f6e57006959fa08f5bb0112b40cfe18fd272a7a109b7876d36fcea622590bc6cc3f4ced3f0a10eaeba45e4968f5c94fa53a564f31c39b0d39e7090371cbe23cc288cd3e898335e50ecdd8664c1f809eeb93f3ae2fb61d80b3447e69c99430e6f3c7bd38da717a7fca4c626e5b9b5ec2e0797ed730348378f8af47854988f60bdc9ddab578cc2a1982dc039cf4e9062895123a2eff40a73496390162061efea2e29d4f45dee1782e7ffa1d035f2bdce69e53c0d8d525"], 0x0) 04:04:16 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) accept$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000040)=0x1c) fcntl$setlease(r0, 0x400, 0x0) [ 2456.511851] binder: BINDER_SET_CONTEXT_MGR already set 04:04:16 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:16 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000040)={0x2, &(0x7f0000000100)=[{0x6a88fffa, 0x0, 0xfffffffffffffffe, 0xfffff01c}, {0x80000006, 0x9}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000080)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000000045000034000000000000907800000000e0000001000000000401907800d7051300f53475c2a7cfb3a1b4b446acaf37d6eac42fa0d425a292ec6ee5bc7759dd7b78865ec1221996c290"], 0x0) [ 2456.540481] binder: 22137:22140 ioctl 40046207 0 returned -16 [ 2456.557756] binder: 22137:22144 unknown command 2097152 [ 2456.583030] binder: 22137:22144 ioctl c0306201 200002c0 returned -22 [ 2456.604136] binder: 22137:22140 Release 1 refcount change on invalid ref 1 ret -22 04:04:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 04:04:17 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) prctl$PR_SET_KEEPCAPS(0x8, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x1, 0x2, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080041000024000000000000907800000000e0000001000000000401907800d7050200f53475"], 0x0) eventfd(0x400) io_setup(0x6, &(0x7f00000000c0)=0x0) io_getevents(r1, 0x80000000, 0x1, &(0x7f00000001c0)=[{}], &(0x7f0000000180)={0x77359400}) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='net/rt6_stats\x00') ioctl$SNDRV_TIMER_IOCTL_START(r2, 0x54a0) syz_read_part_table(0xbe, 0x1, &(0x7f0000000040)=[{&(0x7f0000000d00)="026f54619866d6caded0637793944afb31a6a92edf363d8cc7303b981a4fb4b1cdee19770aec560a93ea98819c439da9f977312006b63551e0aa9fd86d6e1edc7f52520dd3d77964483c4a6b72f1462c83dd4621621e6bf88e04eb9089997310d98289ae6dc9bf3f1889df5c5f3d0b496d09670bb0612686ba2ef4edc9f5f9b4ed1641922dc6abed24be410b36bcac682de1909f7bdf882ab03e4e5a800e3fef0a639b2c8c990f4b5ab5a46ba33156ea5bad7906316f7e3b2c01cabc967094fe22f1bb905605a6f297f93a99ed06913606183713a1314cff6d96f97dc854139014a4012590fe86f006e93e3525fb5e4be88c1d613123835ddcef13e1666e1a9e9fb65bd8958c294e43c10497b009d470d8979f3a5560230ea4504be241e0f7b956cc046b0e59b514bdfbb4b490c99639fa55e52453a8c60c825f14b1047847399ee27d5ab619f164512151d46ea66f81e39d50f5ef7027bf4329b479eb6c0f4a8caeb92dc0b5df44ceb3c0377565710961ae1fd812e68c66b6a0db650168186e1ea81629f67688ec7428c4da32195d0334700310e6a24718dc4794d06a7e49ce46f3156d974ee7bd77a9b72447eb13c935f5e0cba3d01295979191eb45e203c1fc00258a7ec4c48c838391247826833333f0d402d4d0018a04d0fb33728d48d53a81d4c79b6b2c1233791dae5292b2ce897442ec6de7d2f54fc4b3a3fe445c33703c7d1e876ce52a2d9091c77452dd005a170f39540e13871065da9b5a41ec939b256c923a678eb0f7372dfc97888ca6f12cb6c99baf2ddab7e4e7c909d940588f1fc480da72fb33e97eb8b6f43ccbdd14d88d768f562dfb4b681e162b75b571f137ffe95bc53a0590a6a0480d366841f035dc9864fd42a6750a4bda8729163ef87a2629c468f11f514e2277a99e1211e550c91cdf2cc869961400314951f6dd55867dd6e85f078f5526b307c2b0abccab8d14788c024775c2633941bebbfcec4cbea34d95620f2a1e77edf028502b71ca640cd6eca54a7ebb78715b1a71db7049758201c97fbd264946db31f01ff675b6cb214fa72495dc5182d49dbc9181bc3225a1ce867d332cabf42f56d4552fb7e1e943af8d05a8122cf74c27380850fff115a7653efa01aa814afec7a1eb78f2acd3380ec48766fb47f0b5f550aa18a14bf25146c822a034c3f51a0cc5682528e4ac81f5a35dd0d823fc5f1e250fda6b9470b12203b9a570bc50ffce20ffe68d099072544a7fd3df55db89e12804efbe0df5a1ebf11912ffa229bedca41e631194dd9f7ad28b75747f660027f0f0d8b0f463aa8035d090198be8e96fd7b8d3d97ba67c6c470f1f4bb80aa09e74d2fa377b64bbd52e6b471629829baea62fc45d9a6b96b53421c9c5cbfadcef5941bf4a1ae08d024d7592bfa68053a47478750fe14d8668a410989a6dde1745b03aee3d68cc39b89e8ee20d8609a71c89cf5bb6b112f0449e9812cbbd3cdf7539d8162cb80773c27351922b95bd1cc44ebb3c84f0c5187b364084067a7d7d7155e9c0b374809ad479f19a9a74649e07870279a2158edfbf2e9a17eff877981851219c956562cb08618988fd68b4c4d470020f3582a3a905311640b5d697eb59100c9381b27523adbbd82fca1782d7206ab4abe0ebc4be3d9b1ff3cae38af3c8b6e476f231585d79eccebf5ef3371cf463bbceec8981da3ad763ccdc81a9ff14e48c2ac4117a90d7328214aff15852add4dc13eb6d57fd1fd37012bc21755d22d7bd6dbdd8c1955b1e26411a14ed71858e6b53a59ae3fd6d2f15df29d3a7b19cf66b56cb965e246ec8aba0edc021e5d9f65b0799ca7d44c5bbe604a470bf4a65d785bca874556086a6aec33142ab2c08c56549e191c4dd5f67bed04ea307183736292c86fa72c7e1faf466ce4c56ae6e914c5e777e95d041f90fcdec1c49015b9909bfacc7b65c663d61c7c3e427ce6d6d81d87d7ea811580e099bb4f4b4dbfddcc102004b2909e7ff32c1c2ffd55f8c4488ff3f55eb83e73422d476bacc7828cb8256f7d33d0b865f3b53b6c0fe97b830db0d5b9fb24d01d7bca6e25b535641033e27625c3ba4def37cd3882c81771f13ca1a335583cfda5706616a8a7b3a7bb2c49b21e00e42ef38e56fb4e6df5101403bcf019a783b68e6939bc08014156176661c47094463333ebf2e6a11bc168954c945d17112cb6c7de7f658f761bf59acf19282fe8652723102fd2d260b6ef1949ce357140a0b95a770748e2b1f9b854985af63c21ec62bd5fa7e77cef7ab8dafab380dd380db6bf2938ed4ac639c5fa87f8ac743b74e6ed0db1c54f5c4658b2bf5bf70beb8fbfbff502d85ffc49c074684ad9084f26a85aaa135317111792ab91846f2c663a53f2784383c3f7d46b475053c73c0efbffdd8cfbc49db59d4002b45246b85b2fc3921762b4b2e5916e8d9cc7172bd6abbaf8a5fba0e962027c7441273a9060641d5f53432aa2018db882ca64ccda978308bb386d078ec629ba4305ea586e69f4cde0e2bb0533fd9a808e6b72d005af8f22736a5f28ef89c09781d4553a6c9e47e3a960a9cb01311d1fb167f8e564c02eafeee9197e8b14a0e9436bfdcffd9fba526e243bf1ea2832e46ae0259bc18aa6529bce88a887c9da529f19c2a4a47bf8cf640b423511e7f93a1f80676ce6cf8eea31793804ff5923d92baaf195545877c0a55d57f8d1440293c10e79e34c61f3ea2aac2816f302ccc626c8f653e546252d2437aefd9388948af53e59e41648e459f338e538592eeebd701d47cba099131b80ca6bbd992ddb46e09eaf1eb22e2183a9be8391073fcc6846ab14af01bcfc2cab92613aec2721d03884613bed30fee4008b6f6317f7fa420112be6a1b82d5f65ad87fd8b45658b6727865678c3f126ab1962e27051d691d8e4f312ccb3a8f9c9e4dc884ee14fde0db645a8b0e16dc372b76a93c8328a30e4c630b3e3da1bdd410450fb2263ecc5c158d1e1bd0e1ceadd0c52f8a5fef4856f817e04f43453124cbd57a90b9d91ff1b900de4348eaaf3cab66f1e340e3509e86b3dd7e8e138646b8b0eeb78b0b5ece9834d3117db98faae0d5202a6998231bed9f43eb23ed1b5e5121e50ad8ecbb116e71cf3275d1b8d27ccc1f2bdd0e416f85b8cf372c140fa3832c26200e92e4d94578b9cc07158ff029429fab19df868df63c95bb0a31dde178ac86d39d410030c081742cee286546d6bee5785c03b9cd61ccf39da22784f15c541f236afc5341a254d9ea791782b38356ad0d9e51965b6ac4bf2dc2bc02b472245ae10c968bf6aa55565cf376f5784289eeb1f6f0916231f2aeeaeb62243b8a6e914b3e00d135c8b13fd5d5b0ba791c8d5c8e884ff90f520fe57c85c5afaf909bca6377ea6fd6b26af7f5eec267b49f2b0e5a2a8a60a1d60e3b3ad180de589d552203146df301f67f99424ebcb3653fd22f79dc2bf4922a9604d0b1380beddf1cc70a52ac7c8e0c032b0575da4fb71ce9ca6cd4a33f5a3b212673ae7e911cedbef13113d63860ffed25b5f6bb0e311cbb311579327c1084370e0e248ee6255d713b60ef1c73479c601fd22cfe2bf88da0c389e65a172709c6d569731345998e85bc7900e08ebf0bcbb109e68671883a419c685249b9d35efa207a838c33137def14463b699876fa19e3714bf43fac72f5c55210d90ed291cef46819ff93910aa3c4dad918c0d9f6933e9c2bda4634b6f9d1b9332852e248772b5b68aba715419c6610d4e1067b77b76761ab98306145cec2cf70e0f7ee15e387c3206e6ef60267affc7f187b3c0620894951adb809df4681b52bc76c4f7501bdc6e3fc80d3ba3f9445a898880a2f38b1d5b27fd5eca30e9716e9aaf364a5ec527e5ab70f1b9c878a8435e4a4f86b09646f6e5dab4c83df9242246474bf14dd6bb3d98d01c6f1fb62cc10c7f1145557587bc7a429c70a7daba4f9123850e6d05b43cf384c7d2a62bb9c66a17b75a8d8f95b3b2bf5b255ada1998752500467daf2ed2de629f4b450619b0b4722ff5c18c63790138c5c560d9a2e25b1f78eb38fd4edb329d5b84909d952931119cf5415ebe2807f367a5ff02c10de92e63296ea30d0b3a0cba298c62d4ca5966a05371261a462eb6f2a6bfe99f4627b3c714036d52a2dae5ca28590afdf660cd7a2337c408b3a15e6a18fe11996ed008aad3eb51b74ab75d942686081cfc60cfd3500a4e783779e759d5106ce2c95a1a7ea0a14b537ab622f76887d621f014971b5df9dd24140c26b9e46aae1a50ea6867b06a64445f03cb63891a5e2a6a027767b3ebe1faa608cf231a921754ef8056a1baa5a2809a3c39208e3d1780e417590346411e5c11e1eff6966e4df804fa5fba696cf4ca7c9dc48e37156eeb57fbfb35ff19d80f9982c2736afe565dacd7757a7265a26eab68648d9dd917e793a990983fed351f1ebdf2263591c83bfbcaa481396397f5f05d618b4f00c793cf16d41f1fe57f41757353905e4253e8f865f79c8ff679cf520a5fedd197044d56dfaf2368b23a8211e5d5acfa85ae2b0a864df796137d46a7addb6e15544cbf2bfadda71306d41374ef1ba903c4a19c4f828ef35bc2bf0403f2ea3b729b717930d9c1d1f91718650dfdbd365354b4ce30ff93797a9575102afafc87e05e69760cd79e29cab9fef95f3a836858f236b0e6e1c76eb7cfc84f3a6f150ac713d671dd7701f99546c3fea8989a045078af861a944ea4620b68040782d2a8be0e1791574e49e56b00b3eaaf56518dcb303a90329e47ed82d5d415a76a9f3193212b176a2ce8bbd0e8ed5ee8ee05d43578936779b62f9e0645a17212a385c4cd604a8ea51381ff0fc9f94ba8afb986e6291a5f08f5171b9ccf14511fd8129ed5645c039c6b94ec5d1b59f2d08bcf254eaa39e6a875589a5b650015b4af415a3c971bd75d1b234339f4d2a64e9a14806e17155aa95a5e0716b714e04e81aa443566986cf6b522e26482dc0633b9e591fb5c3bb8a1e4a0d6d4676aba40f2c8e58f5d52aa2efd79b7b03f9e28b289641486f2f8d746148171151b7049b0bdcfaaee600e3210b6b41778054800c921c8eb1a33f6a0ccf7f5a29ae0993eb5ca8f038b26999f9ab2b0ab9d402f7c102e3cb6126d28677bbfb6f94fcf4512ee7abadba72a5ba593a905fbd863cf7b1e778eb9c4ab761a98c1cda3607368889a220e93114df8787fd2ba76df25a1b35302991b331a594f8905cdeb6b049375e86d3df09c5415715b042a163575deaed4e24c7d9d2bc209db12e607520089045a34196dfe6692cd90390e988791841fd3a6d577eb05d316a2029d5ca7d0eac204af26638135abe5707d797ded95f88a53a1110886884e91d1ed52b2d8dd512f1092a7b729ffa99198510709880fea7ca0169fc26b3e895d307cf510ca2e8545d58df87a68d2b124d224bb9578e92fe438cc66d36f90fd5db49ea910d9380a4bf2b45d3b878cad267a8ec9efb9b246a63c7201e3573ff4c99f2d2b2a4112515a760cb51c157ce3353f19e980b24ec9a44d72e212cdddda42875a18bdcaa1b309ea348155cd9a1c539199ba63e92471112135265e0bc0d3130dcd761d814829a93526aa582a4aabb09ed2eb39ec1fee43cc3afa0920d7e54710a2f1adeb0a8b86187314e09fc8432c35c3cdb6f03f5e72f360094fe592ce0b84bfd714dd290397c2586aa3d7369479292401ad25a01b9371bd360d8d9b94b3db8799164c01e718626540e66de38beafc66d9b0cd32d022bbe0b8f66162e65207f0eb626f89259f2be170dc5a8615e77953bf2e059cd4d3e0", 0x1000, 0x2}]) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r2, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x50000082}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0xb4, r3, 0x400, 0x70bd29, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x10000}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x9c8}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_DEST={0x28, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x4}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@empty}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}]}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0xc, 0x6, 'lblcr\x00'}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@mcast2}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x7fffffff}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x3d}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x8}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8}]}, 0xb4}, 0x1, 0x0, 0x0, 0x24000080}, 0x20000841) 04:04:17 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000000)=""/172) read(r0, &(0x7f0000000100)=""/24, 0x18) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) fcntl$dupfd(r1, 0x406, r1) [ 2456.908205] binder: release 22117:22127 transaction 531 out, still active [ 2456.924688] binder: undelivered TRANSACTION_COMPLETE [ 2456.948204] binder: 22171:22173 ioctl c018620b 0 returned -14 04:04:17 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:17 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:17 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x413e, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) fcntl$getownex(r0, 0x10, &(0x7f0000000000)={0x0, 0x0}) syz_open_procfs$namespace(r1, &(0x7f0000000040)='ns/user\x00') rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/commit_pending_bools\x00', 0x1, 0x0) 04:04:17 executing program 0: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070") r1 = socket$inet(0x2, 0x2, 0x2200000088) bind$inet(r1, &(0x7f0000000000)={0x2, 0x4e20}, 0x10) r2 = open(&(0x7f00000000c0)='./file0\x00', 0x80, 0x1a) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000140)={0xa6, 0x2, 0x7f, 0x9, 0x16, 0x0, 0x6, 0x8, 0x100, 0x6d, 0x100000001, 0xca9e0}) sendto$inet(r0, 0x0, 0x0, 0x8084, &(0x7f00000002c0)={0x2, 0x4e22}, 0x10) setsockopt$inet_udp_int(r1, 0x11, 0xa, &(0x7f0000000c00)=0x2, 0x4) sendto$inet(r1, &(0x7f0000000440)="dd", 0x1, 0x0, 0x0, 0x0) recvfrom$inet(r1, &(0x7f0000000040)=""/126, 0x7e, 0x0, 0x0, 0x0) 04:04:17 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x200000, 0x0) ioctl$BLKALIGNOFF(r1, 0x127a, &(0x7f0000000080)) sendto$packet(r0, &(0x7f0000000140)="4fd0ad8f6f584154dc9f1124edad41a00d9c38c7c3cfca07199fbd29af0aef251191db568a0ec033264e055603e8cb07cf46c7ef8c62713ac58aa24c4bc9cd5e933287efa62736e9b5781476f50889299e9add9490f17a6fff9bf1e8ba27af0c3b468e8ef339a888f14159d47e89d2d67e4fa09ae3800ebe03d209d3686bc5c470de7ffcfa73a7697475a86650529b69e82fba60ffdb6ff1181b555cb7ff6228127d44b49ee869e123ef6a30fd8da0fce23efcb9ceaa47ea1e92a9b389d818b2c8300e8e83a5555c222aca995e6b0fca2a8b602432492b00b4366329669df88b6b51b0a43091", 0xe6, 0x10, 0x0, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) [ 2457.151050] binder: release 22137:22144 transaction 532 out, still active 04:04:17 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = dup2(r0, r0) getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0x14) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000240)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000003c0)={0x0, 0x0}, &(0x7f0000000400)=0xc) fstat(r0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0}) r7 = geteuid() getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f00000004c0)={{{@in=@initdev, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@dev}}, &(0x7f00000005c0)=0xe8) getresuid(&(0x7f0000000600), &(0x7f0000000640), &(0x7f0000000680)=0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000140)='system.posix_acl_access\x00', &(0x7f00000006c0)={{}, {0x1, 0x1}, [{0x2, 0x6, r3}, {0x2, 0x2, r4}, {0x2, 0x7, r5}, {0x2, 0x7, r6}, {0x2, 0x4, r7}, {0x2, 0x2, r8}, {0x2, 0x6, r9}], {0x4, 0x4}, [], {0x10, 0x7}}, 0x5c, 0x3) fchmod(r0, 0xa2) setsockopt$inet_mreqn(r1, 0x0, 0x27, &(0x7f0000000300)={@local, @dev={0xac, 0x14, 0x14, 0xe}, r2}, 0xc) syz_emit_ethernet(0x49, &(0x7f0000000040)={@empty, @remote, [], {@ipv4={0x800, {{0x5, 0x4, 0x8, 0x1ff, 0x3b, 0x66, 0x0, 0x70a9ce9000000, 0x62, 0x0, @broadcast, @empty}, @tipc=@payload_direct={{{{0x27, 0x0, 0xff, 0x7, 0x2, 0x8, 0x1, 0x2, 0xe821, 0x0, 0x2, 0x3, 0x5, 0x3, 0x1e4612a6, 0x4, 0x2, 0x4e23, 0x4e21}, 0x3, 0x1}}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}}}}, &(0x7f00000000c0)={0x0, 0x4, [0x4e9, 0xbf2, 0xe07, 0xc4f]}) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:17 executing program 4: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2457.323256] binder: BINDER_SET_CONTEXT_MGR already set [ 2457.333993] binder: 22186:22188 ioctl 40046207 0 returned -16 [ 2457.356627] binder: 22186:22188 unknown command 2097152 [ 2457.362915] binder: 22186:22188 ioctl c0306201 200002c0 returned -22 04:04:17 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0xffffffffffffffd0, &(0x7f0000000140)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @empty=[0x0, 0x0, 0x14], [], {@mpls_uc={0x8847, {[{0x40, 0x1c5, 0x1, 0xfff}], @ipv6={0x1, 0x6, "2ce6b7", 0x299, 0x4, 0x4, @dev={0xfe, 0x80, [], 0x10}, @remote, {[@routing={0x3b, 0x2, 0x1, 0x800, 0x0, [@rand_addr="3823c563ffcb7cf15aca898863b5eeb9"]}, @srh={0x3f, 0xa, 0x4, 0x5, 0x503b, 0x60, 0xec6, [@dev={0xfe, 0x80, [], 0x1a}, @empty, @loopback, @mcast2, @ipv4={[], [], @rand_addr=0x2}]}, @hopopts={0x5e, 0x21, [], [@calipso={0x7, 0x50, {0x2, 0x12, 0x401, 0x0, [0x4, 0x4, 0x8, 0x4000000000000000, 0xb84, 0x2, 0x10000, 0x80, 0x9]}}, @pad1, @generic={0x1, 0x58, "f136b6fe2267b69f867223920db843289d0a8ddf620f12286df557d15d93b23d352818a594446bb21f265d5c7d468be4c7bd9078778903994dcf846bf830afd332d7ba86ded71af2395bc0dda4c5ab589efda217b03952e4"}, @calipso={0x7, 0x58, {0xfffffffffffffc01, 0x14, 0x0, 0x0, [0x1000, 0x4, 0xffffffffffffffff, 0x8, 0x662c, 0x3, 0x1, 0x200, 0x0, 0x7]}}, @pad1]}, @srh={0x0, 0x4, 0x4, 0x2, 0xf77c, 0x60, 0x101, [@initdev={0xfe, 0x88, [], 0x0, 0x0}, @ipv4={[], [], @broadcast}]}], @udp={0x4e20, 0x4e21, 0xe9, 0x0, [@guehdr={0x2, 0x5, 0x1, 0x8001, 0x100, [0x80]}, @guehdr={0x2, 0xffffffffffffffff, 0x91a6, 0x4, 0x100, [0x80]}, @guehdr={0x1, 0x1, 0x0, 0x20, 0x100}], "866002782e7402e0459e2576aa18d15d303dff7664341ee2639f70ea3e226687102c937da7479a4718b86ef1a7908767a0233bb67c37dca216f0a770908bc24b38f9fb7cb8c3b1a47ea4cd495da01b4c80ab5850c7e80aee83a837a4bf560eece311e90bc10b0111d703fda4eb7c655991cd530b3869a2a3b5e79cb62ce2bb73180024294d4425eb1eeec4301e70d1923b74b46f33d230a5bc48f5df6efb9013e8d64c11e37dd82916ba3f3840248883c528c993e600f9034dae05f88e08c1e60d161db3f111410070accbec07"}}}}}}}, 0x0) [ 2457.372301] binder: 22186:22188 Release 1 refcount change on invalid ref 1 ret -22 04:04:17 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) ftruncate(r1, 0x0) r2 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_SET_SERVICE(r1, 0x0, 0x3ffe) r3 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f00000001c0)) prctl$PR_GET_NO_NEW_PRIVS(0x27) syncfs(r1) read(r3, 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000300)={0x0, @initdev, @local}, &(0x7f0000000340)=0xc) connect$packet(r1, &(0x7f0000000380)={0x11, 0x3, r4, 0x1, 0x1, 0x6, @remote}, 0x14) read(r1, 0x0, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000180)=0x0) r6 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x400, 0x100000001, 0x1, 0x1, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x800, 0xb0f, 0x100, 0xa7d, 0xfffffffffffffff7, 0xc66d, 0x100000001, 0x2181, 0x5, 0x0, 0x5, 0xffff, 0x1f, 0x4, 0x3, 0x1383621, 0x100000001, 0x7, 0x0, 0x0, 0x5, 0x4, 0x2, 0x3, 0x0, 0x40, 0x0, 0xfffffffffffffffc, 0x1, @perf_config_ext={0x4, 0x5}, 0x2, 0x0, 0x8000, 0x3, 0x1, 0x7, 0x6}, r5, 0x3, r3, 0xa) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x12100222}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r2, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r8 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r6, 0x0, 0x0, 0x2000002) fallocate(r7, 0x0, 0x0, 0x10ffff) ioctl$EXT4_IOC_MOVE_EXT(r7, 0xc028660f, &(0x7f0000000040)={0x0, r8, 0x0, 0xfffffffffffffffb}) chdir(&(0x7f0000000000)='./bus\x00') socket$inet_udplite(0x2, 0x2, 0x88) 04:04:17 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 04:04:17 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x8941, &(0x7f0000000040)=@generic={0x0, 0x1000, 0x8ec0}) timerfd_create(0x0, 0x80000) r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='\x00', 0x800, 0x4) ioctl$UI_SET_PHYS(r1, 0x4008556c, &(0x7f00000000c0)='syz1\x00') 04:04:17 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat(0xffffffffffffffff, 0x0, 0x0, 0x0) readlinkat(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = creat(&(0x7f0000000140)='./bus\x00', 0x0) ftruncate(r1, 0x0) r2 = syz_genetlink_get_family_id$ipvs(0x0) sendmsg$IPVS_CMD_SET_SERVICE(r1, 0x0, 0x3ffe) r3 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r1, 0x40086607, &(0x7f00000001c0)) prctl$PR_GET_NO_NEW_PRIVS(0x27) syncfs(r1) read(r3, 0x0, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(r3, 0x6611) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000300)={0x0, @initdev, @local}, &(0x7f0000000340)=0xc) connect$packet(r1, &(0x7f0000000380)={0x11, 0x3, r4, 0x1, 0x1, 0x6, @remote}, 0x14) read(r1, 0x0, 0x0) ioctl$TIOCGSID(r3, 0x5429, &(0x7f0000000180)=0x0) r6 = perf_event_open(&(0x7f00000000c0)={0x1, 0x70, 0x400, 0x100000001, 0x1, 0x1, 0x0, 0x2, 0x2, 0x2, 0x7, 0x5, 0x800, 0xb0f, 0x100, 0xa7d, 0xfffffffffffffff7, 0xc66d, 0x100000001, 0x2181, 0x5, 0x0, 0x5, 0xffff, 0x1f, 0x4, 0x3, 0x1383621, 0x100000001, 0x7, 0x0, 0x0, 0x5, 0x4, 0x2, 0x3, 0x0, 0x40, 0x0, 0xfffffffffffffffc, 0x1, @perf_config_ext={0x4, 0x5}, 0x2, 0x0, 0x8000, 0x3, 0x1, 0x7, 0x6}, r5, 0x3, r3, 0xa) ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80087601, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) sendmsg$IPVS_CMD_SET_SERVICE(r0, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x12100222}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x1c, r2, 0x800, 0x70bd2c, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) r8 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r6, 0x0, 0x0, 0x2000002) fallocate(r7, 0x0, 0x0, 0x10ffff) ioctl$EXT4_IOC_MOVE_EXT(r7, 0xc028660f, &(0x7f0000000040)={0x0, r8, 0x0, 0xfffffffffffffffb}) chdir(&(0x7f0000000000)='./bus\x00') socket$inet_udplite(0x2, 0x2, 0x88) [ 2457.752576] binder: release 22171:22178 transaction 535 out, still active [ 2457.766050] binder: unexpected work type, 4, not freed [ 2457.775134] binder: undelivered TRANSACTION_COMPLETE [ 2457.779032] binder: 22222:22224 ioctl c018620b 0 returned -14 04:04:18 executing program 4: r0 = open(&(0x7f0000000080)='./bus\x00', 0x141042, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$RNDGETENTCNT(r0, 0x80045200, &(0x7f0000000100)) ioctl$BLKDISCARD(r0, 0x1277, &(0x7f0000000040)=0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) mmap(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0, 0x11, r0, 0x0) r2 = getpid() capget(&(0x7f0000000000)={0x20080522, r2}, &(0x7f0000003840)) 04:04:18 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000080)) exit_group(0x8) 04:04:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 2457.990713] binder: release 22186:22188 transaction 538 out, still active 04:04:18 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) writev(r1, &(0x7f0000000100)=[{&(0x7f0000000000)="4a0879b85d7775371509fdc31cc4b5efd25e24f468e3920c192b37c2f8d972a419904674c6433e8f6261f28f6a341c80b79189e8f26d6e2923a99e5de8895dd60a683c4b52f3323788fc4b0a8b33c741950ee784a4d4f765370151e75eae1aed2b5d7d7a05397a8a55f504b514e9f773feb35558257d3d082b64374d5b46e2c8146ab1e8604d4b7d93", 0x89}], 0x1) 04:04:18 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCGABS0(r1, 0x80184540, &(0x7f0000000080)=""/128) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:18 executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)=@polexpire={0xcc, 0x1b, 0x209, 0x0, 0x0, {{{@in6=@rand_addr="74b038f7716da198bc570d9196923b95", @in=@initdev}}}, [@policy_type={0xc, 0x10, {0x1}}]}, 0xcc}}, 0x0) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000040)=@add_del={0x2, &(0x7f0000000000)='erspan0\x00'}) 04:04:18 executing program 4: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000300)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r0, &(0x7f0000000440)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x4000808}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x24, r1, 0x10, 0x70bd29, 0x25dfdbff, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x1ff}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_int(r2, 0x1, 0x2e, 0x0, &(0x7f00000001c0)) ioctl$sock_inet_SIOCGIFBRDADDR(r2, 0x8919, &(0x7f0000000000)={'dummy0\x00', {0x2, 0x4e21, @multicast2}}) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r3, 0x40106614, &(0x7f0000000100)) epoll_ctl$EPOLL_CTL_MOD(r4, 0x3, r2, &(0x7f0000000140)={0x10000000}) getsockopt$SO_COOKIE(r3, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000080)=0x8) r5 = openat$cgroup_ro(r4, &(0x7f0000000200)='cgroup.events\x00', 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000002c0)={0x1, &(0x7f0000000280)=[{0x3, 0xc07, 0x5, 0xfff}]}, 0x10) ioctl$RTC_PLL_GET(r4, 0x80207011, &(0x7f00000000c0)) 04:04:18 executing program 4: 04:04:18 executing program 0: mknod$loop(0x0, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2cd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) unshare(0x40000000) r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f0000000140)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r0, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000240)={&(0x7f0000000380)=ANY=[@ANYBLOB="080528bd7000fddbdf25b19d86b5080005000500000004006b56226480bf11ca0000300003000c00040000000000080007004e24000014000600fe880800000000000000000023000101080001000200ffc523000008000500b209"], 0x1}, 0x1, 0x0, 0x0, 0x24000040}, 0x10) r1 = accept$inet(r0, &(0x7f0000000300)={0x2, 0x0, @loopback}, &(0x7f0000000340)=0x10) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) unlink(&(0x7f00000000c0)='./file0\x00') fstat(r1, 0x0) chown(&(0x7f0000000280)='./file0\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_EDIT(0xffffffffffffffff, 0x0, 0x483, &(0x7f00000004c0)={0x0, @broadcast, 0x4e23, 0x0, 'lblcr\x00'}, 0x2c) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = inotify_init1(0x0) fcntl$setown(r2, 0x8, 0xffffffffffffffff) socket$inet_tcp(0x2, 0x1, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000200)={0x0, 0x0}) fcntl$lock(0xffffffffffffffff, 0x26, 0x0) ptrace$setopts(0x4206, r3, 0xfffffffffffffffd, 0x0) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000180)=@req3={0x9, 0xfffffffffffffffc, 0x40, 0x0, 0x9, 0x0, 0x1}, 0x1c) ptrace(0x4207, r3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000000)={'yam0\x00\x01\x17\x8b\x00'}) getpgid(0x0) syz_genetlink_get_family_id$tipc2(0x0) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x400000000003, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_ifreq(r4, 0x0, 0x0) ioprio_get$pid(0x2, r3) socket$inet_tcp(0x2, 0x1, 0x0) [ 2458.085571] binder: BINDER_SET_CONTEXT_MGR already set [ 2458.091251] binder: 22240:22262 ioctl 40046207 0 returned -16 [ 2458.099740] binder: 22240:22262 unknown command 2097152 [ 2458.116001] binder: 22240:22262 ioctl c0306201 200002c0 returned -22 [ 2458.144512] binder: 22240:22262 Release 1 refcount change on invalid ref 1 ret -22 04:04:18 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 04:04:18 executing program 4: keyctl$join(0x1, &(0x7f00000000c0)={'syz', 0x1}) r0 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000000)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffd) keyctl$invalidate(0x15, r0) 04:04:18 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00001400000008004500002400040000000000907800000000800000000000000004019004837e698706a1c8"], 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000740)={0xffffffffffffffff}) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$P9_RFLUSH(r1, &(0x7f0000000780)={0x7, 0x6d, 0x1}, 0x7) ioctl$FICLONERANGE(r2, 0x4020940d, &(0x7f0000000700)={r2, 0x0, 0x9, 0x4, 0x2}) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f00000007c0)={0x7fff, {{0x2, 0x4e22, @multicast1}}}, 0x88) writev(r2, &(0x7f0000000640)=[{&(0x7f00000000c0)="c3cd0f5cbd9c4222035351bbcc4b353e7179c701c45212585328d0d0", 0x1c}, {&(0x7f0000000140)="df910d3dee94cf72a04291552a579f31f9fd99e6c184dcfb6f9226ad8d7c81379e3b0ffec6917119bb7da5045905213351fbc9f4ddfb3c72a231a8d8f089414b0bc5b6a924650c8aef987fce29e64bf22541e14284b7d2f57a991fd30e15d7f4913cea4d93338222560342fd8f09c51b3fc2caf90ddd22ccdacf3d4e5aecccef1fdb91d9c67a0d796c5fdb1dbbdc728c2eecff3545b4874fe0edca20068068a4e4810c4580ee35819a438262f95cafbe15b9441b7c62", 0xb6}, {&(0x7f0000000200)="6a6519b1833955bf791aed57e67d0873030b4c7138247dee9954f21d6ef90f7b00d9f391e493f00e61edb33ead3a72f0796f75ad701e6904ea17d948c6603ff80a9f0a7d9d87be4d3f95a31446ea3d30461759ee409980f253467d71c0c5", 0x5e}, {&(0x7f0000000280)="3871c425e8b31acf49aaca3f5c06112ad15eeeb10505fdc705a3e5c68b746769829d9361c6084167187ce5ef3c3ce24efd94dfe67c79dbe5e7bb5028bc7c6232d75c066e71b67bd914d215bb3769d9503a3696e38b14ec9b5c4c45e7a4afbd85cbe452cbf51ebc83c275ba818d9714abee241b78bc51109eb2a43be80a7572fd56b2e330ea9027ff2cbc85f943e30b7e5a4d04f4988d96cb2f3dd81402c9bc5246e06aa840f01e0ecfb688f7bce5ba14e07faed41cb4e4201120f7f00d3ebe1a15cfed9f36d37dad7ad55b8aec4868b0c737f5aeb8e869d639944e782fc58661ca3b9d04e6b47269", 0xe8}, {&(0x7f0000000380)="070edafda12b9781882407ddbddeb86f783b497b335aaf621faf867d94a8cc6d92b81d167cbac6f6c85138b7c24debe32b58d177e2ecc617fe2421c8cad662618109ad78baba3d69de960579bb2e19413801958f0b1fcd5bcd9d5b0be923d5501f9a5cbff48801b4a6a06ab315bfd557f1b7a7fbfffec7b2181b2950fc9a23deb600602c638a24e973fe46198677a071f6f42fc9bc83deae5cc3c816c648d6", 0x9f}, {&(0x7f0000000440)="fa0df2cb7f992f230fd10841b17358eebd7c2a516862dce929ca8018c3715a3758ccfe50d5ea2fc480b3e908dc94aac397b4f8633b6b7ac43b8f75f9d79a0469799d9a37d0ab602b64bf7ce2bf8ae3dacc3632d1ceb85e529d6a751bba8384f9ca0908c4c3984dc3fb6eb78465a441686c4463", 0x73}, {&(0x7f00000004c0)="badde481f7ab369fed81af4d867fcbe8869d9e1fd286c63b67a133", 0x1b}, {&(0x7f0000000500)="4caa89b85f99a5758c991e9d484ae6579a373668290bdfa41e28c2c102b718c538dbf19ce3450f5e435f2b7632dba7640e0ef44e8faf516694951593c945f7654c279c59bb3afcbf8a15b3f7c9d1cd5eec78b71d18f055a080ea692a67c9af001d86b07b40ae32025d90ae33d67ec6", 0x6f}, {&(0x7f0000000d00)="2ad69eadfd8299ffc6c5d52de44ed1ee0ae59fe9e5db566daac1c80eb761e84ceef0d5c526cd5daa160af5de98e3a2a1e04e8003755ec25e2142d842a21d7eb328cbd5da421a35c0a579dc76f44d1b0196f05363ec3967b9cdc7e54b9080d6c250ebe96899b3f4ce854eb51d4fe92e6cd83de10a3d6e0d5c6126238125e268b2376fc2049218a226ac2b40c962556d6b1e591a4b99a7e25027af0ae4e52865fb63712235d33ac404c9e323a91522f59e1deadb93f5224325369cbfa3e3af46c000f97aa123c7cdbb9b75f1653657c62dbd7bcb23581dd4274d33aa4600bd5b1478d4107e87e8a3b56d856fabbd9376eb9dd9e5e3c7b80101f316a22284ec6afb1cb6f5fbdd4b44959143c2e29d94ac306285e187d0d2d2b89a2384c9b5e602778f7598b4a9ba33482451bdc80c7e1301671741d2604aab14aa76375868bdcc16a02667067a16cfb952500c94c681cbdb77f0e29b2219247e339f87ce4173e64a24a6c15ca59dacbfa88a44109cf8e2b2ab7ab56a815c254f06de1ab46d25d45e3159f0ca131a02b820f8db1be4614de37672ff38fe6ab3a79025c8da003301cd978219962d5931c62af4e53db6b3e0c34d01db98518dbd49fd93ed2c6dd9bb4261195992175bc7848ea3e1225ec0cb019ee57a724d5966bb3c4ac278e5013f4dca5c9a9eaa1e593bc981519bb54c68e5cdd86eb6f41382c153b6d0560358caac53c7e5c587e5e0c3c3f6cebbe7bcc85b9800fb045920ab700bc41e6a46aba3a07ef23432ee6568e84b63687c2f020e9fd04aaf957433d0e63fed238a27f9f7cb1e7f089673e034153e113fe65885437d92e0d59909d7a67eec28ced2e52a46f5b2169edf1ebb18eb4309cd6c1d1362f130c38fa638fb0a57817098fb718544d0a3813fdc37df073c59fbbcb39710c6b4acb25c6629d57824faf83b7e38631575af4b4c4152342a58216c9cbc281c3497bdeae605d09512fe8d103f75bd8c7631af3669754c455c4297b3b03d169c46937f4323960125b828abb1250604c772027061ea0d8af08013e67c1324ce526d5da7e5a734468c6e80ead36536c31b47cc56f00d42f0b9184ba57760e578f8f6e7972f5adae8ca0b17608299b16b2d7dc95413a21fcc27dc47e5fd2954c10dd9611c4a158d50c28cb61cf6a9683a8b178774e1c8377e17e93d6cae99e11e9de595a40462d04e74e2282ce133c4d3c381603487dbb3e54e6d38c1af0b6c67915aa97b939d6fb2f074b20ec8d38352208af166c97738616b432fa93e39a57a8586ace8e454a027e3f3b1b290532570642766db14b9d77cf98fcb75068d0100043e8c6691e76f5a77b25ef8a93add300f67583d7f478ba37c55ba89d120db6ea03f22ab65a0ead271946221b2671e62ebfb78ed6f0e36b104ddd82086cd0a6852aae9746f99e8773e971138af571457cf2005e0c07cd58d78529874cf111beaa4de95ce32885fcfad0215df92a4cdbf333a5800f0c27236af4e99bb41a4f772362f1cafcf85ef7932e21991a7750f56005aa4bdb6e9bfaba9fd55376d915fb5a370e55fe398bd4b00d93cf43c059c39e84a395c8acae9b52f38a51efa9c1a809b1e1a612f8c35d491be79fcdf1951180a32d99bb0c68cd41bd9c0157744028660bf5b3b165eeb6b3152831cccc9609f7250a52bf17bc7805bf931c3f277acaab4e2b946b1aec2af23777cf444d9722c47f9f1a20471052b7262f567c61558f19200971bcc257f87aed4d62b22cc9261b371e3a4eb41d8cad9adee5ede65ff2f29a0a72a49d6370c2a28d7d15b05066d7dc85a35c1b1ec1ca297b97dd46c80318b67ddf0c7c64c6aa076dfa8b345cea761d68ecc37a7d4a42cf09ac890cfba6a06c7ba9c2487c397eed7fa4be048a9bee4389f7d99dd10dff946c996a5cc4362c45e028964eb2f4c192ae8299ca4557afd70c7d56d258876634b7eb354227e9530d0e268b764b2b4c1479827b8ac0748fe65732d044f585cb0d8a4762634db5ff16b4e24b13d174e61d2f5b6bfe07f8e9de8343d044edc03546fbe32b5ade8fe8407f5a98ec1ca3c62842513f6b64a6f2c151641226494111c5b382cffb0400487f07484407324f69f2571be3a4968787b846760920587eacbdd7d1564c84617e85f5ac8f98b68bcbd8b607fb203d663568f7bbce32052319cf59dde5f5d050aac0a2fec1c300b63cf009062b8b29c8f98e3a45c375269c9bf5a00b1c98fb36fe78382f36d227946398f114c30ae32a6657eb42aaa5b38c874c7f88119eab0fc69cead0f1781554e770b7e78eeba231382c93fc2053a79a79eb29fb83ab88ef959923ef95eccf43578792b115721e1b1cf88d1d32a299b61035a02daccaf1e3d771a1443b2f3c88b3fca6a4bec358bdcba9628050e71e8c14cb70962471e9622fe834717d5c199dcdc9163fa3752e6d149bd6480737877f97507a220af1137e68e467646cd573825cf9558184650c84a36608c254bcc483fcf5f3be9033dcfc938d7bf7dbf7e71b93c4ef94adfc468b8688d8b4b44c00cc4b5ef4e53f65eae8b4510d62d6aa6cf75a818e9e2b8d1894c049dad335d225b7ec6c468567810a32f902fff7182b6da179d9685237d5bf166e0ca286d3445ec53f428edefb22fde5b460da8fe00e26863f04c9954861f582dc5c4046ec0039ef7e5318853e46eebaf7a60b9068952a4191e7e5b53fd0960f0cfe75e75a1327121251342bbe1128ce7798a25f65aeec08939fda6e322766e03761798ae21c3d3c2d1086010182f984f3abc1f8df13dbe02eb35e0a6079c999392c659b43c5d38fd285a44b71cb5e716a12b261be4252c38410e2f5accb759354b02747a9526b4e9fe730c7f4c21afbab685853e62631ba911c515fac982cb6db16c15c4cb9b81c528fa81aff7c7c3ecc05e361a0d0efd6e48db02450940cedaa05b52f991feb7ecd1e144e892f8d6103d7922eda78118fba33883a39fe0891fb3f89091760aa0a5f41aabeaebc473d9c63a9321f99d02aade55a89ff2899334ebc2c98c1f531404588e2bf8b18c2a0438f4b0219fcc676df87594410681fe83921ebdf059f21b64741e2f24e3b178477351dacb981b79abb0375f736a13b8f1662eb4cf5293b63551327ec0cdd372d8d12327af2f76114bcd4f804fca3b421a197a7f25c76ae45db48bed1b5f9596f226d0bfb7813193b077546b9bd9fe67b79f73fe514580872f9343e8fb0aeaf5d1506045276e5db1f3b469bff8b5d8fd6a50de8b93b04b2467611b285d1960a5caf1f884eb8665785d578cf5b801de980caa25deaa9284087276ebfbb25641275d2116a12051ca24878229fa8b395b430c71ca9e6ebaf0c0e85ade2186e06fa9c2f773754f10e7c3ddf4ee648bae537ddb665286d7e20661b7992da89efea114d845c2ef3333efc8bd1d4170e3ca3bd92ea2e5280d43fb4a2e3261cc0c52a9b18fb3929040a63409b8fbfa42ad80d41858129cbf0f11856e6ed39d2612a2486ffffe0e2db5b2baf6a781ea8604e02601379cd592e8b2ce6ef67c55a365beb5eabd7bd28108786c8403dc0fdeeb24bf8566d9854661e9f252b9c4b90f4dae65e6e141c46a59400509c02d39260b7179ee6be9e80e66ea421f82fc1479d7284d273826706c7cd16e4d109c41c12ffab2f337904aadc149be62a1b89b44116ee9f43a38d140c3d0bfbc4980a545c76ab077725f9590374605b422fb8fa847ace916f992f70800d1d599d2ae70d8eb08abdd5b2f0c3741eb92adecd8759e5c5272403e399d6c93e5df74aa929c72b2dfcd7bb43497bc8132eadb9a9e622903dba04c16a7c5d2d08f5cf6ee66b5046ceddbc965874423074a47d9fed3a6e42d72f3aede93a5bdb9ac132f4dc37b3d199b357d5bc1c89b4c08c7bf4e36ace338900a2b392b4cf732b41a3c676c1197a9e7bc397ddb38c3dbfa93d1f9220b33c29c9d07f9b8b451df7c639d03f0242d7a6166574c10f694bcecf63b5bf2abfaf4dee451bf8e10973eddfb8dedd27d6443136b6740b3a59634e7b6cb019b8a5d20c591a51a0850012ef2dc6fdaf524371d10d6a094ad3722854357ef508d69a050b25f81c7d3a4bcfe94f7f9688cba875d1faa5367d81d8ab94cf53cfaedd6cef14bad76ce54b3f8bea764ef0478cd2ea03aea7eeb631848ff17ee51ea958e4ec8f3062a9dcad6b70d4b56725ec499ed625f1facbde045338dc0504551cc873be5db979dc1d8fd9434ee0e25cded38329380efce1531197d9fbf0ecbc97a6b1a3bbaaf0ec21eb1fcce3bd184dd90a78fad736a39cd1e545a3a2dff486ec8381de953984ced0f6c786a0f044cccf464b9b397b5f5199678c36265ead171a11736d0c2d165565a3dac4776e39ebc4679b0da1adf1bee9521f84a0d4bf20a4375e222f9fe28e21334ae0ea06cb9a7107a7582e04bf77e9f4fb1eb21459533940571e583f6b8e2581790628b4d181c8ab37412c9a0ca6ab0e20ba641b47af57d0592afaa46e279d844995c279905d93caf06c8a43ee506180174417c0a06a8a0bcdf9d892f24b7bca4db18bed438d28fdb56b8796a7989325b0dfe1200796ded6ce09a4b75183fb5e94604625a22f3c2a5734491b8f2ccce103f7fc69cfafd438b948406c12e08b29dad637f34b95e65ec1dfa0936634259da322eb9176b233fb9ab6b4dc080e092f124ea9724edaf24cda40ac41cfed4313373c3b2e8031f73d9912ca7459389bf53327076953895edde30d105402c271ff68ab40e3632d46929b141e44519473b8c53ad6549b35e1bda1fcadf327c031bd60fa9a27265dbb3443c121fe745b033f02f2d4ebf498657c180d24bdb42c8d9edd47d59c6a80bc884a853f61b60587b4821e9a2cea24d72e149a51b1287961f6e798112f39ba1649ad0cb594959ee561930671debe4fcccd7daef7329c3d2eedf2a1f70ae24c53b302c0817fa324d2eef5aa2f50b68052874caff449eddf05c3fa393f99f550fca9096bef207874680c6cee6e4b6a173cb712bcf6f84ac9121fb9cc551d11f4fecb4b5110133d32e1911e77e852b752fbc2d1c0a8afa7d6126c57ee43adc76b93760b280a162ded6d2c56862d1d7b6f058a56d121b765ac4a33cf3f17f425eb200071aeb8114024bd81bc4c5869213c27bf9d625ab1e13379c96c781acaeb77c9739c372622b1f8c7094411fadee3e59406df8d4c71501db28f75394182030ea9d8d9142a4b1329d0685344b61f883ee85785ec2321209f67a73932e3494d9e5c3550342a443f59bcacd7d19edcb9bac1bda1cb01651c8f83e080551adb31e78023ebc5ee52b0c1cea7e42b66d89cbae78b042f5a9e265e32f3a969b577001e60bbb2475462718b535f69bca2cff7992bfd0583bfdd80d9f47f4074bf0ea5e4130aa0eb4fe933b6835fd135b9989a3af2a426d2e7c7abc0689260ffa7eff99629c9cc76880a339324b6dcae13f5ccf385faaa44439932eace711452efecbd4f97bed2973d34a7e0d62509f732638a0c49e1e022322e5575c260a4a7edcf2b5537c276423e52cfea529c0805ea59a5ddc493c43888f600051bfe357f307b00eb133d199a0195b9ec02f5b67c92950b51dc8ce5f9783d1d951939039428193cced1836b943084b594583cd21f877e8f3f5bfe21fe37520471172da771f8c52a74ff158ec3b975b02fbe96d355411f63976398211083a27f4e509befb9b7c1595933321033911093be02b5123386af9bd74c755603f88cebd3823ae77aebec8a0dd2c8f9bb28456c664b9785c2436d4e62b190a9a82dec2662947601c", 0x1000}, {&(0x7f0000000580)="4edfdf564b8528afc8ebf6e4c90506e705c1d7679c0b075d949672ee00c480946c99c8f568974bc0daae72b6f729e5a03e9f6aa7bc98f87fdba009ff15f14445878d7854300356f513706d0e89cfa9512272809931ef1d638d256ba8a5ba3a1c54943cfcbce5ea6d37d216284528cabea16657a0e4b516742041fd224de60b8803b625e3b9e1ab851cb16c5855bfd4955648e6ee5c64611c83f5db4b4ecea62f648a2e8355820f95acb7a5b3f9240ecaace7bde92cb45098362bf23c024e", 0xbe}], 0xa) setsockopt$inet_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000080), 0x4) 04:04:18 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) r1 = open(&(0x7f0000000140)='./file0\x00', 0x4000, 0x0) accept4$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000100)=0x14, 0x80800) socket$inet6(0xa, 0x1, 0x1f) ioctl$sock_inet6_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000180)={@initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x67, r2}) fcntl$setlease(r0, 0x400, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 04:04:18 executing program 4: r0 = socket(0x400020000000010, 0x2, 0x0) write(r0, &(0x7f0000000000)="1f0000005600436dfcffff05690300000701ff2104173f8100000002030039", 0x1f) r1 = getpgid(0xffffffffffffffff) ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000040)=r1) [ 2458.579434] binder: release 22222:22232 transaction 541 out, still active [ 2458.587464] binder: unexpected work type, 4, not freed [ 2458.598428] binder: undelivered TRANSACTION_COMPLETE [ 2458.614922] binder: 22287:22289 ioctl c018620b 0 returned -14 04:04:18 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x40, 0x0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_LINKS(r1, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x41000000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r2, 0x20, 0x70bd27, 0x25dfdbfc, {{}, 0x0, 0x4, 0x0, {0x8, 0x11, 0x1}}, ["", ""]}, 0x24}}, 0x4000000) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa000014000000080045000024000008000000907800000000e000000100e2ffff0301907800d7050200f534752c692131656f596022a37901e81343e1a66980576c4df007119d1d5aaf7be8f4b2d0e582ad7e13fc9d977d08"], 0x0) 04:04:18 executing program 4: r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$UHID_DESTROY(r0, 0x0, 0x0) fsetxattr$trusted_overlay_opaque(r0, &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x2) write$binfmt_elf64(r0, &(0x7f00000000c0)={{0x7f, 0x45, 0x4c, 0x46, 0x1, 0x5, 0x3, 0x6800000000000000, 0x100000000, 0x2, 0x7, 0xf3a, 0x1c8, 0x40, 0x24f, 0x2, 0x3, 0x38, 0x1, 0x18000, 0x0, 0x8000}, [{0x0, 0x7f, 0x1, 0x7, 0x54ee, 0x5, 0x6, 0x9}, {0x6474e557, 0x4, 0x2, 0x1f, 0x9, 0x5c, 0x0, 0x1000}], "660f781ada69192a5d5acd7d3605a3d3d8fb8b6d74c9a5031f6b3d96964bc16e2086c1a6a6a8b869516f6696dc5844209ef0b4f5c98686678abb90ce80fbe642aacf43593515aa5fc3704ec0ced4a6292f4c633fe8b9601da7a98cd1489a023673fa2068ba0c", [[], [], [], [], [], [], []]}, 0x816) 04:04:18 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:18 executing program 0: r0 = perf_event_open$cgroup(0x0, 0xffffffffffffff9c, 0x0, 0xffffffffffffffff, 0x0) clone(0x20002100, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x6, 0x1, &(0x7f0000000580), 0x4) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000001a40)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300030c0000000000002000000000020009004000000000412d1fbc000000030006000000f9180200ee00e0000054d81458186fe8b90002000100000000000000030200044a7b030005000000000002000000e0003f010000000000fca0d9"], 0x60}}, 0x0) lsetxattr$security_evm(&(0x7f0000000000)='./file0\x00', &(0x7f0000000140)='security.evm\x00', &(0x7f00000001c0)=@ng={0x4, 0x5, "5ba6844cadb160ee7a6aed833e"}, 0xf, 0x2) exit(0x0) pipe2$9p(0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x0, 0x0, 0xffffffffffffffff, 0x0) openat$zero(0xffffffffffffff9c, 0x0, 0x80, 0x0) fstat(0xffffffffffffffff, 0x0) perf_event_open(&(0x7f00000003c0)={0x3, 0x70, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x18280, 0x7, 0x0, 0x0, 0x0, 0x1, 0x100000000, 0x0, 0x3, 0x100, 0x7, 0x800, 0x8, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3b75dd00, 0x6, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x2, 0xf3, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x100000001}, 0x800, 0x81, 0xd3, 0x7, 0x9, 0x0, 0xfffffffffffffffe}, 0x0, 0x0, r0, 0x8) 04:04:18 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:19 executing program 4: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @broadcast}, 0x11) sendto$inet(r0, 0x0, 0xffffffe3, 0x20000000, &(0x7f0000000080)={0x2, 0x4e20}, 0x10) sendto$inet(r0, &(0x7f0000000140)='I', 0x1, 0x204007ffd, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f00000000c0), 0x4) r1 = dup2(r0, r0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000740)={0x6, 0x2, 0x1, 0x4}, 0x14) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x3, 0x4) sendto$inet(r0, &(0x7f0000000040)='P', 0x1, 0x0, 0x0, 0x0) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0x2, 0x0) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f00000006c0)=0x0) getpgrp(r3) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') getresuid(&(0x7f0000000540), &(0x7f0000000580), &(0x7f00000005c0)=0x0) mount$bpf(0x0, &(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='bpf\x00', 0xc000, &(0x7f0000000600)={[{@mode={'mode', 0x3d, 0x5}}, {@mode={'mode', 0x3d, 0x11c6}}, {@mode={'mode', 0x3d, 0x10000}}, {@mode={'mode', 0x3d, 0x20}}, {@mode={'mode', 0x3d, 0x3}}], [{@uid_eq={'uid', 0x3d, r5}}, {@fscontext={'fscontext', 0x3d, 'system_u'}}]}) sendmsg$IPVS_CMD_GET_SERVICE(r2, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x402000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r4, @ANYBLOB="100425bd7000ffdbdf25040000002000010008000500000000000c0006006e6f6e65000000000800090026000000080005002a000000400003001400020073797a5f74756e000000000000000000080003000100000008000100010000000800030000000000080008000800000008000800000000000800070048b200003400020008000300020000000800060091000000080004000104000008000b000a00000008000b000a00000008000500070000000800050000f0ffff1c0003000800080081000000080003000200000008000800080000000800040000000008"], 0xe4}, 0x1, 0x0, 0x0, 0x40090}, 0x800) ioctl$PPPIOCGNPMODE(r2, 0xc008744c, &(0x7f0000000280)={0x82fd, 0x1}) recvmsg(r0, &(0x7f0000003080)={0x0, 0x0, &(0x7f0000003000)=[{&(0x7f0000000180)=""/184, 0xb8}], 0x1}, 0x0) [ 2458.825910] binder: release 22240:22262 transaction 544 out, still active 04:04:19 executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000440)='/dev/vga_arbiter\x00', 0x100, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f00000000c0)={0x4, 0x1, 0x1ff8000000000000, 0x3, 0x6}, 0x14) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000003c0)={'rose0\x00', &(0x7f0000000080)=@ethtool_eeprom={0xf, 0x5, 0x8, 0x3, "8d8528"}}) linkat(r1, &(0x7f0000000200)='./file0\x00', r2, &(0x7f0000000240)='./file0\x00', 0x0) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000000780)={0x782, {{0xa, 0x4e24, 0x401, @dev={0xfe, 0x80, [], 0x11}}}}, 0x88) r3 = syz_genetlink_get_family_id$nbd(&(0x7f00000002c0)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r3, 0x100, 0x70bd27, 0x25dfdbfd, {}, [@NBD_ATTR_DEAD_CONN_TIMEOUT={0xc, 0x8, 0x1}, @NBD_ATTR_CLIENT_FLAGS={0xc, 0x6, 0x3}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x9}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000080}, 0x4000) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f0000000740)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x20002}, 0xc, &(0x7f0000000700)={&(0x7f00000004c0)={0x23c, r4, 0x10, 0x70bd28, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0xc4, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4c98}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2a7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1839da75}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_BEARER={0x164, 0x1, [@TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4fe17a5b}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_BEARER_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e23, @broadcast}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'bond0\x00'}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffc00}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @multicast1}}, {0x14, 0x2, @in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0xd}}}}}]}]}, 0x23c}, 0x1, 0x0, 0x0, 0x4040}, 0x20000000) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000040)={0x6b8, 0x1, 0x20, 0x565}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000140)=ANY=[@ANYBLOB="aaaaaaaaaaaa000045000024ec0000000000907800000000e0000001000000000401907800d7050200f534756f02b9a1646ec9c7d4091b6aab5c46fff29460830eeed4058b26aa52091026ed08c893fa097883a41da9a6778cb553c88bd5db853ce4323f22c40f1a0b37db358b81a78fdab9a73ac4f6052b08d1da735050458680845b16e410bc"], 0x0) [ 2458.919545] binder: BINDER_SET_CONTEXT_MGR already set [ 2458.925325] binder: 22314:22325 ioctl 40046207 0 returned -16 [ 2458.934117] binder: 22314:22325 unknown command 2097152 [ 2458.940437] binder: 22314:22325 ioctl c0306201 200002c0 returned -22 [ 2458.947741] binder: 22314:22325 Release 1 refcount change on invalid ref 1 ret -22 04:04:19 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x40f, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:19 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f0000000040)={0xfffffffffffffffb}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:19 executing program 0: syz_mount_image$f2fs(&(0x7f0000000000)='f2fs\x00', &(0x7f0000000080)='./file0\x00', 0x3f8, 0x4, &(0x7f0000001400)=[{&(0x7f0000000100)="e745d4843209127997b3071db8404c96ad5cb38056ebfc31be26f04e606ae3025e5582c5c403cb96a44c38d5e3a574e4f7ba1a0f3a4ab7bc49c5d575418b54aa71717dec4733b8d8e523b316f29ff0044f5b878502f62ed9118cb37f0184c386fd36b0109b951eaca6dfca0cddb6f97fcdda76c4e448163b7ccb86e1a722cea42dc694759edce93d84ea5312372b1df93f76292b244f4cdb13896001cecb520d99ab6bf20eabe30d8e50678cd8d925b27d50876f69a8d79fe0cb2c45d0a3cd22ca6a7056a6891baa3766b57b9cdf1530f99611687c23906e8c438668731222365e1d5c6b6c39e777be9ebe36a5f880fce05543bb8bd10f583e3d98de549b", 0xfe, 0xffffffffffffff81}, {&(0x7f0000000200)="da11a83d94b31292e666f34837b74cbb1d79b87766a48878b9b9a88b531eda48f7ef7f7406e64991277af205f6d2398485b923d200cd709e1871a26ef80db43e280f8c5e45b50609efc9cd79e7fffbaa9a56819bbbe021aa7baece9c9267c4ddfe4c68d41356416703a973c887b432212e26222f4290af1299b29a535f4cbdbb9c39a9eed93b32dc3733a347b3e55f2dd8c9e8a0d2c2562c00d17b51ec872c2854cedd320ff3bbfedc3d2351953b95b0c7e70190734e7710d2ee00586bca06eac8b6e85b0c0ff9fbcbf190d13774e85cc1fd27bdfa1779018fe01624fd88ba0840053fd2cd7383399bd5966622812cd502", 0xf1, 0x8}, {&(0x7f0000000300)="b1ed3bd2dd4b7b3222062184583dd896020865f2ca86838b70e2c6d6e0b4d2cbc705f7e6c64e330e5b3442ba8ba471e3d45f3df539057ec9c362dd02b301951a9bee17b74853537091247d91614423f92db9dc474d6fa0e64475e2f50624b3ee4fc44dff82f979935da27439db0877cf062e2f25878e988204ee9ac83ff7589fbc866e37cb524ad66d67fc05d4b775a7ccb4c2d49d1709078071afea792ee6a34db420eb7b6cbd44518ce0da3fc3c7a68888577e481b603eb4084edeb7d279b8348d4dbfe7b4e83c9092f4de466cce44ea48b3e4a1820583b64f98907edab426c25f662eae21b26c46150f5fe91810b877b80b", 0xf3, 0x20}, {&(0x7f0000000400)="9e20801de507c8a412068ebb256a4c2a02d7602444395da47bb4ea5bfe4e4cf228265fa200735f0c7be530bbf2265d62b5f6e4cc62d96d730957bdc052e29cb6ccaddacf0031caaa2e217d3c68819882fb33fe766fdea9a38958ab92ae2903d22dd23026e9724239278a617af7edb376a818b79955430c85b6ceb4960d161adbde64813088afba824362d790718363a0af88897f19af8c650a05d6cf90913afcd245568e186f23bae2525531170ccff49f8037d66c1a2d07ea7616589ad3279bbb616d42545724e9e50cf85e8b1ddc6135f83a7c62a855d5731ad51662b2c2366ff67e68f7859c12315f3da1bd5f3d71ccb0b6eb5a66a719140d4f8a352eb5e2223f45118af209f8c3a172b89c6fd31501591e5d5a08595ee0a8b756a227fbbf787ae833134491c86e819fb211e6aa580221212b93914497816341f2b81ae358792ff774ac78fe6afcc460fdc591b46a294fe776a49697ed2b5bf680fcb9aa4a30a227af64aab187ee048bcd99d0ae5b0f0568332e4f640cbfab16d15cbdc3942b7be47e9e4c29d3d3eadc10ca50d0a5804f475590c5a4f388c22b9af24f8616a245a2246d3166d4b85e7667f40d239b41f63f8347f5b6702a82389aa7f902d619536f879aba1ab001630a74fb0f0d03a332317471837dac787e8efd4d26e61c598d97f602d0df2027bdf0437e5fb896ede49d4b1cb95a392a3a66be126c4ab79fb25304a07a512285d251a0171509f4a5e9e5ce99e270511323e027c0eb4e8be87a1253eaa8c84012c8e447e89705422c47bed37cc629334b73055501a9772832b648e48afac0f3b833cf8807c879cd708ae86e2cb8b472b45f92f19ecca0538aaa6ccc7e6d3baaf3ba161cea48e4ad2291c66be8c14f2c3cd85f8a1be5c3d7816fa869a68e5bdff2f06608f7ba20798a104846570cc0332b90ab2ef367069c535a1e47875b70d21405ff941b8ad18149a0bc120217d5ef2d63f02491f7df506d721c28f58a2eddfb8bfd2f875a70aaefd0ecc4caa73fd17eb6f9188a15eaeb672463ba232c06c10e4f0e0080b1c795a4e20cb1a58e35ea26fe8d81d4b95b8adc4372b6ba3f743c8c806b7ecae161e938d788c01fcd823b999b2beb733eb1c455132c3a26becc565d0c826b449d4d838322f674fb407d3b5be7df46f9aacd7538abafb65818d85a928914c3b53f1b43d9e9a1a24a3213d50007be05b6bcaa9b0cb69b726035b1771427182f6172e1a1aca907c6d5d7cb1b52aa10b943e6075d270ac4d9af7a8abdaedb8b7171c63dc5f9a29a3cfaeb25dc4334e31f22db129aa88184f4bf5676bcf88b8e70c0a7d130eb3bd1c3de1f489b2e0b85fb4dc6d50124715020bdb49ec3f4b9308af44052ee56d6a54a775996ee88115c5aed4aee9c25d34f8b11f47a13bb5bc7c4685abb6a3aaf7af380c7208f833ae9004f06c769db47067ae20c63ed489c66818ef8559d811bc7baab70b09ebfc41a1377ccb87a3da75f237b3a7d849fa41026fb814154f687879dbea36b44d4ec09d0912ab9a6101a18f945db61a4f94c2b5ea6b141bb59d5f6cc70b2520295f947272ffff6bbf52ced411d9b5498a751a7d51abfb15085f2843555d187c59bf44fd91aaffdc91bbffcf26e9d18dde336f1f951492834a4e6dd419fd8add631b4318d1be8ee707b41872536bbdedd0f13bceae79ca8832491efb0ad74c92b1c8a7d2d3d60fb5bda5807503019c93b56442770433174f792eadc38e20ce1da9c54434c6fb717d35efe404cd9d23989deef1a54140ec479ac6d19a797d127a6a4678aba2b6ef70ec559f7014ef09a359582ce058b2088110a97590991b8fc915039c0f7786d48c30f9d43bc44da4eac2abcf4a16de877a74b296b29caba0bfc3a98bc9a3be56ca9795941abcac4657a93e2ec8a8158c05e891dccbe887ac587a386cd0017013c1dfecc8cb00ce5efde820077120990e92f927eed0d0f9fd7ed34d23d1b13cb840763b12caaf42127e5d11e5f9377673280ec1234f833ecd973c5c27deba31ebe60df549d365978333f5f4577e6cc362bc7591ce4d1574a90dee5ce1873a79237b53ac00350e65eebdd5335bade9f1f02a805e21edd27fb341ce666fe6a564b8e9b0257c48cb36cc98fb628c5b412ad7c1176f83b3b37feaf7cbdc10f3d2f27a86dfa3062d9fd0e8d1f3132d84a62fc9fe349971cd521968bc8401b7e1ccc6122ac825bb716be307bf04a81c3b538ca5c9e99b5e8bb16dbc9d7be8616e1ec5c849d7a9ab57d1d45cdc757025d24f5f750a758f44dc172ea54e9b47de33b9049c29ba58f97afcaec680d2409075bf86c9fbd39c6863821bd83afa29d14efdfc10b26d6f1a168478d23769144f9389c55207a8eeb4fea4e5f65fcd1dbeef1be300e439b040c79d49591d2bff020239de5da1836d5210de9ac7bc839a66da6e5c3f121f4475e016dabe3382f8da3323358e2bca7bef559226e2487d2a20ed58d9ce91d6701d58d7a40d91752d7604fb37e7f3381e09863656042fa43e7b5e09c011df852fd1d71f615dcbf907aacf7d9d8abcdfeeae1104dc63aaaaaae6015ab5d58793b51e74deeead2e10d678cc14e4059b5975f949a229f0b18448dce336d509eba9dd901c18d5064a7c7d8da2bf0b1d5310a94414c4e45eb722ee2bc8893ec0516014ff59bb10d1fea6b83826f5c195acd33ff992967c77db946e40180c9402faf5b7d82cb137069ae6b963e81d75668564f421b6c2352895e0f4ddf351e09ff99d4cf9619afb4d9f9dfbd65704a7f8f976068c394f4991c34588cf03825da03d9e4c2862df3d88afec9b0b87637cef284a0e2546da14499170a6da9b7feb760466ed469e97a4a53f6a53236853dc01dd5309bfa097953b49edad0c3046e72df5e871f16f2dc98a0a140bbce8217c8c9761437cf75bb86f4c18da8ee5489118de58d023bc86f39a38ddf658cff34ad055d5c592e0f482206b8480cd2e20ddddb5b0d5beb4706ec2ec1410a41e1e0e96114b3d81539bf3dcd2269d6150a52981ed0626d6d3e5adc641ca5062c1f8532cf4fad1e2517323dd66005ea9f4fd07fc6dd28eb165759e3b7c73b0a9a394b25dfc965433899a7dc47283482782ade5cf3e3f105bf39b1f11ae1606d72d42c6fb1578e21910904049d8e76c2f9f6b90c1b3527f8178e805da7403d60e8e9a5c5983c9f6bfba8eb77872d9bdd9f973743f5c976424b9cfac4bb2a5c04a5450d1e31ee31bdbfb848e04624d19423f4b64c03b9d93c15ce9e0a25748ffbf460e9488a1534a82dff9e5761d948ad61b34609e9bebd72383c219ebf244e31db21ad6cce35a3825c5d3693c0762fed3a1a9c1dcb6d5f31e7a950223a5990a95c86618d105d3ca5bf50a749e772a9f6ebdee3fde1b412d14a0b4f9bfc5d9d16cdefe2fd651dbb437dbb0594860fca051bd87cdeab0ba0956b1301051fe4c891acee8f29345d3cbc8539f664fbfc55093d0789e9e07ca36704c6e90c830f000fae69dbb48efe7832510d7e9c6348c31df505c13185b2a783bd431623ee0911f931561014da4e35c0217e55fe16ee253ee0b129d574f3b922360e185525f3c4d95f77eea099450b92ae6eef8323cb783c39c44f0cb806bec8d66e6c22da25e237056d7445e364219dd00968ba3f7e0180331a3aed226ed8bad620d829562b8901249982398e89a112dfd981bab6c991f7e8d9d80db33c090d6cd6a7898966a8667378dabaf2fb08593a61fc04c0142a53adcbf841ec987d52989be948eb282d777902a6ac74f6ebe1460692435c8a058b6a57006fe2f220f60becf4a922667457044f86823b0764cfa4b43508bd68f09a74b9cb6b8541b928048c2625263d0696ea1ef1ebfe9355b8a0c403b62eede616190001fa85f06be671aceae3b9084ef03c7b37918133d0cc9aef80ed84f3f3b14902d5d6f103394b187b610dc651f8bf772bd7099ed936f2bbddea607d59763d043ed4e1848a4acacb5f6009658438ea1165330063462750d1da7209b051e8dc2ebe7a8f7b0b5d382b51660ffb7cdee969d8dfd22ac1dad362c2976057f10929985bdc770204ccecaeda9e3de413cd373df5f80afce4f9c8c5b5b7eeae5bfbcc5a2ac4de74cc371e28d86c227850101eb4971383572041aa5236f34b2133d68f2bbf0b8f6b3269231e67a55167abbbe1ac17c3cea586757c544180b51f5254af71a16d51ef9b394c78f4d670624e114d21d646dbc8c1e77879abd50d97cf33f174cd1bd29f10649fc4ef5f0014cc03b305fbfe67184034e9a1764170f2840e6ac8b959e39c22c83be09cf49fd14c859f9fd82b09342ec0bf850edf5d091b5b36c60115b88542403bb8a5e96e6f7e6924a6e0f362dffcbd9bd849fcc35128a12eefd397b9b20bcae593e8fe6112c24a19323fd255ddb0cb7fb780507dfe21babf9b93ad54c6e3e310e27b17bc541ccb69a087fc76bd0d967a5b9d5ec1085d4f06fb8c01b010baadd03732d7911391920039cf70a843956908279093aba179d04339ef8436f22fdb18ca2b604a77ab34fa29aef899190c4449fd9f215c1bf9a2a4ba8424770aae94e253fccb091bc7b8c7284c5b5f4cf8f574ad75f996858ca1be181918327445147f1463f4c036c547adf41a7a90c98af1aba65633bc8a1a576e0b056be15a383640d6951f63d667db12ba4f3c95eb01f16def16a5b208c2e7fa586b43b04bed56c44bab34069a10b14654b7ed134bdbfbe1ffbb5c185c55948325a8da78534be22e48c22cb5cca019dea9276418ec82d865d413d683550673941c0715c45917fce4fa188d16cff6e132eb739c4c2efcd69feeccdb9516ca59d0a77468800107d861dabba7c3464147616c2f8d65f7380b7fabaa3c88e2fb6dc1bfb45eebb3a0ce945a8ea08f277f62391c18c1aef7cc033eda628cb83c81d4cd560526fb9ee5f8f3239bdc066fe930e09ab28f205c04775a970aea7a64179313f2ec2bd02c84161d4c199771e695ab56552c9d6f53b5f066b608ae16f40c54736d00aae5c232ae0f124ba89b6746fb0385cfd41067d0b58b81564b3fb52a164db427a02b30244d6962c5860700191008d19f460c723266cf7020b9cbd6ce022614708a8c23b07abfd15ebb71e460099a7e230ff2b8873483a589331f3ada0be298020a013ab5beb802c9b3a7cfdba5136c47104af219d681f3da7597312b2da834002b228f6f378e45d83a4b1380ef00b09ad7487cbea3b0abd67ff9ece86f373403e83f71c11d9e67aa0b4f4b2d159f00920a3b9b7f1f8515aa0c9eb0e23ffeccca6d8792dbdce5b9f21fe0d408ea7554537ce30834605490815de563bff02c6c9b63a0db09d5af8c6f9bfe0bf717cde262956e65968c3eade0c438eab6d8e445da628f9f2ecdba92165226c129077d226599c4f2077bacaf34a7c3940aeab588aa46debffbb208874d5f66066ef23f991087ed242598fadf5b5c0b93a2d82822e9d2ba5286b17a3264e1ef901d7bf7418e005417155b2016041b468b3cce149fea05692befc70a19c4ec098615edc631d598f5032c22aecea77bbb6ab6d5fe7eb0f85c3748de212d27e00fa8e271815f211376fd8a503749a2f196a0a80314a88b122b935feceb72d88c4b9a06c7185e991cd5c24927f2b23d2d6155bfc131a71656635398631a9ea3c0db9591142a7168169b84687bcbb2958735ab2ed892eabdd37deae0963a0f3845a326ab215c5bf9015bd9e6888059c8f87ef979b8d682404d480f342be6cc4e6febb84df0f5fd0788595ba26ca81d1ece8fa796f65d83486138aaeb", 0x1000, 0x1f}], 0x800080, &(0x7f0000001480)={[{@nobarrier='nobarrier'}, {@fsync_mode_strict='fsync_mode=strict'}, {@nobarrier='nobarrier'}, {@background_gc_on='background_gc=on'}, {@noacl='noacl'}], [{@smackfstransmute={'smackfstransmute', 0x3d, '/dy\xbdv/autofs\x00'}}, {@func={'func', 0x3d, 'CREDS_CHECK'}}, {@obj_user={'obj_user', 0x3d, 'proc'}}, {@audit='audit'}]}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mmap(&(0x7f00009fd000/0x600000)=nil, 0x600000, 0x2000007, 0x6031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000a94000/0x2000)=nil, 0x2000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r1 = memfd_create(&(0x7f00000000c0)='/dy\xbdv/autofs\x00', 0x0) mmap(&(0x7f0000000000/0xaa2000)=nil, 0xaa2000, 0x0, 0x11, r1, 0x0) 04:04:19 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x96, 0x0, &(0x7f0000000000)="6beee1ed087deb58146f7df20135a294c9ac29dde6a0f35e9cbbbec5b8a564afc4039d278070b6919fca3044776852fe7d0d7417cbc32a2d80401a58bea5d6abe341619b804c91d6c673a79ab1982a53dbe9f6c5e2ad691be477a3d61a35846ca8d4fce61f451c43f48f0e5f34b14405c028e17bafa9157ce20c3a3b10a8581323d769c720dfdbb2d5f00702e93600043af2019c95a8"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB="0000000400000000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 2459.414682] binder: release 22287:22297 transaction 547 out, still active [ 2459.434152] binder: unexpected work type, 4, not freed [ 2459.443019] binder: undelivered TRANSACTION_COMPLETE [ 2459.449840] binder: 22347:22349 ioctl c018620b 0 returned -14 04:04:19 executing program 0: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3e, 0x8, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0xb65, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffdfffffffffffff, r0, 0x0) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x11, r1, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8000, 0x0) ioctl$EXT4_IOC_GROUP_EXTEND(r0, 0x40086607, &(0x7f0000000100)=0x400001) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r1) clone(0x10000000, 0x0, 0x0, 0x0, 0x0) 04:04:19 executing program 2: r0 = dup(0xffffffffffffff9c) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000180), &(0x7f00000001c0)=0x4) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket(0x10, 0x2, 0x0) write(r2, &(0x7f0000000200)="2400000052001f00ff03f5f9002304050a04f51108000100020000000800028001000000", 0x24) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) ioctl$sock_proto_private(r1, 0x89e5, &(0x7f0000000080)="7ff80e4a4cbd42889f87e4ee5b416e1ceb5760a1c1f38a875e449b43fce66679a7cfeeda3577b0b6ddaed43c7210c18dbaaf61036fb36d8161da5e8ecd9095becacf7ce620f20e27d2cf") syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) ioctl$sock_proto_private(r1, 0x89ef, &(0x7f0000000040)="d51995e3d8b14942834d57eedf32a9") 04:04:19 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) mmap(&(0x7f0000ff5000/0xa000)=nil, 0xa000, 0x8, 0x20010, r1, 0x0) prctl$PR_SET_THP_DISABLE(0x29, 0x0) 04:04:19 executing program 0: socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) accept4$inet(0xffffffffffffff9c, &(0x7f0000000000)={0x2, 0x0, @empty}, &(0x7f0000000380)=0x10, 0x800) r1 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x800, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000019c0)={{{@in6=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@remote}}, &(0x7f0000000040)=0xe8) gettid() bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x9, 0x5, &(0x7f0000000080)=@raw=[@alu={0x7, 0x800, 0xf, 0xb, 0x8, 0xfffffffffffffffe, 0x8}, @call={0x85, 0x0, 0x0, 0x48}, @generic={0x25db0a6d, 0x67, 0xffff, 0x10001, 0x3}, @ldst={0x2, 0x0, 0x3, 0xb, 0x1, 0xffffffffffffffff, 0xfffffffffffffffc}, @alu={0x7, 0x67, 0x3, 0x6, 0xf, 0x13e, 0x18}], &(0x7f0000000200)='GPL\x00', 0x800001, 0x99, &(0x7f0000000240)=""/153, 0x40f00, 0x0, [], r2, 0x4}, 0x48) preadv(r0, &(0x7f0000000400)=[{&(0x7f00000003c0)}], 0x1, 0x5) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000140)={0x0, r1, 0x0, 0x1, &(0x7f0000000100)='\x00', 0xffffffffffffffff}, 0x30) syz_open_procfs$namespace(r3, &(0x7f0000000180)='ns/cgroup\x00') 04:04:19 executing program 0: r0 = open(&(0x7f00000003c0)='./file0\x00', 0x141042, 0x0) write$binfmt_elf64(r0, &(0x7f0000000480)=ANY=[], 0x2e7) rename(0x0, &(0x7f0000000080)='./file0\x00') unlink(&(0x7f00000002c0)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, 0x0, &(0x7f00000006c0)) setsockopt$inet6_IPV6_ADDRFORM(r0, 0x29, 0x1, &(0x7f0000000600), 0xfffffffffffffe97) lsetxattr$security_capability(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)='security.capability\x00', &(0x7f0000000200)=@v2={0x2000000, [{}, {0xffffffff, 0x1ff}]}, 0x14, 0x0) accept4$unix(r0, 0x0, &(0x7f0000000380), 0x80800) futimesat(0xffffffffffffffff, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280)={{0x0, 0x2710}}) sendfile(r0, r0, &(0x7f0000000040)=0x4, 0xa198) sendto$unix(0xffffffffffffffff, &(0x7f0000000500)="81be9346fbfe62133a6f6ca3a38fab17f9e1e94620a270a774e8eb1829c599515c5d346330a966a60ad1da7c5ef7e34bf4c3816f0214533468861c78cda91719c1b8c0c6aba330677a3e2b09442b103f029c6945ff4213607f11063acb442361bc8c26438d1abb8eead6879d61642a5d6c4d0b9f1e7bf5d5d2dd9bc6d2e4cd78dc71808cf73c69105247334ca83c2b168740e91bf382b2b7584d7331f700fb5eb98f1d55fff90da35b4ecb6baee89eea3606eb1875a8d74d8b5d0a8780fbd981205da30cfdda06b830dad829b0e5ef2623fea2d44b4611e5", 0xd8, 0x20000040, 0x0, 0x0) accept4$inet6(0xffffffffffffffff, 0x0, 0x0, 0x800) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x3, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f00000004c0)={0xa, 0x4e21, 0xffffffffffff1d12, @rand_addr="35b75d67778ca429c838a53cd8c1814f", 0x200}, 0x1c) connect$unix(r0, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e22}, 0x6e) write$P9_RXATTRCREATE(0xffffffffffffffff, 0x0, 0x0) r1 = getpgrp(0xffffffffffffffff) sched_getaffinity(r1, 0x0, 0x0) 04:04:19 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:19 executing program 4: r0 = socket(0x1e, 0x0, 0x20) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'team0\x00', 0x0}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000200)={{{@in=@empty, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@local}}, &(0x7f0000000300)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000380)={{{@in6=@rand_addr="ca2d1a6f382b82e97ca6816a28b6345d", @in6=@empty, 0x4e23, 0x100000001, 0x4e20, 0x1, 0x0, 0x0, 0x80, 0x2f, r1, r2}, {0x5, 0x100000001, 0x5, 0x8d3e, 0x8, 0xeb91, 0x7, 0x8}, {0x3ff, 0xffffffffffff17f4, 0x7c6c, 0x67}, 0x1, 0x6e6bbe, 0x0, 0x1, 0x2, 0x3}, {{@in6=@mcast1, 0x4d2, 0x3c}, 0xa, @in6=@empty, 0x3507, 0x4, 0x0, 0xffffffff00000001, 0xbd9, 0x1, 0x19800000000000}}, 0xe8) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) r4 = socket$inet6(0xa, 0x80002, 0x0) sendmsg(r4, &(0x7f0000000000)={&(0x7f0000000080)=@in={0x2, 0x4e22}, 0x80, 0x0, 0x0, &(0x7f0000000340)=[{0x28, 0x0, 0x7, "44180f810000000000000040ed7ed5c9e8"}], 0x28}, 0x0) 04:04:19 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) sched_yield() 04:04:19 executing program 1: r0 = open(&(0x7f00000000c0)='./file0\x00', 0x4140, 0x80) fcntl$setsig(r0, 0xa, 0xb) fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) [ 2459.667966] binder: release 22314:22325 transaction 550 out, still active 04:04:19 executing program 4: r0 = creat(&(0x7f0000000140)='./bus\x00', 0x0) chown(&(0x7f0000000100)='./bus\x00', 0xee00, 0x0) r1 = open(&(0x7f0000000400)='./bus\x00', 0x14103e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x10, 0xffffffffffffffff, 0x0) sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x0) setsockopt(r1, 0x1, 0x3, &(0x7f00000000c0), 0x0) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000001c0)={0x0, r0}, 0x10) syz_genetlink_get_family_id$tipc2(0x0) getsockopt$inet6_int(r1, 0x29, 0x4a, &(0x7f0000000040), &(0x7f0000000080)=0x4) sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f00000002c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x100}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80c4}, 0x20000000) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) 04:04:19 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00001400000008004500002400000000907800d7050200f534750000000000000000"], 0x0) [ 2459.821033] binder: BINDER_SET_CONTEXT_MGR already set [ 2459.831867] binder: 22375:22390 ioctl 40046207 0 returned -16 [ 2459.842046] binder: 22375:22390 unknown command 2097152 [ 2459.851593] binder: 22375:22390 ioctl c0306201 200002c0 returned -22 [ 2459.858953] binder: 22375:22390 Release 1 refcount change on invalid ref 1 ret -22 04:04:20 executing program 5: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x200000, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000480)={{{@in6=@local, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@mcast1}}, &(0x7f00000000c0)=0xe8) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000580)={{{@in6=@mcast1, @in=@broadcast, 0x4e23, 0x80000001, 0x4e22, 0x1000, 0xa, 0x20, 0x20, 0xe, 0x0, r1}, {0xac, 0x2, 0x100000000, 0x9, 0xe31, 0x1a, 0x7f, 0x3}, {0x20, 0xc2, 0xfffffffffffff194}, 0x5, 0x6e6bb5, 0x1, 0x1, 0x0, 0x3}, {{@in6=@dev={0xfe, 0x80, [], 0x16}, 0x4d2, 0x32}, 0xa, @in=@multicast1, 0x3504, 0x1, 0x0, 0x8, 0x1, 0x5, 0x101}}, 0xe8) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000700)='+'}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="852a627300000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="0004e3ff000003006a9104ec58a025f5fac32917cee2804b03e5c27235255dfbf6d73b3184dbdfe73d78f9bdaabbb370be7dca644662f6d5bc6507ce2e5873ed159b118f5dda62d0f79af4fa6b6899a2c9db6f4b0cfcbad9d1ce2cc018b30708452c95c8b8a0cffc9125dcaf7ad3e037034b1b0e38a3b384415eaedd"]], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 04:04:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/enforce\x00', 0x131001, 0x0) creat(&(0x7f0000000100)='./file0\x00', 0x2) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_mount_image$ext4(&(0x7f00000000c0)='ext3\x00', &(0x7f0000000000)='./file0\x00', 0x6, 0x1, &(0x7f0000000080)=[{&(0x7f0000000300)="803ff8ffffffffffffff038a7e7164006cff9900000000000100000001000000434000000040000080000000000000006d5ebe5a0000ffff53efdb56108e53b3994b2cc86d95687df2409c1be2ac93b7e0050a6b72696c6044c1ea3efe6c6758f60c45bd40f25a67c8f04a1600984320ba934b1f6bb5b8aa71195922768bffb448fe293b938320d465841c4b9447874645a09a4556784571175e9cf62a508a719e74f53e99d2152496b2681239615f5e07ee9e28ad3c213895eb411728308e2b65d899416f5059525c805da36187fe5471ca5b22ca10358e4fe3577800314c000000000000000000000000a21983a4a682b8600945ca6754611f4e9b65f4a58c6607", 0x102, 0x1}], 0x0, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x4080, 0x0) fsetxattr$trusted_overlay_redirect(r1, &(0x7f00000001c0)='trusted.overlay.redirect\x00', &(0x7f0000000200)='./file0\x00', 0x8, 0x3) 04:04:20 executing program 1: r0 = open(&(0x7f0000000040)='./file0\x00', 0x1, 0x82) fcntl$setsig(r0, 0xa, 0xb) renameat(r0, &(0x7f0000000000)='./file0\x00', r0, &(0x7f0000000080)='./file0\x00') fcntl$setlease(r0, 0x400, 0x1) rt_sigtimedwait(&(0x7f00005a1000)={0xfffffffffffffffd}, 0x0, 0x0, 0x8) open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) fcntl$setlease(r0, 0x400, 0x0) 04:04:20 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)={@local, @empty=[0x0, 0x0, 0x14], [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr, @multicast1}, @dccp={{0x0, 0x0, 0x4, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, "d70502", 0x0, "f53475"}}}}}}, 0x0) 04:04:20 executing program 0: r0 = socket$packet(0x11, 0x0, 0x300) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, 0x0, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0x5, 0x0, 0x0) openat$selinux_mls(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x88) ioctl(r0, 0xff, &(0x7f0000000100)="aed3f561e5fcafc95b52c5a2b960dc2b2ff879fba4e1cacd36f1bf36fb755e8549a4920b08c2922a306031995fecac14008017dbf7a0e996f052dda89b2b2df9d3686542993688b6c58a71ef041fc535d8245119a35567aa5c8a35c433615a04e41b3fb559") getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f00000004c0)={'filter\x00'}, &(0x7f0000000540)=0x54) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x3) geteuid() write$binfmt_script(r3, &(0x7f00000002c0)=ANY=[@ANYBLOB="2321202e09427b75e42f"], 0xa) close(r3) clone(0x10002102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f00000000c0), 0xffffffffffffffff) ioctl$TUNSETNOCSUM(r1, 0x400454c8, 0x0) execve(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) close(r0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000000)=0x3) 04:04:20 executing program 4: syz_open_procfs(0x0, &(0x7f00000000c0)='environ\x00') write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000880)={'syz0\x00'}, 0x45c) syz_open_pts(0xffffffffffffffff, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000080)={0x0, 0x0}) r1 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) r2 = openat$keychord(0xffffffffffffff9c, 0x0, 0x0, 0x0) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000000)='trusted.overlay.origin\x00', 0x0, 0x0, 0x2) syz_open_dev$evdev(&(0x7f0000000480)='/dev/input/event#\x00', 0x0, 0x0) openat$cgroup_subtree(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.subtree_control\x00', 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r3 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, r1, 0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x30) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={r0, r3, 0x0, 0x6, &(0x7f0000000200)='em1\xb7\xb5\x00'}, 0x30) io_submit(0x0, 0x0, 0x0) perf_event_open(0x0, 0xffffffffffffffff, 0x9, 0xffffffffffffff9c, 0x1) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) lsetxattr$trusted_overlay_redirect(&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)='trusted.overlay.redirect\x00', &(0x7f0000000280)='./file0\x00', 0x8, 0x2) r4 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x0, 0x0) ioctl$LOOP_CTL_REMOVE(r4, 0x4c81, 0x0) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) [ 2460.240674] binder: 22347:22354 ioctl c018620b 0 returned -14 [ 2460.242679] binder: release 22347:22354 transaction 553 out, still active [ 2460.266361] binder: 22404:22406 ioctl c018620b 0 returned -14 [ 2460.323327] ------------[ cut here ]------------ [ 2460.328366] kernel BUG at drivers/android/binder_alloc.c:1130! [ 2460.334627] invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 2460.340551] Modules linked in: [ 2460.343758] CPU: 0 PID: 22422 Comm: syz-executor.5 Not tainted 4.14.108+ #38 [ 2460.350939] task: ffff88819c778000 task.stack: ffff8881746e0000 [ 2460.357004] RIP: 0010:binder_alloc_do_buffer_copy+0xc7/0x500 [ 2460.362806] RSP: 0018:ffff8881746e75d0 EFLAGS: 00010202 [ 2460.368273] RAX: 0000000000040000 RBX: 00000000200026b0 RCX: 0000000000000350 [ 2460.375632] RDX: ffffffff82237477 RSI: ffffc9000076a000 RDI: ffff8881c903d458 [ 2460.382902] RBP: 0000000000000020 R08: ffff8881746e78b0 R09: 0000000000000028 [ 2460.390186] R10: ffffed102e8dcf06 R11: ffff8881746e7837 R12: ffff888181199918 [ 2460.399626] R13: 0000000000000028 R14: 00030000ffe30400 R15: ffff8881746e78b0 [ 2460.406910] FS: 00007f73ea2de700(0000) GS:ffff8881db800000(0000) knlGS:0000000000000000 [ 2460.415131] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2460.421005] CR2: 00000000010c0978 CR3: 000000018ca0a005 CR4: 00000000001606b0 [ 2460.428364] DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 [ 2460.435635] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 [ 2460.442891] Call Trace: [ 2460.445477] ? binder_alloc_do_buffer_copy+0x1ef/0x500 [ 2460.450752] binder_get_object+0x90/0x190 [ 2460.454891] binder_transaction+0x1e2d/0x5640 [ 2460.459410] ? check_preemption_disabled+0x35/0x1f0 [ 2460.464415] ? binder_inc_ref_for_node+0xba0/0xba0 [ 2460.469338] ? perf_trace_lock+0x11e/0x4e0 [ 2460.473572] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 2460.478505] ? HARDIRQ_verbose+0x10/0x10 [ 2460.482565] ? __might_fault+0x104/0x1b0 [ 2460.486616] ? lock_downgrade+0x5d0/0x5d0 [ 2460.490744] ? lock_acquire+0x10f/0x380 [ 2460.494727] ? __might_fault+0xd4/0x1b0 [ 2460.498780] ? __might_fault+0x177/0x1b0 [ 2460.502919] ? binder_thread_write+0x512/0x1f90 [ 2460.507579] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 2460.512499] ? binder_transaction+0x5640/0x5640 [ 2460.517168] ? HARDIRQ_verbose+0x10/0x10 [ 2460.521233] ? lock_downgrade+0x5d0/0x5d0 [ 2460.525363] ? lock_acquire+0x10f/0x380 [ 2460.529340] ? __might_fault+0xd4/0x1b0 [ 2460.533307] ? __might_fault+0x177/0x1b0 [ 2460.537367] ? binder_ioctl+0xd48/0x14ea [ 2460.540066] binder: release 22375:22390 transaction 556 out, still active [ 2460.541421] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 2460.541433] ? binder_poll+0x230/0x230 [ 2460.541444] ? __lock_acquire+0x56a/0x3fa0 [ 2460.561513] ? perf_trace_lock+0x11e/0x4e0 [ 2460.565753] ? check_preemption_disabled+0x35/0x1f0 04:04:20 executing program 3: r0 = socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r2, &(0x7f0000000040), 0x0, 0x1}, 0x20) r3 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r4 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r5 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r5, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r4, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r5, 0x40046207, 0x0) shutdown(r0, 0x1) fcntl$getownex(r3, 0x10, &(0x7f0000000280)={0x0, 0x0}) fcntl$lock(r5, 0x25, &(0x7f00000006c0)={0x2, 0x2, 0x0, 0xb5bd, r6}) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000002c0)={0x15, 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="00002000000079dff4afc619690200e33740ac6c10877fea004d684f4d56be2c9f756dd1e87e84a20051e47668bed8b9db1412f3bd999afc5538559b9fd841fadfb98bc87fcb240d24d6e94e324769bc8420d435db25c2d432564887cb4027fe37786951c627fc6ca6e0"], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r7 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000540)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r7, &(0x7f0000000480)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000780)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000000000000001bc0700003000020000000000000000aa02000000100001007500400000000000000000000000000000000000"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$EVIOCSABS0(0xffffffffffffffff, 0x401845c0, &(0x7f0000000580)={0x100, 0x4, 0x3, 0x3ff}) fallocate(r1, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 04:04:20 executing program 0: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r1 = creat(&(0x7f0000000180)='./file0\x00', 0x0) write$P9_RCLUNK(r0, &(0x7f0000000200)={0x121, 0x79, 0x1}, 0x100c9) ioctl$PERF_EVENT_IOC_SET_OUTPUT(0xffffffffffffffff, 0x2405, r0) sync_file_range(r0, 0x0, 0x0, 0x2) r2 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000240), 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000300)='logon\x00', &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000380)='\x00', 0xfffffffffffffff8) r3 = add_key$keyring(&(0x7f00000003c0)='keyring\x00', &(0x7f0000000400)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$link(0x8, r2, r3) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x101813, r1, 0x0) prctl$PR_GET_UNALIGN(0x5, &(0x7f0000000240)) r4 = fcntl$getown(r0, 0x9) capget(&(0x7f0000000280)={0x19980330, r4}, &(0x7f00000002c0)={0x0, 0x208, 0x4, 0x6, 0x3, 0x5}) socket$inet_icmp_raw(0x2, 0x3, 0x1) fallocate(r1, 0x0, 0x0, 0x2000002) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) write$P9_RXATTRWALK(0xffffffffffffffff, &(0x7f00000001c0)={0xf, 0x1f, 0x1, 0x2}, 0xf) fallocate(r0, 0x0, 0x0, 0x110001) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000040)={0x0, r1, 0x0, 0x8}) 04:04:20 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) r1 = gettid() write$cgroup_pid(r0, &(0x7f0000000040)=r1, 0x12) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) sched_setparam(r1, &(0x7f0000000340)=0x9) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000400)='trusted.overlay.nlink\x00', &(0x7f0000000440)={'U+', 0x5}, 0x28, 0x2) write$selinux_context(r0, &(0x7f00000002c0)='system_u:object_r:depmod_exec_t:s0\x00', 0x23) r2 = memfd_create(&(0x7f0000000080)='\x00', 0x0) getpeername$inet6(r0, &(0x7f0000000240), &(0x7f0000000280)=0x1c) fcntl$setlease(r2, 0x400, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x2, 0x400000000000004, 0x24, 0x9}, 0x2c) epoll_pwait(r0, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x5, &(0x7f0000000100)={0x6}, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xec4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc75, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setown(r2, 0x8, 0x0) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000380)={0xc223, 0x1}) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000300)='illinois\x00', 0x9) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) setsockopt$inet_udp_int(r0, 0x11, 0x6f, &(0x7f00000003c0)=0x7fffffff, 0x4) [ 2460.570781] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 2460.575723] ? check_preemption_disabled+0x35/0x1f0 [ 2460.580762] ? binder_poll+0x230/0x230 [ 2460.584660] ? do_vfs_ioctl+0xabe/0x1040 [ 2460.588728] ? selinux_file_ioctl+0x426/0x590 [ 2460.593312] ? selinux_file_ioctl+0x116/0x590 [ 2460.597819] ? ioctl_preallocate+0x1e0/0x1e0 [ 2460.602238] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 2460.607868] ? __fget+0x1ff/0x360 [ 2460.611329] ? lock_downgrade+0x5d0/0x5d0 [ 2460.615598] ? lock_acquire+0x10f/0x380 [ 2460.619577] ? __fget+0x44/0x360 [ 2460.622947] ? check_preemption_disabled+0x35/0x1f0 [ 2460.627982] ? security_file_ioctl+0x7c/0xb0 [ 2460.632494] ? SyS_ioctl+0x7f/0xb0 [ 2460.636042] ? do_vfs_ioctl+0x1040/0x1040 [ 2460.640199] ? do_syscall_64+0x19b/0x4b0 [ 2460.644269] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 2460.649656] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0d 04 00 00 48 8b 6d 58 48 29 dd e8 33 33 0d ff 49 39 ed 76 07 e8 29 33 0d ff <0f> 0b e8 22 33 0d ff 4c 29 ed 49 39 ee 77 ec e8 15 33 0d ff 41 04:04:20 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='cpuset.effective_mems\x00', 0x0, 0x0) r1 = gettid() write$cgroup_pid(r0, &(0x7f0000000040)=r1, 0x12) getsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) sched_setparam(r1, &(0x7f0000000340)=0x9) fsetxattr$trusted_overlay_nlink(r0, &(0x7f0000000400)='trusted.overlay.nlink\x00', &(0x7f0000000440)={'U+', 0x5}, 0x28, 0x2) write$selinux_context(r0, &(0x7f00000002c0)='system_u:object_r:depmod_exec_t:s0\x00', 0x23) r2 = memfd_create(&(0x7f0000000080)='\x00', 0x0) getpeername$inet6(r0, &(0x7f0000000240), &(0x7f0000000280)=0x1c) fcntl$setlease(r2, 0x400, 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)={0x2, 0x400000000000004, 0x24, 0x9}, 0x2c) epoll_pwait(r0, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], 0x9, 0x5, &(0x7f0000000100)={0x6}, 0x8) perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0xee6b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xec4, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc75, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$setown(r2, 0x8, 0x0) ioctl$PPPIOCGNPMODE(r0, 0xc008744c, &(0x7f0000000380)={0xc223, 0x1}) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000300)='illinois\x00', 0x9) execveat(r2, &(0x7f0000000500)='\x00', 0x0, 0x0, 0x1000) setsockopt$inet_udp_int(r0, 0x11, 0x6f, &(0x7f00000003c0)=0x7fffffff, 0x4) 04:04:20 executing program 2: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000100)=[{0x4000000028, 0x0, 0x0, 0xfffff01c}, {0x80000006}]}, 0x10) syz_emit_ethernet(0x32, &(0x7f0000000cc0)=ANY=[@ANYBLOB="aa5451ca22a400000800450000240048f2279b8d23ce0000fd5c95f5040190347500000000000000000000000000000000"], 0x0) [ 2460.669043] RIP: binder_alloc_do_buffer_copy+0xc7/0x500 RSP: ffff8881746e75d0 [ 2460.678550] binder: BINDER_SET_CONTEXT_MGR already set [ 2460.685294] binder: 22425:22432 unknown command 2097152 [ 2460.691339] binder: 22425:22431 ioctl 40046207 0 returned -16 [ 2460.702635] binder: 22425:22432 ioctl c0306201 200002c0 returned -22 [ 2460.712344] binder: 22425:22431 Release 1 refcount change on invalid ref 1 ret -22 [ 2460.722576] ---[ end trace 9a3e3f778c48e1d6 ]--- [ 2460.732174] Kernel panic - not syncing: Fatal exception [ 2460.738284] Kernel Offset: 0xc000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 2460.749311] Rebooting in 86400 seconds..