0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) fcntl$dupfd(r1, 0x0, 0xffffffffffffffff) setsockopt$packet_tx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r2 = socket$inet6(0xa, 0x3, 0x84) connect$inet6(r2, &(0x7f0000000080), 0x1c) sendmmsg(r2, &(0x7f00000092c0), 0x3fffffffffffe9f, 0x0) inotify_init() ioctl$BLKALIGNOFF(r0, 0x127a, &(0x7f0000000180)) getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@ipv4={[], [], @initdev}, @in=@remote}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f00000001c0)=0xe8) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) pselect6(0x40, &(0x7f00000000c0), 0x0, &(0x7f0000000140)={0x1b9}, &(0x7f0000000200)={0x0, r3+30000000}, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r5, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r5, 0x4004743c, 0x0) [ 796.900943] binder: BINDER_SET_CONTEXT_MGR already set [ 796.906303] binder: 22995:23002 ioctl 40046207 0 returned -16 [ 796.924343] binder: 22995:23002 got transaction with invalid offset (0, min 0 max 0) or object. 18:18:23 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) prctl$PR_SET_TSC(0x1a, 0x0) [ 796.957444] binder: 22995:23002 transaction failed 29201/-22, size 0-8 line 3348 [ 796.974209] binder: 22995:23006 BC_INCREFS_DONE u0000000000000000 no match [ 796.989021] binder: 22995:23002 Release 1 refcount change on invalid ref 1 ret -22 [ 797.010408] PPPIOCDETACH file->f_count=2 18:18:24 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={0x0, 0xffffffffffffff9c, 0x0, 0xa, &(0x7f00000000c0)='nodev#[:{\x00'}, 0x30) sched_setaffinity(r2, 0x8, &(0x7f00000001c0)=0x81) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={0x77359400}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:24 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:24 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setxattr$security_evm(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='security.evm\x00', &(0x7f0000000100)=@v1={0x2, "f90ad4142d27e2710b82ad722c"}, 0xe, 0x1) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r3 = openat$zero(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/zero\x00', 0x0, 0x0) getsockname$unix(r3, &(0x7f0000000280)=@abs, &(0x7f0000000300)=0x6e) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:24 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000200)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) fsync(r0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) [ 797.661777] binder: BINDER_SET_CONTEXT_MGR already set [ 797.667341] binder: 23022:23027 ioctl 40046207 0 returned -16 [ 797.675970] binder: 23022:23027 got transaction with invalid offset (0, min 0 max 0) or object. [ 797.691624] binder: 23022:23027 transaction failed 29201/-22, size 0-8 line 3348 [ 797.700856] binder: 23022:23027 Release 1 refcount change on invalid ref 1 ret -22 18:18:24 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000180)='/dev/ppp\x00', 0x80004442, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) sendto$inet(r1, &(0x7f0000000040)="6101e5528d265b4ac98e1cc9d32783da23b39729f17c7ab9455e951eae567f37468ae22685f8941202d81d84bee7bf17850359b03dc7cc1b5420af004ac92cfdf204605723af7a21c99b9ffe0970cb8034563472730d84c9e5f8e4434434565db1b8d038ca7d8e3cfc40132c8e46a311a33074920ac5c27ff7866d59f65c6e37504431815c113d37b28aa4124535022355a5b38fbbb0c7893378b10d586faeb57577aa234bbeb9e93736e15da47f28c60301b868bdc0fca630a5d4a527737d4e9aad9646ee731f9282b3a62341201166ebb9595cfd0638304535eea665dfb2a1a31b", 0xe2, 0x8000, &(0x7f0000000140)={0x2, 0x4e23, @multicast1}, 0x10) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:24 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$netlink(r0, 0x10e, 0xb5e4c0820b68ad7, &(0x7f0000000380)=""/249, &(0x7f0000000140)=0xf9) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r0, 0x4004743c, 0x0) 18:18:24 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) fsetxattr$trusted_overlay_origin(r0, &(0x7f00000001c0)='trusted.overlay.origin\x00', &(0x7f0000000280)='y\x00', 0x2, 0x1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x100, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r1 = accept(r0, &(0x7f0000000040)=@alg, &(0x7f00000000c0)=0x80) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in=@remote, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@remote}}, &(0x7f0000000400)=0xe8) recvfrom$packet(r1, &(0x7f0000000100)=""/113, 0x71, 0x2040, &(0x7f0000000440)={0x11, 0xf7, r2, 0x1, 0x7ff, 0x6, @random="62551581baf2"}, 0x14) 18:18:24 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") flock(r0, 0x2) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) prctl$PR_SET_TIMERSLACK(0x1d, 0x2000000000) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 797.971694] PPPIOCDETACH file->f_count=2 18:18:24 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) r2 = accept(r0, &(0x7f0000000040)=@in={0x2, 0x0, @multicast2}, &(0x7f00000000c0)=0x80) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') sendmsg$FOU_CMD_ADD(r2, &(0x7f0000000200)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x3c, r3, 0x404, 0x70bd25, 0x25dfdbff, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_TYPE={0x8, 0x4, 0x1}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40080}, 0x8010) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 798.020596] PPPIOCDETACH file->f_count=2 [ 798.090637] PPPIOCDETACH file->f_count=2 18:18:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:25 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) keyctl$join(0x1, &(0x7f00000000c0)={'syz', 0x0}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f00000001c0)=0xc) ioprio_set$pid(0x1, r2, 0x3) socket$inet(0x2, 0x807, 0x2) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x200000, 0x0) ioctl$LOOP_SET_FD(r3, 0x4c00, r0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x4000000000, 0x5}, 0x14) setsockopt$inet_tcp_int(r3, 0x6, 0x88000000000019, &(0x7f0000000100)=0x80, 0x20c) 18:18:25 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$TIOCMGET(r3, 0x5415, &(0x7f00000000c0)) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) ioctl$TUNSETOFFLOAD(r2, 0x400454d0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 798.220651] PPPIOCDETACH file->f_count=2 18:18:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/status\x00', 0x0, 0x0) write$selinux_user(r2, &(0x7f0000000380)=ANY=[@ANYBLOB="73797374656d5f753a6f626a6563745f723a6574635f72756e74696d655f743a73302073746166665f750032cf0dcbd0b8ab624231d79c113e8c0d764f407c22e06a0b3d7d3275"], 0x2b) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x40001, 0x0) ioctl$EVIOCGPROP(r3, 0xc004743e, &(0x7f0000000280)=""/246) r4 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet6_int(r0, 0x29, 0x14, &(0x7f0000000040), &(0x7f0000000080)=0x4) io_setup(0x1, &(0x7f0000000200)=0x0) io_cancel(r5, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x9, r4, &(0x7f0000000400)="6f3f33df55db963ad29d16e9a9eaeb8ebc14f1bc6189ceb0a907ad310b44157e646462979d1113a1fe46f6af823fdaab6453fb3dd31c8830a150cdd0c1a954772d888ce610c5913b5c5d41452c2ece568a5eee5802e26d77a46b300f861d6877260c9b9594d3e17af6fa41442072067763a05d550250e85c8ab8d110a06b531b533b36b64fcdb961c1a03e0d6f73f3749cd0123ac91d6f0c1ebd0ddfccceb38cf3e18db5840df8cf15a993ef2f1bd6388651c4877fc7d0cbf46c0a1e86dce9e6ff61b0e5fea9726b38336d28fd4e02682cade27345ac799e84db320d1add904d073482a7721dcfd46652ad91cc8e70f228a835bbffbb28f375611382d61abc", 0xff, 0x2b05, 0x0, 0x2, r2}, &(0x7f0000000540)) ioctl$IOC_PR_PREEMPT(r4, 0x401870cb, &(0x7f0000000580)={0xc76d, 0x5, 0x9, 0x3}) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) write$selinux_access(r0, &(0x7f0000000180)={'unconfined_u:system_r:insmod_t:s0-s0:c0.c1023', 0x20, '/sbin/dhclient', 0x20, 0x8}, 0x52) 18:18:25 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:25 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:25 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000140)=0x66) read(r5, &(0x7f0000000000)=""/11, 0xb) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000280)) r6 = syz_open_pts(r5, 0x0) ioctl$TCXONC(r6, 0x540a, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RATTACH(r2, &(0x7f0000000180)={0x14, 0x69, 0x2, {0x2, 0x1, 0x4}}, 0x14) 18:18:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000140)={{{@in6=@empty, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe8) open(&(0x7f0000000080)='./file0\x00', 0x40000, 0x1) sendmsg$nl_route_sched(r0, &(0x7f0000000c00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000bc0)={&(0x7f00000003c0)=@newtaction={0x7cc, 0x30, 0x400, 0x70bd26, 0x25dfdbff, {}, [{0x6c, 0x1, @m_sample={0x68, 0x9, {{0xc, 0x1, 'sample\x00'}, {0xc, 0x2, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x7de}]}, {0x48, 0x6, "e7194cb6605b3e78bbdc4c859a9fcab2dbe3202a9ae0dc4d9216b36c7fba0eb3f28fc770044f54cbe13dbf22d36f822ea1134feb826201e34964565cca6b56e76323cb"}}}}, {0x88, 0x1, @m_bpf={0x84, 0x1e, {{0x8, 0x1, 'bpf\x00'}, {0x6c, 0x2, [@TCA_ACT_BPF_OPS_LEN={0x8, 0x3, 0x8}, @TCA_ACT_BPF_FD={0x8, 0x5, r0}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}, @TCA_ACT_BPF_OPS_LEN={0x8, 0x3, 0x4}, @TCA_ACT_BPF_OPS={0x34, 0x4, [{0x81, 0x401, 0x8, 0xeaa7}, {0x1, 0x4, 0x4, 0x1ff}, {0x5, 0x39589280, 0x3, 0xfffffffffffffffe}, {0xa5ac, 0x0, 0x100, 0x58}, {0x3f, 0x0, 0x1, 0x9}, {0x3, 0xffffffffa0737194, 0x7fff, 0xfffffffffffffdd4}]}, @TCA_ACT_BPF_FD={0x8, 0x5, r1}, @TCA_ACT_BPF_OPS_LEN={0x8, 0x3, 0x5}]}, {0x8, 0x6, "083ffbbd"}}}}, {0x120, 0x1, @m_mirred={0x11c, 0x1e, {{0xc, 0x1, 'mirred\x00'}, {0x24, 0x2, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x3ff, 0x8, 0x5, 0x1c6, 0x5}, 0x3, r2}}}, {0xe4, 0x6, "4d570bb0775a6a9a2e71d0f03553f24d23e81117a6a995774d71ad06219ab61e0f2d39810f70c87a76c41e675dbcdc5cae25dedda52a28af869f317fc25c857e991f614acd63a585ae498ff56b0373f780ff0888eb1220871fda0e57e765d0c663e48381914cf6fcea6e52f2878e73066842601dca6dafdd6e8c2165998868fb84f654a56ce492fa0d5cb24486efe12bc645f51d5b6f54e697c5c5bd864fc0df062e37362849032f0b9155722f7848a5642f15ff983abd9530fa30f1db587272498ad3410a8b622b1030abdbc6694750f9bdb1ef9d45c949b1d0e42d7dd0"}}}}, {0x70, 0x1, @m_connmark={0x6c, 0x20, {{0x10, 0x1, 'connmark\x00'}, {0x20, 0x2, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x6, 0x0, 0x8, 0x2}, 0xfffffffffffffffb}}}, {0x34, 0x6, "3fb6231646690b3d445a687a4520cd97c34e9790a721fb89af49ab119f78e8c3b2c4f38acac0122d4dfb99384d23"}}}}, {0x150, 0x1, @m_tunnel_key={0x14c, 0x13, {{0x10, 0x1, 'tunnel_key\x00'}, {0x50, 0x2, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x6, 0x80000001, 0x0, 0x7, 0x902}, 0x2}}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @rand_addr="0546cb470c57fe70acda55a4b45dc1d6"}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @rand_addr="e9071702f15fd71edcd7661abc92edff"}, @TCA_TUNNEL_KEY_ENC_DST_PORT={0x8, 0x9, 0x4e23}]}, {0xe4, 0x6, "c9e0959b73b90c8ac57a48eee8b27b742930aa2b55fd8fcd4409ad811be17a72f560c2352abc07c49f8bd4366c975cb0d374e0a51f29a01634ee229b8b027517195d2b2a63127016a999b6df93feba2b32944206885839b31ee1b4b59f8aafa3ae6bbf1a06c4430cd05dbd5a249a58a37e99ef86e7d246f3760c7f2225a3260e59862afcacdda2a62def9b2fa9ee01d25cb390b1d15954582b5822c0deef1e8d4d51333f2023e4177238f43a0ebe895ced60c978ce35838a06716f6f98974fe08c339db1588844f10b4fdf37ccf305013953b5eda3188c5ce7c939b0e5"}}}}, {0x80, 0x1, @m_csum={0x7c, 0x9, {{0xc, 0x1, 'csum\x00'}, {0x20, 0x2, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x3, 0x4, 0x5, 0x0, 0x8}, 0x36}}}, {0x48, 0x6, "c0e7bb9d850eb1b68dcd77c6a5fc2a2a62ff193ebbd35570b4f25caafc7332b9963d7684afa7536195e7eca8dd5779e1548120b8f232f17d5cc4e09ec4f23491ab12ce07"}}}}, {0xa0, 0x1, @m_vlan={0x9c, 0x1, {{0xc, 0x1, 'vlan\x00'}, {0xc, 0x2, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x8, 0x4, 0x8100}]}, {0x7c, 0x6, "2a807027b19e76dd3fd178e39e3b055f69b5d2e6a1e86309f34f9e25d0ecd36c40bdd2949988c0a56877eea6fe5a7b981670992dc834870f09b3d7d8cb6298f13efb8f0ea32ef79ba3062810869f9010c8347a5007c1a79c04a72dce70dabf0041f4e640c0bc725bc684954e392dd5a2e8960fcbe9"}}}}, {0x10c, 0x1, @m_connmark={0x108, 0x1, {{0x10, 0x1, 'connmark\x00'}, {0x20, 0x2, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x4, 0x20, 0xffffffffffffffff, 0xffffffffd05d74ff, 0x2}, 0xcd2d}}}, {0xd0, 0x6, "3129579064c610c7f92a3a63ebaac3c37961cfce6eafc67fb381590eaa7272d9542d8f37044fe86f118effe284787984de49cd831f532eb6399b496ab4dbf938eba809c00934e3dd33e3bc752b0df12498123d87466dc5460431d1c7daa30976511b80d2f8bb4ac7ee4ae954b11b53069b06aa84db2665ba1d7fd15f15941bcca46bce92da725b3c84301c1331b23ab8b161bb9c651042895cf1af2fcdc4572b46f825b24d8db75f61531c708fd2152b87304ec2e7ddc6252940b3779f3a6b0e85eaa9d405ea28947417a3"}}}}, {0x150, 0x1, @m_vlan={0x14c, 0x8, {{0xc, 0x1, 'vlan\x00'}, {0x54, 0x2, [@TCA_VLAN_PUSH_VLAN_ID={0x8, 0x3, 0x4d4}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x8, 0x4, 0xffffffffffffffff, 0x4, 0x5}, 0x1}}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x1ff, 0xe22, 0x8, 0x1, 0x3}, 0x3}}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x8, 0x6, 0x1}, @TCA_VLAN_PUSH_VLAN_PRIORITY={0x8}]}, {0xe4, 0x6, "8a76003d00ce62bc4f8b2c23246ae59da3952e9621a3c2fd5fd4640c6fea57fd46b7e68894911967b0bd2b6fcdd8df35984b39fdfa93becbd6cef10506088f8fd7532868703c2399465d866bb1917c20b652d73cbb4da6c55d28d8f7e89dec5c5d008458ce201c22f40f48c35d4d87b8705ef2bacc677d5aebbe9dd05c66215375980e2bca86d48cd48d9840708b09c702c7a58618cb8493f5855d4123ce17793a47f9d5d6fc01b4d47654275e884df7303de38f6fecf7e76b4a6fe56d4fa6a81d1df70b2d194475af737f2958a50f4bd8cb7666a8e8019d158d09ec7925cbba"}}}}, {0x68, 0x1, @m_csum={0x64, 0xc, {{0xc, 0x1, 'csum\x00'}, {0x20, 0x2, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x0, 0x3, 0x10000006, 0x100000001, 0x1fffe00000}, 0x57}}}, {0x30, 0x6, "68700d1322c253cc4fd3ca3bb65925076f2bacd6a72766f25fed9c4cd8a114af8eaa7df64f8dbc54cb9b68ee"}}}}]}, 0x7cc}, 0x1, 0x0, 0x0, 0x40000}, 0x40000) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:25 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x4000, 0x0) write$UHID_INPUT(r2, &(0x7f0000000280)={0x8, "2af1c29d31e9772122c17f093fee76f1df35317bc55ad5ede73089237ccb91483e27b45fc5d275d7612215e8732b57f98a9c62f2ae2224e1f7fa8399fdcd19a421c38315716615f96da554e04cb9d03e1baceb399063bcbf859c9997ca85942971393fb7962a6b75d323ad1f8c7dca438153990f45b5c6decbfeb4d7212e4a4e8a3aa6429228a155fe147cdd4ade4ed89f929016c045fc612e709820f17add88e3d8da07dfa87c65295eb5e8dd3d7dfbc44592a3f8a1eb89b39f7fb6d486c05af1b4cc2a15e8016e0b98313119abc63e30b26c6252dd7eea525cfd25f87c71ad72bb28cd547c867552b5e01743da3d0d18ef10e2179ab3b19cfbcde5ab23dafbb81b93ed5ba6274f1bc6757ca84ea0b7b4fb10946e114b16e8a76db05ba96028e1fe8408b4b74d90effeb6c8c08365a958156c785c1d9b31e7e4c13f8afc63cc2f61a15672de5f95f8fefc00ad0c69e4a96e99e50d992093a230a6c4bee42b27244a26bd843996111556db3415b363d2c4200a84b7c906b5bef1fef7dff475351c935b7b84ddeff6c00d175734fb3a5bb1c5fd54906bbfbb4f919e9350eecb5dfad5d6888f517ea508fcca032f53ec4c163a285a0d487a7fa3a44ac388e8a40a1540d5cd4f2622d14ecec015fa6036dfc60aaf29b70c6c7e40a67bae7c8fbe80e19100995f6d293643786730450bb5d51aed5cd8bc92bfa5c19e2818d282a4f86e600a076f4fc318ec97ed8884e7927146c9e7ec309d1d51121b5210aa457aa598f2ecae4660f0249ad07ed83dd0d23d3409cfdda329ae815455d44747d4fd27784b534e9eb9a3e53b4c3509cfd3a5ee0b247b2fa0fb6c2012c23d231ccb1293d66c0ccbcf84ba42552239e6b335d60a5c55c6ec1859267e419e7a5700a6fba1fa797fd0562da167d7d4d9712237ed00d17f85099da8bee7f043a714254ea05c1e34db6fbba5642c60a471eb4d202de70ae50e66ec4b110342a1939488c37d5d8655f2bf8579bd4da251c4d640532b255dae501a821604edcf02a6e14444afc0196c4c415258616b93bc84c58ccb675e1272a7c1df5cce57a6db9859aa239398aef5f53c8139f8e904778706554f7e683e000402a95bd876b86b4ec10e4441832613f3fcd5310b29ea444c6bbc7183aa5705553f8cc54b438097f67754af7d44f95cd724592a9f0136346c172284e21617882e6be8526b3fe10832e12daacf5d099f11d6d6c74b87e6883ee671bc83c68fe7007adc1a9ba2eac2d29590145eb808e15e7aa365e9167cf7673bdb664f54b666f1dcedf25e884b9814646e86031c6172d6f7e7fc3eb7e6ed4454208e3349cbb81ae808db39075d066830d07848513131a2939f825d265a1dd6a947eb96427e91d9a9888b2e7c3fa149a4cab68848b9b929d4f7720cc5fbe65adbdd7ea0608617c1ddac1113b1fc3250d4b458286133e9fb37135d01d65370dec8ac966fa9d2d74f0384fbb89c8e4e3a10eefa5a93a914ce5429cb2c2745788148224524078dd53dab0942af4cd065f2c9fa7af2653c589fb4adb5fb8ebbe8c83c8209859832553594b719cf60a05f4d3f9ac67d507621909ebaab6a57d7ce90b6c9bf1c1526f18b4174f4195da33899e92bec621cb97c9547dbcd3f3573699b0f65625192c1d8bf01a452e63d6b513fae0fd88ec89f0ab4909591d799d481a2e33714740f40dda276f3541d51792310602033220ab5d784e96dc31e8f2996ed1b66a682a5a7f81dbbecc6009ec4d474d74f438d90bcfd6130d729f3065119136cdbb8b75ac73fc3c77db659fd09a2fb7f2a7ddbbf9462867c83113e73556d1d9df5e1403346424fe78224604478e705678c2af4f6ffc596d57d42495bed53257b641920b742f92e516a2db9fc29eb5ac58dd1063d74da168f036aad4308542a7f9562d905d7e41a7e107b0ca2695441725f16a2338e2791b6ceb002d4d82765a38f182fbb517b2439f9932222c225909ffb0b4242291aed6173801d04a2f0a4555aaf97ba210ebb210d2610bfcd6ae0f0bee3a64bef99fd182c43531d72d8686132f1eea550ce759de200d1b9a10662cf8e06717eae52b4793e3edc03d9b809811da4f9b1f1b651600409660951fb2b7d2fc45e8b870572c021d5dc7d962b0f503d9f9844f6add94f2235b23e9f657d82f2ded518cd9d37abc4bb6e3fea4df71b0e5dc7a678ae4a8e57bd189b7abe9eed153d337264e9d5ef69e04bbb614e904d53236c7287d86e1e60acbf89fd37f7f031ed62d9716cce26c377f3b4e384c737442d318d5535b8c3a1171ca9755828dfd8bec30deed31b2ddb12526013481dee09cebf740ade2b16b1874d91221238549de9acd8cf1fcf4d0526bb679b446eb3e41f13d01766c5f6a322cced6995b99fd04c14d312c0c368d708b4cca795a662f9437cd8a0242db532fba4f37dbf170328af4265c7e16c30484c58a88832bd2b8eaa1c976f3a93286d589c7f3c72a1356e7fc0b32d87fd2d2d433ed972ed0b91df8157206446071712081348ced6da1f28cc67384eab3e6fe0face87bf4149b59666ee16f570142affe10ce763fbad174e30677c7dfc98b852764c423268d9049497e3db6a81a5c1b56a7e108fd625e091e0b3286fe909454853b210a211a3d2a8e8472a1834334cdd1c74fc57de03f1b520edc6efdbb23bd4df8b711793f61dc018f10a4f3eba9e513c56ca4718b0aa18fdc5be39a1b3a858fae33ae4478d9c6ebda1efd2fe703a7bbe22e553f50afc84eb5d87ab2ef6c9615066d54194144f01a952ecb82c3ed4e4e3ab1e21e90705799b770a0032dafb6634cf7c1be362a71c576b93e1eb1b66c46b6f1ace18d1b936d1ec45b15c9b06a88a5c3e6fe1c7fce40539e1c2e9a90a533e030b4452ddc97486cc46b9625f335a6626862137370c111772b806c4482070b1b3708e2211d7bc07e49d68aae95369dbe5e69f6c7ccbbb48e15932cf5c9cc1b87f9e3d5de509c9f2236ae1dd42c69792e7153c9f2663802925aad649392b7bfa925276209395b17d0115c750dff7074b5c5f494efa114e7dc66574396a09f8ed7b062fb6800b5bf48a55f4242d247e9df7b719d86603cd85704d97a8c014541884e071db37bf89d096125ba12534b16e7306691a2d4e2ab678b2bd63f197e07dfadb2d6a73ec0dc5b640bfd35a1ae63644be673ed710d4381082e82b488c82b3c6f28f53370090c8303bb2b139208d7fd30a5f3dccb6d84aa204ab77533f297478c5d329809849f9d94ca285528013080aaba1eab5d70df05f6d6be717912ffe59a346393a60bc537d399a73f5916dc85a3ba24c4e9f82d89f53d8fcd256ab055b225941a2eb4a7bfc0ee130fd8ae0ff92f18b48efc58b201388b0e9f454cfaadbb6eb16bf4e30e761735615b819254a825294c0d62afc9f93f785dc7adfd91433bf5af7654941b6f944610df2bc80452fad6e09ba15a33ecff4d699e6e38efdad878e3eb8f7e480addf36a0ee0868072826f114aee0a8d1faaf478fed0251266acae46d0be36f177c678d6f9ec6776cef126e23883405fecf067e7a72ac573d018cd617e8ef0e99f74a249bd3a08765edaa3a1df0a5bd31b8033923ecb5deb0642600693950a136d14e32a240b58f8f4aba5ae87882419be59179e15a3664be272b94a9f02e7385fa5f9f45e37dc6ff7b7586a9e056b728e75f25b5d9b9fcdce32954740585716f1e51b074027be10744cb03203e86f0845dbef78a3b51c8e30bd6436912634c5867cdea0f1d4ebaf531fced2323d166a2a068389e3528cbd8ba1074a5979232e03dfca16e2fe4bbbefbd32cd7c2219222102c14bea9b375ffe36d0b54138307c6a8b1d118607d767613e927b4a23820092b84296fcc6903fa599f4785aa5f5daae6c2002787f54ead85b418de7e5a60367cf1a1f87997b4f3721ec8ef2fe3288f54c32bac9ef0494ef51a643c1bb5747ee68ff3e4b028b80b465f8571dc7a76544313a45e589e2351b6ce412db863071ae88fb1243a2033896b7724cdd58547f8dba564d3fb406da87c8e696bb9c4668408e38be7d266308cf20ac9bea9701fe8639a105fd66739cfe74266202adecf1373cac804b32cf05acd18f484b9877fc9d1ff444a0a4f59d28eacc1f8402054abc5d2b401a04d4d149977352883e025e4dc3adb2d30a2f126135d5cc2451a6bd23415f874c5dbea16e05414cec20d9c8e31f15d11488ab307f06eb6fa1a9ea41b4f599ac56d2f28512dff00e603d220817d8199e289f1b3854ced5f1db0a6fff1a16c9e7a06600a826cdfac7e28c0115a7adefe93b4f9dce3a0e1288304d222f8842a5c118f2deef7d683591d34ff36225e1d30e1ec182fe13238743452854b70048ba39261a9c48e1c9a3b4d10277a838176fe50ebb28d229cd99bac01da8416fe5a1fd780527e6f3553a6525ac85e5ece2c7f5e8859cc1e362c27b96366a1d7eb9cbdfd14b5179ef6e7ac9f71cc14a161a66c08ba42bc3a1427016d06fb23655a4be09e816e0e81fe2355b227b4a64f0b6518977f674cc8891f20167e3b080c4301f0b5e62c7fd45067d26248b6898923e589fbefa7e32ee1e4755254b292fa4d297b9962106ebede34d8c95d67f70be83968b7142825594e1a2223b76975c1e9b520cf0b55c96e96c193f7b0e2873ced43dace5fc21f055598b66e9fbae321868f9ca8462af8c051ab363b070c99caa95643bd8f05a401e0fd37fc56540962a7888dfc4bf012898179be1f93b02f323304b22a88b0564a433479baa8705df775236f78e89fa5004164c9ca902a6ad8da2a06bdc7c9a1738a9a90c108cf4744eec2102f874164127ebc9e0434d9bae5eb90fb159b3807cd6c3814650278e6fd3013caa629edcc27b139f5d6f34df3ff0abf1fdcdfef178b0f688e0f768e38ae32964ceafeb0f33fd352dec9869e236ba65460c61c20fc6717b688fc4017cafc53ece93c27df01b147d6682edad47c64f9917386e8bce3fd6ba02d18e9b213bdde9c3b0904623dbed18442a603dc4e51fcc5e25071fc7cddccf384d8111bb4bb51e6b7a0a949d800596a66787c3c481413e4a1e532f931e92f07a550daab27e823431bb1ecb857d100e1e43bcf77d686e3406a16eeff765f77e0976ec592a1d09ed17fb98b9233c229efb3a17ab9cad8d673b62471c58345e269e7cd9db222ef03373b95ebb6c077f7e3b8c4c13ff1a5611fa4fd47b723964bf3f0f089804abf708e235dbe5fc72368a785258c7dfc68742f64b658b71068014de6f7b17764f25929979f2e5d5e4ddeb6bae9d8d4ec07dbb1f5d543cacf296bfa0c423028760f086451757c33bef34ec355f9c955b82ca3c0f5a37fe41915d848436e29fd39d7afda30f5f5f63de120c15254cd90011e22f634ba70512ac7def19ac1e10ce99152ec7ac97df1d0cc459e55cc8e9aa5d8a0dae1a6478c78bae4cebdbb2b0f36963e8e7d04f6a0b8101e07d003b8d1b710218cfb30da1112a5eb23049ca54438c03b040f756cb86d0c210ad747504dce8f1479a0de7baa98885ae05e525c5ddb5168721bfd4e6a85d4f118a5efda377dcb4546f4cb9b8fb7a1752edf0e18caa1982dee1befee5a40a40f091284a1b9b27dc322b9ab0e15aa0a58e2612d96ea74718be3a74c55fdb751cdca1876211c4f3e1c60e75e69d0d1e8e76f77c3b91f19dbc9ece07c16a7dd4de60aff401beb0d619f0479ecad83002a2b63285871af52e83f6e661e914b0bcb4fce1f37bc1dfd4497cfb710e40d824d4aafd1c8e2053f34b56fe0336b6390fd19bcbb205f05788fe6b3", 0x1000}, 0x1006) ioctl$PPPIOCSNPMODE(r2, 0x4008744b, &(0x7f0000000100)={0x8029}) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 798.504528] binder: BINDER_SET_CONTEXT_MGR already set [ 798.526036] binder: 23086:23090 ioctl 40046207 0 returned -16 [ 798.534069] binder: 23086:23090 got transaction with invalid offset (0, min 0 max 0) or object. [ 798.545129] binder: 23086:23090 transaction failed 29201/-22, size 0-8 line 3348 [ 798.555867] binder: 23086:23090 Release 1 refcount change on invalid ref 1 ret -22 [ 798.580351] PPPIOCDETACH file->f_count=2 18:18:25 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) write$ppp(r1, &(0x7f0000000080)="0ed46bae405d95f55c8e4d9b22d7f9a84025b7dbf43cf0a5970683647d56a8be3f4800e17977b3bf7a4ee3b756ba697eefc3a52a9b7870727ff92782c9eff07dc0bcdec90aa56cd85bd71349f7d44ad5744d0e95f63b07fbb50e8c83f36b79fea7964260934675380e1cb2e20c8be58bd6708a92267251fa7face1857d10e3dc78ec0d78991ed81c32663880995394db8c1c506f5d35ab", 0x97) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000280)=""/232, &(0x7f0000000140)=0xc6) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5, 0x1}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:25 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000340)={@in={{0x2, 0x4e20, @loopback}}, 0x0, 0x5bb, 0x0, "acad739ad2a3ac6445309d61800cc96a6a953aa9ba66b4b26050cad80c93471dce7045b13cc470bd01257a1d913bb27a651f35840085de60374c290cbbd0a3de022f20702901f35c44232d6ea157f9c0"}, 0xd8) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r3 = syz_open_procfs(0x0, &(0x7f00000002c0)='children\x00') ioctl$KDGKBTYPE(r3, 0x4b33, &(0x7f0000000300)) r4 = accept4(r0, &(0x7f0000000080)=@in={0x2, 0x0, @dev}, &(0x7f0000000100)=0x80, 0x800) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000280)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r4, &(0x7f00000004c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="98010000", @ANYRES16=r5, @ANYBLOB="000028bd7000fbdbdf25080000002400090008000200018000000800020003000000080002005400000008000100040000001000020008000100fbffffff040004000c00090008c9fe1767323d1e920001001c0002000800020002000000080002000300000008000100000000002c00020008000200c0000000080001000c00000008000200090000000800010015000000080003000600000050000400140007000800030000000000080004006a0900002c000700080003000800000008000300050000000800030006000000080002000400000008000300040000000c00010073797a30000000004400090008000200040000000800c122da79020009000000080001000100000008000100d107000008000100ffffffff080001000300000008000200ff0f000008000200ffffff7f640004000c00010073797a30000000000c00070008000400000000000c000a0073797a31000000000c00010073797a31000000001400010062726f6164636173742d6c696e6b00001c00070008000300400000000800030000000000080001000e000000749a0aa65d11b52ad86d1e5a5d2e64e9a73a2638ac55254b4fd0ad9ca237806455bb90daae6f138a15b3cf5421a44bc86611c8153048c53f713751a18d3cde40ccd7958fcc01fb5f0a6ccf74e4885ed97c70d5285169752a029ff23a4bf6a7b10f0fe90c25983aa7d85be6e5be7289676f2891b558f7712df133e6aebcf064ab96af3dd16b331ba83e77b817f9ede321f2f2a67a7de3b69564165f982acc1d599485ce0cc266c833c7c2734bd64e7b2c138516f6181b200d"], 0x198}, 0x1, 0x0, 0x0, 0x4000000}, 0xd1) [ 798.790511] PPPIOCDETACH file->f_count=2 18:18:25 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000580)=0x0) r1 = syz_open_procfs(r0, &(0x7f0000000140)='fd\x86') getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000500)={0x0}, &(0x7f0000000540)=0xc) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x10000000, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x3}, r2, 0x0, 0xffffffffffffffff, 0x2) io_setup(0x3, &(0x7f00000002c0)=0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r4, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000040)) accept$packet(r1, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000003c0)=0x14) setsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000400)={r6, @rand_addr=0x2, @empty}, 0x9) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) ioctl(r1, 0x2, &(0x7f0000000440)="cf2443d12917419ff9e6f38753dee628d4eee8aae22194002851738b638d35af69f7ce9439c70824d2fc16033d35e5ce492afb00e7bf1014f34f0c0914cee74869f6114c0bc6c47e26947b1019d0bea3644c1bc3349a") getsockname(r1, &(0x7f00000001c0)=@pppoe={0x18, 0x0, {0x0, @remote}}, &(0x7f0000000280)=0x80) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r3, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r1, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r5}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r7, 0x0, 0x0) io_setup(0x7, &(0x7f00000004c0)) unshare(0x40000000) ioctl$PPPIOCGDEBUG(r4, 0x80047441, &(0x7f0000000180)) 18:18:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x4, &(0x7f0000000040)="0a9c1f123c123f03000000d0984f") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 798.940488] PPPIOCDETACH file->f_count=2 18:18:25 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:25 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000080)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x1d}}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 799.080396] PPPIOCDETACH file->f_count=2 18:18:26 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$TIOCNOTTY(r2, 0x5422) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 799.281235] PPPIOCDETACH file->f_count=2 18:18:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1ff, &(0x7f0000000040)="0adc1f123c123f3188b070c806298edf0fea0994964d2619cbdd0fc611b447cb5b6aabae6a8f6c61e63e459455e0d65e0dc0a83d8bd128b515b5c874faff0f748fc7ea8a0fca275acf11dc252ba26b6105cb5d1e9bd205fb89fb545a18e88f015c4d4cab1bcd4d89f712453e7855af029249796404f7a36585348b48696d74f79a79a7fc8b75b7850e2244dc02da56c80d907db39eaed6c81b6324c50a7e048d8a2254e294ef3ce2a079d03bc095c719a2df3a3d1aaea9eefa6ad62d7edfd26cc6a9b6f248c5941f50bd87d28dae03efc9fa4e6ab496c48feb12c72cf8107ab4c64bbf9c6f1d13cb68afd63d58f54dd6c3951652171b67f15b7dc32b4806231aa959e6fba97fcb030316fa2498e6906c88762e7d212d11c987db67c85b688750198d9726c965b4096b2c3307bd636a9675343f1b40ef7e7fb6205fa7d825b346c00910641e3a73f7eb4312784abc899cc186117ffcd024393aad799a9b") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) dup(r0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000440)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) r3 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$ASHMEM_GET_NAME(r3, 0x81007702, &(0x7f0000000380)=""/176) 18:18:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x101, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/checkreqprot\x00', 0x4200, 0x0) ioctl$RNDCLEARPOOL(r2, 0x5206, &(0x7f0000000080)=0xffffffffffff44f2) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 799.324798] binder: BINDER_SET_CONTEXT_MGR already set [ 799.330319] binder: 23140:23144 ioctl 40046207 0 returned -16 [ 799.330496] PPPIOCDETACH file->f_count=2 [ 799.342372] binder: 23140:23144 got transaction with invalid offset (0, min 0 max 0) or object. [ 799.351835] binder: 23140:23144 transaction failed 29201/-22, size 0-8 line 3348 [ 799.363766] binder: 23140:23144 Release 1 refcount change on invalid ref 1 ret -22 [ 799.440263] PPPIOCDETACH file->f_count=2 18:18:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ppp\x00', 0x2, 0x0) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x84800) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000140)=0x0) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000001c40)={0x0}, &(0x7f0000001c80)=0xc) fstat(r0, &(0x7f0000001cc0)={0x0, 0x0, 0x0, 0x0, 0x0}) r8 = getgid() write$input_event(r2, &(0x7f0000001fc0)={{0x0, 0x2710}, 0x17, 0x9, 0x6}, 0x18) fcntl$getownex(r1, 0x10, &(0x7f0000001d40)={0x0, 0x0}) stat(&(0x7f0000001d80)='./file0\x00', &(0x7f0000001dc0)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$netlink(r2, &(0x7f0000001f80)={&(0x7f0000000100)=@proc={0x10, 0x0, 0x25dfdbfe, 0x400}, 0xc, &(0x7f0000000340)=[{&(0x7f0000000180)={0x18, 0x12, 0x200, 0x70bd29, 0x25dfdbfb, "", [@typed={0x8, 0x68, @pid=r4}]}, 0x18}, {&(0x7f0000000480)={0x17bc, 0x36, 0x911, 0x70bd2c, 0x25dfdbfc, "", [@generic="7fb13708fc5678c6185f5b6105b8c9c26e04f879b9e62ddd8fedaa07df3309988cc179c14e12c887781651883389a595b6747a3ee3d26b9a43f1b5df99ed2e7fbe9874c4bd3f37d9015253ed0f21dbf782b2d3fdf17bfea48acc4d3b3de9827be778d0ebd2b818d7eca18b72d2c3928a9cc0dbf85bbaaaea9e45efe6f2f1f52e9edad0375d78aa333c83c7fb8b108695035c5a2e0a275606ca7b027a59a0811c1964b7f3e78aedfb1a15d0bd186df1fee6232d5803ffd716df15cbff55dd9ad55c58cb818d8013f3ebb682069d0cbfb29e86b5c0eb247eafed57ae4037032471b1a7bbf9", @generic="920c618f364f4c5793f51d66a6452d7cc767409aa30d1647316c7986a33f4b95951590b63ce3", @nested={0x268, 0x3e, [@generic="6cb7d52666fac6bfe540965d4187b5aa979dcb54e5c8c38b1be17e2f833afe7f740b4f94750ee021231ad2cdf874fcabfdbe339c82e3e3626c7de2ad82fb48e8b73c3d684898cea9bef4647acb78a2d52da78aa06ff11069615c763e6196b58178499f60e26be4bffea1d30d2df00b21ca402d3da9942b7e9d8d9169aaefda3147fef96febe8fc8661d304f1ef1c5a3a62d9b1bfbad950fe0acc99de4098bc1bc53edd5d59451cb96ac2603160ef1915fc0d6d8bd0e5b016a8a47cffc9ac1c0520f5d3f1c3f3084165e206d999faabdba41b386f3c012137491182bbde0418481f20162ca3", @typed={0x14, 0x3a, @ipv6=@empty}, @typed={0x8, 0x54, @uid=r5}, @typed={0x4, 0x21}, @generic="de5728230203f0d115172736fe20ded9bec99f7232461efc82ac2ef2fc61fb1017c911642d89b5ebcdc86f1c581ad625845f66639599747a39264913a7441842f5320b06d2a238ae4ba8a8078f803587beaa087dd1e322aa8807e90eccd2007d2805782258393d85a678c734fcd7a9d91a6c2853c4f3624ad0a084", @typed={0x8, 0x50, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @typed={0xa4, 0x47, @binary="52f717845da63711a1efe3e1dc95621d1adc4b8e5e04e2005f81fe838ae6df01f5a9fce99fcd1b81e47758f6649c93ec2d309fc427dd1e75d9f1591a85ef3df90ca8da1e2e18dd38841da199d3eba30d6b30d90516f1dd75275996a1e8ffe8b92001caba7a49083d38947ed162954023a9ee54322decf0a67e03c9d9cabefc1cc23baa33978e572d25165d958f99ed642afe749532960408265ffa7eddb3"}, @generic="635e84ad0f57b91f8e9491db27922735214b2f805f193ea8f0f9cbeb123995efd35d539f2c4b896c866d9499b361512ec3056882d82195"]}, @generic="9946730c0a7d1b747231ba0a465bfe508abf42d510cdcce96da86ac39d55b3198d29a4bed990f8926ad5cf123e868c529f2224463400e8ac98fda74698f40dd3a3df7d696f4b0be76d599f3220aaf3ac7d21187849ace5842e309dc68b6dcd74df5838a185dc498ada27008fde2fb241582451891c39a565f6e46df63a92c9395b04964bd46d5b49ef01235f68450d0aac4a8c7ce783cc1dd0db701df9012b9cc036449b1abca39a30d649245fe37f240123dc40b7fbc654f353b7a583d1d8c61adf9904462750ff9b7352e0c4ca6bee2ee509531acc052725864d3b2b85536b751013ac01", @nested={0x1118, 0x6f, [@generic="fbcedce44fad17095c747d060a530bf9a0dbb7", @generic="5cb501c97de9395e059c1323fb5fd9d3ec38cc8d07e08fa5c261e52434bc0e3616df91b1c0acb9d060b9eb2f6152098138ff21ea0a56d1e98f0a238245cfcf3be9f6796afd246f9d6c2f2cdd1d020fe8123fe44403784d8cd2477171846249e931d6b1b364abe1d650382438b6fc217571f1b263c5172a2065740a281af0db13502ac39c1b7e972a76ab16f166b466b1b8e9a8f4e424bfe944919593298e72917fb5bc9df6f102715a22015cca31c84a5c67c10ef5befe503c9aa9f060d54d60d6e5820b31f029a073729a0583a670760156158d50c7081e600dd72dcdc3731b97c0a26f8f8b73c00425cd0a513655ef20ac2474d09559fa5faadeb9caf9", @generic="4ba0eacbaa2b21b0a18939c81bdae273f2e898ce860f9859837ac74fef963c3171e5dbe4c1001e3a543d0db65cf23082455ff0cbff55a9c92ba5fe68f741dcdf8c9e4e3694c2575723a3d7e497fd92405279518c9218a78205769fe927802a5d85719e4f49d44bdc5d06b346942f15d39f7f1b76020194f0dd62c8f7908d1907dbc68176049db77304962f6e4ef0c4c0e9276be3b373a4fd198b935ad6ff72982543472604ceb396c2b2ad0b723a5715ade65a64815fcfe6397a39fe500d12d5378fc19dd4eeb09294befa7a7c0ef2c5ccc9f0016c82f3dacf7630515814cbc0f15739edb90d15280d5763aab5464038679b128d898d9f5dc45b12a66cf2f88950836d992f78d91f60cdbaf981f56ddf4a9f588f4e7b04e8cb81223e0f432be20e653b7993507b878769831a6abc9c6457f8331710475389af6550b9b7286c270b244fccc39525bdc4f982e3b7a459e53c001b5441e8ce51f7fe5b87c7955a48421cf73ac6f11d43962971fec3fb6d622a13797fdeef97adc2813b7055cb46f4645040c82fd2614edc0cc41a0012c61828c6d1d747ed2cc19787dcfe3d89daba3954248f5251dfd429f6a89669bf11b17c6a46c07491a1fa08333610555c6c2ec7614b054658af080a7231361fc57e04879a54d8c8f553259cbdd9ea55905f1c8969e56f9996f89ef0c0dde4b809cdb568e53b5eaca351a6bea081f11c46c6f6f50592048ffae7c25e2126436eb64f604b5e792c9780b574c8512e8f47e1cc536256d149b9efef7783d104c9ae864581f79bb60281b1b0895eb536478e86535c07c787bf8ad14b7956bab6860ea749194b80f4e426bef5d09b7ec47b8a42fca58626cbc67f63986fda31c77762a9094d31daea7d4a5f4aa1bd5d786194002cdf4806f83a7ffc2aebeacf389762854d8b54551c3f1dd99b8df4db75bc5cdcf252b777fc659a9f4450656e6b73fcd0ca2c348be0b7a8f9d4e54ac8e0d017941c97221bb98f94c06dfe01bc79cb406a2f0bade2d74d06db498d6ad369c2c439cc5aca081058767f6858bccc2b27db19514843f44c99e23e941229841ab4e42aa2f3f8b00b402c5f3a13596cacf32c745b73dc4f6914645ee0213d981f7651818b86f00cfc4d1a48134a32c3cbab9e39a7981c52583dcbacc9beeeb4235ddd794636d931886f0f97dabde1c25feb8ecebfbbf81a54114c2a2e10d46960227907319a9db919245dffdd559d56784671f7214744dfb61941844c64f0fd6fd6ba8d8c18b26c547ecec6e6d10a4177e31d306484d77c1d0882d385d9503a88f0bfcfac58b0a321dfd54396608776be2d61b6c22e52d2cb3e4d68f03c4ec0f6330957190c482bc5a7a8c53d6a0ebcc6a3cb84f746aa9b9b977e2c6d30803c2ccf96865f945cedab07206829259a2fee6ad48a51f5209ce05846a34100df98ca69b1b5d48b9d68849feac113bd09d11b8473f5db1e5d3e7080d1cd5a4246907c015098a322d52754af6c1366eb946ecf3e3cd085132044e5c4426e6eb0070cae213bfe55310201c1f2d4c44aba7ecb99db66aa2faf1b158f3513613d995e63b37c3154c4b4c08a1fe30b34ec8d31fbadcfd9c8677cf916e5b1a51273a5a7cbe6bf283d4a839e1528700831fbcf35f5c61e5c000f84b3696fd5307f4f458740880569718d6b4b5f3ba8dacd4cdc9407c1969708e8f7d9a488479dca1332de4bf248705e5b49541e984ba1e6d8cb6d163758dd12a44ae732a90f06f366fbc7871d5ba3f763404da2d61a94a81757ffb8d38f54e312b4e9782dc8e0bbf61e000feb4b47c6dc086c1d017af78af3a66e4b0bc73a7be108167d1f2c99bea75d86e9a13219908dfe3a16cd05403fcc5bffc05bbd6b7fa45105ad745b8ab6a0d1bffe319377082b501c319d5b44abc62a7c3333893b8d4799254f9aa33068d7743e99807d05099d275f2755bc944d7597050a56e0f18dc8a004299e8342ec562a265072fe51654e5789f56400fab95ca668727785f8cfd667d6f653f41dd2efe9845852a398a336e8b53cd97f6d0a3d3107e62c16d4282c85869f7088d208dd2146f5293b9ec9a386b1f3c9e5477a20b0895692644092a5a0290b37dad0ed4ac9c8ddecf2e5692a57b73cb177d5ecc5703c3f6a3b8b087c3bbc6aab58ee1982679287a8935e013cc2580b57030b771b7d95be3d4d0109f42fdb385b4fe3e8c64267647f141f53882934db24c8f1d629b51a4d8d6cb610d73799d5ad4c31ad6f4d982c8ff144cb14003eb0b495c3b4db3a01ad68051ec9fe4bedfc8ae3ff85aba6c2479de43e0f18e401a9ee85654326e0455a1df373e127fa65d0a7278aef90bb27820ca77895b09dc859d90b97a9d7ea99f68eaecfd7786f9c6fbaa66e686964b21694b2834e01d86897e928b8688c6db51d34b94ec75252fd4571ece0aba49b94bb635e6b98ddec10a5837cbcbf950e1df3c4020305469c9c96a46ff8bb1fc77c6f16baa18b1544b6517c400bcbbd80be8ffb49f3f4eddec02612e1f725324cb1c545d4ac1974c79af71285263bf6176e541e409c47f81567e052f4cd1eaafac98807adab5c53494d7384fc36bcb334589fbd5d27c39e705cddea2bbc58d1f03c37a830641a5024da70f042f548056f066bbbe4d5567ffd786c799550b9d3db4aedf8afccfad26b69ee77816ef22c19f2ce0fd76020182e6221d687440ca1accae68c368400df621033d5e867564a907c833f77271ce6b64a3db464c1387b96e8ca8a06b7fa2894a13acbff513493e697e6a0cf40cbe82628033b19908fdccb06359b39c2ebeeb27a5302063a5542a9a6eb9b55ec3339e116af28c56813e9bc5f8ff11567525dd09100979f285562883af3f40e8977f2ec3b09469913fab541d9103294ec29dda31a99a57fec34563a33dedc19fdd89ffa660b7fe58e045d3c0c988fbc0a3fcdaa0831c69a6eeecf33515bec474050fc7c55854e54ea81857c114591a2c7511b55ac0d55c01781c90e30a7723439e0550d8e86c8df5b77b098f6afff1ae51218d708d06f840d6c37689a883af9b9c12aaea4c43e5b6a3535937e71e22e2ae8494c0a87eac85e6dc2bbf9585343475b387938be800795d7a4e2bc0c7483423b1d2566ffd278199d737c4451cfa8d0b54615912b1dca84fcda552d34cbdfdf58b0ead01689a15db670212524290e1aeae55482227b8cf5cb116a2bb29214ea9cd0023af0bbbf6f40fd82b2ed3dc1ede0c2fa3f4ca7050891b9159fcea6785d8a505b842432ff019f686a5f0dca815b3e7cdbe98c86862a90d0ebf6963d47b2dac4b09fea873ca424127a2fd09b93c250db6a40ada0bf568eb64ca267158dd35595b2ced2c65a1fa701430c0d8e8497b430db7cbeef4ce54acd7bd3757b1e4eada7f004a10cee1a528e1fec15f09b61de2780b75bc43da3b76601f0a136e5560c0b772228c074171e698d323bce09f2c959a62af4b2a620305efff2a288b85e987f13e92800754f9b46aa4e77f04ad9c1389691e0952331ec78be6a3c009ca3a321af0408ad8cbdb116cc233c0b2bfff887120ba79ecdaefe633b08b25bad0ff94cf688580ae3e3405b8eed6b2ab931d1521b3fef547df7ead7e64c3cf4f4bb157464340a4bf93a9b7750fb3f9ee64346b1785fbf3dc28fdd6b6fa0fa478c6c4af1f62feb92c0dc6c3a77d691ec297aecbcdb5fc8b0ef508ee0720921e603e620216d6bd84cc814b817f13f97769f05c542d0bc156bd954d5e8db543fa17aae75584a75223ddb813c840059af8f79f7eda70efb84869af2778f9bb77cd2fadb2f8830b17ef6332c73ebb75cdde97636538960fc707caaf59c9a7bd2c4de965b0d1e05b47fb5ca27ea3e8ea665d6c298b3a50e99b2075cec00333d594e92d55cf29941660164a38f69551346a436b95dcd51c573426317c1f244953e066b36144945919af56ffd3a70ba5c935cf6a209487384b5085fa0ba8723179a61ee6df44ef6b91b11676e1a6b671b371ce4c4aa022a059052d5cff614f0a585c61f7d3ff430828fe8619b79ffff9094c9096177529e7319ab78888beed6652969a6d6c64beef7cb1a871f304d10925f47e3d4e3a91a60b912dd545acdcdb6bfe60fd32a5621c6f4ee146d78bd3f48e91ec0fdb92b5041d7fba8686c52277b9796f74253bc9d47f882c12bbf05f1bf6b520f944bb69ac9dd513d4cc2e2bf8e1e726bbccccb055832c2ca9c52f7e0a6886149764a8be99bc4a3cc9b14f56511042284246f40a4aaafa5a022af7b1f1f524ae9f3b48373519d2b3e085bf66a45b47d898cc6694473ed34b77b352b8077d00d105d006def6f864d9c902d9870adff1c14543a885b5cadb67daf3c0132718f8bacc82f2de48899b134995a9329d15837b98767cbb12e0e3dde92810ce114e291f21e76c6063c292db60f9adc3a0843ef77185bc34826cc238e5bc8e77cc3d05423d7a819672ee720987f0a07345dcf543c9ee9580e4e6b040c17efd21ec9f65ecd531adcce818532b1a34ae32ddf4230ab2c47aa22802d6abb85d4a6c9fe0d83c0712e1097fd0fa97211b99f77fbe15256f6b46c2305a12a1a5105d9d3fe25941270820e9bc26d9e9b1f713bd335e62adbf8eba3d65ebd027f4ed799f5bfc1939b7b12174f9f2e364093993e16d69c2544c5233cb324cf945e6a7b46aec7229df3c0df4fc941e36adfad18d0a6533bafa36b6a1e73a4ef3b17c47a6b271612d5dead08e097f50eb5126aaf6f3f8cbf216008bbc86f4b89fe54c402afa66f758ef11754b890257172559f85c5a2201b4dc80667bb57a132982bf0805439ce6439918061ce48fe2f2bc449e3ebfe1725bfc117269ed282404e8eb2ea71236b7ab419e6a0145e9ea040d3022ce078a39015dc0c474a5e5d69e7cd2aa24a74c2a94c92227ee61d3b2ba5f24773ab0cf368b35a86bd1c07631897c8a25fca32d742c427399fcfcddc187e7f741fd29093e535683cc6a3d490b1810b14ddb183bc53a62794233ce5ad59656aeca0ff158d56b8d5ef37b05f4821f062ff998bfe8229abba907cbd0591760de0214d3bd4cd398d59c08be5a8fc03ae0631a4f8772fb48525eef753b93747bcd62cb9df7d2b3996fa4eeeac8a469bafd7c2e5ce8f92d6a915148b2e190c76c807afba6df55aecff1bb880992c7e5928ed8aca053d722d2baac873572bdeeece285889f00138ea788ecc09bc2bf6b4acda004b155d8da2d188f1450b266c3474e8e94514437ba3333b81b252426cdc7ed3540f0df55a35823452d34e86888b1ff76707dd52b8b12164ede6c70de95fb901bb2ef06fdd488b8b029f244bef83b017d2aa9328012c7e631091ad1d39e024966f473d9c86f1b289831995245ac2622456f80b90c6ecffd26f3f45bc121715eb3f9269fe2211162a0400cead6ef194021b9f1187dfd57fa26efc9fc3a7bb915ee5fa203afa614bfedbce27a8159b9fcd786d782d5d59907d1191cdb2763ac70aaec6af9f3fbfd5120d663d4cb97ddb437101fca52bb71a6e38513f53e9a1d53283f5683418f8e0bffb084ada10e839d6055b71587922d19715e7e6fb1b190592a3c4b107140ec82696aca0b139abc716896f8aa11daf03d943b9b456af6b8839eb99eb83b90a954a90394377b4df311e581ab12e10a7fd889b0d2befb820b71077bc40abb7f143a2c6bc2fc63c152303e4a72d08959c09a3b1a172a78b3d12620244cdffa2b645650424f04cbe79b427c24fbfe12c9ccdbed1cd77f38e42908dc7a16dcd3a127e2151555c81e8b80a5d5eeb9f5d66d56b9ce8210832c5"]}, @typed={0x8, 0x12, @ipv4=@loopback}, @generic="3eca7cdb263a067db88bb41f30ca88c57fa3b75996a6b4ab29f03481038124a04e777b0cdca5b3aaaedb3cf5f795c549bdc5866da9dfdbdcfcff7fced771aaeaf657", @nested={0xc4, 0x73, [@typed={0x8, 0x63, @str='lo\x00'}, @generic="0cfe48bf8e69a11e43d7f0324c8342dd41ab0917144336e74ce9838afc58ff1c78c6c4176572d2c1cd777237f4588e4670b9264dca2a66c1d1ddcdbce95d58245b3b51c5fcf33909de87490f9a68be799630800fac82e7257ae8f0234ef904bbaa6625fae8bdc7dfdbff26fba8168849a3d6f1c61756675d283d4d0936d0441916afd01f922054ff7fae39f894a5f3257e5b776c08196246e0a2b9c58c4f5b7c", @typed={0x8, 0x76, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}}, @typed={0x8, 0x16, @u32=0x8}, @typed={0x8, 0x29, @u32=0x100000001}]}, @generic="d6f064e60a8a9222c7e54614acfe4d0c229ac5186b347701acfb7aee83df554e79e0a78ab9fe8d5b5467f1a0f8c597b9a52d6f728ac5e27d8c67d8f32c2ffa9c7b59515c1b18590be19ef8fb22819d17bd167d528fef65282cf48bf9fd2ad39335fd69a5c6bb62a3aaf52d5d8da73e51782255140476aa0bb3d3175ab6d1462d", @generic="e3ef5422e319ecd44b70d2875e5616bc4c3421d142ff7993d89b216aad4068b49c14774a64391195939a4254382082005ace1b3c595ca524e7fe55c113376c2dbd0f0c2036beb1b4d451ab17c1fe3d2937df9e5c03a59e6cb957f019af941210aeb4f735c8d81fd2aff5b1895aae0b313b3c1a7d12277ef90d9c81ae73908b1b194e32400a49839e1a83f4c89fa22746c167f3429c7f26d0e57212d3b9a90abbce4a313a32380de24cd74d83"]}, 0x17bc}, {&(0x7f0000000280)=ANY=[@ANYBLOB="c00000001800000429bd7000fddbdf256f852086855254f4f4febe8c4cd438187932dc06d342d8fd99450308f18b78cc02443e20f3c07790b2e49a2ab4f892e94e90f2c404065be33499762ed1e9fac3cf8eec61d04d01332b121665701728b27e90756b5af234810a54ccfc9293f414e82ec5a6db875ee1efbd9c2d6a24da0bfb7a86ebac661c9ff9091545037c0b5a9013d8346067c6ed936a45591a724de7db97d1aabf115d5a874c27f498717402563eaa7dd0d78d90f75bc48136000000"], 0xc0}], 0x3, &(0x7f0000001e80)=[@cred={0x20, 0x1, 0x2, r6, r7, r8}, @rights={0x20, 0x1, 0x1, [r1, r0, r0, r2]}, @cred={0x20, 0x1, 0x2, r9, r10}, @rights={0x18, 0x1, 0x1, [r3]}, @rights={0x38, 0x1, 0x1, [r1, r2, r0, r1, r1, r2, r3, r1, r2, r2]}, @rights={0x28, 0x1, 0x1, [r1, r0, r2, r0, r1]}], 0xd8}, 0x810) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000001e40)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r3, 0xc004743e, &(0x7f0000000380)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000040)={0x3, 'erspan0\x00', 0x1}, 0x18) 18:18:26 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x204000, 0x0) recvmsg(r0, &(0x7f0000000600)={&(0x7f0000000080)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000000580)=[{&(0x7f0000000100)=""/121, 0x79}, {&(0x7f0000000280)=""/204, 0xcc}, {&(0x7f00000001c0)=""/43, 0x2b}, {&(0x7f0000000380)=""/216, 0xd8}, {&(0x7f0000000480)=""/31, 0x1f}, {&(0x7f00000004c0)=""/155, 0x9b}], 0x6}, 0x1) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000640)={@mcast1, 0x57, r2}) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:26 executing program 2: r0 = dup(0xffffffffffffffff) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r0, 0x29, 0x41, &(0x7f00000001c0)={'filter\x00', 0x2, [{}, {}]}, 0x48) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) pread64(r1, &(0x7f0000000380)=""/48, 0x30, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuset.effective_mems\x00', 0x0, 0x0) mount(&(0x7f00000000c0)=@nullb='/dev/nullb0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='f2fs\x00', 0x80800, &(0x7f0000000180)='/dev/ppp\x00') ioctl$EVIOCREVOKE(r3, 0x40044591, &(0x7f0000000080)=0x7) 18:18:26 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x4000000, &(0x7f00000006c0)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) fremovexattr(r0, &(0x7f0000000100)=@known='trusted.overlay.metacopy\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)=@known='system.posix_acl_default\x00', &(0x7f0000000300)=""/82, 0x52) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) syz_open_procfs$namespace(0x0, &(0x7f00000001c0)='ns/mnt\x00') connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f0000000080)='erspan0\x00', 0x10) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f00000000c0)=0x1ff, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000440)=0x0) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)) r4 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000540)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$TIOCSTI(r4, 0x5412, 0x2) perf_event_open(&(0x7f00000003c0)={0x6, 0x70, 0x8d9b, 0x1, 0x4, 0x9, 0x0, 0x7, 0x50000, 0xf, 0x40, 0x9, 0x0, 0x0, 0x5, 0x4, 0xe96, 0x30, 0x187, 0x8, 0x200, 0x100000001, 0x100000000000, 0x9, 0x9, 0xf01, 0x6, 0x2, 0x6, 0x1, 0x1, 0x8, 0x5, 0x4, 0x5, 0xf80000000, 0xffffffff, 0x8000, 0x0, 0x5, 0x0, @perf_bp={&(0x7f0000000380), 0x2}, 0x6628, 0x9b34, 0x80000001, 0x7, 0x7f, 0x4, 0x8}, r3, 0x2, r0, 0xa) [ 799.610231] PPPIOCDETACH file->f_count=2 18:18:26 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0x25b, 0x6, 0x0, 0x1, r3}]) ioctl$RTC_WIE_ON(r0, 0x700f) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) openat$keychord(0xffffffffffffff9c, &(0x7f0000000140)='/dev/keychord\x00', 0x4000, 0x0) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x600c40, 0x0) accept$unix(r2, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e) [ 799.871098] PPPIOCDETACH file->f_count=2 18:18:26 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) prctl$PR_SET_SECUREBITS(0x1c, 0x0) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:26 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = fcntl$dupfd(r0, 0x0, r0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000400)='TIPC\x00') sendmsg$TIPC_CMD_GET_NETID(r1, &(0x7f00000004c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x42000000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x1c, r2, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [""]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r3, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r3, 0x4004743c, 0x0) prctl$PR_SET_ENDIAN(0x14, 0x2) r4 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord\x00', 0x0, 0x0) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r4, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x24, r5, 0x10, 0x70bd26, 0x25dfdbfc, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0xd7c}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x44000) lsetxattr$security_smack_entry(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='security.SMACK64IPIN\x00', &(0x7f00000000c0)='/dev/ppp\x00', 0x9, 0x2) 18:18:26 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 800.060150] PPPIOCDETACH file->f_count=2 18:18:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) prctl$PR_CAPBSET_DROP(0x18, 0xc) [ 800.180678] PPPIOCDETACH file->f_count=2 18:18:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x29}}, 0x10) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) lsetxattr$security_ima(&(0x7f00000004c0)='./file0\x00', &(0x7f0000000500)='security.ima\x00', &(0x7f0000000540)=@sha1={0x1, "59934d571ee06b9fb01d06c362b088440616f0f1"}, 0x15, 0x2) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$PPPIOCSPASS(r1, 0x40107447, &(0x7f00000003c0)={0x4, &(0x7f0000000380)=[{0x6, 0x9, 0xfffffffffffffffb, 0x20}, {0x2, 0x900000, 0x9, 0x85c}, {0x80000001, 0x4, 0xffffffffffffffff, 0x1}, {0x4, 0xc6, 0xaa8, 0x20}]}) ioctl$TIOCPKT(r2, 0x5420, &(0x7f0000000080)=0x8) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000480)='/selinux/create\x00', 0x2, 0x0) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) r3 = getpid() syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') ioprio_set$pid(0x2, r3, 0x0) utime(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)={0x8, 0x9}) ioctl$TUNATTACHFILTER(r2, 0x401054d5, &(0x7f0000000440)={0x1, &(0x7f0000000400)=[{0x200, 0x6}]}) perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x1, 0x7, 0x1a800, 0x9, 0x0, 0x191, 0x80000, 0x6, 0xff, 0x3f, 0x1, 0x5, 0xc0000, 0x2, 0x1000, 0x2, 0x58fccc35, 0x3, 0x1f, 0x2, 0x1, 0x7149, 0x8001, 0x0, 0x2, 0x5, 0x3f, 0x1, 0x5, 0xfff, 0x6, 0x0, 0x9, 0x0, 0x20, 0x3, 0x0, 0xfffffffffffffff8, 0x4, @perf_bp={&(0x7f0000000140), 0x8}, 0x2, 0x101, 0x7, 0x3, 0x179f, 0xb22}, r3, 0xd, r2, 0x9) ioctl$FIONREAD(r2, 0x541b, &(0x7f0000000580)) [ 800.204686] binder: BINDER_SET_CONTEXT_MGR already set [ 800.210742] binder: 23199:23205 ioctl 40046207 0 returned -16 [ 800.217674] binder: 23199:23205 got transaction with invalid offset (0, min 0 max 0) or object. [ 800.227076] binder: 23199:23205 transaction failed 29201/-22, size 0-8 line 3348 [ 800.245946] binder: 23199:23205 Release 1 refcount change on invalid ref 1 ret -22 18:18:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000440)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0x9c, r1, 0x200, 0x70bd26, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x46800000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8e}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x2}]}, @TIPC_NLA_MEDIA={0x64, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x400}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}]}, 0x9c}}, 0x800) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) [ 800.310229] PPPIOCDETACH file->f_count=2 18:18:27 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r1 = epoll_create1(0x80000) fstat(r1, &(0x7f0000000280)) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_GET(r2, &(0x7f0000000240)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x34, r3, 0x10, 0x70bd2b, 0x25dfdbfb, {}, [@FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0xff}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x37}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e22}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000800}, 0x90) [ 800.400473] PPPIOCDETACH file->f_count=2 18:18:27 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) ioctl$PPPIOCGNPMODE(r3, 0xc008744c, &(0x7f00000007c0)={0xc0ff, 0x3}) ioctl$PPPIOCSDEBUG(r3, 0x40047440, &(0x7f0000000280)=0x4) ioctl$PPPIOCGNPMODE(r3, 0xc008744c, &(0x7f00000000c0)) setsockopt$IP_VS_SO_SET_DEL(r0, 0x0, 0x484, &(0x7f00000002c0)={0x32, @multicast1, 0x4e21, 0x1, 'ovf\x00', 0x20, 0xd7, 0x5a}, 0x2c) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) r4 = open$dir(&(0x7f0000000100)='./file0\x00', 0xa0000, 0x80) mknodat(r4, &(0x7f00000001c0)='./file0\x00', 0x20, 0x3) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r5 = dup3(r4, r0, 0x80000) ioctl$TUNSETVNETBE(r5, 0x400454de, &(0x7f0000000400)=0x1) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000480)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r5, &(0x7f0000000780)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x20000001}, 0xc, &(0x7f0000000740)={&(0x7f00000004c0)={0x250, r6, 0x800, 0x70bd2d, 0x25dfdbfd, {}, [@TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x100}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_BEARER={0xf0, 0x1, [@TIPC_NLA_BEARER_NAME={0x14, 0x1, @l2={'ib', 0x3a, 'bond_slave_1\x00'}}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x3, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x1f}}, 0x4}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x34, @loopback}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x10001, @dev={0xfe, 0x80, [], 0x19}, 0xd84}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x69d7, @local, 0x6}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'rose0\x00'}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x800}]}, @TIPC_NLA_NODE={0x10, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8000}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}]}, @TIPC_NLA_BEARER={0x10c, 0x1, [@TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4cc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x401}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}}}, {0x14, 0x2, @in={0x2, 0x4e20, @remote}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e21, @multicast1}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'batadv0\x00'}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x46d5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffff801}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x80}, 0x8001) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = dup2(r8, r7) ioctl$PERF_EVENT_IOC_ENABLE(r9, 0x8912, 0x400200) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r10 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r10, 0x0, 0x0) tkill(r10, 0x8) ptrace$cont(0x18, r10, 0x0, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x1f, 0x0, 0x0, 0x3, 0xc4}) ptrace$setregs(0xd, r10, 0x0, &(0x7f0000000080)) 18:18:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) r2 = creat(&(0x7f0000000040)='./file0\x00', 0x1) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000180)={r2, &(0x7f0000000380)="3c424fcb8499147b8f89b0d2b319affbb0ce21d732d4db483d991418a8aa0cc0caa3912fd48a51f5a2408fd7bfa0c4f9e9b5f122bd09c9a2c2264014771ad2182fc39e4e6b6f1539b236c58ae649c30d32154ac389944c58d2f63041dfbf3959451b60ff12314712449705e2c52abf4150788b499fe86099d10bdee30e79d83d8d6bad0c922d3cedfc2b786c75e893e136cf9e56d6ea3c69e28dccb3c585ee939a0d004e475a1defc973ea0e23c67aa4a2c749ed7778e932f2371264382a4ca7afad49eb42b5dff7d533182125e3a7f713ce9168149339494029fe3f00a4a0c93ae11f37018b6e98878b8b718a98afa5997bcf066bbe5b6c999bca2268d8e67f8abb0d78c469c6e84e2686ae447d757c23cf1d2453ab391e53c8c68b83aef6226708ea0150de5c6a771480041ed0a4ffae19a7ed9172de9eaf6d6aec40ddb507f0ef272d7d967f3ec55f35d0a8e4ef32cfe09bd3240adae56181d89dec6f14b696786dc8c28966a412eb40c3109d4ee53454203c8bbf72cef63570e48792ddc6e5377e58e175c0ba2d1e63fcc37918885a932f10bd1a714304ec1defcf121efcfa6a7bc8da7b38fc60afab973f2856af29061a3389aa43c292e61aa101a39e8922607697146cc0d0e79bfab2f41bcfe80bb5076ac1fc1dae0a3e2da6f90580488ac773f32f58c12c336474c73230a1de5bb4812db7ce63b1092697fb75fe3d0f1c6e723e8cce7f971e0382afaa2972143f679bef333012cf217641c729672f46d0c03f20b7db6fc06543e36733e570984c0dd3966bbe065553959fa3878dcef9d2e992bb265bc3ef9ba0a3ab51eb4d215dd3b0f3e357e3d871b6141c237a4e2c751eab206c38866a6f12538bb69b6ac584b74fa09c9dd1a33d2704e86e1c5e1889c584f5c7dcb4150f860c30854b8bc77bd6593b62aa1783e16e32da169692484cf9e29a80d2542479c9770339931f5111442d055c27d30af391f18a5678829ccb8a052d65d1bc885a97c8dfcbc1e4ef02aeaa167f750691dbc57f082ccc595d54b8c29a97fee919da83aaa28f8ce7b618281e4add6cc1a4ba00173a4c20c43beb5c02c888d4bd2d25f435bac2efa3dfd6655ce9b7760071cf3167bad9f6d021c18952dea41328e7033a9767abd15f4314612853b3f025b0e96482e40bd3aeaa796b44d421da568de1de07293b36326874a2f0fe7982c75c8b66c30b84386bd8dd6b4b745ca93f32fff865599a99f672fb9343fecca657d932359dd73aacbed2cd6fb9a07ef90849b8be2b23b8131c0c3130b31568a57b63827a724d0e3a527cb6a304d6d1e1e9dde3163fdbbf06c96128e8cc06a55bb8b6a5516664734e49b6ca7f0def8ec2cbe5f633550128a55eb7f1ecc690ecd7a0b3bdca7c5072a987c92680078b8c403033b03fc243824555b4f183c97fb50841ed05f8737ab5ae89e22193f0f8c51569225365975762a3d0ee42068f8c73cb974f133f95375e6179c6404dfc71567847e80dcae45bd6a9dedbd7c9f314dac1c2322630e0916c2b1ae90a885457ac751c58155d2bb414acb10a5efb99fca3858b5fb479da7c2878454ed6e7e17ccdf919e6600d156e34f64cab40795b7fa46f7861a841bf8ec1c9e0c7323bb3fad93c66bc1d159dd0bcaa450ae0a006245e844f5bde5761b3b0860ceff6c4ebd9712c9516042526c4395c5cb04f6696e72eb5ba5a93f83363560d333f7fd308383f2bc527c8f9dd1c00de13ce6d1a1faa8d6066090cfb1bc31e86bde77c75e28d6da1ecb039cafb019bfd7003a07fbc6935a4c311a2e319d9da158da2add31d49520a2cbbb77dfbad0ed4009a264e994c2098205cb444f0eed0e53f9c784734f45e2f53f1e7dc1f61f842507b74ea637ce75d0a22ae8dd211282f06329499638b12c4db9db6d0d36f1e54e1321228d231c46e1ad6592d9777d5d8e89d6661c321d060b2b053ea339c6bcb581cb433d198f3cd6be918c7c7ef6505180e3492570093cd577c9c40a86a60210df5285a8e67eaffec4f209ff9a9a46b55bf76257527feb4123039e5819de9e3ee8091e6c2655c3989207cc731aafca434391c9bdbf3906ee7ba53f852cdfc4d802fd2c3d1d4df9605f85d66d017c9beb0e13e26bb9ea395a91ec8381ed3d73a93ee17308b4a33e8046f2aac17093cee7927a6a4568d4b1f81a728e1bed8dfa376b58a79dac3a40ac0d20d1ee16ffb588aca1a343e280feb7e178f094519932e9c30893fd821ccfee311bc632c910b800c77fc7b76efbc1790ba6170d055567ee3f7b65d18199354b2e1952a4b881da73602c6022198472d916d3cf084fa1ba6c72aa4f5ee36ed67afc6f0e92192fde4929869b1a527113ab678b3fd239d9944e0f0d727a632c255ff7dac7cd114957a0a177d7cb23bdc075801ad4b540e565575b3ba102118ad8a13c6a91461aa162f32c56873628f5e7520e92d923566a1494f75b2771b806309cf90fb12871397dc14b26a85bdab114553220dfa368dc10fc99182444b1923f2f1887629ebcf5ae32989b2020afd77c8fe099550715165999fc98e3d8c8543067915a05c4414e613e2f68993b219ee693189ccea3ae14d0f27f8e53adecc8875f48b12aacd64a0511619a66bcd46c2b9ae1cdbb765c88e7b83acf6b8e5ab948029329d7b49aa6ae32190cbd3a66a23c00f695e90d75a5d1d425d515f4f4130688945b22ddf54e05a423f72d8ea4c66415997a20f4b1ad44e600683cd2d8c841b5d6406850e4ccd9f7775893bb2b9f69df2b64e7fecef6977ad1c4050ae76aaf6deb12f45c32ae73ef3db157e32f279603b67b0ddb1cd756e4be6f9390c565dca5f38b0f5829a6bba5884070a77ae4dba856bd0a37de834a4d23c0df9eca7aafd9573c207a4dbf916ce40b6f86c49cd35232a6df7c7d5b24964bb6f7568663600e87bd0c7fb6df69ad2bb6469311df32bc1cc0ef22a41616642b5b95a6891aff4618ff09d02049ffef0651fa0d881613294bcc3317ea49e33402d4931b6002ec728d8c8f3c0a2b608a329514d4631cb152751145c54294ee199ac0aa5974b75e4931c873f00d2b2e8e85c918f875e2daf80194ff84673837c8acb7f4bf9b74a495215facea0569ae0c55c82f9bde9a315d5bfd4d6db64cab0972dd2a254460da87e87e09a080a979f7a741f61e9f6a43b641ba2b340ded0ae6997d103b41f5a29262b51d26faeb20806b5979e611d9114431236d4931bde4caa30abae3c39034d3832e8a2b813633fbc50b9c034c9af02ff43bf1615fa306fca8950d71119d3e1fccc3ecfa1dd05e40fcc2ed205c7dc56e9160e062e9db7460f853280e99427c3bbbcdf9605c21d7619ac3a770679d702176f8a262bc413698f72aa6ab9fc7452ba0ae6af00d987c8bcf230542f2dc92dd0be293a44253b56d13167ded28937442bc7ae58713a3d31d82240bcbe86b4a76e5f07c2214ee1dae0ce966f5c10d4223a93c41c5ce6c4999530374c91bb70f9662ecc60972fd21d8dbc1568a55169cd48733a1e814547ec416301790c78071c12dc18b7f46528d9fcccd36ea31a5f2e8016488108203913eddc6fbc501b60b3c0c83a9cec44fd130e8a82c42ae638ee784998442060bb56c1346b5e6832d6f60387b2d592218b105cfca06837dec08eb32e888340fd38244ae00782ca8a7a0f48adaaef9d174b51cb08053b2863913b8f9a0c90a19a570fca178fa92e364fad2f8c605c7e3a66efb226a5271fb1776c76d9772e0224dae1a9456a16b48731977d2801ae85b222ec842c6899ba652eb2a9a18524a83bc00e11369a98fbc5b5f8113abad899d3a17fe6927da84d6e7a16365efd09c6c14cd23fff6f6ff1bd4268dffdc543c0fa1a04c7df62ed4dc08298d12f218d024e387647df0a5b997067911e5cd08e48d026e1984b0898c4825c9a399a1c188aa74d10358d5c5bcdd0c9df47cf0e8ff58b9cc3df6c2869739a65b3c8bb97dbf38725c36f918440aecefb0ead4d2073a9eb11528394d6c0a575db547de321badf29c105857b5e8a5edb1925a956e2c86111aba2bb1ce4bca224b3a03a997f199e4f1f520662a66758ba77d44dc66e9fab80e6023f76c5cce3328388df172e1970e179233f6ce6daf1ceb377b035ef8d283393a56bfa1d7b3088682e64bcf8a38b8a9731b8b3fe6e6096bc17c8b7a7b3c15f81cf9344b6842c228970b5f1d0c09ab749ba2b2109832225719186c08528cdd92adc45e96a286b6510fd72c6adc51c48c3d7f7f834911b16ed5356fb6966b33da409a7aebddce5d1b59259cdb541c98501fe03d808c71e7929cafa405c3d666c812edfccfdb86ca1f303730ceb6b76ba2532f416b9ba25e394cbe1951b2f0ac6a5b27f85f92991179b4481e86ca2b8f1d752b6840ee338ac92ed31969b16200702bdd159ea01a4bd099a3bf2d8eae89b24997f2bd934d703d7746975366c5e9c622edd8927d14d90a8f01de50a8f0066d6a837abd42efeba28860f91ecc03bfbf2d61fe0d41db8b15c67a538b8308a6157de86727de706aa97b1db0eac95bbd7db623abeee27d2f1d24bb2d547484d196f4be623eee5ba7ccfb8fd164e4efa01a7fce0d14828349992e76afdee874ca8bbd322b0001eb09dfd8e25747432783e3447036091eef74ac896f4dc1f11a1734bb6404247b8a29acac7cc13a64e146a05e8918081553698905f29f74923feb33ec02e4e3cee75ae09d201384fac6590bfed125704067aa77c66fa02231d7d433cec9289e0939af8a9baa15277b472dfd2709ebe1cd2659547cc884eae26bd6e18384b2db4b8d26d9d51694a81cd76855f0305a7954ccf3cb6a02f015029f3835fd2c061c9d5a0499e563e3d59b47a12b9593d0d6c7aa4da0fa66a314ccce9fc0077517d6b33f9d2d606bd88011a41350312fb6a2e1f0cba4bd14b5a284be5da29e2c5e12546e14ac61f112175f3c8341caec1acefd1173e04afd02b2fbe307424e768c7ab39f7e811421d5a8b17bae04e27cd3f2c31a719cc614b1d17ffbd1070ecfa02cff285b362914d9b8fe1702243dffaf7c773db2b0b80b89dd340065e2431099a03a37ba72a1720ae2017fd298f83aa9877a85486ab7c98aefd6bf52968b7e646e9201d67fbd3616369d65b224ce39b4f66c6654f8b02875693403a74ded548a6863b4c8f60420ce48b15923e9cf70549e52059c670105d55b5f7889cb8541abf61ba30630797364a305bef9836df58ba8a5aed3b8d203faae012a552656fde4bf1a42736c7403c06476cd3ecbad2d03c7f0ff1036c12f89672eab665ce823ed49f0622e42eb44781c787e84809066becb272d78a3ae3051cb076599fdc535a96daee8b40c51340bceb6ab9224a44c83de564eb544fb67ad68a157811bed4994a2732db3ecaa770f7b3d2d69872aaabe92aa1e357ff146795e4ddfbdf6e2a02e8dc81efabe4089607ebce42ad5a050252c2383d0d8f95150f356cbfb9fcb133abb727465115d1f00de176aa29706c187835e16ae5feefaf81740a4aa6d88d26e2080960301758152da5a8ab3f5c6f56c9fcbcd4dcee893956088ac9d0ffca4641375bcf63987149ac021b88488acaab1fc6db61adc9029a5968ae9e2b85c869384d255396f62e72b65f52f177c2032efb1d573a6e03508eeb2c04daec25060085f4527c8f54d65d7a63e96f1569d42ad3216e42d9845db698abbb0a471bc96735c253bb75e178215fd12b8813f81961c6107ec89ae630448d89d567ba9a9cc23370de36c25a0d3e7cf1cb4b7c24b93ec86a34ec26101502994398ad007a378bd0", &(0x7f0000000080)=""/235}, 0x18) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x100) prctl$PR_GET_FP_MODE(0x2e) [ 800.450825] PPPIOCDETACH file->f_count=2 18:18:27 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000021, 0xfffffffffffff000) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r3 = getuid() r4 = geteuid() getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000280)={{{@in=@broadcast, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}}}, &(0x7f00000000c0)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@empty, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@empty}}, &(0x7f0000000100)=0xe8) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000480)={{{@in6=@mcast1, @in6=@ipv4={[], [], @broadcast}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}}}, &(0x7f00000001c0)=0xe8) r8 = getuid() getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000580)={{{@in=@initdev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@remote}}, &(0x7f0000000680)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000006c0)={{{@in6=@ipv4={[], [], @local}, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@broadcast}}, &(0x7f00000007c0)=0xe8) fstat(r0, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$system_posix_acl(r2, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f0000000880)={{}, {0x1, 0x1}, [{0x2, 0x3, r3}, {0x2, 0x3, r4}, {0x2, 0x4, r5}, {0x2, 0x4, r6}, {0x2, 0x2, r7}, {0x2, 0x1, r8}, {0x2, 0x4, r9}, {0x2, 0x2, r10}], {0x4, 0x2}, [{0x8, 0x2, r11}], {0x10, 0x4}, {0x20, 0x2}}, 0x6c, 0x1) pipe(&(0x7f0000000900)) [ 800.600299] PPPIOCDETACH file->f_count=2 18:18:27 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000280)='oom_score\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) ioctl$TIOCSBRK(r0, 0x5427) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) linkat(r2, &(0x7f0000000180)='./file0\x00', r2, &(0x7f00000001c0)='./file0\x00', 0x400) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000140)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r6 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r6, 0x0, 0x0) read$eventfd(r6, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000300)=ANY=[@ANYRES16, @ANYRES32=r5], 0x6) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r6, 0x0, 0x0) unshare(0x40000000) 18:18:27 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/sctp\x00') ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400202) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) r2 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x2000, 0x10) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f00000000c0)={0x8, 0x7}) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000040)='tls\x00', 0x4) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) iopl(0x8) 18:18:27 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) set_tid_address(&(0x7f0000000080)) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:27 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 800.900393] PPPIOCDETACH file->f_count=2 18:18:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040), 0x10) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 801.001631] binder: BINDER_SET_CONTEXT_MGR already set [ 801.007027] binder: 23263:23270 ioctl 40046207 0 returned -16 [ 801.014671] binder: 23263:23270 got transaction with invalid offset (0, min 0 max 24) or object. [ 801.024704] binder: 23263:23270 transaction failed 29201/-22, size 24-8 line 3348 [ 801.033742] binder: 23263:23270 BC_INCREFS_DONE u0000000000000000 no match [ 801.041392] binder: 23263:23270 Release 1 refcount change on invalid ref 1 ret -22 18:18:27 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) r2 = dup3(r1, r0, 0x80000) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="2b6d656d6f7279202d637075202b72646d61202bff7f0000000051d24a70baffe7f39b53402700006d656d6f7279202b72646d61202b696f2082d664526b37b590db22378cfa5dc2228d6bd9414261e2a3d453a3b166a7311aff638edecf8d181adb5796c9202be0b707e6243e430696258d7d2ee652e24ced6be9c6b1e0463485079b711f307f3e8dab5c00b212770d7005ca837ab69f010be27a151992b89d0aba2458a2dbe337f9c5c25498884e1295e1de"], 0x2d) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 801.052895] PPPIOCDETACH file->f_count=2 [ 801.061042] binder: 23263:23270 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:28 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) setsockopt$inet_mreq(r0, 0x0, 0x0, &(0x7f0000000040)={@initdev={0xac, 0x1e, 0x0, 0x0}, @local}, 0x8) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 801.200397] PPPIOCDETACH file->f_count=3 18:18:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member\x00', 0x2, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 801.240425] PPPIOCDETACH file->f_count=3 18:18:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) fcntl$getownex(r0, 0x10, &(0x7f00000000c0)={0x0, 0x0}) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_QUERY_BPF(r2, 0xc008240a, &(0x7f0000000040)={0x2, 0x0, [0x0, 0x0]}) r3 = fcntl$dupfd(r0, 0x0, r0) r4 = perf_event_open(&(0x7f0000000100)={0x0, 0x70, 0x81, 0xfffffffffffffffc, 0x7, 0x6, 0x0, 0x6, 0x1010, 0x2, 0x39, 0x5, 0x1000, 0xa0, 0x0, 0x7, 0x1, 0xfffffffffffffff7, 0x5, 0x2000000000000000, 0x0, 0x100d73, 0x662, 0x1, 0x7, 0x6, 0x8, 0x3, 0x400, 0xffffffff, 0x2, 0x4f02, 0xffffffff, 0xfc, 0x4, 0x4, 0x3, 0x1, 0x0, 0x5e05, 0x2, @perf_config_ext={0x5, 0x1}, 0x1, 0x3f, 0x1, 0x2, 0x18, 0x4, 0xffffffff}, r1, 0xe, r3, 0x2) ioctl(r4, 0x6, &(0x7f0000000380)="0adc1f123c123f3188b070561325f191e27f30762674ec338002abe23dab4c7ec6b20d43d3651fd6fa2160aa858cc1df03fd0fce1c1b323c4b9b6508ec904056c815850e23d24b2e127875971dadac90e8a7453ff421fe261e83b5c4001e5cd6572078e3ddd86c9a6f0561491298c1b15d768fc8791c6c1e1b0ee539bc3cecd82357b7bac74303aed2d273ec0dbb22f6ad1c781c1a8953ff120c6599ba05b786dec81c40eb985590d68b3b9a8607d5fd0d4d6a1ae13d913f5cbb88b542865e5465197a59b079245533ba9424ff9e23fd5fe55e1f1d1990") r5 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r5, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r5, 0x4004743c, 0x0) [ 801.330799] PPPIOCDETACH file->f_count=2 18:18:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000080)=0xc) [ 801.390810] PPPIOCDETACH file->f_count=2 [ 801.401471] PPPIOCDETACH file->f_count=2 [ 801.490880] PPPIOCDETACH file->f_count=2 18:18:28 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") ioctl$EVIOCGPROP(0xffffffffffffffff, 0xc004743e, &(0x7f0000000280)=""/246) r1 = epoll_create1(0x0) r2 = epoll_create1(0x0) r3 = timerfd_create(0x0, 0x0) timerfd_settime(r3, 0x0, &(0x7f0000005000)={{}, {0x0, 0x989680}}, 0x0) epoll_pwait(r2, &(0x7f00008c9fc4)=[{}], 0x1, 0xfffffffffffffff7, 0x0, 0x0) r4 = dup3(r3, r2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r4, &(0x7f0000000000)={0x2001}) ioctl$PPPIOCSPASS(0xffffffffffffffff, 0x4004743c, 0x0) 18:18:28 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) ioctl$ASHMEM_GET_NAME(r0, 0x81007702, &(0x7f00000003c0)=""/139) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000180), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000480)=ANY=[@ANYBLOB="264536afac22c6adf8259f70c99c14025ffba7a79b3211a119fce5e7353d82e58130f434ccd827e87520d7b143712af0f889e24b17f382cac740eebdd7413d66ba74005eb96061de620020b3b29a76624530936675b6e2225ad0bac161896ca4f40e2f80c79988bf4532339252b87e0cd0bc95117e05614eec04d6d7bb5eb14e4f7beb1ad5611e7fe69919efd5bdeed979b90ce5f86c869a01fd26bb1f5944170ceeb393c16113f55c1f935a"], 0x56) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:28 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x77359400}, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/status\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_GET(r2, &(0x7f0000000480)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x1d8, r3, 0x320, 0x70bd2d, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x1c, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}, @TIPC_NLA_LINK={0x84, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf399}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}]}, @TIPC_NLA_LINK={0x28, 0x4, [@TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10000}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_NODE={0x4}, @TIPC_NLA_BEARER={0x88, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e21, @empty}}, {0x14, 0x2, @in={0x2, 0x4e21, @rand_addr=0x5}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x1}, @TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb782}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000000}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x20}]}]}, @TIPC_NLA_SOCK={0x14, 0x2, [@TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xc99}]}, @TIPC_NLA_SOCK={0x30, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x72}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x101}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x9f}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8000000000000}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x9}]}]}, 0x1d8}, 0x1, 0x0, 0x0, 0x80}, 0x1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:28 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$inet(0x2, 0x5, 0x9) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x26}}, 0xd0) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000017, &(0x7f0000000100)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:28 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 801.894152] binder: BINDER_SET_CONTEXT_MGR already set [ 801.899776] binder: 23311:23322 ioctl 40046207 0 returned -16 [ 801.907652] binder: 23311:23322 got transaction with invalid offset (0, min 0 max 24) or object. [ 801.918613] binder: 23311:23322 transaction failed 29201/-22, size 24-8 line 3348 [ 801.928379] binder: 23311:23322 BC_INCREFS_DONE u0000000000000000 no match [ 801.936633] binder: 23311:23322 Release 1 refcount change on invalid ref 1 ret -22 18:18:28 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x6}, 0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x50b, 0x70bd2d, 0x25dfdbfb, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x24000850}, 0x1) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 801.955996] binder: 23311:23322 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:28 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) syz_open_procfs(r1, &(0x7f0000000080)='attr/prev\x00') setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x84, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x200000100000890f, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x8000, 0x0) ioctl$KDGKBDIACR(r1, 0x4b4a, &(0x7f0000000080)=""/62) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) prctl$PR_SET_FPEXC(0xc, 0x20000) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x1) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) [ 802.461224] PPPIOCDETACH file->f_count=2 18:18:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = dup2(r0, r0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r1, 0x40042409, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) r3 = creat(&(0x7f0000000040)='./file0\x00', 0x10) write$binfmt_misc(r3, &(0x7f0000000140)={'syz0', "138a6ef48cfa09fc999d486edbda66b7e3d9a34df6acb3c2da80f5e5e9d0094be31b3cebde839c44e877671fed49251f3ca18528527238f2c982777a"}, 0x40) ioctl$EVIOCGPROP(r3, 0xc004743e, &(0x7f0000000280)=""/246) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10) getsockopt$inet_int(r1, 0x0, 0xd, &(0x7f0000000080), &(0x7f00000000c0)=0x4) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) 18:18:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) r2 = getpgrp(0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) perf_event_open(&(0x7f0000000080)={0x4, 0x70, 0x800, 0x8, 0x4, 0x6, 0x0, 0x3ff, 0x0, 0x8, 0x4, 0x5, 0xfff, 0x0, 0x8, 0xffffffffffff8001, 0x8, 0x401, 0x800, 0x8, 0x7, 0x5a, 0x8, 0x3e, 0x8, 0x7f, 0x200, 0x1, 0x9, 0x8, 0x2, 0x7, 0x80000000, 0xab7, 0x1f, 0x5, 0xabf, 0xbf140f00, 0x0, 0x4, 0x2, @perf_bp={&(0x7f0000000040)}, 0x10084, 0x0, 0x5, 0x3, 0x9, 0x5, 0x33d7}, r2, 0x3, r3, 0xa) 18:18:29 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 802.600265] PPPIOCDETACH file->f_count=2 18:18:29 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f00000000c0)={'broute\x00'}, &(0x7f00000001c0)=0x78) clock_gettime(0x3, &(0x7f00000003c0)) clock_gettime(0x0, &(0x7f00000005c0)={0x0, 0x0}) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) signalfd4(r4, &(0x7f0000000340), 0x8, 0x80800) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={r1, r2/1000+10000}, 0x10) openat$ptmx(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/ptmx\x00', 0x4000, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) getsockopt$IP_VS_SO_GET_INFO(r4, 0x0, 0x481, &(0x7f0000000500), &(0x7f0000000540)=0xc) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) sendmsg$nl_route(r4, &(0x7f0000000440)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10800000}, 0xc, &(0x7f0000000400)={&(0x7f0000000380)=@getrule={0x14, 0x22, 0x300, 0x70bd27, 0x25dfdbff, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x8080}, 0x8040) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r3, &(0x7f00000002c0)="88c066aa7df0c262384c75a669d2b088b5d66d17c717a324bed6a1b40c1935c5", 0x20, 0x0, 0x0, 0x0) memfd_create(&(0x7f0000000300)='broute\x00', 0x7) openat$cgroup_procs(r4, &(0x7f0000000480)='cgroup.threads\x00', 0x2, 0x0) 18:18:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x40, 0x10) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) [ 802.652962] PPPIOCDETACH file->f_count=2 18:18:29 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') ioctl$EXT4_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000180)=0x8000) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x8, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(r2, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) getsockopt$EBT_SO_GET_INFO(r2, 0x0, 0x80, &(0x7f0000000800)={'broute\x00'}, &(0x7f0000000640)=0x78) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_GET(r5, &(0x7f0000000600)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000400)={0x190, r6, 0x803, 0x70bd26, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x24, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}]}, @TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x401}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x294}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80000000}]}, @TIPC_NLA_MEDIA={0x12c, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7991}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffff97e}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x52}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffffffb3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffffffffe1ad}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x41}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffffffffff5232}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7f}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7fffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x81}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}]}]}, 0x190}, 0x1, 0x0, 0x0, 0x50}, 0x4000) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) io_cancel(r1, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x1ff, r4, &(0x7f00000001c0)="810bf8a266217c2fe1d2f293a6aa717649e84b6b", 0x14, 0x7, 0x0, 0x2, r3}, &(0x7f0000000280)) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x10000000) 18:18:29 executing program 5: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000140)={0x0, r0/1000+30000}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:29 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$EXT4_IOC_GROUP_ADD(r0, 0x40286608, &(0x7f0000000080)={0x4, 0x450, 0x3ff, 0x9, 0x1, 0xfed1}) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = getpgid(0xffffffffffffffff) sched_setattr(r3, &(0x7f0000000280)={0x30, 0x0, 0x1, 0x9, 0x3, 0x0, 0xac5, 0xfffffffffffffc45}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f00000000c0)=0x1, 0x4) openat$ptmx(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ptmx\x00', 0xb0040, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) times(&(0x7f0000000100)) socket$inet(0x2, 0x807, 0x1a2c) 18:18:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") poll(&(0x7f0000000140)=[{r0, 0x2000}, {r0, 0x30}, {r0, 0x3000}, {r0, 0x4}, {r0, 0x48}], 0x5, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000040)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 802.769595] binder: BINDER_SET_CONTEXT_MGR already set [ 802.775573] binder: 23357:23372 ioctl 40046207 0 returned -16 [ 802.793990] binder: 23357:23372 got transaction with invalid offset (0, min 0 max 24) or object. 18:18:29 executing program 2: ioctl(0xffffffffffffffff, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r0 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f00000000c0)=0x9) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000080)) sendmsg$key(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x2, 0xd, 0x6, 0xb, 0x11, 0x0, 0x70bd2c, 0x25dfdbff, [@sadb_x_policy={0x8, 0x12, 0x1, 0x3, 0x0, 0x6e6bb6, 0x0, {0x6, 0xff, 0x3, 0x3, 0x0, 0xffffffff80000000, 0x0, @in=@multicast1, @in=@local}}, @sadb_key={0x7, 0x9, 0x160, 0x0, "fa2462ae300924981725a1c32513747fac777229ae85deae07bc82cff6f919ca42c5205fd4acd3d09e6c0787"}]}, 0x88}}, 0x4) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) faccessat(r0, &(0x7f0000000100)='./file0\x00', 0x2, 0x400) [ 802.816810] binder: 23357:23372 transaction failed 29201/-22, size 24-8 line 3348 [ 802.837664] binder: 23357:23372 BC_INCREFS_DONE u0000000000000000 no match [ 802.858229] binder: 23357:23372 Release 1 refcount change on invalid ref 1 ret -22 18:18:29 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000080)=0x80000000002, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000040)={0xfffffffffffffffd, 0x0, 0x5, 0x0, 0xfffffffffffffffe}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) socket$inet_udplite(0x2, 0x2, 0x88) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:29 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x4000, 0x0) write$UHID_SET_REPORT_REPLY(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="0e0000000300000002010010856e24d6b2cbd2980ad43138133d85c5a820d8bfe2f86aaee5280c7743930d16f2c2688b17df4b066db7ca82f389eb9f216c15836ae1bbf86a90e44fb08cf26b9bd497d14ccc2a38a972ea56cb1b02a1341260f7ab15609eddbe480c2d5df66363921acf288cd440bddb664fece0e7bf9fc30a23e9c378c17ba58f6e0288f235abde6b7e5b58957081a64551ce2d054869e53a49aa9bc9bcf40d33ed85acb0e936164f37d6d64b88ca1be03e740d481fb1924ba784c4854e16615b343c542a1d8b6f204b3c3d2d63f4aa2b71dfccc533b07cefacb125ca790acf10c5806496c4e5b2d70152ff27af366ee8d52af951d485ad29a202fd08f8e103b3ccfd8f32a445f0ef5b950a04c84b0280278081d42876e8a6714c5934a449938a07a52b049d69ccdeae61960483e3aafaba9853ea7b4462a8d6ce71404f0b0561685101a3d14a669013bdf7deb31e697c2d25c40ee6a2c5046178b973d6116fd6d5f25056bb5a62a84d960a2c6a7398e5ddd6ac8101bb0a9c77cde44aba425dc9b006d69273a2b7ca5be0c8714d856b50a4d18770133693b0dfc010346dc5f418c959abd7ffa0da4711eab82b8a6d71931db3c05d2e9d44643ee766480634643c3190874f762942643e3d1c1160d50b714ef2ece1b40798e2e3a8ac19f0bfe2735056b26a9024d1d3df837b587fd268af4a88339053c526085a98ff33d910dae1d57c3a49eb3da93e8c6fcdbaffa49050b77141839cbba2c872d07458371ba69fc29b65ef75d2e558f468cb587fd828b22a5285ceaf5c59469b3c5517dbb58f91e7b9f680a1d1d23a5e16fab310cad4582b1ffcd8aa9872c25dee456ce5ab858353835c789354c79cb72c4b527eaa42a7ea137715ffdb33228a4600b811927f102871e3c374c32496b45719ebb7720cdfbc3af276b3dfb73a343d9bc0dcdd69bb0031c3f20ce8cd64fdabeb49dde0b04be3e55c4d0c1100d1f2264b570849b57dc07aaa23c0c0b8148dcbbca605e29ab429127847ee3a34654e01b5de8d06657a73d6e5228c9372173d3b3e1d9b960534427e5bfbd3765e1a7e7a4d384d8d055634f6391cc66a155ddf31e387fef4f01956e2c459fa7e8950c250f41cd061ffc48c0b9b5f0e0cdbee04affdd74de247187e8e60999ff1c1910a1a3245624ee9ed328ee849b462345b999a63044d4a9d64bbe00bca054efa743c5b1ef295137ea055bb52a01e9a88cd5867f30eb7e82bad04d45884ef7cfb38e81061ef9b11344a4d1517157eccbae184214a849cbc8c3aa87c5b5f08d66bfb64259768f6bdd47530bddec4c01970caf82c1b4fdf455a97e1c53fa995d1ec2fddb61ec15a4cb7863d333b18a86eba4e67fd52b5cba02e93546dfcabdfcb5d30e1721577e863ab4bbb00a4ebe9a5058f4617720363f8560a4bfb47f8581f4452d84e6fabe28fafce8eed555b9baebd700437a5d8a5be20220af45467ba0bce5445457aeabb633122aadd313b823de3c78edf6155f2dcd24db778ec5066a7eebe97b1c8ed963056976e30f9f0bd70c5a1158673b217cbfd3375661f3c0fda6b8ef498ce3c14282b73e0f52af708af8c86e309151e9626643511963eee5bc163fa9eccc02a2a5d87ee4869c3cd57d4d4f0a0b368e0c8c3c45f9dd2e4c771d812551dd938263a2b4d74f498fcfc30da10ca115fd9a733ca15ff942c96885c32dcceb93e9801fa64c8ad1a3e3ed3fe5d6da45c28099c6c9cf4a199b5493af3db91459468b664484bb157043730706f03611187fb5dcde9f5426886ae7657cba0df39cde2d74ee1cdb4573b0eee53e1268441fdc3974c8c93da92b3ea3b616d9c80b0974f8ead215a3ce09db5181427721f5c1f02eb80cc56185a3422252075b6a331c844bdee5b585646249c9a79e4d9be2cfad5ce63849b649815ca2ccc661b8b431b62bec03f1d22322aae83e5a625384ac0d71fcd3104418256a54f257591004fd6d826e68096eaf041adf54cfb37af67aa9ba30e0d7176057ca80263be1966df0bd3f9cb2eb2b1f7ee851c9829a533acf080dd8670d8900955ff69024a2b4f4c2530516fbbb16b6abae6cdb423e4003435ac4d4fe92611cd8273c32d4ff99555b4bd18a4aea1e742b7b1cac806aebc1566dfed5220d4855ad45f973946dbffc6371e64538bbd6a7326647236713c6bd866e831b7933b64951c7bb88425ce5562f81c85f199431918c6ef02e3d028eae7aeea055a4e50ed904e9960f7e084a201ce3579d3e378a1d35ad80d0ec57a46e9493a4720e7b262a1416c94f399282b977a6a80b1f3336af2866b26c77b248b907ac13a647e5f3f2d277f163df175797e8f3ac2db316226eb5f88e0d16259588e2f382e18c252e4a1692efe5cf4eaf6471972893a3e6309e4367598bfd484ba7c657e8511962ce6275d0dc22c7394342744bfbdf1ae9c4b71ff7ff772b1d7b132563b4ee8951fe67d01f9d5297586df9e00f6d777ad70145a3646401a0224e936091d9ee168720084159b783ca11904daee9e05277e6d497af9d05bc71356a5102510c6971ea0bdffa0bcedcf684e0a2416feea2b1c5ce97ed35a4eb7e19272b28b01b9f18e8ee5b3ce102af6be626d7e50644e4da500a7f2c77f09d0fb419529fc2b0363c825e12781d130d9afa4b413cb208929ed9c099eb030c076191e69285a11b60d44cec51eddc1cd9464fbd522e0096f5cbfba40dde23f943daf11d199817bba8e3149bd5b0d85a85688058b21d2ec2689701899093e03a7e235b316f01ce8d60dd6a3fb1eaf6342ffdb5fc7d6de233ec52eb85e11d6e0f36952acdef4ff638ceef6f01ea1164ea46d03b127880b7c21cf7e8010282af745d16125ee8939a404e4e92376910238a9ff336903f40a02e8cc931a6aef093234a1e1d5c5f55bcc2576ff0f779e7a63d3a6f262a3cb41778082488a0b78e56e7110b468823fd1634ed3522e296bf196889eb076e82770a4a6679375d09c6499d831a47b78d35d3db76e222b5a7c515eb84facfa08cc48607f8e213399078cf407a2151b7d1afcfdd81d645131251969b4e5446f806145e00350515ee68c0edfa59ebc4ee3830ce564bdacad4b8e76433774c25212a0cffb4f9e07d31d18331b946dd1cfefd45c190d0e3bd2badb75d2f6400a604a905a9c99ca414096828ad62abd2467f042971988bd246ee58690ec1ee4decc2b6e2fc13ebd501ddb7e2af72006c65c3f56c03995e4226222795628533abb576c08fcc2df4347f208ad079bf87d83ede568738f147ef97a42c8fccc5ea73515fd09b418bdd4124b80771e71d5857ea495f906906016a22f070d71bb97e79793078336a9dbfc4466885fb132b18ac29aacdd440e850eda93f9e537dcd5794aa9566772636536dc6ba5544dad26cca6510b2edd0ff89e2fde3239c47ac370f01f409319e728f4794dd0058068209578b7220b63fed291de3611b49c38d5640029cd33e85b3209bd549f130d801332b6587c0fccd35e17c3e8fa9ee964f5431286e3bbf5e542fbaa44706b0b3549105f7489a5a211aade98065f7343586a8eb9f989d04c06754778654bc7c6242acdf6b065ace9ea5070070e78e903d24ea90c517d1243e7c205fcbb6b607dfd0b88edd14788f0d3d0b5e64311b810499ad3dd4bc4c38cb2544237588b18a8ef35b054130afc6d4107b3c430ec97c5c2ded936a52ca076285fde97b2573104b78cf80c861d40283a8dc420baf78a985a31e4f3c68fb7f42dda1929448203186b7db64f109eb13397d96445540a1fb72053192e491d4ca55e9140283b5718a7358b77d9725f11f768ba7b22a3b9c29c0806d10c61de92af09656507afd3754e74697ae079fd2b719fca543518d0f072c5d0bf2dbe24c4704b617f4b5cf08793f1070a5e8fa1e0b8cd02a74ddc6a8ad4bf1b8d7fdfd6ce85a562fb3d7f936d52e9f626dd9c7d96b6b0c422f4c3f3c20bfd98ec20085135a8388858432426ac05973f2078fc25d92b50f5fed8b796e133743e16e93762a2258a9d11f67cc59b8e3a07bf3bcd8e5bdd146f79b11dde1b05c6d4147c80813abeacff57d0a0af168fe5c9a43676fcedda0b0c8141b92cad5a57f1474f798e1903077ed5b62967ff2591d8b5d2d92e034609acd4936b0c7fd07613b3cc4c1a53caf16cebafc6cb28918da5d1bec44324dd067434702f48c8d33f1d220ae0f695bbd264ffe1aa026af54e93c96cb95323a0351840f900950a5223eeb42336e06f8ed6d6a6c0db6c1d9d9892761138ed02d468e9915e7d96b4015661f72a9f23bac7e1c17cf51ee1eaf2f5559345a2eb39cc573741324e342fa5284df750aacf65f2e9ba827693d601421e304e449c181d0806504c413ec30f10fadb52a65cb71abf6e4c9f434922a2167c849d8a72dc04b3cf69351856ef09f3f9c9c0b8c49edb62525ce8defde5a43f2f94cac5e22c6b240f1c06664989b2e9dd8ed6f6b4883fd49c11093dad1aa9ab66dfde1997017eecd4bd6419c7e17748c065b500979cbbb59b4ce42d1f84b56f052768c7d7488894d1a5301c9c5d90eb6f67dc77eb65ba4c3ce40ce7c7614c7f603829a927211ed0499785b9d9359bc52633878ffc7048507b4f41847c04ad76d0da3ec4c2e71307683b1bfbcafa243ef1b2c0c02e85926066a911ccb5953dea8ccd3b6a89b11a23825ce41faee17ef2f9c761f423349b4232bc3ef005c482a40fa22d704dd54105bc3def9a478448c713de5d0d696188686a869ba931c5560017053ae1483c70e8c216997badd3f762310a047d604162aa15cba6b5abc342f2ea20a75c365b558b267550acd2bff0a2d71cb4d31618d5a3ad685f2b8cf58e4a28fd07d21c8eb490c99be9c1d48e4e1de97cc8167b39270989e5b4e1df6370b2507fa0838ff27ad02515fd010b3a897c431aa4e848110734942976d0cbb3ec76b5149e5274d83fc659be26c51375bca371a888a2374124264e1f4eae21d85b2d9ddb0560bdffb651fd4fe2ad91fbd4248a83a78ade16b1047353ebe2c6f38cb2e3c3718504536298d59a1940147e697d07afd81b601f6ced88813e8f2219d6cc86c2331a4747d4d05a72b53e861016a593c3c66350bd6417db63feca076522e15989f096fa6c35f152fbe5193fe5c7ac620f2fd905020351aa3f0cb75d98c6ecb7c54fa6689a0eb9e157fdf4e9db696a40e270522c9b4e3e46a9ece483d4020fd2266151eb3320dbf3f9a99dee9c0689267ba4638a374d23dd69df32e376a5cba287063bf380edf772bffe0bd1e957697c113865226a55cc2c0ef4fae6b079b9100ee08715b43617519b8fbf5a7e9cca058c0b52dbb3acdcd763fbd3e0bd20228250c21fa4b62df8e4b338169099211c9252dc9dfd79b5529de17c0131476ad94bf24a7ed266ab83a9a470883f57dffc19c03b5ceabf9f9f7de182e1a260fdcab53158003d7ff0b5840d3a18c4bedefcff0d51308a8f984f1f9cf731423487e780d188894b64c4cc53f75ec8c52ba313941a4a1f1c8dcd9b9a63c79bae7dcf547a9d79b88a202686ae8e5ebb98db8bbfb418ba73da03dd40761f4803b96b7f780d6d52be276ea00a7c36433368cc9b15ed3034cab2749c8a628fa3da63459d1e8e615dec9ffb1f103976e58c06dbd8d7d5a604677d552a03c21874aace13dc418a246e6ec178f67c427dbac7bad75351d5c5e2f79fea57e37fb0c61bb4e9c9c5c70d5e27e18f447677c124d0622edb0a9e4b663e59ccbfb7de99941779004c729c32d66c907749da689be2883cbbc3aef4f0db9390da9b3fac1f743c3b2cce9410b812af"], 0x100c) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) ioctl$sock_inet_tcp_SIOCATMARK(r2, 0x8905, &(0x7f00000000c0)) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 802.869505] audit: type=1400 audit(1553710709.761:53): avc: denied { setattr } for pid=23380 comm="syz-executor.4" path="/proc/23380/fd" dev="proc" ino=79993 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=dir permissive=1 [ 802.882972] binder: 23357:23372 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:29 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@empty, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@initdev}, 0x0, @in6=@initdev}}, &(0x7f0000000180)=0xe8) lstat(&(0x7f00000001c0)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000400)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@loopback}}, &(0x7f0000000200)=0xe8) write$P9_RSTATu(r2, &(0x7f0000000500)={0x79, 0x7d, 0x1, {{0x0, 0x5b, 0x8001, 0xffffffff, {0x14, 0x4, 0x5}, 0x800000, 0x3, 0x9, 0x7ff, 0xa, '\\*vboxnet1', 0xc, 'em1vmnet1:-\xa3', 0x9, '/dev/ppp\x00', 0x9, '/dev/ppp\x00'}, 0x9, '/dev/ppp\x00', r3, r4, r5}}, 0x79) [ 802.980208] PPPIOCDETACH file->f_count=2 18:18:29 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000180), &(0x7f00000001c0)=0x14) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) ioctl$PIO_UNIMAP(r5, 0x4b67, &(0x7f0000000280)={0x6, &(0x7f0000000200)=[{0x4, 0x7}, {0x20, 0x7fff}, {0x800000000000000}, {0x4, 0x5}, {0x0, 0xfc00000000000000}, {0x4, 0x9}]}) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) unshare(0x40000000) [ 803.070622] PPPIOCDETACH file->f_count=2 [ 803.120341] PPPIOCDETACH file->f_count=2 18:18:30 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:30 executing program 2: bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000000)=0x47, 0x4) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x400800, 0x0) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:30 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x101000, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={0xffffffffffffffff, 0x10, &(0x7f00000001c0)={&(0x7f0000000100)=""/168, 0xa8, 0xffffffffffffffff}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={r2, 0x10, &(0x7f0000000380)={&(0x7f0000000080)=""/93, 0x5d, r3}}, 0x10) pipe(&(0x7f0000000400)) [ 803.510453] PPPIOCDETACH file->f_count=2 18:18:30 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000200)={r0, 0x10, &(0x7f00000001c0)={&(0x7f00000000c0)=""/245, 0xf5, 0xffffffffffffffff}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={r0, 0x10, &(0x7f0000000380)={&(0x7f0000000040)=""/125, 0x7d, r1}}, 0x10) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x200, 0x0) r3 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000400)='/selinux/avc/hash_stats\x00', 0x0, 0x0) socket$inet6(0xa, 0x807, 0x2) ioctl$EVIOCGPROP(r3, 0xc004743e, &(0x7f0000000540)=""/246) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) [ 803.553629] binder: BINDER_SET_CONTEXT_MGR already set [ 803.559135] binder: 23417:23423 ioctl 40046207 0 returned -16 [ 803.566105] PPPIOCDETACH file->f_count=2 [ 803.578180] binder: 23417:23423 BC_INCREFS_DONE u0000000000000000 no match [ 803.593116] binder: 23417:23423 Release 1 refcount change on invalid ref 1 ret -22 [ 803.644059] binder: 23417:23423 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:30 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x800000000, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) ftruncate(r0, 0x1) r2 = dup(r0) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000200)=0x0) readahead(r0, 0x20, 0x401) fcntl$lock(r1, 0x5, &(0x7f0000000380)={0x2, 0x3, 0x4, 0x2, r3}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') r5 = dup(r1) sendmsg$TIPC_NL_BEARER_ENABLE(r2, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x81800000}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xac, r4, 0x200, 0x6, 0x25dfdbfe, {}, [@TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x6}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x4}]}, @TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x400}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x94}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x200}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_NODE={0x28, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x40}, 0x4000) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000500)={r2, 0x10, &(0x7f00000004c0)={&(0x7f0000000480)=""/24, 0x18, 0x0}}, 0x10) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000580)={r5, 0x10, &(0x7f0000000540)={&(0x7f00000003c0)=""/188, 0xbc, r6}}, 0x10) fcntl$notify(r5, 0x402, 0x20) 18:18:30 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff}) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000000c0)='tls\x00', 0x4) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000080)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:30 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={0x0, 0x2710}, 0x217) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000140)="fbd70453b9dad8f70dae07fc1d81d46ea81181e83202baaed438b32c5ece13d011123cd4d0a37b8c867c6d7a014a988aadf59fddc72e37e866ee", 0x0, 0x1, 0x0, 0x10a) 18:18:30 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) readahead(r0, 0x7f, 0xc6d) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 803.761021] PPPIOCDETACH file->f_count=2 18:18:30 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000080)=0x80000000002, 0x4) r2 = getuid() sendmsg$nl_netfilter(r0, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x30, 0x7, 0x6, 0xc, 0x70bd2b, 0x25dfdbfe, {0x0, 0x0, 0x7}, [@typed={0x8, 0x8a, @ipv4=@empty}, @typed={0x8, 0x16, @u32=0x8001}, @typed={0x4, 0x6e}, @typed={0x8, 0x13, @uid=r2}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000000}, 0x800) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:30 executing program 2: clone(0x3102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = gettid() wait4(0x0, 0x0, 0x80000000, 0x0) ptrace$setopts(0x4206, r0, 0x0, 0x0) tkill(r0, 0xb) ptrace$cont(0x18, r0, 0x0, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0x10, &(0x7f0000000380)={&(0x7f00000001c0)=""/88, 0x58, 0xffffffffffffffff}}, 0x10) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000400)=r1, 0x4) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f00000000c0)={[], 0x0, 0x0, 0x0, 0x20000000, 0xf9}) ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080)) ptrace$cont(0x18, r0, 0x0, 0x0) r2 = socket$inet_udplite(0x2, 0x2, 0x88) openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000440)='/selinux/checkreqprot\x00', 0x200001, 0x0) ioctl(r2, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r3, 0xc004743e, &(0x7f0000000280)=""/246) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x200, 0x0) ioctl$TUNATTACHFILTER(r4, 0x401054d5, &(0x7f0000000180)={0x3, &(0x7f0000000140)=[{0x3, 0x4, 0x8, 0x1}, {0x6, 0x3, 0x1, 0x5}, {0x1, 0x40, 0xff, 0x3}]}) ioctl$BLKREPORTZONE(r4, 0xc0101282, &(0x7f0000000480)={0x6, 0x7, 0x0, [{0x8, 0x5, 0x0, 0x9b, 0x0, 0x8}, {0x80000000, 0x4, 0xffff, 0x81, 0x7, 0x6, 0xfffffffffffff001}, {0x401, 0x3, 0x200, 0xff, 0x3, 0x2, 0x5}, {0x2, 0x1, 0x4de0, 0xe7dc, 0x80, 0x8001, 0x3f}, {0x1ff, 0x5, 0x2, 0xa9, 0x0, 0x286, 0x3f}, {0xac, 0x94a2, 0xfff, 0xfff, 0x3ff, 0x0, 0x101}, {0x8, 0x9, 0x1000, 0x378000000, 0x8, 0x40, 0x8}]}) open(&(0x7f0000000040)='./file0\x00', 0x140, 0x81) ioctl$PPPIOCSPASS(r3, 0x4004743c, 0x0) fdatasync(r3) [ 803.823615] PPPIOCDETACH file->f_count=2 18:18:30 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = dup2(r0, r0) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f00000000c0)=""/108) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x1, &(0x7f0000000000)=@raw=[@jmp={0x5, 0x0, 0x4}], &(0x7f0000000240)='EP\xd4\x00\x1f\x91\xeb/W\xb72$C0%\x03\x9c0\x96\xb2\fkC\x93H\xbfh\x9c\b`\x857\xd6\">c\xad\xc0bO\xba\xe2\xe1\t5\x9d\xcei\"2L\xcc\x13\x16\vh\xca\xe6C\x06\x97%\x9d\xd5-\x1fs\xe1j\xdc5\x92\xd0)%\xdf\xfa\xe8^\x9c\xd29\x8clg\xc8\x7f\xb5\xb1&\x02\xf1E\xb4\x84\xbeE\x91)f\xe8\xb7\xe2\xf6`i\xc5m\xd7l\x1d\xc1\x12\x01<:kM\xe9\x99\xcd\xcd\xc8\x85Z\xee47\xdc\xc8u\x80\xcf\xbeTo\xbb\xfb\xc0\xebV\xd8\xbb\xbe\xa2\x90J|s\xc2', 0x0, 0x0, 0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0010000]}, 0x48) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) sendfile(r2, r1, &(0x7f0000000140), 0x4) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCATMARK(r3, 0x8905, &(0x7f0000000080)) [ 803.920301] PPPIOCDETACH file->f_count=2 18:18:30 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r0, 0x0, 0xfe) read$eventfd(r5, &(0x7f0000000280), 0x6) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1a, &(0x7f0000000180)=""/42, &(0x7f00000001c0)=0x2a) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000200)) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:31 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 804.267700] binder: release 23417:23423 transaction 881 out, still active [ 804.289276] binder: undelivered TRANSACTION_COMPLETE [ 804.321693] PPPIOCDETACH file->f_count=2 18:18:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x400000, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000080)={0xd, 0xfffffffffffffff8, 0x3f, 0xd192, 0x1, r2, 0x8e}, 0x2c) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000000c0)={{{@in6=@mcast2, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@dev}}, &(0x7f00000001c0)=0xe8) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0, 0x0}, &(0x7f0000000380)=0xc) write$P9_RGETATTR(r2, &(0x7f00000003c0)={0xa0, 0x19, 0x2, {0x400, {0x68, 0x2, 0x3}, 0x80, r3, r4, 0x6, 0xffffffffffff4808, 0x7fffffff, 0x2, 0x10000, 0x7, 0x6, 0x8, 0x2, 0x3ff, 0x1, 0x8, 0x3cfd30dd, 0x4, 0x200}}, 0xa0) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 804.374757] binder: BINDER_SET_CONTEXT_MGR already set [ 804.380296] binder: 23474:23479 ioctl 40046207 0 returned -16 [ 804.387663] binder: 23474:23479 BC_INCREFS_DONE u0000000000000000 no match [ 804.396519] binder: 23474:23479 Release 1 refcount change on invalid ref 1 ret -22 [ 804.422441] binder: 23474:23479 BC_ACQUIRE_DONE u0000000000000000 no match [ 804.460358] PPPIOCDETACH file->f_count=2 18:18:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$keychord(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/keychord\x00', 0x8080, 0x0) ioctl$RTC_VL_READ(r1, 0x80047013, &(0x7f0000000100)) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_percpu\x00', 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x3) 18:18:31 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) fremovexattr(r0, &(0x7f0000000100)=@random={'osx.', '/dev/full\x00'}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) prctl$PR_SET_NAME(0xf, &(0x7f0000000180)='selfcpusetwlan1vmnet0cpuset^/\'\\#loselfsecurity)md5sum\'^wlan0wlan0\x00') chdir(&(0x7f00000001c0)='./file0\x00') r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x24, &(0x7f00000003c0)=0xfffffffffffffffc, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000280)={{{@in=@local, @in6=@ipv4={[], [], @local}}}, {{@in6=@mcast2}, 0x0, @in6=@empty}}, &(0x7f0000000080)=0xe8) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r4 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x220503, 0x0) r5 = gettid() write$P9_RGETLOCK(r4, &(0x7f0000000380)={0x22, 0x37, 0x1, {0x2, 0x3, 0x9, r5, 0x4, 'osx.'}}, 0x22) write$P9_RSTAT(r4, &(0x7f0000000480)=ANY=[@ANYBLOB="6f0000007d0200000068000500010000000002000000030000000180000000000001000000001f00000081000000000000001000232875736572275e76626f786e6574301d003a766d006574307070703028637075736574296b657972696e677b405d08005c29266e6f64657600969b8a7caa83062c31ce713b1687a1054160b1842e8e9ab7d2f2a9c7422dfcf0074f4e86e23be2dc2821b95d34a95fada81553d6bea3b9e3b3ec7e81d544c058f3600f5607d01422b3ced631de1696987f5d6262ed491b413fa17c250fc6de8d84c85c757341d9"], 0x6f) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 804.580260] PPPIOCDETACH file->f_count=2 18:18:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x11000000013, &(0x7f0000d06000)=0x1, 0xfffffecf) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000080)=0x8) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = dup(r0) ioctl$TUNSETLINK(r1, 0x400454cd, 0x0) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:31 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x280282, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x3200}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x50, r2, 0x8, 0x70bd2d, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x2000}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xfffffffffffffffc}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x5}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}]}, 0x50}}, 0x4000000) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f00000018c0)={@broadcast, @multicast1, 0x0}, &(0x7f0000001900)=0xc) r4 = geteuid() setsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000001940)={{{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@mcast2, 0x0, 0x7, 0x4e22, 0x5, 0x0, 0xa0, 0xa0, 0x8, r3, r4}, {0x5, 0x7, 0xfd2e, 0xff, 0x4, 0x8, 0x8000, 0x8}, {0x1, 0x2, 0xb501, 0x5}, 0x2, 0x6e6bb2, 0x1, 0x0, 0x2, 0x3}, {{@in6=@rand_addr="d048b9f408bf3611a5c7ad88fd2bd52f", 0x4d3, 0x2b}, 0x2, @in6=@local, 0x34ff, 0x1, 0x3, 0x4, 0x7, 0x0, 0x2f2f}}, 0xe8) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:31 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0xfffffffffffffd6a) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000340)="5ac8ac92bc4204e23fb36ba71fd318bc9252fdf4d4ab5ea0029bb791e4c45d1c084058d973c442c6913c9e420feafde4bb048400524de357608f7f6c9da776c5821529fb57ae01c71eb08b7ca857992771dfcc862ba2c69d4c93ed8976b99e09ab1932726861d70937d1d456ac01c943c74b28da7f03b1fa54d901519e5910e47d3fec986edefae31fdfcf23960d04b0e94a8649eb877279dd12f4edf143597100", 0xa1, 0x8000, 0x0, 0x1d4) 18:18:31 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000080)={0x0, {0x2, 0x4e23, @local}, {0x2, 0x4e21, @remote}, {0x2, 0x4e21, @empty}, 0x200, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3ff, 0x1fe00000000, 0x2}) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord\x00', 0x400, 0x0) ioctl$BLKALIGNOFF(r2, 0x127a, &(0x7f00000001c0)) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x110) 18:18:31 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x1, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080)='/dev/net/tun\x00', 0x240040, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) rt_sigsuspend(&(0x7f0000000040)={0xffff}, 0x8) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 804.860353] PPPIOCDETACH file->f_count=2 18:18:31 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') prctl$PR_TASK_PERF_EVENTS_ENABLE(0x20) write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) ioctl$BLKGETSIZE64(r3, 0x80081272, &(0x7f0000000180)) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fsetxattr$trusted_overlay_nlink(r2, &(0x7f00000001c0)='trusted.overlay.nlink\x00', &(0x7f0000000200)={'L-', 0x31d7}, 0x28, 0x2) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:32 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/net/pfkey\x00', 0x583000, 0x0) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 805.102677] binder: release 23474:23479 transaction 882 out, still active [ 805.229848] binder: BINDER_SET_CONTEXT_MGR already set [ 805.235675] binder: 23524:23528 ioctl 40046207 0 returned -16 [ 805.243784] binder: 23524:23528 BC_INCREFS_DONE u0000000000000000 no match [ 805.260691] binder: 23524:23528 Release 1 refcount change on invalid ref 1 ret -22 [ 805.284408] binder: 23524:23528 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x1000000000000, @multicast2}, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r2, &(0x7f0000000280)="61ff3622e4ddc62b2a8cb997805d7064975eadc7f7959d8cb2ca868217080fb9d93d598c3b4028d9f689dde96b24b9e6388d024d0b40d035692868cf97b2c66817b183831a24d552ec38f2fd64c4cea1ff6495b4783f9267393107a72d6e8f7ebc8a32e53d82e50f902d53658f6e83d7bee1520f16fea3d9888723feb3c8433d71bc1d4212a32aa07c1aa920ea9e56ee7c9d6d7e1fc3d3e72c8e9e6d60eab9e40329134af9bdd6b516972903670938201743c5a11a9ef0e2e4ca489011404a0359e4237e79ff1c661e2aea5d9c26", 0xce, 0x0, &(0x7f0000000080)={0x2, 0x4e21, @broadcast}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000280)={{{@in6, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@loopback}}, &(0x7f00000000c0)=0xe8) stat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) chown(&(0x7f0000000080)='./file0\x00', r3, r4) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:32 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) flock(r0, 0xc) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:32 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x11) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:32 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r2, 0x0, 0x0) dup2(r2, r3) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) poll(&(0x7f0000000080)=[{r3, 0x3084}, {r2}], 0x2, 0x0) socketpair(0x11, 0x8000f, 0x1, &(0x7f0000000080)={0xffffffffffffffff}) setsockopt$packet_fanout_data(r4, 0x107, 0x16, &(0x7f0000000100)={0x5, &(0x7f00000000c0)=[{0x1, 0x5, 0x40, 0x2}, {0x5, 0x4, 0x200, 0xffffffff}, {0x5, 0x6, 0x3, 0x1f}, {0x9, 0xe, 0x3180, 0xffff}, {0xb26, 0xfffffffffffffffe, 0x1, 0x7fff}]}, 0x10) ioctl$sock_inet_SIOCSIFPFLAGS(r1, 0x8934, &(0x7f0000000040)={'syzkaller0\x00', 0x8}) ioctl$FS_IOC_ENABLE_VERITY(r0, 0x6685) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 805.601638] PPPIOCDETACH file->f_count=2 [ 805.670418] PPPIOCDETACH file->f_count=2 18:18:32 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x8000, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) sendto$inet(r0, &(0x7f0000000080)="eed546ea1424fa52a02f1c76fd05284443fc9724936af6fe7294f67c2ef679475b0c3352885470b538865437719fa6a43ff0709cf326199cdf111dd2f7c8fbb47b20fa9f3c2f9207b3e33b5b7a75436253c0046217ee2c64a086bcfb259ef34419d2e765b34430b24161651dceb7fb3c56fa2f91dedad6f11a7fa4ffec45e2bbbc2546fa64347c0066c9f39305acbc", 0x8f, 0x4, &(0x7f00000001c0)={0x2, 0x4e23, @empty}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) getsockopt$inet_buf(r0, 0x0, 0x2e, &(0x7f0000000280)=""/136, &(0x7f0000000340)=0x88) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x7e, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 805.823790] PPPIOCDETACH file->f_count=2 18:18:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x9) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r3 = add_key$keyring(&(0x7f0000000300)='keyring\x00', &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8) keyctl$get_keyring_id(0x0, r3, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r4 = dup3(r0, r2, 0x80000) r5 = syz_genetlink_get_family_id$ipvs(&(0x7f00000002c0)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r4, &(0x7f0000000580)={&(0x7f0000000280), 0xc, &(0x7f0000000540)={&(0x7f0000000440)={0xfc, r5, 0x500, 0x70bd2a, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x78, 0x3, [@IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast1}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bond0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x80000000}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @loopback}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0xe46}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}, @IPVS_CMD_ATTR_DEST={0x3c, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x6}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x100000001}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x5}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7f}]}, @IPVS_CMD_ATTR_DAEMON={0x2c, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}]}, 0xfc}, 0x1, 0x0, 0x0, 0x20000804}, 0x10) r6 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="98ab000500000000000000d5b720ea149b649911b5df0986fa3ede", @ANYRES16=r6, @ANYBLOB="02042abd7000ffdbdf250a0000006c00070008000200018000000c00040003000000000000000c00030060404219000000000c0003000200000000000000080002008100000008000100400000000c0003005e000000000000000c00040007000000000000000c0004000400000000000000080002008ece0000"], 0x80}, 0x1, 0x0, 0x0, 0x10}, 0x48004) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:32 executing program 4: openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x0, 0x0) r0 = dup(0xffffffffffffff9c) openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x6d) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$F_SET_FILE_RW_HINT(r0, 0x40e, &(0x7f0000000280)) io_setup(0x3, &(0x7f00000002c0)=0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r4, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r6, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r3, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r2, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r5}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r7, 0x0, 0x0) unshare(0x40000000) 18:18:32 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:32 executing program 2: r0 = dup3(0xffffffffffffffff, 0xffffffffffffff9c, 0x80000) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xfffffd35, &(0x7f0000000100)={&(0x7f00000000c0)={0x24, r1, 0x400, 0x70bd28, 0x25dfdbfe, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x80000000}}, ["", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4000800}, 0x40000) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000340)='/dev/ppp\x00', 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000000380)={{{@in6=@ipv4={[], [], @multicast2}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@initdev}}, &(0x7f00000001c0)=0xe8) getresuid(&(0x7f0000000200)=0x0, &(0x7f0000000480), &(0x7f00000004c0)) getresuid(&(0x7f0000001780), &(0x7f00000017c0), &(0x7f0000001800)=0x0) getresuid(&(0x7f0000001840), &(0x7f0000001880)=0x0, &(0x7f00000018c0)) getresuid(&(0x7f00000042c0), &(0x7f0000004300), &(0x7f0000004340)=0x0) stat(&(0x7f0000004800)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) r11 = fcntl$getown(r2, 0x9) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000048c0)={{{@in=@initdev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}}}, &(0x7f00000049c0)=0xe8) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000004a00)=0x0) getresuid(&(0x7f0000004a40), &(0x7f0000004a80)=0x0, &(0x7f0000004ac0)) r15 = getpgrp(0xffffffffffffffff) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000008280)={{{@in6=@ipv4={[], [], @initdev}, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f0000008380)=0xe8) r17 = getgid() fcntl$getownex(r3, 0x10, &(0x7f00000083c0)={0x0, 0x0}) getresuid(&(0x7f0000008400), &(0x7f0000008440)=0x0, &(0x7f0000008480)) getresgid(&(0x7f00000084c0), &(0x7f0000008500)=0x0, &(0x7f0000008540)) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000008580)=0x0) stat(&(0x7f00000085c0)='./file0\x00', &(0x7f0000008600)={0x0, 0x0, 0x0, 0x0, 0x0}) stat(&(0x7f0000008680)='./file0\x00', &(0x7f00000086c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r24 = getpid() r25 = getuid() getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000008740)={0x0, 0x0, 0x0}, &(0x7f0000008780)=0xc) sendmsg$netlink(r4, &(0x7f00000088c0)={&(0x7f0000000180), 0xc, &(0x7f0000008200)=[{&(0x7f0000000500)={0x1278, 0x37, 0x409, 0x70bd29, 0x25dfdbfe, "", [@generic="8e9d2392949b6107188ba8d5156d950145be4ed5e7fa7471ce289e2e615dac5ff517e6f1763786bb116c563ffdd71d472fe7489e04c2483bc921648f62f0a3db73003693b3776ef2f74d05a325d2617daec0792ee1a07095344985960178ec681271b22669f63831f8d3ddd600d9daa34fe5f6e2839195afd174c67da3da7e213aadfbbe3b1434865d1ca37fa765f761a88a17b5a5e76235c69f109d712631d1f0208dbc0e705fe4fe1eded76fe9a5bb5c535ae89c", @generic="c58838ec6c9932ec428e0471d33ed08357987dcb9af246e867ef08a857d40aa580fd3dac04a69e9d9bc267a446075f09331f", @nested={0x48, 0x6e, [@generic='2B', @generic="53789b2962a17fc3f321932df83883af35742ea3d8330cfc0f5d20a78a5fdd1c1c7cde719c2312d4f404653ff390b37f62b202559cbb4034", @typed={0x8, 0x6c, @u32=0x8}]}, @typed={0x14, 0x4e, @ipv6=@initdev={0xfe, 0x88, [], 0x1, 0x0}}, @nested={0x10, 0x77, [@typed={0xc, 0x23, @u64=0x9}]}, @nested={0xd8, 0x36, [@typed={0x8, 0x2e, @u32=0x9}, @generic="25fdfb15c7b601b55e73fea234d37a79d80833ad09e3accaff659d2866c562dda01dcbf6ff97bcc8b5129ec013130189ba58897039accfd01e351cfab9821b2bdbfdcc3fefcd24eb1ec2069ee5498181f79e8738f8ae44ab49405bccbf239eee7514b3a69a997f26048c5d60678f0211cd7ed73361a48f613d21cef9693f95112b57b9d818c8c80521885d7cf0abf9c9cc254cc791ee9b14b348425b6d41c7cd35faccb69eed853c1502da15a08bfadb3bd1f7d73075bc794efff931e7646bf65c40b15a6a8317d712c1ae"]}, @nested={0x103c, 0x55, [@typed={0x8, 0x2a, @uid=r5}, @generic="67cc47763bad4d48edbcf9fe90fcabd1a8c14858618e6e39c4362b4664a5024e72a36a662df1", @typed={0x8, 0x6, @uid=r6}, @generic="bd40a17ab031c5396b7ff28981431682cfa9f9d86ce0af659ebc70ac9eb3b54ac8c59de4404ce008bc952c25e4559c2dec1141a20456d6d944d6d84a7946ab37f14d355e4e80f44c11812d63d552407cff4be3dd2a4dc32831a3fd897f6051b4359e5474a00bf51dcd079ca9a45f0eb93506f931aa4a75e91fa13f9f4db4dc9989e2b39f76d8073040e29bda2af78901cc9bb601231ea74872105f72f4d66cbc6a50aeea1194ff323a86a793cbcca4415411d0b6fb753a64b0c012470462eda3654719c8ab92d96f991fc8596763ef06f13421bcc2220c7b692844c0ced81eb7f8088b77814bd79066e3285f1e3bd566ecd15993938172c1a49fdbccd99eb0dc47dfc7692e1a1c499a4583239b606045e884b156dc36f63c00f85a432d41d73c105922d3d8263d7b8a9cb7867454b56ba93cc4401813c65ae1c5c8da2fc701662d51ae6909cab8b37961a1cf49100273ec03ebf67261827e07690a9d9d8121109b3467dd97ac68ef032e6f3d784c853cd3f8a4f259e98c76146c8fd5a153a4ba037662c6f0cee9645f3455e63ae634029e1640130706db18fdbfbace3ccf87eb3eee69b06a63b4b974c9ca378abc9f71def2ad2adbbc8ec9ff60d36f25b968b8f49d542b233d3d0799ab8cc9e6f1e729b867222f68378db4aa6a16a08add206854f02d52a4278d03d8aada9f2b52eff5c9b9b77ef7f1923ca5ccb7bd80af5a7208fff49bc0fb22d5b44419dedc60e77b179eef3630c9bf37acb4b9575f21efe2644faa182223ac31e94d414800263f6738bc2bca95207f9e0af9d57cbca09b1911ab8b36e38279f44b29c1f4d53e4ed4038f33fa52e9bffc328914a10fce3ec0b38e7e9c28389aeefdf9f38be1b404f1ba950cd4bd461107ab74db0df02e964d0170dce53f3af2490c4092742b3d8190cb4419661cc6a72d3a377ece2ce51e254fd3758e93fb52ec992a228f217c4b863622cb94fd2e8be55c72534997db70d51032674d36d0da5cd19c0977ce33739ebfeecefe7699265da8d94ad97ec28b700c6c0698077067cd974645409814deec030bf251714b70ff14371ccf76970f594677a4c812f724cdc24d60828925f0af84d9b6ef10fa60d396c68c1d40ca044cc331679ac90a385857750d20bb4e28e017850c6d3b2f9f165a2e0e10201edd3870c433ac166cb0e6823259f4b8920687ea6a3e1fb755441e9427f59a92861a96b3caf962146e335942b6adaf026f13274465e45ad21e749ae6583d20cdb8f0144bdc69e5fbfac29ca463fa4f62a5993f8ac6b0f4f80695d40ed51ac13c2ca4aee27aad2231d57a208edc06c7df2f590b293acae7ef16795955a3c8c010428de6bb9eff6241661d8f14ccafcc961d1843cdb425c137c247eec86072abcb72ed761422b4becc5ffd8691febf85c0b2c429874d800e9ee288648d5115810f1fff1dda6dbb5db42505e5c9de6ea78b1508ed4cf4a28085a0c0242e96bc853bf2dde44cd804da2c4e02fa7e2290720e27f4bdb3e560cfd156bee3c36d1698fedbb67cd144d8b094c93277c035cd39630f14a7f127422b9ea9a855b239efd9a312050f87df05ff1bda2bf863ad05d1fb79013234a3002a2bd4a6df0dfb0d0cd1f2527876ef7e077d7e505ee828a03d460d2029d176a6fe057a99cd9679e0b7f0febfaaeb15fc947772fbe1fdcfc9f0ff8a00a73e1674ff0cf0d1acaaa37e16951eef0d99a7d6f21f8a047753482fa9741434477bc872bda9536ec903f0daa0fa2c6a1ab4aa9a65fc2a0b532f5bd59de84c03b9ba2e88d085748c38bd0fccec6bded814fdfcdb140af0cf228fafe036fe5ba6363fa602b88b400b62571c280683fceb1820b442d8505ffc91c0370d8ab8ae909dd31ad77b7453ababd4c8fc0e359a980129ba7d683f3924562908adaeacdcc8ba88c39649fc05c947aedd0443d072695a1e96f05422c2766ba313bb79fe94c289e83dce16fa7cadc1bff0ca469cffc5c4639c3dca34642dfd541b1cc85bf9d369fe825cb9371c95ab8cf738c15b244590ee0423bc6ab6601cffef6e9849f785aa152934b4eabc908f08f26a5b761a20b4723778896e3f4a136258528086a94533727e01a8119424ebcf9069fc6165298023e5ad6db86cf0122dfd3f3d45946cf4e0659f926b91fe1a284a1c11ca8cfbe5336750baa600951b14c4d7ac1bc4e9014ec8e3cb2a844a25c65770f1788b4261d53f09441fa9cf202f07e8be239b3fb8cd46757a9a974ec5f233e2d8fda624a5bf87d9a4db71d93ca9934ebcc1f9c4204ea9c81c4bc89eb1a73e89bdceacfaa32843204b6f01ea92251d848f59d960b54fc01675f5e2e6a4015f99f76cdc790e62ed17fa64fc762be44f62d96d90bc79aac46b0f20f347f06b6ab41aa41276a4aed633f1836a9356e05a309bd06fcc37b8302fc265130c1356efc911ab4e060d891a28508f16b4f43c0ec465d5784d55577361a45d151f580f70652473d822bc22f1867f2762f30d1370cdaf09818efaf7cae3b3e85139868b0eb42f3b053f570addf916046773fceaf13a1c9ccb3439fba7675caa78ad3fbe92da6dcb0bd183a825ba03552efb9d6df601e406add2be2948fcb2978d73d2100aa7e3eb8eb5f36267ab72a4a6ea7e20c7d0cb25005fdfd348585f1867aa974c7580b99b9a0ec21c29bdd20c1aeb2d618874881975e2394a2bfcac8b7b6442af4e24088c44f2806a919967d4f274a7dc0fe951a6fd7a4c2939698b4e10a74af4e05e97740691e634272cab48444971f8191960f76dcdfe6844202ff64cb14233e49d010e3acaeacda8855184dc7eaf271269c8a56dd8ef4a583123cc3cd773e4075560659b3db1f1953d96088a1373732c39c01e4641203f7fabbd9bbd0d80054c3128d44e127cff1a874e69496e3976faa7fe26c1b054813f91e4d295f67cee544db037bc80a6707430d69cf48c109711136016103f4402aacecc987a19cb2ed6f362492f2df6a3d7b6b41f879fa0d05047ed775783955901fa1704a3c013c83dd99a5820e592472402fe5fad83be5b23229c7e859b5c8a00f5e856573fb185d179ed145bd7b778536f1b555a9c9449970d48a3cbfdc0c7df0b34ff23b766dabfe8e6f8cba33ad303dd44fd274d50de439d20913826df90fd447774e7f5f1b082d6e80cf210f541888f9031e1ded65fb874f7db6eef19abe41e7b346b817f0ec009d5a51e7c3add6252961f4368bbc347e1c2f12115e7755da55d89507a7ede2847ddd294eaf0f772702e272f13edda35e70298a186cbad2fddec62765dc4293f0b524c2dce396faa8f20fa8789338ab3ba22298512d819d2188eebbb4c9b80fc36863938cd61358829f62e8b872d3bfb86fce4d82a24c0868a9e06580e2bae858083f2b7af8e725318ff7e779faa04035a75668d59e03aae81ad760ced42503690eea75009448245044a1652f5ada886b67f9be7190100740606a8c92dad9ef07bf8d658bf5f287252b0daeaa1d82eaa8a0de757aa77832b62f6aca7be99c65ffc39ba9ffb43094dd050915f155679250aef5def2b5a203d351a0c95238d2584c0003bceef5aab454bf36da8125e8ff812b0d21f6ba67446eea1a6c78d5c9c22df55c98208490fa109eea2d3c27397f8883e4aa093533418a1677ad87147d27837f53c628c5374338061c9e02585d69208b1c0241d1991a0cd5b5dd2fb6d3bdf131fbe6636046d57692119fe2fc0c7b9bd54cd7a590ce1e045c5b33b0c8c796d245b4bf7552a3f47d5f3e8749284255583a745a20b30cd0437eb9474f38eff52b49232e633ca546b841da2021c84546496a7ffe6940bef50119cc4301d23849be9ffafc8ddbcd8b629258e4869fdfde5def3505aee1861228956549bfd6a160845e32dcceaf19b862ac1a32f661abde9fb7bbe56fc8543ff3627a8d1119a28f3121e4a34a7a4ad8f598b75a8296d2532cc64cc388eb639b7794b16250fec1d77df0a7b76593eaa518aecc8f4176c9f3a42708eef62984653197dd598c472f56ee095315b96d5dbc4a9d34858afd100466f13642c7b383892aeb5cd4b603445e068add03d5ffb7ce437ed9ec58ebeb51ca20440d34dac6112b4f271947d0ee80e9790e9b86b517f510e6cf4c728e6c2606fbdfdd1c202591c34376a4539bbc431a8d0d513dc7bda5c2532721ea87e41b974dd1744be4d9d6df970d8ef9e9d818aead0e0cc48ca9318473f284c5d591f0b98cdd8daed9e4362542f7e9d7318837e69d0aaffe8616c7a2107cef446026d707eac7087ad24a01c33a0ce9071b7504ed7a3cbc79b7fca47494c799d7eb920de73ae066435a719b3960254a255c85ea02aa3bd8c98b7288c675435b7fd3d97a884c66226eddd6a0c483794878ddecb9c73fd1089336ce617a4abddeaef3e97005e3e845cb5b61311deb5686ce6d455c047aae15386267d84851b5ddfa9ef2d58903bcc3be3d3416a85deb42c222be194726c87491c5c4d6b0057c633071406714de2307d0b9f6a20b88945660efb5efa56ab1f89253635da7efe188fcb104dcce368f5f22d6e1ca8b883056e8ce35e55d833434e482ca4068e126e08af65563fdfb84b3ad929abd8defa7a34d9d6c64467e3c52d042de618563da41021996e0625ae73b630b666a365b67cc18246542103b092a451028f253ad6a3ea15c61be7f6d68960d38ad0dbe40d7c96c0025409de2276e3200e5d42d9254abea053ad3c947bfdaba5f9d9b2e2bcef32211346dd8bb2934c17896394ceeb66faa24bc7c71732530d0f766b1c3e4c7cee841732aa1fa9722b0163466c9c545e92d90c07222414e37009c0ddf6cf9c406cccc6670c620bb1267a8d25cc564ed2cb99c2652305005ce9e163b067e8d6ef8aa6fd83e7067e3ec652e76313f301e2f4380e41cd0dbad79bc15dc9e48f4c4979c410f0b579b3a554eda95253955748932c41000159190690faaa3f59f800a6ec169874eecfc870b68b587bba45d3c2a31b9b37360164b588305e491a50c082ddcbe6ca17d6fbc150310a128cd6d8d42440c4ffc9fe1bf551f2ee70899512c54187975006b7d6a2d22b66a3171a0d5adaf0e00eecd7b6fd64826370b27257c2bdd623d1160d3e7ae60d1173fbb9b0b036348f84c489fc394171b8a596359d7bd8b1f39a9e6ae3faef8cd9beb468b7e9fba8a5f5a558250da8d31a17dd6ef1f6b45b37ad31c5e1a07b28324c454b04543eaa646eebd3c5319e03e49a6d03ead660aa655ed920158a8f56c77a5412c6c0dec93efde1258adbf37d66f842c95c6dc8c98ecf8978ef0e5ec23ee14e00ec2bf268f16880f046ef89272f14d83149836bbe0dd5726de16223ed481540b0bf34ae011d09c1d100467b55f67934438a39d19e79968ee120eddbbf6538c81868504ded19b2ad7fccedefbe4eb2cb0fdb4661089e19d8fc41693e7e96f5fe9c041b75a6ded630be03107cfcd63f8211954233b0b62475d09de40191687bc7ef1768e4564529f7c581f5ab9c73b5d9b23672337c88b087741ca08a4400dddf6dd888919eccda9075f443cd7a5db5a3c2e54eaafefdafd4c8cf092db6305df102b9af9608087441adc38d457502e42f023a367551f042fa9d67114927677969586ae578ab712c760b74239905c1e4b8a08fb545f6fbe81c8b97b6dc57c4d2959628ef47d4d0b0f49d5b60171ea035b0eb4059f8b9cffecb8ca26d69174cfc6a2603151c2d2431da73c9ca44869daffe16a049daab840410400fc79863b9096d35257e72e0e047a448b9bcae388849c81462e1145edece2c612520db9810"]}]}, 0x1278}, {&(0x7f0000001900)={0x24a8, 0x37, 0x0, 0x70bd2d, 0x25dfdbfb, "", [@generic="77918455d4385dcfe8ec25d986251460db82cb8772f433ca215c00f286d127b6af008bb1875bb2f77b51afa26a6e9379b48a72f232190f28efd2926718c76e341d74d0b11cbf3e8a0cea878bc5338b9127e3d048c47685b9da1f828028a99a57e8fd9ee0b3716b05d6b4ccf6d7a88201cdfeae06d443966b461097590663b073c4764d708a8a5debeca1414298408af76fa241868cdc4a7f810276d53ed6894a6ae580b43f7f035d28bbd190be40714eb2b90055fc63bf828bfd52f0fe58210b01f2c1c5d77f1319a866299b1b0344fe5bfbd3ca", @typed={0xf4, 0x7b, @binary="1ad749b440554a06c75fbf7351af470bace9d391a6c42d81787b0d545425c0acfffea1ad33f1f14e18dc9ea63eaa0e924dacd50f8fa5d7d76576ce46c661e47a98a39b34d8c0e24c7dcfdccce0768f75687b1066f7e8645111534df00ca8ec296fb326760da7c0eefe1f91957894c34573a08666f35070f5af81bb246fc7c5f30deed2e7b1a8cdcbe3d1e40375d3460e0cc2b0d452e6edf3b55d29e89762ec83dfad6b868e65e16346d6858c9cd3dd0d29673832be35885b9ac069114bc6f7bb5560a4fa3523e553f3c3af3963844b8b2e99e8bbebb5d1f39f225939a20868d8c71c126a3b740f30ae0109c614"}, @nested={0x1190, 0x64, [@typed={0x98, 0x57, @binary="fbb9eac318b1a3071af56e351e23cbc28a0d390e1a0492eb61e0bbc79407170fd6a6c3f151b253efd61f98ac5e5bfd1541f70e9c7552281dae6dd70dc89cbae1fb8e0185b71e0abf8802759a6cc460b8fe15ed1ec11ba93101edbc0fa016b09d68d56a8a6df1844550c36f92aa1a5db269663fb5dbbca418bf4f14683ad6f8f55a9f511f58e2d55a41498327a075d87644dc"}, @generic="27e4c46bd49c89f60e9773373005de6945640093562adca10d519f9da09e8ed136d83d9d530b07fb81fa1955f2fdc09545214b2f44d6571e9e25a86971bbddbf737543d7e3fddb3489cd799b2c56baa7a76b1930e1250a36d67622e7add1e05541465b0f29c40b22583d2a1ddbd70861b043088901dbf0caab13771fd80469451a277945f17eb8a004a480010a109636d5d623aaa25109794d076d0c3a66457d4f0443ee2f40a4ad501dc2ecc00a2745db7cc338b1b1d669c46f8485e9d6023421de9e159f8063b4440d15f9535ff3e620db1c82b134c7bc89ea42442c03ec03e9fed89975831c91a8bb0ae65a588ecdb85b4a576a5ea7b6e7ac0784ff762985ceb01b21a22efec044110d4f05bf31f0be03b1a5e26411f2711ffe6b1f9457efbd93550c3c43544b5433c8ad45618d8cf1c76eb53216507b9b07600ca563f370160046bbf70ac9640d710d5a123f86c0915878b8aa290ce7f639a1cc821a4a6f04d154b093cea8e9e341fdb14d8f35262cc6d2f7e307d2358a916fe9536333a3211a545350f896452a500ead42bd585d08c960dcc93d09e73aec5f6bb6db0436592f0fc6b30b29d1956071a8814a97f47f58cb57868d229468e36e3d0a351a290bcd3d15310dbba85a566b3e6faceeb4d829f89384d59e867f06982332627af7790c3dfd3d78c8ced399c1e9081e549e56d8d4f73121e2778fbdfc02f5f6cde0f6d609b82f77264471c9a79685842e488f8d381e973c9bc221fd0f223c24804d9aef059e61f10528a30f87d4d6aa01487302e3197cceed6ea8069c2eedfb3d49310a87bdca9b5127739061ff5ec5bbd54571428f3f1faa3f3d84b5e93e852eaea555c44d55331f1b7f6a70d2d260848fd40465abda6f6fb63b83df9d50db616bff6a642502eb02532fa3e762e714f978c46d4a992aa717356bd3b97f691f7dcbd24ba144daa47192b4b4878cc27082aca27260f1ebbd410047b8471f7a619fd83ada68f51c92b07bd1920149151297cb6d13563ff021d766bbd1754343d9f209db516eea113d76a22a0008a334c99950ce9cb7df4e47f216d541a6fb4f4d9ba4a399c60438d6cf329552aabd0c1d3ba95cb90fbb6a05e1eab3f64e906c88b850262da3d89ffaf1dfd037f663822f0aa028b671b6d328ad8f12e553b4d7c2adea464c9c589d985f9529b3edf7867bc8f6a47c61f11b725138d37b156076874a8a866193e5be3de0ef514ad3bba87075ecb157faa6b26626913a7ed69066295041222a11a1ee2fbac4ea033124ffdd6852326e1f963c53669e5b8fb08dc5da840f790a2841a3f40b24a6782dcbbef0e00e244b044b6de68c68cc56800aa70ce0867df622f3c094a72441446a94afaf88cc9e0dd14bfceec73b0d407c54ad48b5b9e5c166a637876601b6c97fb8019b36fad33c2e38271b24b08f8a6bbf7e38fff27fdd636aea7818887747ea2845e6421afc6ff14d915a6a3715038fb4f3274647769ace40c825ae3b411f34be3d5b3c91791fc128ae3e8071e6685b29c5fc2783ac65b4af2f9cf78128d3ce5bd32b6104c31b44ce7a7f10ee5326b5e2ed545cbfccae34916942b6c2017a119ae5a4cfd918bf7f2a2259ff01ec616d0fdf28be0fdbb6f65c98b78fc9a0c252ac3a6771c44405438d70dc9d63ca87321e1f3c27995cb92cea318e7bda2ebd8f0f5280afc981bb9a67614e3449a85c626c50ec9e8664e899597f8d020cd33c28536b2b9cb48be2a2fd622f4ae2a720e2ba6f101a88360333d437fe42f6def4a36369a6c07a26305b914e4fbdd2d57049e8d87f660946748009dd99add86417172e2f00e5a265e0cf4e282c795f41bf67648ae5be7cf565640edf42d63bca174da4c78af2b45acdd9bf61a08c690db66377972f6518e3e809d26524e1ab71ee0b8ff35e4cf520634503f622b3cdc2cfcf1ea96ecf059e8a1f7ca449b1a540fee4c2ff29feb978db699e974a2c6ab8500b7e239df4f607bc971e241339cf39e2c4f03ee9c9e6c64d6dca844546a1aef477296fe852b810e15ee026d071c716b87eb999e833cb16beab485c83c64e55431e05969c0b352a14a159a4413d85947b170bdcc5d94fde5f8f4bc0a51e3c8aa9cc8f7cbb6dbfdf9d84902c1df435e5d845e297d8634df6569a6f289d9c9e868f81683dedb63a854f71fe855a74634b023b08d9b88e8b554bc0eef06a02792ee521be3b1087629888d38fe2cf50baa4ab53161312b15d89c7b060fda67de37c466bfaec7d43d875c1741147c8a142338c6f6512ce2a3855112031ed89d57035ddae8ac8f351ccd383ce307b0eab2b15adf71504eb89cc748fd7b1d60e81c7a8d0b2d7e946707553471b32c445856e89ed0e49d95f2f6e15c8e4465ca4841f38940c89ed656c754c7afd9d667bc66f757d504a55d0ec15d354afd86036bec5eecc9a6c0ef6a7ff7a4b50148a1346c8c967de03aa667624f4aa3fc3b2a34329e6018bf6339ad5b506d4bb27034f6fbffedc5607f7ee7fb2c5222bf46dca80bfbc17f7641ebf72bf072240cbfda377cb5b159ed4e9ecb638f620b7d34db9a31cc0ad6e8bf5773ff273eea4407bf276d5b657398cead7c513443a8536bf2db2f8db8766c3272e9ae861bd9be85f409d5cd81faad5a1adf86908d152c260049a77b27d7547e479d871add61afeca9b613a874c0bdd8aae95b6aca2d1f65cf46eedea7c1181fac3687f31d89eb6f3ad4a4bdef5747a61dcfacb432c067dd250af9225ec65a6793e7812561e9b496b3d50f60e4424ffe8395a8dd9927df3bf1a48893e449bfab925d58a9ff3d0542211dbffc3d28e9a950caf1fdbe3eae75fb77dff18d5e502a19e5c7de08cc963d6eb737d0caaf1c9e0fd819c02739e406c49f11db37506c5ef49a69093230351c4df9296773ad1914c518b887eb26a9d4fc4f2cd0f7a1b3571f522e14d97795b148a3e3798d7b84b51cec71d52023a65e69a2e007f83e6b5485796a4b0c8cbb253b36297d12069fe9b8a7b913efb2cc385fcde23ec5a88e7c258e87db979d0d71dd468e579ee854e0072052dbc6ec40a68cc159020a90b46ee12102e3f8032b4c5acaf13993d932593ac21f246e2389b5c7190c6924af060f7a4b4708cb73d4e457493e31f94517875a377cd23774f89d240ae85d3bcceedf33a062e10a7c2f9026b455e363559a0e542f1491a76a5a763a3d883d076a978e006820267f616ae2de52506ec271ebf62d00c7246c4d326085b0bab111834df2f4d73ce16001105bc33b9669b03c05b96db5f7ae543fc638783a4806212a6df87f45105d3cec7f5b0958dbb34ee7dc59ce719178c8c5a2cff58b3253923ceece62783cdf10d293eb555592dddd68adda4c70a5bc7dbbd387dd4721fafc88588bd0d4983b37ec72a67fdc83a398a2e71d47990de9e704d1d90c0f12893e87a7ac53f64781c61ae40fddea2cbe85935f51eb3255569c5b7f2e277a58b9aff01ba532e9482afe2ca98dbface69e53c1f920eef0ebc41de7a9e53e0eb466095db35f24d1425a33e751a24347a36d2df9a589b88f1b3d0e29d1eee71582fda48b754634ec12322b82d9855adefb77944f00b54dbd1c52f6d74e9ffdc784af252ce97fedae26391e10e3e6458521aef36181d198ada4c6094f3d11f05bdf7ab36fd79806b66fe6eb6981e7463836853f1ac3ceb36132ce9bdb627ac2d94a69119f01e64f965f9a455f0311872d5c0d02bedaee968c38641904e9688a6730ca3e39c79274b589d7fca2d81170f6aea5a8059d2d94896c8351e1c16ef59cad7b455c0a066f75add7618cc61a7cff88a004b34cb488c5db77b57c695da2bdf224ece0e7d4cb558d51e34770aa5450f77ac04fd9d44cfbfd37ddba65094ba1dbac36d23e1eaf66dc73612b59772bbc56534e6e3dca8f77bd0936849dde73ac59adfdd26886aacb63033039763cb9e85f16d6d6d4b01854008055b54890ae67381016aa5e8b0084b5d7c6dbcb95d92bf97de44ca433b75a706dae06ae17e12de25d6bd240b571fb8eaf4238ef63c6563f42d04d7e3bc72b58075135efbc24de753defd698d436d387b23ff6ce30cd13481cdafd852ee716babbe777cf98d231ee7d9040a1cfb5c37d98652950aca410d0e10633f325586c63de17b2db404bc90cdfc015fe1c62b4d6a97fd13cdac7c15ffc6321a5c877f0ee76ad044cbba5bf431adce381bf2cc5a4fc5a5957ceb3459bdf8d9acb24556101fb1db6df5de1864bf40328cbaab8e52735145060d4d5cf55745f1dff85a7bd40c38832f465864e4594eae61a91b0d6f983142a946bc8906adf314d2443c90011ff5eaf579da712920f06e27c1799507efead0f33083d84f59be20fcb3d8bec58d3cf70b0f9949d8202dba79bc914f9a4b4450fb8f15f948b0047116c09448d289cc92417c6894943d3de5593b317e95d738a2acb3a8b1056097cf08be68143268e997e86bbf841c27d39b47d62dd0d4fc8dccb6e051df3d0d1ef12223a6d5a9986e7a23b50f8739b9450edcbf9ebb8534f3799aa2188724e3bea83d4b17da5836284d24c0fb4123a619b7507f55ed79b33c5a025d3e8f1bc55c9b7c2284b6529bdf133b1d225e41fca19553d3fd9ef490e9de5c85044902bf3f99046603415688926e5bf6661834aaad059146efb5594a2404e5d71650eee4a4837aaa3678c4ebf0f8d783729cac547c02921ff994661f546df59bbfeae8d624ee0b6b91396885cb902188eba19312c7e202e6aa4686fb9ff18e7ecb5fae0d07109621b30d202eb38d2ee2c9db94278e2bf9816c4a79068c64f50d1aed8601abaa305ac071869b328d2cb7991c3306ca3db7b8c7b472afd5a55146fe7f1cfa6b9edf834cd4d6afddf7ad35f3300514cb42fd79435ec09ebbfc705f1a737c66bd1cf29831533cfa4851755cf0ffdb02e0283581b950557b36943031922fc3f156f1093ff0c099372bb8538f805d76f4ca67b7787fbb90d8ed751e065f306d525fe0c7a859c4dbd60b179361419517fec09f7bca9150acee86a63b08727b18fadcc86219c5fe9cc31b69d09f320b829cb2dd9e6d7690c789908574c3b8cb5aa52e28b5d8760ab318fac262d4b323a92808b0a9b7f9e3adbacbd19d6ee4e0f9d804a7da5d627e52bf7fcf38e6e2afb8fdbc68bab22f23a552705cd4eb6ccf89873c606f36116e6a6ef181ddd07e440d7770d26caaf0c861706c26bdb08fe875f127c6f190778c42aea6e1b5eb8fd6a049b5e55a70d2e7201bffd887c32e3be10985e10391c215e88d30fc79d9f4afb0b94b17572316c72b759df4051d0ef55f73d1e9e69d95ecb83e131f00f0b5ae56978d9ec8360fc5bd2603e199a56fbe6a94e6ec8b5e4e2853fe52112a2d8d98e9b2603ca06564dff8cf50a6baabe96679d6a7feeb92a4e987d43baa663649962231b12d47b7073eb1d91e1ec60f2f4ed0df372fff2223c82ba79ccca39721f9c8fb3a81fcb3766a9a9df65747671eb6e3e9c20c16acf8506c3f2927c80487198ba6dd95edca13bbc977c365a64e37d0935d803612f02bf30e954b48e046871824058acf7f68ca788ebedbe71d9cba661b32657c3efde3594e2c008daea85222fa3dd42aad9bd6fe88e2a0355f804b3ee4a75a4b070e7df315d4a92ebb509ec2636f357f636fdc3b1c74f1260994c77bb15c647c7118959d625e02caab9e3942fc2ab089a2ad52089b8ee36465fe70d2a9c2356c21150be6749a1db0168cd574d336d7e466cebd0ec70efbc37145a10afea7cf53d5d1b9a0da4121c503ababc46859fedc7fa4e2f965be", @typed={0x8, 0x85, @ipv4=@multicast2}, @generic="9272ae476ca5439a46eea87edeb3a0191cbbd202c88e4b27dc012956775241a6b58ab889fc36b5a3893dd7a7fda43ef2e5652f3a7fa013676e3fafb2c8b07ee5e09304d959b96d463a1fa38880f37c9f1bbf0b9911e2be532e3fa7f6737e9088803dbbd0c0638e23e20f3338e1901419fe9efc92894cfafee4ae870f1a29bd08b1d91b422f043ba00f14fe3631234686317d192720284aa0cfa4b575de46a90df6cff687d8d5f2212ed02661e0f70dce84bf7b3b86af3423f1a11a193a94b7426f9850f4d5111c5ea790ddf3fc2b027472a57345c8b77e5917da7528", @typed={0x8, 0x64, @uid=r7}, @typed={0x8, 0x85, @uid=r8}]}, @generic="bda31416ebf27cfc35c679be2c171d06d73a2a86d14df6a631b1f32b47e9609ab241ac647c678e357022914c7036a1ef750c5ca274cf7b9185797a9d4b9c78d1a1d1c595b6f7b7f17a899d04a6a333282a98a4763941c650ac9a196cbf572d92d9ddf8d42bf21d610d1c87e0c8a5da87a34d5030f8bc2c894ecf3d40c6a283ab14f2d894d1799acbe4a0816d58285213c361bbd62204292940b891cf11c3a140452ed46f4f0d", @generic="0485f4136bb1edf307589d6dce09bb2f230e5b3268cd5e81ed084e9f3df018c2765777ce199b33b9b876aaae9e5be71200aba22df612072c26b3d87b4a516400198d1e140864e1a6ae28c7303f0d89fb421842e2c51c549d35e8c4e593cd1d2c291bdd4267ce644f7fd88137", @nested={0x102c, 0x8e, [@typed={0x10, 0x22, @str='.keyring\x00'}, @generic, @typed={0x8, 0x7c, @u32}, @typed={0x4, 0xc, @binary}, @generic="8001ed705768571c0fb2ed0fd96bc4de931eb8207af1c6b7d43fc120bcde01bafafe816970a2b3d1119851a1103c47d68d07a0b9d0c740b5a270012224bf7c61184484414b49c980147131810c800a9cdb7aaa851ca6dfd451dbabd583fe985c13174580ff7ef585c3b0e42c147c17e967d1a5af9acf4822ad57c4f11a5980d2b7d5af5719d5cb27319310489f6e59c88aa8e5d07e2d993128bb55163a52ccf6578ef029980e0d105d149ce139d4c7dcf8ed92200497c9c6d8bd1d4bcc88c1278adeffce61d46f98b42d373cdf80ae27695e2bfd2a65e543899e1981a40f3225ed841583afa1664b21530282dc2ee418387725e7054587e76a3961bdec9e9312f0b436aa4dad6f204b440beabf296d30e0737eeaa51ee1154827cff3e714964ab0e0155f512ce4f1febd9f5cd2fe8b6636618cb6d99233ff42483a40171c99e94a5d83323f4a42dd003ee9d2c3f58411170ffb76bcd4e7ce27b8a559aca42480d61c41fb32b6bf4c93a9093daf61f76d870635a68e1b05d54d688b6cd061cc48e224fd2ffd6a0c89e94fdb70050d3115a330707a3bba56387f59e6240c012a30eb8fd20e1037bf6943ec5d965c69263c45650fde959c930224c9c58ad5402c654ac6f74d4f27a525f9408b7ccdb9900fc6c7cf1791d72ce767cdc96af698f659d507b9130f2a1088717fb121adcac30ba037d67983c92f845f2ab8e3288a56ab497884afe2485dc9c92f56b55a218657f8848154d777c94c63b2136f3a3f02ee68e171e15b76030cea011461cdf426a5374fea1bcd91d99b8d8b470bf62c0f8b9f8482bcc58ad58a4f5e29a199e728d30b630ff828822c295744416e2bddea0513057f53de13f1f68014c87ec57083b79f8e3cbbedf96e948b55c9c51cb11bf26b0970a54941ed176e9e0a9ba81837594f83decef63e1faff9ea71ff30826e4a5a2872bbc4053a6ba9b1dbf2a4169d05aa9615eeb5f00b1044eec1e095f5c63a538be50e5c8a2157b308f5da06ec2a9437f076911c984a527cbd31a5d54e8b47e5761ee9ec5cff5e7a781668d950608102bbd73840a95b3944c696ec737ac11a9a91616e8791d98c98fc0bf1b7f0674f99db998846ac0f3587e67b233d1c481136f752e229460f7d7a9aeff2efe9666b4c93df9b4741b98daa0482b971ff1a13294cd399bd33ddfaef8f0e2339db454802c56c88014d7240c4b01b153f2cf91887420e5ca597a3776e622f0097980ecb7991f02571c0293a1d5008af925cbb3398b5ed8ee7d2ea6c522bb29bc3a7175153f8bf49377d41305fa8df21b8420282b6d2b51d18391c20ede3bd35f5b4938659559f2e90abd361234e0b8796c9977322ec9147a5753c9fb94e2c71418c634d418832732a615f6fbf3e74c63cd2350db8341f73fb292133a2582e37b207632f7856f05aa343947fb7619c236a04804b11d4cae87000129e25a15cf3559ab6067fa96ff60b1b94fd555e86e032e355b1169028e8b0ecd10875136348ddce2c0fd8050ee3ba562d774b4305e58ae6423c7206a6eec657ca2a0d5b263084340bbb4b00c65762edb73d24a77236ad90878ec087744fd05e173b6f1b657637c684f29d0996e5d46fe4062a81d16a3f998676acea734c9b75cc143b32b1d5a4b901f38382d0ba20c06e78f89a36a9c7d333b7d6d6b485d40d07908e88497808e0150de6c6cbdea0446273652f51e813dfbaa68cd9a97d4282a25476eccdd1f7198137025fa77f401309c8f4821348225c7ece57b12d7cb51878cd0dc9da1dde742c8491960316b21bd81b1e14585eb92151bd58ea12b55fdeaf3d309254403a07092be126c37fd97b10578de781f1e91bd50a9265b8cc812d7247064b398ccd5d788ca28c214580fa3f4ec6a7b9389669161185f7eefb3fb9b4a8ef62acde35eb6744f74a3fe79821910ef0a3489aaa454fa54cac6f4ee83c79503930992a2614e02069590fbafbe0949f22eb3ea39280d7bae9f0ecbf2be3ed5fa01a74c153a605d30a8b86ba8d54027719beeb22d5becd2a3f561c8deefdbb5d0706be70850d1b367c425fb6d2464dcc41a99e88a502f99d4ff423707643bcd1d5942fe98121aa33387cff1a3e6cbcbfa47f9b602db34d19ecefee8f522b805cf3a71ed7f039aed2c716fb65f9f748d776edeb925fe1f6e35746b41b4fce3cc6fedb494d134da8ab13f718a3613340d38c3b1aeb0ad17b2c17736d68f4161acaa5b959c37e4c691692c5d9e32de19c32857a12755e026b31c1c1001d6ea22ee1a7f4df6c40fa988e687651923ed4386b0a8b8517e2b6377818c132afe7aac0b7af4d979d34614ccf4fbca37a6a7c39cfaebf10cc0e7cc6f6b19242c0a6cde90ab285331b71bf8fafc0f7d3a616595a38a3a5fffea795e277dab17a4c12577f0fd33fee7057e07a182b06ae7f7aa53be0057a3d6c000c9bdcbdf0923014ea82bde7a620d54e29f497a6e6d9f7df5b4ae653a7fe6f830898571eabc89b900a81f8f156553f192ea6d09cbcaa0f4fc0a379f62950e5aa24f085a97b9cd0730088d760c066f47375eedda922255460b242a1f550c45c2ccef43485bd755b250387b7bf5a0c11048b097e8cbff3ae7cfede0f4db9027b1ffc1bc0c8c0418ffca6aeaafc5f98f0ea8a87fcc8c4d7b23946be4cf5ff53998d92b8f1787a2bb070ed1269fe5eccbf1eece1199fdb410c2bf8014e9f313f81b80a6bdf34078924a8dcc43f1be74bde2986096883d3d7c3bbe61cafb26cbeca8487d115a6aef31360ca024a9b4f8435ea0fdad9c21a99126ea4666fb31bd999b5a686c7c59a5497bbf4f574109ea56381e12d0536cdab8d10a989a4a82649b25526e4de8792a504dbcdbaea00c768521588dca3e3a56655f092829ab6dd792bfee659e627b84a980d0b1dab80b499d5f2c55a6dc808316f17c0cdc980fe490bf76d123ed1cc939c981c831736253a467ed7012cb084d8b3c7e2c22b365aba39c552a4f56d7a4e45d9fc5ad1b66b90f3b5cecfe2d7c3263a86457e2598e8f2f8d2e16ede427ce02781750cbd283f4c66e7353dcce8911d8ce3b0c19fa41849d6919a19f98d0c44362246c3a607f8f4bdcd2221fea40eebb705450f49ba2d5daae194b8ca2a83f04566e9c7c4a492d8fec51d16398cf84131e898360cd6206766ec2288f29bf4c980bd2f5b15bd4ab90efa0275d5836915be14f5c4a433216ab3df47d8de98788d525bf9b33b2adc42bb72e5d5a4d65b39bc5e36055d9000c610e7f800b7545ef278ad6fa155daa54dd00c78ff84ecd538c43d48eb2326bd209ae28ea1175e5a384659997eb570a1d49835ec04b924aac373f7e202d6bf3595be4e172e20d8781f68be48dab4818c9ad4686c2241b218899d067c7551fa07513a17a653785e7393993b0f1cdfe5fedc656dc0be170068d040d9c316020eec9c7935db6ac2895eec438f6b6880f9b12a4e629b18a5b881bbc0340055105f0a7414bae8e2e9bfe69de75db4ef0ba8521e47356890808f01362a8c2435bdc3f72b66917e0f8fb4b7a8b11ffa01356aa2e08553ce3b27cedc00f579be7dfa46fccb721966e1aadd0d8dbd9bd834df8c7fff9439e8b05bb16f3c483878a965a8e8a7c74343fb7c53c96f99866080a0ad1536b01fc1d1c2d1ed71611c13df5470b33e0376923fc51f416cf3b933bcfbc1cb21a17b1093d7e40ae748f0e23d27dbb9542abe19ca8c4ccaaf9e40b1cd029e2887aa472aba12c63ece0ffa40e39191fab899bbc15249f9fcb097a82428f60693dc440071131b8090e3aa5a08d99ddd2e0ad4d380ff8fe39304695c5ddb4d2748321b5037071a476112b42652969edbb4ebf0a00790862006c694bd8fd10c7bf0fe2ae289cbbaace520242cdcd988f39b4af028a347d3fc6f29b79f99e25dfc105e129cce4af821d2448c62e199a64db47972206cc7c9341312223b3c6585f33aba99943a6485b8c9c49303aa21ef0ce92ae029f1b3dadfa2b5a231003c4df780e76de4597c877494fb5732bd6c56c1147c22d2a8b46cb79b6e2e9078299c9f2ac23805ec68c32e340081e87dd8f01c2c7e00e953ef2b50715c4342a31e68041d75c60f94bda0e786860ed5450f5d0364386ea348e20e70b8b67b7e9b96bd37dfcbc412bb463f1f32c1eedf93474eb3262dbfd2a2897275b8d73c43d9be493eb1c640c0d73a233aa707fb4b5e349a82bc0781327f57df9266c9d0fd0107182b7689535cc248439eaaa4cc1133e1cb13cd2b15d03602292e407f5c3349bbbf87d000b8b1e6ba483ccdaf027ab69bf04a988994ed0691d4560e15d4f7ca6192587802dc0d3912804aefd44723914dc58f684f74827723246c56b02247f3b6ca412a315f49ba7242dc15cd42c767bdff4523e678ebf4e9303f1d451a5134f2d7f9a29acff00ecf8349b890e8ed0e7370996b9cdb9ee69646d0bcf29b591d5c64701bc1b8e999aea09b8cba95bbeb09c650ace4b8090b101069561f0d6e55e6bc7239155830740ab3fce219d38f5df0077175e24257518165818c257b229c8f0919d4c8a9cf667a6e7c5d01c71f8100990392dc855a8b6386edea4647ad1861d2c209674eaced921d1d6076c311e0929812e30f4415af0c423f4f414df03929e75ff0112b87e45182ba11ead9650de699ee91a4d439b0769edc40360c605603c3397db3d9cbf520d83568c23b268e693c474368a2e39ec03287118391d6f49ec9b58d9231fe4d31d00a8d7addff217baa658c1b5a03918e6eb205cd6ddba9c4ba0fa436824736ec0a0283aaa8fbeada408b7314ba3cb8d703965bdbcb24529366aa53043015036c4f0f954ff5467b0c694e9afceaaa9d738d43512feb95f73801473819c911859285a465ad52cadbaca8d0ee5be800e5e1c24e6a11aa4bb8fa903133aee72ebf15b09a810d0ef8fa8cab3598d5b2fcbe92cadfd8a0436a3ee905b77858ec19172b4b0c74f81b8dbc766537fb770a968efc03d5d4dcf55fa79dc978dea821005bef2c74013e20e13888dd0e8cb0e4ce1156c73b914d2eb22356244bb5d265ab73d4b146e33c816b95f0857f41fee65922d4b23fff39bf3d2da695b3d097c5652ce15fdc2cdd95c5b8c0b196e0a3636700775f1089e9ae26bae1027b6645cc40bdd9ca3c61084823779a0e5398382488d80a42181857a2725d7d32b98d4f22f44e3821f36aa3fe5d721723cffac887a83928d8a5c0b797e8fd454e947ff946a41cdf4fa31193f65253f77e242db004bdfab5d2a2ea80ff86bdb2a54a6abe4cf6d0682a7bdf52feb8be2893fbcd0f4dcdc505e66c8d1c662b555efcc7f651bf4bab5f2e579a6e5c2f74053ab19c3061f7292895a12c8166717479e89e4c54a87fa141f8e5efa76c5350ae0e3f5a20ff7381c170b89a7c60bc7041a2b2d6357f4b487fd2243d586dafb3bd59b6273a2cf00ffac29b8d2aea99cd68b38ee78faad4eb40f213b5c34a9fcfc6b978c215ac74716e21ae1e79cecfee9f1fa2a80c2b47b9833171fa634fbb0c53cf94203a7e7db75cb50a726e689e273bd48b06720319a9b140abda547e30db9ac576213032c1b481bf3277fc79f3fb3bcdb1622bc6d4d9093265209db6b964a7aadbafd9fcd7328b9255707e6fa0170d06225bb0f73baa05b8554d927cea60fd3d185f25fb04ced4ff8656aa77514c25d3e700fd25503a14147bbc8363e137beac96c3e1fb5cbf39a37f8686035367754c72ca6642e68aafcdfa4f7e4b411d1c49d7fa34548d60649063f699f3254de0df42ed424ebf88315bf1c5a8755a491c763a8789323edd135f", @typed={0x4, 0x2a}, @typed={0x8, 0x2d, @ipv4=@empty}]}]}, 0x24a8}, {&(0x7f0000003dc0)={0x4f8, 0x14, 0x200, 0x70bd2c, 0x25dfdbfc, "", [@typed={0x8, 0x4, @ipv4=@rand_addr=0x200}, @nested={0x168, 0xa, [@generic="f25168a39847f4d9fe8fadbb158aedcc26ee5cf13fe49a91acd6704d950de6955ea2145eeb100cc131b3add2ad55c593c74c3919bb4fcec4719a662211207b1abab0fdc7f45db9a2e73a26609f5a7f39d045ec1dd0adef05d96793b6cb67821a493cefc76a295508e9696ff5ceaf87a65e7912bad533536c602786522c900a86183c0fdcb4137cd9564ae69a7923cf233c9c5c51b87a4e0408f4c267b496462b25f58bdf6fb5f552b24ee1dbac513a1013c56f9de80e2cd4cab946e36d8b47d5dd9e0c6af91921b038b0d4691002700a7d6cb1fc33b7fa1a2b20f8d1ec03ae71c87ac8d4056e", @generic="9f4bd99ab7205896c9d3567d9f4dfbcc48f97e84e1d3d722bb70a4fc1c2cd8c9306be8c6c09275f5ec130330c3318ea666423ca2a435c1b866e06fa6032e3a617390e910aaba5a07cdc4c27c65dfdbb0d1d24f7aba800d4d4b7eaa141f9e8ad1c56afa434b9ff9d11766083a62c657ca220eb2", @typed={0x8, 0x35, @u32=0x3}]}, @nested={0x2dc, 0x93, [@generic="480325362157fa765c7f68ab78da72ea0cd008d26102068ce1b9a3ce654d32831cf0645108f5291b0ace4255b29e4bf639650632dbc6da914af9f9f512351a2d469ed821c8dbaa778b4a28daea5a6c710e0c8966dca74f87a39416418bf07f1c7418adfc4733764457952c3aac4cb2023c374869d0cb20583cd22c0b2ccb9f62814b537f8ec6dc05dfe0c724c51b2614a845e8be34050d1411b5351b1c6a7de0d87281", @generic="d913d69151f34a97d97bd89ed905f14394cb6e91a77ca75f51262077fbb2270af5bfc2bea5b0e7b0bbc1e6337c7e7ea30694bdabcd0a41693d34119c0364ef60c831914a3abaff4f2e3bc4e677dd233c54df84873e73c57c92b6d8f652c1c217bf91f9e5e329e7334b28d5fbb0f7e4761c8d3ea8b98167c7a9375ba7362be3817e204792b66bc2c206d46b5717c4f0637463ec4fba5f265f8d50d0a0f8bdfd4249f5db87e8c15f3c8a2217af0ecdf0786350d5045de2af1daed8d23592dc926db1d59fe0a4f3f69f6d5873bffe47766a039a81f4f17ef2279bb60b31faaf1e67124b7d315e0b7ae1c0f114cf2c2f2ce001ed19a550650d", @generic="df628bcc2cc04ce2f1b0c1a014358b2d188947eab54168e39143434d270192f4a7f997aaf1f4f20693e85a7c8216bb4e9ac0c3d44cdf2b4d568b92fb2d86fdb78d2e2dfa036076deb6791c72075d9615fd4108eb2aaff33e277e5e3debc281bce22a29b480c8711697ea68ae1ac9abcc184b863cd26dd11a98c6aaa6a54d1227d8a6ce00719ef62adb89266495866533092111316e2e2177f25ef8bea524895e9e8e66c92b03c10d456fd553574b8bad3244ce0195f8dd8cc4a6830bffc6dfd3253ce62f24eaefbfd03db0d5bc2208bba8da07f3de99fa938e43ae094128238a49d710063da0860d69c34aa31d3e1dd41b1263d576f9f85c4477", @generic="950f0690edf1f50bd6578d37417f3abf7946560668c868737b47f07708f14d9094520046c6868e1e2c85bf78be7def9ad904cf2cef626775124c2ed8c0f4864722"]}, @generic="ed3f519b29e40b2e1db05717549ba6fc76ed61ff11748793ec9438dc843e6e887fe546e203c3cad07871a8d5c53e5a5abb301af71594dfa83f670f0d6befcb4313fdae46c72d94d83e779156600ef95a54254da37832b4d5a89468ced3bb76cf0c8501913660b2c22c19f80ed3604d45166b890580e2469583e29bcfea0263a384059019558ad672a7d06b3e4aeeb5ced634caa541782d6789bf"]}, 0x4f8}, {&(0x7f0000004380)={0x480, 0x21, 0x1, 0x70bd29, 0x25dfdbfc, "", [@generic="03ab8eee7513cf6018bfeed4e32d3886acccb826b69ebae16d6e272c9295242e586d51188b98445bd52551e7d01cfce8ecfeecc5bf440efcf921c707b46a3d7017358f0f00279e81ce875eca6036cb6f6807138d0cc61d6b319c16feb07e83be2b604e7b08874219224cf46638548ca8", @nested={0xf0, 0x42, [@typed={0xec, 0x68, @binary="53f265220fea1b27c803bbea26c9ba8a8c06e74a8d7214831f6a3aa51854179c27884e29ad1956e92df21b9bc664e9b8b7d7f7afb085758830216a05bb909042786ecaec5277977a30fd31fd647bb61aae29c0d8feea6f229d1c4d75b85172c75c9dd6a6699c6b53b78eee559e03996385730f741995d3aca01e04539655a69c1c4729c8042cbf48e132777bbc8e58c03243156559f54bb27a6739374c8c9fde639ccddfcb5c2df86a436be0506028f9f3938b22f4cfb8e02a7f253d101088359dcf4b4b9d7f2f30cbfe0e5aae350aab2263fc157ac7e4a34187a60d04770ea47bfdbb2842"}]}, @typed={0x14, 0x7d, @ipv6=@remote}, @typed={0xc, 0x81, @str='TIPC\x00'}, @generic="f91c7e5e88c80d0a60138b036171ae37e6d4b659db345c18f3e8bc8a020c9f065477cb588273727d43a1d0c251f9b4fa141214ea4e3a22a1ead6c12af82004d371389d1edab3744f4501a2ca40caf9eaebfea989c201e6573fb9980d3f695447fa2dacd8079f2b7f", @nested={0x88, 0x32, [@generic="ea7a1e9c5041fc4cf6bc285979686f0a75a1ab7a4896d9b9161227f7a3ebb288d12f49e77254ccc4ce4765bef1fc4538d42fbae3ccbe5a4ad278823b416eb497667321438a9582295a0846aac48bd8f97d007fae11dd25d8f0f1850e9e6a963ad0b5fda1f18c54ee6e11053d237fbff1c415d5689bc8d1790d53d9bc9ec44235de"]}, @nested={0x1f0, 0x88, [@typed={0x8, 0x81, @fd=r3}, @typed={0x8, 0x15, @fd=r3}, @typed={0x9c, 0x6e, @binary="01be370d733828629226792ab42bf20a202d131b95378a1f89702dc1248eeeb2472f039c542e0c9b2e89d93f626a9860d35acb41a239a5259ac95c59c83b74a884de3edd63cb99ac1c0e1f437582330824ded30115f66579b4af9eb29ab9c6f8ed6372556aab979375867d3317e8bc201112314067ba2627200379b743bed1a2b7391c5a7d7423a7e061a251fdc133c21cd9a0250510d2"}, @generic="69daa7c08bca", @generic="0b8b3dd00f8d964123707ff90be00d4affe86d9796525bb1fc292c86472baabbb2bf02d5e1bcead3bfcb692b9f5efe55c2d5571d0b201b162f0ab15ae0789a01600f15aa86c46220004e45ae72d9837dd5784b219593c67b8cada9229fa45f23f6897618d6dabfe0bdd8abaa50a1ace09a0a89b2f047356800d1c1306a18c4a810d7be7a1349d7b05d7a67c560689c13d48c0ac376d89af903e17fa659", @generic="49a02b01b330fadde85d29ad23df6bb3f4373e00f5c510f6dccd778fd30f78569f5a976ad7f6f7506f75ecb27af30275863fb9e5ba34605c3e5e0f09c0f3834acf5f416d9a7666041c818489cb8da337c5e340760afe201b3b5f3d2b870916074cfd0caffe9971677d884b965315c11d1ff5055c6c5fcf", @generic="2ca75285497d54748a1812dfe8346b123c547dea175d4484ef", @typed={0xc, 0x94, @u64=0x5}]}, @typed={0x8, 0x1f, @uid=r9}, @typed={0x8, 0x8c, @fd=r2}]}, 0x480}, {&(0x7f0000004b00)={0x35c0, 0x23, 0x308, 0x70bd29, 0x25dfdbfd, "", [@nested={0x248, 0x1f, [@typed={0x8, 0x35, @fd=r3}, @generic="ab893b0052e5aac7e5226515709bcfdfef0aa2c4f7d690c8f0c42ee378c0afe21678272c60a1921c3e3baa08c082af002294ecd6e4b6f44723b875fd639efaa9f69ecab54b5414440e9fbea8f76fdc1bbfc5ed0804670764d3bfcc57f62c0ea9cb809b917ded93181e6390be92464f66dd181c43638663ad382402374e4484b6871688cb8d98d2f2dd03aa75d54db965b78ae40f9ab1391558a0782ae4de0cb70771dbb9a8962b1ef663b459c1d5ebc33180489e691e3b0740ba1d218e4d2897bff1dad69792c484517d54c954636c67816444e4ea101d2a586d158103e65adcfac2b5609c2030a39b26", @generic="890fe5c9e341297c2a7f36a23f1192680512870a3e16f499861a46e8070a5b69fef2d26880028721e879704271cf0f3810402f03e69319dcceb050a8ad9dda8ec8615cc3b183b0df50e8c8843f0c6b382b9b73a9336baa", @generic, @generic="32ddc3c40796bcca2ad578c22cae3d12813e4f5037a9920865180ab8970242bb1cf505190b795dbfb8da9172b2a40ffb30084d6655c8bd7c72b4ae3a7c5bfea79aeee9c937862c0e5641b048cd324e1c61b97e96413cb087e9257c35289f197521fcb3af6bafefcc551c2fb2954b3a32c2f18449df02cb7e7e554e68b7ad6ebe42", @typed={0x38, 0x78, @binary="04f29417df968070a7e9b5e4d6d8cefdfdef065fc38052d581d1713a3e46a4ab5974425a32b4f208411a6a29577a453b7d025e"}, @generic="94c6fd26f8d6a305992b8796742a326261e7c335582edfd37b51f18fea5d97ee6e3d6a4e502461add28c9696176578da878b763b82c8950fa30efadcf8cf664d3105"]}, @generic="7a87236bff35bf07870e3cbef512afb21ff8cb7cba238912d0a327f2da1f2f27b435cc5cee9a8087c7709f94b6b4fb21f284ec187b248ff1dfb903f08bfc66785ca953566aa282a01373a4fe8de3722d24f6c3a296c48cdcd20dc559295bb100019d90ee8d8499fb5fe6cd1728c15936308b5ed209c3cbb3aecbf05538d3afbc1ae7c1e1dbb216efd170f591ad3d98ea003daa747805f7cf97c1556cce290ca03fc8e57380371248a6d7ed6430e138d8e215f7ee3bd7786ba50f8c76c8f3054cea71f6e46377854218c925d1e2ef94e6eab1799d2bf00ce8f27ffcb6c4542ab7bc72c4be8c6f1ce7577318f25598464912d9c14af3bd3a313e45b132109a5c056509bf8ccd8d317f38e1f9b53618ac3eb7917bbdf21a7ba80f9269a5bde8e41733217fed653494cc83a0b260021b4e330d484ea92a9feb2935644a2e5c1710bed27535cb6864ed1430eb253b1b267010acc753a44d6b6e7a21465067c2957a2ff84fcc3c64c273caee534c15aa6005430867b59aa62586dbb67cdcd230343bb6f6e865ef45bc67daaedfd43dbb8e9c6d398c9b701b580d14966b5fde5ae4c3c4f8577f5bbd453845ecf97bd3020f66bc2729ee61a8a8d72cbdc7d4a1149c9028a5383127a1d022b39d680110bfa7f5d0ca68c7454d1b24f4005b32deb344d94ac6d291ada21e8423c888006c5eae090e8d9541c2bc7b757babd8c5ed7326098087597d6ca467009564f237b9732b05855ce04ffb09cfecdd837a76c0b35d1183e2bc2ba744898fa6db71f35069f24013f7079dd0dff41ef163720ef0ca516b7294ba1adb40c1b650a110ebd6a49899d954e21843c6445cbd7a7e1d2b604f9fea97cf3353d90d73f6885d05467a71489927c4cc865fedd4436e16462734d988ba79d5c3a43526ad4d4c561092872c552d3be300e014d4ad4693b2cf5f392206f8168ce306129df821883b6aedc2cd12e8bbbcf9152049220a53b152a42fb30f6859b8177be642a336128adffd636dd3c1b3030a3aea6c84d17e8dbd39e46f6410b88c4aa3f7630af664f6ecdf1b4b2eda87714609b399ed1be51df5ce966a4e49d77208c1f9cec31b53993cf6ceacffec967e47b9431cd3a5a4f06800ad7978eff753c4b2728f1204a7a94b58af4843fc355c5a579750728125d728b8a493aafd85bcc6293ffbdc76647b646388119a7d4c55050e997af3f5955342fc71009dffe2136ee6d1f8c3949e733353430d8e567c138d266d54b68288f103c22f5f897bbba6b131bbf3b958e320764842830d9502c77eee43204fe2b297846daa98eb28a270ae694401e9de32b9edeb85a932b3c06930317281181a67d8a32c823cfc0b3787f85dd89314105ea0c6fc0434f718cf0f52bda06d1e5ab2ee5d10319e23caa918f34ff7514633b052ca78c780dc9d9c53fc65fb0577a162c4d547c4df10273107cc034febdfd91560f1f8ddfc277673c5d4b169d0fb81e3283b50935fd5a424c7a6e98966cf700da50128a7a34a4358be9812ce9683135fd987ff9d88920acec609fd751c743a0925448666aea23792c77e82a5b577874e2a69d88a929122d6c9c2a976990f57e8cd0db5287686fadf310e78b6bdd6460f1434e6b054917113a7bbd1affcfa92f47c426cb56f72818259779025d9e51dcbf211419aadf6a1501da2beaffa71f1f29e6d280643713f0bbab475ada1be645c4fe44e3b2494ca83f4bd093ee578a1776c1f1d9ecbd624cf030e584bacd78226a4c7fbd68cef71ed92b387e44dba6ab0c381e43c87cb5fada9f90724a597dae580b2049ace79f229805a0f03f42600dcccb29715d7c7cce32a1cec4d71f6328b670420acec65812e8a40baf30d070d0bc2259ebe662088a72f0290550e384efecadee6970bb302d0a2628f75d88ce8094cb9a34acb631a7b14cfbc9663385957fff3daf1b5f879aa9b88785069d0cb218a203884897e28a11e8206c5493eb34851cdba2fa1657d4da4e48007c8c27def5b6ce32ef450c6cd6dfe5322217e206a1d35e7005f6cf83d4882b78c014f49982f569953352b42f7552b3b39a2ef0644349bde29a343545379a1866d71355cd790a2285cca7b11de101a2b5ef56800927b2f4e7d274691ca8135c94c0505bba39ded097ee322f1386c81f7a7332f6d0135312b7c27af6ecf5c123e080e83c993d36b37aecd81395c5ab1cc901b0e8dd87ff835d412e2ff54dc88f47f628155d351640955a30434908147e0271167bafc69d2573ce231caa19b7ff9e19c41e9a0c943a56673a85056cd075d94ed7aeeacde947d825bf3942147181fa8753c4db949f7d1d7182c6b3f7e4cf2484beab4f35cdbb397592da3ef47070c6d95ba4c594a79755d79e4bd3ce6b6b3178bdc2256775a0a6cc1fe1e8cd66a746f975c8745aea39b95a296ffbfbbca276c04899d740107e02be557020bb9ffa1d549fad7d451eac454b09e228662f2574443b844710c77537ded3b8eb899e2c92859875d7dd5e8e4beefa8c9eb42125ba33122d0adb4df88b77485720fdb2b31f11824220b6f5d386fee67ba2984d2c0dfc672e0197822a75c4297052d1963efb208bd86faf89d9600ab36b1036334d3a157e5a8fa9a4c3a964415f2c744082b2ee27c187e7e4d0fde0841de749ba2a49f7976276953cdde73df65d2d0b0dc0b51baed56ba5f76a9544a28d6bf3d3466909ea8c7b4bd69a3bd3c9a5bf67f3940ff5059f67619fa9a1ab8e2d5d3f2d75d1aa6e3b81737301081107cb55f9e762c8ca373e56e0f1aa4d5cfdb79335c9301d7a7f0b387398995518e1c419a48331b903dcfaa2894398c6aaa0df8208ec0c4eb13fd4328a20b1a65ba2eecc76be3fa2006c1a89fdeefa647cdb408fcb7ec05eba679f17ab2bce8432be8e6126df99e5cf37bbb00044e32bde3b77cc83a1764d4e11f6957a74e87dcb242bb34ca0a403214234a71bba17f71d85476154745c2e41b094f0129461abe463d0132382d81d9a6128846e7a4cb1eb8364d5e483bb05f5d507e4db0a9ca378e76113b87d9aab223430afbd58b7bacf519c22c817d6d275f48c6d6b3944abc364a7cb24732b4c812f47b1919c6bf47c2712adc3d606052660b565f4970377c4b82847052ecb9f95c8f84825bdd97842a60d28267fc0a19069220c4028d9d00c964fcc14c7b3b7714f4a9fd7e0a61ae7df95bbfe73a7c677bf1c3060447d1e6984efd3f289b2d5aa560568ea11769934a776bd27e1efa85fd281720f9e85b6746ec40df672c5c9c472ebea01e4e528bda2aa8a2dd9566a2e690efbd08e57a1814e5c236c7dcecaecfb8f4ba426ba2377ad5c81d27224e83eb599556e80e1e6dac660d0ff8116d1b6c798725e90e040a671028434493d0b2fc77c03d256f5b40a32b45298a792dc984805cedaae819b89e499f950d48b87124035c831e7ce7be43fa46dc90713076e4e643be744994f6f2e84de0e71bd30baebbee1666535c035cb5386fe4698e43ce7e89d4ad584f40bd2af71f13f68b327084f9d74f395077eafc31835f734dc5075d4c7f3aace2e7289f233af5b30bda20dba9676622c79e48d9f0dbf8283acdc17168dd019e628ac86e21ef1786b5d33d5e778dbfb2997a0fffd70a48aaaa9ef9e297273a9ebe2b42c0209c726803048cfbb5f72ab3a0e0a71bc5f1d5f826a47291b984f7944f24250d0651f78cc800ab12e196c65cd05d65669d33012142554593f973458e56ec21b462c4fcfdfd14945ef339e1d2522ff24d22953de3f0c32eb777c48b582d3ef720f38041ef4e0ee8edd8033b32c4ccfb5a7d6aa04d7acd956e7418249deec013b9108e2152554c8034e86c058e08db33f41b860d68f47a1d3701d5ba3172153aaa1481aa94c9ec934ccc397e778fddb6ce657ef9bda9ae767a7fcf62cbe54591ac29b201cd9aad0ecd33001385681932a5526a6caa7c1ece9bf5c22e25698a0f72b52d3c597aa0d818d1b14d381bad0d4ddf74dbd07f1263c2e0d26a5636c3dbe2823f0653c4b03019a79ab5d79f878f3f826d17addf17f936f834018b611dda03dbac2b5260a1953597beccc87be873224d2eec24e66d6001a182ae2ff01ad5d0391b51fca73f7e5db4f35ba1f69dd96293c9f15999444252fe1187335d2d5a9befff2ba486d7541e7480a905704124ba57ba5d2d9d1dc7dda71a6ede6a3ea1c478a48ceed165262ac55d27420a9a2620c908a08f6dc2c50759d27a09996feb5b38601ade1bf0f1dd742645167216407fd39efbd85d4d6df03a772298302e26566473c6b12fceb2d2fe9d4c4a8a2940d888b92332447e94518ca84aa87b5b01808539863fb52ad9bcb25b168a29c64048e29a97ca9d491f62ed7e0a9d79d8d7046cf26b6703ef975c99300cbbce20bf0c66e1b25419cc0d7d99e24697bfc826b37977202387fff3a29d5f56c929a9f7caded4d5651f2113fe13985d2e534356951164b5a2f824ccd88f603547aa001aacda81c6fc9aa0221684ee921acd385df9ff0631f45d2640f84a28c4271405491f8cc5f85148f8680ea26b14f82a954e2a0b4e47252e4830a8736e763f3bcfa53ef879c6ce4416f9209d0aec7d2e2c4f88e5c6069da30120b8413ba4cd398bbd0ef076440ba14aa869a2007f725569373300158e49e6463b45f375a9e6642c89a4c004c0417fc43c27ea223b3a0a9de35066aa0c797ec4b37cbe91365283af501d0693a17bb9d361da926c8d899f637054c98c2e61b73196eb9b6bf69a7a30a73d8366b01415796a162cfcfbf2015fcce9bf67af4c02279a417ead68afb1f16d781de5219c41569be865cb85c054391cacf81a2e4f06f839e4af60d178db61913509ed3434b55ce7acaafab76b0b85e29cebe1d58aaccbbacab03ac631a15c77df6617b3110b565c392c4cb32545ee0824ccb81859f3dd2effcc6f348fe09db89c59f8732e938f4ad12b229d665a10a0de5a4a756d0ec373ad13f9ace21a078ee251d61fa0e2e5541ecac96f02fa9327ad0e1c1acae2f6681ce94b06efb479238eee5d432b66ad23e35f6254132505f001484df392a7a6ef0184116545d430bdad590739793b43cc0d4e399bcfc26f0a897d2171bc6baab1d601d882ff9fe0e344f3c4648caf2421d062bd0326c9a1860cb04917dfe2c74c69b47846861c413755a2e299f3cb967926e9c855e40bb371f3b1a424d7c61a124d447c56af869481fe4690e5cb99265a2662b9fe4a51b365fd27755438244cb980dcb7b5858ccb92487e9e35ee56ba4953acf7d286fac80ff057873a3b11fff9fa988315ddcf3db8e7f9a11e387b06dc41982a9d88d33733ca000e9b6c535f67d931606a486774bd7b602046100e30d9f89ca513791b78018de983ca7dc623dd9f478ff1830743b3b373076d62c34a040b88fe44318503a32fdc3582717496559751d5a18fe3ca44e87a0f1b37a8a1c68c0c708f947223b9a27460a4dc7b5cfc0d48f306d45b807efbffc12c1306141453d6804ad769d713e359810e4bd3ea6915460ca4685352454710718a97a41fee368bf0b2512300929effaf5c18b87f1237b8201bd9935bd07886531fdeaa27f5a4bad205f613f7e84b8b75f19cfd2f12f6925854787bf9f0e864d88a6ab18f63e57dd8a9b7e559b451b02deb3715f0fcc80014a7837867402dd679237c91ade85fc61e436a17ebe9b00227f12430b4ea8ba26aa278e9646c3cb7354251c83a0c12d3e8cc75ce4910a95d35abf3dcc8fa8a3263d7b4d6925868a59c95d6d3225c09ebfab5367110677f6b8b606040f24ad17abc8e25cf3e9ffc28", @typed={0xc, 0x23, @u64=0x65}, @typed={0x8, 0x25, @uid=r10}, @nested={0x115c, 0x95, [@typed={0x8, 0x85, @pid=r11}, @generic="c8779a20c96d43538e940303313d94217348f1368682e1adeca53829975c858c617053f0dd489de44e9af7108b895bfef67d3dd2a5d6f63cdb10ef02a0c01f0075b4967f1d1a0105a1327cb86d31fdf8185dc35ec6f81dae57344920b7ce8e17e69056f8b236e95bf2d1fa51ea97a4fa2cdb1dcdcafe98e93040e8f38a4b8bdb4c45a0b5f42c4e6294b20c6d679d81bae9c9896e594160928f47922301ad261ba78104e9d17ce683b0efdfd8a6d5cd1df58d00d8847329f8602189c3db661c34e3fc1744615c02089f0ac4bbb776679799e12537a3705d000abf79018a5bd414eb7f99326e239d8eef8f4311c6aa9f6fc156c73afd431b36a094847c4f5a0e7bb9fbe30ef502f4bc4237c40e210c4e8f1f9e192a0394b22ccd9db03babd203202ee4d885a8a93b84214c4a15a4f35892d55476284c5ec798e410c70a169f9dafd477c7143b7ceada965d1e3bd58b2934468158fed26f5f491512bc135c8c203484080f1582c68bbbae069062d936e1c6cf06ab2f8c0e0762e146f1d8fc128c49b5ffe114e0c2e7e374a53284f0ba5d816ea5991930ed1d37c66c3c761ef7016637c1734053b2f5b243bc32ca39f2a9ee1cbb29886139bd135a2a125c6a53be2ce313d06bef6f5ddafa8712aef39050a8d64e9f902dc6c93fc0d54d1584f1827a6b82ad9b05ed81065d3f6a6cdd53565e474f564e08017b05338c241ae4e906a95abc0bfeac0daa9ba12cf5e5bc42a5e0f5758908dd33a2f0e4919bda0ee074cf490eda15cb883e515fbe1ada36c822dda7e7378220a8b046fdb54cd1d6756e20698c4a7691cf8c54affd9cd61486d09a4db1e7c765c8e2ec1b330a9334cc59f2ace1a1226c16c2eede1915ee50f0ae937d753e959764747761e72f27be5ec3433623f7897829f355fcd9567c62581083c6f2d187ead7fec3f364a7d2450fbad2350524b73432f2be694224a9a81cef19c3fb20393970614de68ddde999c80a907f72b4dcbe4b94b0e5547bfcf30e4eea0800e19b6988598d1be37b9dfa7e6c9dee770493bd7c295df1cc42b5b305ac6b43f4f007dc6680104ef0636c19046ffde04c3827cbee842cf41364cbf0b206fc365b958f72d6050bbc2befd04cd97688dc0dbaeb65df3c42fba84d535076780db06e467e8528884811d8bfa5360bdc0d5c4119a5a5be369fd541c6127b76e4307631c747b9ad052ce8347aec302301899631c0ddc959842423df412c9f825c7890c50ca5b61f42908c8f55c1c15411dc7855fae63fd3e895c3abfcd41b17f19898ac4c43e73fc2d865c3e46d1bff07e4fa8e060d04d5b1942012a07d5d6f4401548e03f626937c08d026568136c8507422d311a200c42c0f5476efb6207a8eda962ba241ebc5ae76f6d62d770f805703eae915c15d516cce334d676b575700da4288913481dab3f0ca2e4361acb46ce42db73444b9d218c3cc81bb9c5fc3f38bb909d49a608802de56076fcf1faedfea0f07c685ffd0b00093cedae3619d824dd77b9ee8b22e1ffc1749bed244d2f0e38f5e0a4c6c062fe5877c449df98c6a245db28f22a621c36a2bfa5babfb811f3fed823073556448a759dd1a372ed503f7ff1f399d116c4a69b6bfb9500c1352a5876bdad72df571a14ea76a8b89e331b9c4afd71b8ff019e64b107cd3498a375b24e223dd12739372d6029af8f3eb995596e1556cd5e6c1cdc82ba6d44ab661f0e3f5b0700ce9825b21e615a672e55ccee96068a806743c8df7849ead15e3bdc4fe8eb41a6adf1bab504d528fcf1f041ef5bc70ff995c146033da1fad7b122a35e0663fc56773981d33eed7eb7d9cce30e04df16db41b1ffe51aa6b54656a5372fe6ee593e6f539e833d20463dd6e99e7ebf1a3300d595dcce30e6cd462cd3a70c4db0f5b64dc8b10c959fe71d7f03e34d78065e6b2ed177ed6ebe85ea268894b7095da5b112b4db87d90c54b5e027d569a8312a24a5a6f04d348ae6610a55ee004b90b9e7d4dae461204120ac684210314ceea5f00b53d827a0e4ca09766f18dfade557ddac68fef271222f7492ebbae8cec2add8b18a07ba650efcb1cf574308656be1fc65a0be5ac09574557a62ff1b5f09a67904f790eea77a7d6fa84c1d423e447a87bef0aff38f358bac4077b55714ad29c592db7806f34ba6e8fd703feacfcc975d54af13572d3577d1cbf147ec3e45d6659e47c694389700eb4ce10f003f1f0f232e12b747540608bcff344ea9da1afd159946b2fbf614a13e4357283d100b20181792790194b79c42c62a87df85610903518cc563e0dbbab2644d46bec0cc41fb9cab1e3ff9188482295f4435445303ae4140aa4c0ed5fe5f93dec8d5d61081173fa5b03d3ad2c0f0392f2355ca2a2bdcc9c4ac590d0d657ddb767b1621f1a5666309bc5ffbfac452c018a4e408a00fb9e9d30bbea83bd1e79696da830bd607f41d3bffa59c1871ea11fec734fbff4cf8b11c4c2a566596359a94cb65d8fc8c85c01f0c8b5540231ba2b3d8683fa00d69895d55610b5c6a244fc62a0389528e510ec9f8d83092dae5a292c9adf01699f5b9618b96018a7a1347daff77474546a4fdc3f9e4f5930e2f3119cf9516c9af6666e6e22f814ee766f8db8427852bb1ab07440bc7d11f11a32e853684042004b5d96d95b6b39f8f4d6569888e4381c7804ce36004516f93947f574b5b9de7a793ad8c9028e6ae6edb27507f3b13ad8162f1dfc3e77c5503d539324d77f0092156bd0c63e1140818edc3e03b7116bfe079958ad131f8f42ae481ceb3f31c705cc437daf71b0e81d4eaeb64cfbe41ae51227ec56ae4bb0ce1b21f7bf082b4260aad9b1d89242072798c300fff02d5b5e721d3958d6c6b77120e77aad608447efc97d9a846bd702f59a97abb93764d978da9c2885fd6832ac10d1ffaaef8d6272b3fdb16846dd73d549a3cf59b2f19e212ffa677bc5c3b85eff47636f64e80fdbe5b9c9ea2a15f72f2b66b5e5c0de981415e6716ea71550ceb27deae32a8d4bef144767f5aff0378080f136e6006409b7d5964fcc4b2ec3b714b4ebd55c6c429e755c80387a8ab525ad0857e577a6a9d0ad5a654c3f42eff6b5e0f660a594600b31ab9b4dbb9fc1d93573c516f6d83102138e9361e0898b04aef185bbfb0d21fc341f66aeec20da3a68f21c87d84bf5e7be97f461ae0338303fe3a2f9a1401554ca263191179bab95c8590d851d6a3354d3a534b4ac406e172b2bb5365c93cf182a0e67ffe8a79d0f4ed74f2c0f809f9d56f9185f832a8348219c21faf9c265d41678cde36f80265126793fa8daacede1b387bcabc107659176698f42a972e66eac41be29202c1c1bb7a9941accf4b0d738e6aa92a07f1828ea57a43b69bbde6fadabbbc77e5cdbf313aedf8b1bbfb530ff01e6f478b91ee5daa91dd1c602cea9136cae092c64d664eb9263e249d1c1aced519c1f88d3ba9718bea55137e340a0361bc9874553306565439939d9f84f7abca5ec57cacd91db0c1dc62d5638d87d5faa68eecc1a8280da04890da033299900035666f4021913825d66d240b6c66e219761f6ef19e926e2b5eb95abdc192c84e7237008dcece9e95c7ee5041efc49bfa46c73c6ecc2fdf3692e6d47c792d7b283bb7a1e77e94b576bc38e5dd7856be1d3a88a106b48d1f6d8e91dde13a777fc03cf7b2f204f42721d3948d31c0c98bb65604feec92efd557669807004d0588be69995f0d89d3c033256f59e13e47954d26b1569a274b2c09610dba04233b90cd531b92fb109ebc51258ce187e31692db1692cd2ec8e6889a902d0c26523fea47ae773cce4c2d5ac4e02c8ca58aca666b63cc6348003e5fecea4652fcff85686a78a719c9621e3e25026c3c624e763c2239b9b48024e11cd4303c79260f0ad14af76b41c90d19734c5dae67ae2d29ff6813bd0f1a927c71cd943de78e98673c987e4a039de0f9f06d91591290ce84bd72035df0fc9b6215caf7374bd362010d852054cfd52f070ee7925297a69c3c6f71932a79bf9b2523e74f29bda52be4403d535578d499c87b498d18a5df368729e2e94e617dbb5189b80a256b20770df3df01a0c8f5de059280bacc513401dfb66f2e5813c8ee8ec14535e65753eb13a736d32ef40ecea964fe1900a9e05174a32d9b9a13956032f6504bb337b065fe5f1ea5c2b34387e05d118ecac43a8d3d03f62a4089fe9007a7e4068cebc7b30e58d1048dc454da8ed3ca20a0e200e3fa502426f09ce78893492c2db42827c54e665a818145567e728bbeb14cac9600a0319c3b9a318f3f4bc2998a823b73b8fbff192a0c4a3ab414086c12b7ac1b989bd8f920e29f36a4474e29f13ee897886a4f1c478ffaca1a5c23e23ddc9ad96b380ba4040d2677fd2cb747886c55da402c4c94d8026aab50d34b0a5463352a0c1dfdc64cc2570766f7f3da02d7c67771fec59c19e9cc303c49f741965a675af502f83a963e1f9515ad4c35778f48da517cf7f226d04f925d93f57d7e2bc3cfaa9920e1cf8425b88bee06e38ff6f1d467c134d0155e9c18898754c9e4d8f4f879e1a4a51394af46236d37b3b985db013005eb7d8f895e13d2604acd53507e2a1f485b7f826b27fba0068834d7eaa5153c84b7b33fb9ebbd7644f47eb91f4c0b3e68197ced5eb00e3cf71d2bebbd72fed5eae7e01368588dbc8a10a2b60737c64e1f5762e58d544a6913f0e2b265a4aba0f10651904abbf154e27c50962d91370dc49c78c5fc002fab2720542ea6f2a9d43c83031f55d62381707914e5f00a82f44f945051d71d0d27c290df483be1dd8148b66c10406047f167658533157884fc2f70d8fa1ae667924204ee78e23dd96bf288289f66133e9c1494de880f35d516c0ee9b1ca08fdab7818b34a73bc0ffa3fad684373858bf70f73793fc35c6386b81b41e2e76cc477a033f5eff5ff96c066dc0b655ec9a8d5bc5fdf2800ac9dcd0f67519d5a3423c9293a570b3aaa4594db67f2e9e7669f6a504f4a14571caf689efa2435d434f5be06c954021e0cfb2099d76cf4fa09237ee8a189bf6afe8003be9e11230ad66f885547e273fa1deeac496e05bf0b9e22ed94cde21839476989601152d423d2244949e0e9a04be556675741f1dfa0b528ea236e5d1a0db3d035a15d8be9d40d5057f4409f3a72163c37ef368be6c9c11c111203ea386e4577a795a31e75eaf87148f4f8156b41bacf0ff3b3bb858f4d4f0b3c63432bb13bb990177a69c35b5de106b536c2d4aede976015365c69d875bd0ae028bdfa7ec55dd0da1c113569e4fcfb764d13a6bc2ad4837311dce07faa6f8916154d5b966aafe7f0ea866f46571b03a97fb6571c8e52b59c8e8abea1545afd09811239c777a5ef27ea84eb2c42ee5d4abe87498475622b7cebfb791e95bd8d335368a1916e94993ae329a63fef6c595264dc221c1a128161757709b8ec13958d011d187addbee33101672b718a582355181b60c28a9b32d5dc454e73dea9889991cc7b950c983ce9ee10c7caa098f75bf62d19f13ca12fe3205fc16f5de819f9ff6c00adee7b1e2c6564e4bb0e68ad51212e1193b9ff87b7fabd2220aa0dbf6fb9027845552aac58bb3f1b469148027d41a62e9bdbd9fd5947ab5e20be96f80d468521d5560ddc595b3b79daa8473a33ed1c40b99b9e715b41dd163b6d641271cfa044fe457a967b80a17d8ee52494a964fcdb7f73016e1072737dd07941dc4cf768374b79dfbec4853f54c79e00d215bdcb86f6d671e59c902ef771b83afed1c4fe4ba6e7fb1a46becee3e6e30c5ec029435da1282e", @typed={0x8, 0x12, @fd=r2}, @typed={0x44, 0x82, @binary="d0e40d57c3bf719a4b24eb4f9210f4a972a02c727d71f3392cf9111982689cb052ed93ea87902c321455e30bd0ee1f8199e5b59718723f5fcdf4436998"}, @generic="61db72661d9c9bc48c32256f83defbfc7b33396859fd4360990acfe0f444f456a0595a4d5d9cbc82ee4a9bdfd06e7b6c70db5cb3e26b107a5be430806c", @typed={0x4, 0x2d}, @typed={0x8, 0x4f, @uid=r12}, @typed={0x8, 0x2c, @pid=r13}, @typed={0x24, 0x6, @binary="ef17c985a9e0fbd2b7494b53a74c01adc597db6db3b04be46bba757a6b6e2c23"}, @generic="556c22730e85d9c850101ee5fcb58fdf8aea6ea86f88a96b217084af7371b32698d8bfbee21dd4ce69af9984cf0f1792806e3f67faeab1e8df9d7025287330af40f5d004ba8e25581b2a67163dfb22fa3d4871e57507d2b22af3a1d444fdfb56ac74733f7ef4ed43db80ccc6f45d96f9dc0151159794fcf3f430183cde5842be9ecd8de86cd4ef59f6d8a671ff11"]}, @nested={0x11d0, 0x5f, [@generic="9bf49abaa6a0dd548b0f8aa5ad2ee7b32fba6376c9fd13a3a50a7b6c30ba4585b8fb2ed29cd7721b6c25120dff80372a7aad2988534cc114e06ea29e1b2b89f0375d5f95d8568e71aa8d3d9931a06d23bf3250309acac011bfddce181270e5e9c5038ddec301043f80247feb2969fff011e6eecda12c32b2ea168770e9054dc9bf2091597a86082067376510a6d3224be0340aefc73852266bed7c8a6814ab404e4b29b2c681d0cc7e3f0365459199e3fae42ef30b5913bb9fb6f947182f4e8716a0ad5fc46b0abf6501a27253d78c9a4cdc54e7163bd70bea44574dd6b7adb575cbf1b143f0a7ee8574f24209116ee62d5d124df7dbaa5b4e207a7c575b7f8528ecfc540ae2549febffbb18350cc02fe268e9dd243e7ec392edebfd0bcacb8278bcec88e54cdc0ea0213eb4d489b889e55105fdb2901c67720d7e6d5b5c1cf4ac69f8c56824bb3c815149fe51fe979a6b9241901545c8a4fce33abd9169b1fc20d1179135d5c1796bfdfbf5a398a1281ddb7d44a6d2aeba988cabbacd2837545e5a1ef4fd6d0a2312e204181e013f51e2a89ac729553888167b463027bbb6fc40d454fa0791bdfc0766c033d4b467528d4ff9ef49a2ee837cca246f20bb0c04522608cd4199af80de12c47f20e1805ea6fc9d62eea3f6f42d0e702b1bbef8fd1ffc4fc69b3dd3afcba9277521a5205c4efa9a01c9d570162eed6fdcf3f2f10b575385867ea71ca02b52da09a1b077aaec3e2af777051f9d10d175c3ebe837b4d1b7ade7d97bebf236d26bdfeb4fa64b4f3eb04a1edf29de5fb5b8d2b1c87ee8a2212f5e40712eeaf45a79525cb553f59a1d690a2ce88e2212e4ef3e4d4181328e054de730f39953b48789e7ec781de0b68348e18f48796784e66a2cafe91d59234cad191b19ee1be0aa99ab3b0553b20288e37141be82ea92b5802043a7f176ae413d731eb7c6e315531477d095df762f9004efc4c7a27dd9d57ed2a3b99e2d561a2ebdf14ee26fa8fcb54dd820ab1deb41f4aaf9734c99976682ae856eaa3f7e375517e9f7c45e2b931f17ff3e0ad8312aeb17ffee643e9d47338f89cde66fa778ac618299a1ef553252b46e8cd5ecf0854691df9263bb56259af338f0378e4a9a9eee6381c4859eb343c99a78828390269ec422b086d5378e1f429798051c1740f0f43ac6ceae5251f7c2e41faeac46b46f2739eacc7d0a6fd6d1aedc3b7ce1967173ec81877922cefc244b0e71649b78e37226afb72c409f8594b2b8fb969da30b2e2e6b571a88c29a3fb5687203ab294a60a9378060285e17f50857f9ff1bfa4e4b96fcfb033cdcb4d11edb425c09f0d253b8e65cc3c74f11a5e18291ff4747223ac486410d7bd4ca226b45e2bc08d35ed58f9f097afb54b683760f750a780a35f21704975f7b9b7ea0afc4bf8de719ff7e6c217fdad972c347d3b63b4aad8624f2a8bcea6ba55d7b0744f12073bfa167f604711d1eb979a173707b902713f852872b8f1341cd1ba4bad4b84edd8ae8fd8c925a75f2930fde5f889375a17fe0ec3a01f660527e5e0441e7b7f45416b142b9c9abdcfc9bc12eebb4d62a06ffcb3beecf558af7cfe5787881258628bb0b8ee8780c1e984a9791e80c82c2421c485fbded11a1edfeac7f70e458034ad44dee2a0d5749b6cf40954c0734511424db878ad2d82175bba2b174aa5b4c931c84047a33241f0ee72b1a0112a00dd16257d80247523a104a5037fe1eff6348838f28b2823eedc5f3e6017a0b889e0508b6ec7aee7dbbe92595fff189c9c277925b7b77b099ef2a14fcbcc248a13a6ecf258c1d363304952eeeea94ddb22c6bdab275e8ba4b3ac34024301fc1e21f768eed5e5944e6e1c61a6fc779941c997c6807a24cfb7729aaa850ca29297ff8cd15e0ffe68456b8a185b326dd9e926ca6cb6af7ec286635fd99b2ed8e0ecd269cccc313c4536b9a312eee769d778ac21a8b465d1b803210e11d69d8b169b9b3d1c259faf26a3d92bc4b8d602c608f055368ba0d816d74e7d87c1eee1608ea751a8bc44229f0dc059c08c7037a6bb6e097c99403c1759e552ce591735f51e5d82e2a8ef8f1fbbb9d41dce450660f8304a94946caffb1fe7f7bb0cfe5e9b6199500ec8fbd561dd95875888e25b6e27e8b4a2f521696b26fdee3483d8b074982c8de71e0a61174ac9d2b06c9cdda9e8bfd435fa179450392f6cbe53f93cb176eb273b2fdec3a6efb59b5980a469b64a39e2849edc2edf94e61dc1ad0f33e89092611869ef9ba5193d6a44627f17aede80ce0e7145e6c070431921449faf993d9dc192df05da0a912d1db5a14ba317f2f41e53d34b91836708a54abcf62e61808b1d513decd88aa9374defdc124ac6ab7963eb9bfe68d4cdf2f26cb29ede8bfd530853355f50f78cdc66537805fd6cefd3e8bcccd7e0cd4cdd8a05d37b3b75096bcdf630482d216ff9625115e0af484d80e933ab87771fe1954e8d86ecc5ce8d2c620f1a803b71153ec7d272f40c942b9646a4edbbacbad679028b61eda2deb3493b025b6dde96fd4e49985f9b235639616e563765ada3693ba845621cbe07aac5c609b37a4c0973ea2411c1c3db2cb7ab73503daaf6f795bc14c9b9985522403a9a7de3667b16bb43787721ac27c074b80b96c0216aa5440bdeba002ea3a1b2857db057431949f0c995f80feded7abbf44b7cca3d818ece3d612ff8b337b149fa5cfd39c8dfdfe1737a4c37349f603b1851addb62bc9ffd33d1c2fc7eb4d2b6285ac1eb9a56ae40581b4d9f1078b7b2c7cfcf02b421d75adcb6018240f6ea4f49a0a4ee092d1776fff078fd3d42a4113b04826c020020427e1b38fe90f73ad38a9d0ec35aae1af90d69f76399b2cecee252fdbfe2a712cf82c689c164548b3b7d4ef2e9004aba7b30399f0b99845e3cbcb5c4528775287c500ca2bf959041b3bc541745b675696d3d49668a687db647f55a5a6653656be16b952110106f4cb607ba4c5c131cd49d1d14adbc15067d1b04dd9f9f5cd1920499880c5fd220bffd029f19913148a56f16cc4b46edd89c5196cb67c7fb9352796d87e9f14caf5465e33f7b4b8de471445996e1d4526971fb2c7efbc9689864b60f45175b6b1d2ff29c20bb9d6707c5cd67884442142d93638426cc07d25ac6f169795fed3eb9a655745aaec4ecceb3046882675d2568e9de6dad73f07f8c84201c3abd7f1baec33f3e9c426f348ca967806de75b4967a2b4476638fd3c3f7c1deb6a2c963225a021d735985d00da23ef35e63e9fbed1346f242a1bdad9cd978805361d0a370e9dba0ab2e61c7fa8e521eea112836eddedc2ace00f9eccd6570eabbad0534036fad2a9f464ea91c48a9ab94e18151cb48ae2fcac97f7f8ddf34d9fa8768b6ee3b9c6461728fd7de3cee05e31d7a773385a215b68c67f4ed4a1e1176c3e57f4e5835217907ee213f5073c9d7f49addc69570fe9436d2642757a3d5913507a2984b9bc959a5262447f53b83e8666c3732b81e7fe22f0ecf81c5bd1ac119862f5b5d028d1348e0f212c5b908751894dcaa975aaa0e124dc566b8ce065888b1a84d6a2e42b5ae73cd05f7e079a6871e20e7be9eb80ec67a52bd489ed49535a66102c2ddb1f0951d353ea7fc43938f94d0ef9d877e196385c7ee82500a547688f8699108e0fc9182507e14497788e335a5cdb2fd8ce8d1ef81caffb633d27afb38a99b1686fabb35a4ce7cf6468931e7a061f05ed3597b45781a4940d61330f7c7997fff831ff95a842a35923873ea4101fcd20767c1a69b07296601eecf0e17d37b4fc067562be8cf4a831ef2a8de6a6d5ab2d78ac7206c2577fe672c1be8f5a1d192f6eba259f803327029741f6df6570a69fbe8a2539bf33e683ed303ad648e43318947717c42225ad8b72ade768764b820776e4390c79a28395b9186152c5ed1f1f58da1c3ca2c0c7afd677476ced8406d1df5327244fd535158d4cb1b3dcff3e6e761c4c79debce1a1f1658da57e83a38fa201eb11242e2adbd94d891637f6b54f5cc2906b251b21ec9d930c948df870677e3b83c997a19c0160c225fd4f09201a5e6510fc5384c6178bc12472e91b2d5e08de98a8ff89c905aace8529509fb630dd12ddf4b531a593d9e3afd2ce5dbe0714224dda6f65da3b5e699448db2ebd873b296226d95967b84ec00f84404b158798f675018b535ba6ddaa0ad136edd08dd77d115c9896d21a9fc0d9d3ac1e980c2c0b522d985e2674a23fc8823e593a6cd5c5a322a79302c6e22f17e259813e5473fd4d971306d78e92dedc4f5d6bced42f07531b107eb9b02338521f2f3f441ef89c47328f284af508f9c7b186623db37769a58978cf28fd4403b375370881166ca91d2971eb08c34e130df09b2463cc60e68ffa425089bb533ac6c6d0d17c5fe04df77cb180a80242261e171964ab5492d912c099e72f93abc94417fbbae30b9b3adcb618281ea350df2b9a831549086d12207bfcda098d3ee3c7c2384a782e22635b2a639d66b639114c3f59577e4c06ed3a62d250ba71a3dc9cfe95b64e8645b8485a438954caf5666fb30eea0c7de744b9cf5e6322b01f70c874d755e3bdb36f2178de4d3adf7bd2c0565d440e803e1ba0fa603ba749fbe0d3d891fb79a0e8e02f53a54df321a3d300851a1e8d44c9e6bbca8bbb48b6b910c5731508993780910e256280652c81e1c7bc3c486ea2d91e3bc775a63ad2470fc93d322d01ec3d9ca364cd5f43162d8ed9fc697a21258d747d4f4f2f767b61357b843c1d3bdab0a9e3099cc5e632c3c48d9cb3fff0c53a0c7a9a3d89307e898982fb9b20367aa7ca0d5295df0cacd05d8d11172a296927d7b4ab7309ca0018ee84aa2e3694eb0a5833549a17b5e2dac7f9ffc8ed99c4f0c2de7045857a045945a5da27d9cefc778aa6d2146e621b33d9d9dbf7b5c09cfb66b49bdf1990d09c29e958de3c48055c8feda9591778cd8ea4aa19149d96b0c08153d6aa83e104c32ba59eb40b4b12b27be600604a6705a39029aef74f72a4ca4b1708bd0cf641e1a36750d02f96264b4ef8372de7622660b3f1fc60e58660a4a1fda6bc449af4fd6bc563cac4448abe2b4bc4159c1aed120f8207866c99d7b1e0cf5af7d01625453561238d97cea522db1b804616ae195a3d74d8e00af15ae203c4f3784676197b25e3bccbf81ee961713f09b2788e3978514b196dd8d3bde45d537611cecc50a083d2c429a840960234f136967bcd181326df1fce820305c18a4275a523d3191d919edad1353d7a12e83f9000fd97cc2a675ccf3ed32e61c58a4b40b943f20dd477e1d596dab15bd7c81cdcc3edccf1bfc7b47c6e1734b5278cfbea8362a4a7b15676d2638cbbb9242bbbc774114a2a161f6b0ee62247420ffceec8611abc1ad2408ebf5545d5c86d12a56a9211d7fbb85166664adcad8d7af51e46aa40a781972938d952449339cfc61adbf3e71416d7bdc212a7d95482965f15bc0fbce616cde5e81402f01d72c7e1446498faf1ca0855ca8b321aec988bde95a74b9edd673a1fb099d1793271fbf0393783dd7307fb32e210052a9ae807ad48a4bffd5ad539418e8d366fb5114a87b210d554e4e9df8a803c3e5acdce1a8f7440560cf73e4d9eab1b3cfa5cb3afb483df3b8b56a6edab2e42cac20a77869d826d29317c2145bd62f7ef754dd63bd2dce11fb5e0d26b6199090fc033e9239c639fe69dfde5d03461d2a303023f0d5ad1960239457f7fab563fbffd51ac8bf29c015cfe15936fcbe982d8b51ececca6cf0326c325fff4bc1c766525e2c13f21be8", @typed={0x4, 0x4}, @generic="89e676e131e362631424d66e8f563cb23acc56fd4fbd7427d5c762df2fc070e8c6f75f676b299a6e794ef6385a4e7cdeefa01719f4ce37d6fa69aaad84127d77415c38eadb53e2b2c1c117f57d9e713f996f57c2ed26063b096bce459a5591343615e40cada6ce4bb4904f9d047770219d2b9f0fb8a2a2f40be0dd40cfff0a9260fca670426416bb2678b162e554ec764b80c15b1a4c1dcd167fa4ad9ab7be8b59734e5a76ae47290c6d0c0c32322338f48febfdc0691564e25c2a14056461e24c30a0bb3a6010caf543064a608d3c94fc086b9e5426", @typed={0x4, 0x9}, @generic="4ba300acc8b18560726e44917f7784728d10a77e681b3412671ba894bfe72723124a23bda1e085bd7480987094321da02bacf8c9d13a5da12a2199f86fb20d6aa0f11e6ad8c32987534fbf3ed44c090b29194da35a6fa25395e01fa63498c13498b0534e3d5f1775855bc2ce5cab004262f5c5753f56e561291a9bd3ec58adc8045aa2e25d34e8638dc4ba838ff711b36e19852ccdf5c0507430f58468e7bb4e2b5828ff9dbf028c0958bcf4ecd4b69346b50612c4c390458a0513ef0ac3be998b99004bee17d24e5c1b319216a4732307ca425f11e0d3085e47db9f5a02e53a4c5e62bd67a541d6f1e60c592751"]}, @nested={0x28, 0x53, [@typed={0x8, 0xc, @ipv4=@broadcast}, @typed={0x8, 0x35, @uid=r14}, @typed={0x8, 0x5a, @u32=0x8001}, @typed={0xc, 0x51, @u64=0x20}]}]}, 0x35c0}, {&(0x7f00000080c0)={0xc4, 0x13, 0x1, 0x70bd2a, 0x25dfdbfc, "", [@nested={0xb4, 0xc, [@typed={0x8, 0x0, @u32=0x20}, @generic="d23a8e7bdbf05bda0a6df28789469526314bb5d28c3225c559d99916c475b866cdd69f4256fd86788277a9bf131723feac817bef5e7ddd0988fe7bc32e1a9ef00ee4257f00af1c632f2269476c869e87d0fe5024bf91e62867c7d4dcb90de4fb44ac5e6186abbf92d509b7bd5d6da3ed4f68a8fbb120c9d516f7f0607ed77fce6879caf9119dddef536d9e45e511d5fb796d56cdc1d3d545db60732e0af8000112d305944bdb6e25"]}]}, 0xc4}, {&(0x7f00000081c0)={0x28, 0x3c, 0x0, 0x70bd2c, 0x25dfdbfe, "", [@generic="a91d380c1d9cb2dda19f6e798c67123a42ade11571431d"]}, 0x28}], 0x7, &(0x7f00000087c0)=[@cred={0x20, 0x1, 0x2, r15, r16, r17}, @cred={0x20, 0x1, 0x2, r18, r19, r20}, @rights={0x30, 0x1, 0x1, [r2, r0, r3, r2, r0, r2, r0, r0]}, @cred={0x20, 0x1, 0x2, r21, r22, r23}, @rights={0x28, 0x1, 0x1, [r3, r2, r0, r3, r0, r2]}, @cred={0x20, 0x1, 0x2, r24, r25, r26}], 0xd8, 0x24000000}, 0x40000) ioctl$PPPIOCSPASS(r3, 0x4004743c, 0x0) [ 805.936412] binder: release 23524:23528 transaction 883 out, still active [ 805.948969] binder: undelivered TRANSACTION_COMPLETE 18:18:32 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 806.077698] binder: BINDER_SET_CONTEXT_MGR already set [ 806.085293] binder: 23568:23578 ioctl 40046207 0 returned -16 [ 806.092713] binder: 23568:23578 BC_INCREFS_DONE u0000000000000000 no match [ 806.101038] binder: 23568:23578 Release 1 refcount change on invalid ref 1 ret -22 [ 806.118463] binder: 23568:23578 BC_ACQUIRE_DONE u0000000000000000 no match [ 806.125696] PPPIOCDETACH file->f_count=2 18:18:33 executing program 2: socket$inet_udplite(0x2, 0x2, 0x88) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x0, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x2, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000100)='fou\x00') sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x48, r2, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_TYPE={0x8, 0x4, 0x2}, @FOU_ATTR_AF={0x8, 0x2, 0xa}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3f}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x5c}]}, 0x48}, 0x1, 0x0, 0x0, 0xc080}, 0x800) ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r0, 0x4004743c, 0x0) 18:18:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = getpgrp(0xffffffffffffffff) ptrace$setregs(0xf, r1, 0x7fffffff, &(0x7f0000000040)="1bcb4fe3175a7850613564a026285738992770763a903f8a019d4830f0a32b7cdd11589042c04f7d1d6fec684a78293b8da38b0c15e7f0ec9028adc315cf48fb6bef71818b62cc62338463cae61df2c53471e5f97d1662d1b404b4ed860180e5f5b98e2d1e9fa8608deb85c2fcf371c467ca8ac93bc3bc6f0bdf031bb89ede4952137007a6352b7eb74be58f11bbf2ecd35f74d80012387acaff23b397cb96548dd171445d6fc2") r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) 18:18:33 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f00000000c0)=0x40000000000080, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) write$UHID_GET_REPORT_REPLY(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x8, 0x240000, 0x7ff}, 0xa) [ 806.330772] PPPIOCDETACH file->f_count=2 18:18:33 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_int(r0, 0x6, 0x18, &(0x7f0000000080)=0x7d, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x44f47762, &(0x7f0000000480)="0adc1f12004d3771791ab22101cd0b7856c964b778593ac0a908c0d0b09149d36fe54c9aac43cab9611adb5e47118e0a162c1c3a098e7faed82ade73ee62ab760b9a2d75d2c648a832df1c2152f856e6e414f138b9ceb6d5a4bc9bbfdec60c7a5ad75f04f995d35293abd8f58b08d1cc673a91f22425f4ce98c1e5bbc13ad86074c65ba8a7764edd7db6c802000000000000009bb061fcc6f9bcf8ac5ef8e7d45c8351aa707a69b9d74a939723db36040000000000009045262584598ab7a21e3b376c8d6461f3f9dddb73538cf63b053659090f571195e2900a52fcd1641ee40505695972aac5c04eb656000000000000eeff0000000000") r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$UI_SET_SWBIT(r1, 0x4004556d, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memor\xff\x00\x00\x00\x00\x00\x00\x00\x00', 0x0, 0x0) ioctl$sock_inet_tcp_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000080)) 18:18:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) [ 806.460793] PPPIOCDETACH file->f_count=2 18:18:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) uname(&(0x7f0000000040)=""/135) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 806.641472] PPPIOCDETACH file->f_count=2 18:18:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x80000, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 806.763788] PPPIOCDETACH file->f_count=2 [ 806.785510] binder: release 23568:23578 transaction 884 out, still active [ 806.799009] binder: undelivered TRANSACTION_COMPLETE 18:18:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x5, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ppp\x00', 0x204000, 0x0) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000040)) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:33 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r3 = dup(r0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={r3, &(0x7f0000000080)="a10ab9548413d5f9dc1f547c8aa01c13936b6a93079b434d8df9f5b4bf26442e6b4cf5f03a84fb3ea0318490e92a838aa17588996be2de12e928671766be05d4602dcce57635bec691eae7b66fb5ca0b6491685847fcf8f1fa2a05c51bac7bddd33e2c48f8edee5490fe7e89c637d4b99496dfb682058479803737278c47f471a8cd780f9c968631da338edd766d18dfa35366b7a5164ea47164498d3ac8dcc29f588127ba3a866a6500008da36e6cc41d082772896b4f2dab02eb13", &(0x7f00000001c0)=""/57}, 0x18) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:33 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:33 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000640)=0x0) r1 = syz_open_procfs(r0, &(0x7f00000011c0)='net/ip6_mr_vif\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') sendmmsg(r1, &(0x7f0000005c00)=[{{&(0x7f0000000180)=@nfc={0x27, 0x3, 0x0, 0x7}, 0x80, &(0x7f0000000200)}, 0x9}, {{&(0x7f00000003c0)=@alg={0x26, 'aead\x00', 0x0, 0x0, 'authenc(digest_null-generic,xts-cast6-avx)\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000280)="3e1146dea3195626b93721d6ec280cc2245566a4caa1fb9b257f770e235f8988f619a5814efbc9ef06b2ba27f132aa", 0x2f}, {&(0x7f0000000440)="e32b8058925d204a1a24d73175f12e00c7cfceacc94814646586de283982c6d4e5b7cdaf4d84ca8c70c503d5a7013f682d409e757fb21115e8645e76e3ab27462098fc86b301af4ea4a5d530b44e05f8d91cab9b460cd2df45aafe24c15543e664e39c78ec0a9f35d728960e169dfc857e6c0b5bcf16b4fa2fe893d83892248949ae615240043027c0419743d090d61c8f1d2e95d447d26fb5c003fb330ef5e75726cffe69c8d98edeff18f07f33e62dcf35bb10a6149e4a23c38de3176e4b33681aa5bcd794a781ebf320c55048db8f4eb4dc3b017a19f6d57f9198f1d119d5db133c8c15e80eb54adf319edb5a97864a4aa721da248d7b138954df68", 0xfd}, {&(0x7f0000000540)="36be52d18b71a919a5c473c86dc2df1263faeffb4c12b54b1a53f3781ecb1b4cd224ab2066f926ab63b7edd9f71b1d66123aba01839f4a1f4e02495fc51cbde5c38cc8d2ea489fb0bfad7f92355ebc8ba859910ef9cf974d8bf0890ba0d11e2a7ffbacdc24922b017236ffa066e72e09c580b8f925863fb7cbc302a6a658d53111d92126c68c1740a2c1ffd1fbe94f", 0x8f}, {&(0x7f0000000300)="c5e4833b47cf7bccc2575c81b4a3566af1ab04936ee7ebb571028533f96b48a0a78558", 0x23}], 0x4, &(0x7f0000000640)}, 0xcb}, {{0x0, 0x0, &(0x7f0000000cc0)=[{&(0x7f0000000800)="759992dd1235392cb8d1e8679523cc9316ab8818b60b2375457ed323b10237d81c4c6341c91e4e159331466203d7d004649b9ed197d5fc0d7fedba44ee25523c8fb199582ddb51a2eb9b717b4266dafff317053b668172aac44248520f2e10b4fce00c97ae215a79a75cdc622a763d02472031488150dff99b1b70830bdddbb69ca81fc22d7162d3e7bb366267128792c2f0fa59d7b0e02afa135c9fb728b2236c191ab2716321fffccfd1e6fa4ea7762538f79087505f38222cbc13c0932f057ef012b07dcf98aaa8e6c00371b04fa1d9d8a1ffa50038e27d22306f97e3aa79e5338aec7450fc76a662798ec0020637", 0xf0}, {&(0x7f0000000940)="b392eada3358c8195d4fe5199390f73020f555d562669e493fda9b2000072a93c1c6a50d71bfdd5a3116f6750d9746d3495a4d4ff3061c9b6241e0980b1fefbb1802cd19822389199e88d2d539cd3d297cd0b0c67c40651b8a7aaa35f8512dfbbd1cbbbe681036cfd995e723b2939a98f02f", 0x72}, {&(0x7f00000009c0)="f29fd19606eb69122f15d6e1163fb94b4bc132b876660253ea56d57b27b3efba5433a2baceb2feb5da2a24324b8251cb13034b6c21b9e412046b0aa01e4b794dedda26bf9aa724fe362165350564db3fca181ba30aa56f0e6f4ce35b47752956534092cf4d7a95b3a4c90f60b2c62e5dc665cc848f3a8339e9788960ac25926d4139aed8c929f1a3497d8116ddfe5c9d47c58cf9896cdf2acae3d8e5ea918a401b86d2dfde07df3e1acfaefce3f8fc7cba3ccf5b19fcc2e78c1e6b3683c576095b0e", 0xc2}, {&(0x7f0000000ac0)="dbdaf948df164e151ca4ac74bbbff2cd328b9c9e8ed7a7ce73cf9eb51df5623e30582d34150ae7431c78674002d4ac50ab9baa92e40b0df255e7773af99e64fc627a395d1bb34efc52fc8c41c5c283993ec4865e92", 0x55}, {&(0x7f0000000b40)="64554c7d9223358f476b66ee88286c5124c06ea80e7791df21ef8d667482510d9d243c67847f8dd3fbb8d72909a7702191f53d90362d36eeaa5c20de42b813565fde839ca77a451a48a8b62ea19465ab276ec572c3c49eac2931315cc38c3cd215991619fcc8339617cd4629e4d261118d4f8d819dd966017b4c5dbd632ff379fefd586c18ab864731e30463c1745f3649caad6cd79a92720d0c5d2e2c7f2bcb7ca2a4627b3f410c699e9bc02d1e1036bba8f42b8c7d7425ff54c02dd2cb8b9f11924b0eee4980f4d46a437311416a91a8a62767cf7b444757c4e8256536003d197ede068a42af4870aba3d425a5d1b300c7a754942ab45b726f127f30650d", 0xff}, {&(0x7f0000000c40)="02a9dd2804633249e3751aab586d19e679d69630ac07658038a41705f91c18a100d4c499f13c151a41bb62329f0dcb053573365e1475f6ad4c72c2fad7f66854e8dd61cd33", 0x45}], 0x6, &(0x7f0000000d40)=[{0x108, 0x13b, 0x7fffffff, "ac1c9b920d031dbb189ae1c2f9147e9250abde0b5c80f5d8be23e0ad1a6569e9ed7a2ad1b23485f1ac8bda3d67a85d740d2679837f22993558543ec87087bcb52cb63f5250471cbcd460a01dedffa6e80d07c1b1263d8d32f1f9da69092effcf7c8fa28814498eca35c929e92dda65469d17a39d3daee8a889fbafd9109ae7d2edd3ff34264bf62bfc1be9c1ae39af594c2696deb8d4611af83995391ad5e65cab0a5838c23f5b29972a0922b531d67f8f356cb7f1967f7a2a40f8babd68cff636eecee8724cc17acc3db89c96cbf96fdc5f93b54eafff49159580e103a970e99cd7bfac25c66f25f4f542402e119a5a76"}, {0x78, 0x119, 0x11686cf, "72e6dd1b1e8d552333a85d28bc6803ef381783891b356f6ee0d9088ad170a65eb440394580dfd20375e360473199f23de5a65254db5aa4a682a2c96b7395de4b1f694758c53736f09536d7db6febcdd6fdd46d6df4e4adc7e3432512e1b19d53113e391d74b3"}, {0x78, 0x111, 0x8, "96e749d5cc6ce7aa9f588557aa87074066c2ea7560016da162a787531bf2bb212f04d0d862f59aab2c75c6c9559949cc21675984c50a38ff2c979bddf7b45a17f2c54aa61865e05092e43f1e35af33a5fb7fe4f5998abd211e8cbc8c06a806e9c3ca"}, {0x88, 0x113, 0x4, "65206c111040c7a147b81b84af3c639474866c4558b85a487b94d1cb982225bb9c97d459c5f5cde602af3ccd34ac436ef59e72d7a44898bcca5235cae6c23d1a2133bfed140a54b94f27a0212e8c8781dadd4e6a62e273ce81f4a7b27edfce7a18d37e90ad683493f2c516d6319a0fd68ba6cc"}], 0x280}, 0x8}, {{&(0x7f0000000fc0)=@llc={0x1a, 0x0, 0x3f, 0x5, 0xffffffff, 0x9}, 0x80, &(0x7f00000013c0)=[{&(0x7f0000001040)="4a959d6a8b398328382a58cfbb4f11111b8700f1d8572a33c2bf53e47b4e8d3b6df4839ba2f9b6e64fc4a2af714de5432229aa1156808c15e3b6554031d928280aab03986af1267104e626b429948167d2bb62f4ab855c0e294c10147a4212228233487365aa193b969ca090d9d697c9d5588ef0dfb26e0c35135a1b6b5c675e7f008c7d9fa875f8cd8f5c53a104c3b2803dd42df42f4c2fde52c8abd9552b399df445bb485eec3b28b20741cddb3767a53c9ff645b200f6b6b8ffb85df16ae76f9dd7a06a43220763dd86be54ffba337aa7bb17d772d411bb47e518eb2458649f5aeb27ce5a8d056c3946b2a73be680", 0xf0}, {&(0x7f0000000740)="620d39325e691e84acbe", 0xa}, {&(0x7f0000001140)="2283afe080819f6a4fd790cebef92e3735cb746f6d001ce3706ac34b0ca1f56366f6e1a4985af9f49e365431309ab8d494322bb98b38308ec1beaf70866e2252b1170d57d83ac3b228c568f393421862457f5e7df7b27d36656ab8894a10dd57333ea20c93030ab3b8b053517b3c2d888383a0ead50d", 0x76}, {&(0x7f00000011c0)}, {&(0x7f0000001200)="bfdda6702ccbf3391d54793762ce5d263dd2b5eb238a388caa364352f082e97345664e6acbe61d24c0d96e6b658d856da7583921d328b167d9d41a7841d1b9f005987c69aa9fef56496825651623ca0ff92592b29f8a2286dccdd8968dd022df77ae4735c74c72533afd2d70a98fa0ab0eb80a5a13db271fd311c982a4df10eafb40f7b0d32cdef0254a535492290b98b712cee19dc3a4de6d070279479e42f2b031c7b02bdd7df24f3c7b35b7eefa70b34034e8287dcd123fa731849a6b771d31", 0xc1}, {&(0x7f0000001300)="52a11c32438c7892aa6a8e8bea790789cd2128ae1d3a00cad14f25ade1913362f7e2e9e9b67bdbb560be3a73d85b22f8de34307b63be36cc730b94ce9f08789a7c061f43e48bf38131fa38ca0fa521c999d6dc4ab9a96a5deeb70e8e0066fabf962622a27ed0a8483917371307c7cd20252ddac8a91de797b775a100b0ba7bbc551b9b1712f210b115e26292c69d6251c1388fce09b7745b79703f356b618312b22c07c22f51c6a526e923c4e3", 0xad}], 0x6, &(0x7f0000001440)=[{0x50, 0x107, 0x80000001, "7a003af2a84f59966f7ec04df135ac21dec532a89cec732323a325410a0d91e2698922f93d7f74630e218f0e6656ce5d96f26b644157e7f5556423"}, {0x28, 0x10b, 0xf7d, "a49b6dcdad9ebee01d1e5818536dc25d04296b76"}, {0x100, 0x10a, 0x4, "2a0c7c02a92fbca44fa2611de4a610c9692d6c5257e9d35f4c1f23094714cebf88efc0d9c8d55db2d502c73dc46957dd0ccda8bfaa7b151ab540e06abe3931f8d2e0a62db5847d5c922257aaa1d118c83f3ff4a41a55fb070db3f1a08223e51e015fc83a6eccb4d0a0480ac61d3ddd42fe40f6067024435f683a6ea422706d0d8e1cb572ad2382efd629d6977c07204ca69ceab8b1f972a4b6280f5d682a32a52caf90c13a40f1f2929948dfe2d23a5bc5d100c0704499398fc3ee9d2677419b523bdcc96c8cc98b572dd7a0dc8e1cd599c7a2fb40dcfa269c3679add4453aa02c8eca3a2f539294f7c51d48159e9f"}, {0x60, 0x0, 0x7, "517dcfca185f50c8269aa14e2a74bfcb7d0bbcc6cf5f6f5d8cedb05b6fb03236eceee554ce156dc1f446ab5fa2936408163a1a94bd8849b7e805bcd3187007e24d4079e56e97df052faeeada0337f4a7"}, {0x1010, 0x103, 0x4, "f409554aef84482de248058c33047bc02229de5b9531b068cbed6579dd45defd368f439e2d038044acddd96626b578be055f39eafc17c590627238b4c79136a665f9ff2c568ddfde8e386497e201e0e3cdbf8d3682a1bbdece5f22652ff852cb5a89596a572889a9083b49909c4ef6b1e06c18d263554a4f72258164c4d9935d8bcbabd324002404c86c0d0c3d122e87c6cf642b92a29f4c85593e9110a60213c80831bdb6809e5769019748509048b61245d9b238fa2885fe9ead904b08edb59abec4f150b5c9d90eee2650f159addc0150bf7cffbf988dba4b7b46397aaf19db3c01c4c5e29a85b442ff2ac92d1df9fcaa5740e61da5a02d5d983e87eb4dc88db313467a22d758f2371b0dd0266bc742f6b2840794d4ea8f002cab9cfc6da82c7580c72ef47dd08cd4347a479dcecdbd0f5719fce0d8830be9a142be03c24666c40ab5ff16cd0571cc3072e5c064164d92ae84a9b220023538d936afaa411fd871dae3328aae6ecf6ee1464a4efab19494f8261f28c8d1b4ce58866ede4d37a7e6dd3c16c2bd84bd1647f2d1d168b012fd78ce5614d74edb5fe9142c8ab8cb727e815d9e3659c85ce2c268c3b5d2b1a4894372afa91337a048e36a83ac5519b7d3b51d4b7189eb749bc524d2e65b2991632a51bbdb0df7b0afcab46cc6f3757efd919c76265bcf066820c081daa63de3166c55565ad960a3fc579eca30e5cc6330220476366f2370f876f88e4f12e869dbdd8705469fe314b9077b7c2db358789d6663b63d80c2cfe3cf42195ef1b4548c17142c370bb8ea2092bdc3fe85d48a9128c821de2d18fdf0583922c433713041c841aaa7daedd4dd2168b3a086581fa2dd9e08f2e0024b3bc50c3a2a6b6349b6cc6f15e2f2795c34e7bf8b294b3040d83326299f6c75af8d357e3ce69d5296e1d1d954dc531ff7f6cb0f840777cdaa1229cf5c36f2668640f7cb160d6e868bffb504ff591427287e48f26115812d3bfdf49b9a38521b72ead97fb97a5d3686cfa6187295c1fb11f6ff89fe6544e6f53d374f52e0e0d664bdbb07c69b4eb944e228233e1673e12944f9306783ed6f4614d323d5f5b242613b45a82e12e6f8113de25afe9fbc6dc11d88c1007b05aca62ecd2d3dcf1faed13a09f8d42909b4a9381a66224fca3b0e4b2a08bcc877cdf05550dcf6c7bdbffaea4a5beae0f8817ee2d20ee6c77f5b76962edf256f8cc0244487436381ffcd24efeaf18e1e68c94fd126e532dddc6f0377e66109a7d398d8c97efb6493b27e4e91af2f5c5af7094098f22f060123785e51cff381ff2d0317a097d0ef21e1c4ec2868b0d0e81dc4605896d3827d39289e6076a676572d46f765e3e78eadc7e4950ac493405cc716c2342313c4630a07eacb70475e06b1041d630bbcdb301a7e1258e9d05b661657e36e0c8d63292ebb364dd2e8927f66c038c540c65a97dfcfc4ebadbce6393591f9898782cce92c528b45a6c854842c9dcbc75b2ecc888a310887425aa85ba59710d17f88084bc6d05e9bef76bfc79e87b23ad4918c7e1ed1a32e0cabe363065ae35caaa737d02760bc5288148cd0ac5cb1a0e6484555eaef53ec8ebd2f3758f59c01cc8d89036413862b6a661e4276e067b535dd22b2a0ac53d2b900c0fa5c2724efddab336f4b9c9fe04e722ee12e819a6861130e341a2069b78af1b7b5705e45dfe24178ca0eb5a20d901b5156403d663df79fc5627f8463646db1d1e1ba76fdc4d4f8ca802724197dc950bc8c8c08eef55a4db331d9b9941f49ad2efb5947e6ee3c60982f4f1175dd686dd7d233c0690d3d69c3568fb4fc2d19e8f60005f1c0edca3f1f6ebf074e0cde0fd26867718fee2422bb1f049f3d64c55f43b1bab26d71e0cec38e839b28081140c0ec419ad44720d168e8212b8e19a3b6110e81e36ada5d13a8005f47169c5f732fd1d24c6fb77f809ce912899b02fab62772c8be9994fbe5e701c3ac0ddbad8e3934e4fe23692e095ca8b2364e90243f9028f62019821c572dededaef77eda76c937c74c7d74ccd472f02f4686ea3c38522663ac636c7647da8e8f90b69897b061437694a2cc2245c3779733a58cff1f39b9208f0e8d22297ca2d282fb4ac57658a57993407cc0398b7dff75b5c8ac26abb495cca1e025614ed6a9380b6312cbac5bff70e87dbf2c817af43c3add8e3855f597931900e0c0e6fc7f2e1572d48f3f2346fd56a4d558ede7535511139f1e6b997e29a5b302e886c626ef6badac2366f4b6d815792ebcfede0c96f411d86ca6d7442508e0d584fb97a457786002353578ceb9a9aba1b8ab88cf2333c35946ad6462cbd5f73a4c6ac93c9ecf41cb4f3a53109386f4c2c86d7233cc344f3655e9deccf4cfa2f23755237810d13e07e4072fb0a95aed14a9d64bbe91dd042abed9cf91aba9281b03a49a50ec980fffc808ff83154d4ab5bb9dc57de27d4455c6e7b93912966e5aac49278b1e5e10f31e61b09a8745436b45dc1d4e2654b54a8670b5cc9d821e27f3a9d7199f56033ada08d935303502f4339569f712ef9555ca811cb94450cabe37f69030964acbf9df8f9632fed1119fa6226581e3928223a571fa9a44c22b9ca0d9140c6cd2db635caaf8a16c1eff00b5195f80ba0eb45ada1ebf3c9cc751d9c7ec4df082735d7eaf3fda97ae33464999da8b4ca0849249f8353b6a8fa773ebc1276a8f1d3011d32bae14d5f2b9fa19f66b6e69790394a10e00f5067e0566c28656f00e5bd44590f6422b79a03cef735b20764e072a75f419f288121b83b800bca93593d42d3c77598fab1c016229a9b8edb724ecee93c5273bd1bd1ca9492f9dbd61718bbe2bd38ffbccb85c7bc578b754fc5edaaf834f844658d0b40a619b9832c9cc46a42f2c13bd38024a124ff299e3d81da089923c8d016b86999cab49cfc124f9adaa8646b70ef7b05b11731081af8ec3d52349ea3399af26418cf43a1c49f5e87d2d58f87c4aeb8ddac08265281dd88ac1357e010f1040c5424d43604f8cc3978b1e218007351d302419877d5b41e18a2a600296d4a4d76eb1ae14062f965aba61135822881c7c39c0337dcbd8a87abfa131cf303ec52c3d7ba5bbe39fbc915ed427afb70702b6cd1bf73323c0646387026cacb237cd8751818111736ff2c5cdc7672daa2a91c141bcc62570ab457959c798878224bef177f2f89c7513812955f32eb9e2007a4c6443116c119c10f12da5dbf581bd6dc7c087fe6efccddacd0d2f18b66757b3f7012ba11e0a71e3f15aa94acfed05e34fe3ab722e53973334c5b6af895b458d8480d4e45267e7943f0777f2004d2e71470946ca6b1f5aa93aac22e516674ce334376c84f73a1639971b3d3278de6932178910f9e7750e003777e0c570590ae84670fa454177f5b883d6872174eb0123ee6280efd7bf74eb7177d4f559e2256bd7d640c24ebb2995173d4de337fe9383b7c1fbecd01da4edb5e7917d942bdb3667995c7aa571fdfe3d4c6c898289d6c73f52956dd0fa0f0e55e5fb60eb5cf212653584c7cbab4efa3f66525ab125e065fb51e82fb1e69716d49789d96cb3313994e431ec1292e182eaa35987cfc8e3f581ca69aad4f2678d1e4c02eb6becc3e8e667fd7772c91d4429d438a40ccf5adfc61285e3a2dbb4a777c688e6c2287cb1ff5046d51ce6404e5821b34a75b096164ba12a1d13f0254806cbc6a2c58f48fa29a3850b4322745607145ba5359aaea4b4e841ce208f6ce006dec06d5f8c9ca134629b5fec8159e71ed8017301fe5b766fdf0da68f11391ab231810d682bf9f9d44a73f300596e02ae479a1de08d7bd592186235fd6a041e7e946ba5dcb4497f1092817e51f83b7d78761c107fa43c1bfcaae6a0dbf5fdc096c96b8e0989bff4f7646c1ceb2b3cf0998046fdf6c001ca8017e499cefb42a9b4a17aab7c3a425d9fbc8465fb8a8f12d576c8580aaa785d760f89edd0b14f72e0beca083fd7ca9ac39cc19dce9557cb1421b9af9da2b94b3a68e90febe1bce211f13c654f36601b2182d9aa544e202d003f5f0f69e7e76e28f149e34a2f676aa44b4f6d2d752be27a8eb3962fb0001676aba6bc2382fd0fbbb1a2f30810fd4163372c120d8d4ea6a5df8a5fd892735e3aaf288f5b646feb85dfd5c9b283b58dacd5888ace468be0f744c45f0d76a578222923815a969c41031b15df135a02a9afd12db1852c70b00dfe9c5a6f13a49c3abcc7e48445e66008208b69f360f972f5593b8c6a898d828bf6ef2817d1ad81961debdf7a0bacae56775343db5f16ad686d759fdf1c2cd8a0c1da3254f79159e60184b1aa10bdf91e9aa95483a07844f967f35d84e5e1dff6d38a2f5ecdb08dbf4d474c92159e0aed580a9197dda4acb11081a50b90b41f80be30b4ba3adcfb49644cee8b309c5c6c0ab28a90ec64f5c48918cbc39a207b5359de5b762bb1520dfed21f35106bacade4398788973e1e62789611a8e76be477b82815bd255427169cdc39e1676d14b82bc32c3a8d39eb24c396ebb8d8156f3ccbb4f1b0f2d20dae601ffd3a655cd6812161d74f33bfac43e9cce911a390c6e48927580287b10abd0b76624b34d024984fccbde9dbf4aa7afb29267021e71ac2a47f77eb4d47174af6cc3c8bc6fffc62989c7e3950ec60b2172b530a740581f8ca6b549d4962c5f5038b562d5bf2bef002f6d79c58150fee52a76166f38fcd8ba018fb4dbe1df0ba16787201c100de89dd7365245c8e47572adb51d65109956e5975f5bdd3ce3d2cf70d78650d5a35376457feaffce3909cc310c828cd8d3b18f170ad151ffe396b8ce222763bf8978bdc47af0dc59e9111d70612f600aa2f486e81071cdf6252401c2734b46232a54c60c714f77908661953012b7042838e9791d5187a5bba392a83d3ffd2a0473e6186aeff20175d7659fecd4c736548d76534b8918850493557eaa5ef6b0eb24b77867d2f69ffc91541ea1d83f09ada760422aea54f5d392e5aa38b848be00c6cfa976e32faa0dbf4ecd2819b8316a6f64126f8aaf4dfc90e8ad69986e9a7b5089c0ea97eafa0f2119722b411829d0bffbd8d5d65eb41f450cbb6372ca74c5398ee170a0c5b46311249f6a3e2fb8e438cd479068b36d2de24644209555d83ff600dc29d5055d48137aaa297ec9491e6faf61196acf54156ca922174bad9e5c7abd6c146f34d8d63f8a15ee96707581bef6a150ca67cbe535ede59249927950a9888530019e5c18c1362c2c133c56881b3647c15814ed37551cb65418c5b0c9ef0994a1c6504de507ec2424e969af21c9a983fe1242bd26a6a742b1d035dde11f6bc9fbc4028c66facaeeefb4dd6d7f22903a09c3a55be27e0b11d24feeb5daf93a1c74fe93388485ef2f08e435ca04f4937af881e25ccae89540bd0bb01e0ec2718a3fe48ddb48b0df856bfaa297a6e9991c367ab0560aab01c0d85004653c2a34f8a4b4641dfeb6e4bf4dda74d8e67163c6e8ef559a35e7c0916332ea8fb8ba52571f740dc2232913c909614c96204f82a78163a9ab79a763a36f8c4488750d6fdece933040b50441c3982daad69b3524cefbc94b16b7e1e0e19d1ea280836a5ccde7b30020a05aa88baaafaea312b78f1fd48bdecb4feb80a703a26401f9eb817bc7ac57e32641115db2e6a59e948b7e109f832850318bb0ba564c5d29289a776dfeeefeac9637b427b3e1403080e5a643ea6d9208b19afc8d623b0af087c3f8acab593b45e254033b24994416eec472576dfca45edc172e1c5f060e4a3dfb0cfe6afa936824307882258432149b7525cd034"}], 0x11e8}, 0x1f}, {{&(0x7f0000002640)=@x25={0x9, @remote={[], 0x2}}, 0x80, &(0x7f00000028c0)=[{&(0x7f00000026c0)="abce75ec9b3a91759b21c9c7c6fd309aa37b0e4612d679688859fa61aeaaa0899634974a4f8ab1b6444ff1cccb1d1cec20a631bc67d6167fbc7f6ba007d4f6c5da8cc93199ef477b6253870e645a52d474f85b1cfb53652a270101a26a56fb18dbe27ec714b2fccd786c950b1ed36ab203e12f6aed9210087dea91383a8e4d9e926eeba95aa15dcfb8261a95caae687006d4fcf6328995074f20951f7928fc46c0e8fbb91af50c6c1ded82f4bd83856bad3e2842d4661565aa0da096ae65578c9aac9e7b718909e81931bbe1bb9f4c0366", 0xd1}, {&(0x7f00000027c0)="a5753fa4a1df5e859142dce4a8956c84b4305b8b53003d77f0b10bda7ba0ecb833a625b622334073f118105c4c07d398d2f3eb1c02ac05ca86bc49488fd2ae2709bf387dd34ab46b8e15e76323ebd90136a01ad609d7a3321137c9c55644beec561f46b39631760a6fc966faa0acb32a13278140fa2b19fd646e7ffb26843de63e1ef08dce24f6d698afa193b46067a711d8fbb3b88e173e10f84c55bb395f88de47e0a5c80311bb7d161346d535726cfa83a7da6b82e3bcb051c8e8562ce526df5366a55609fd1781b3e26c7b56191930b56443700373e10e36bcaeb13e060ad3ecdf357553934fd338b48875b2e8b0fd", 0xf1}], 0x2, &(0x7f0000002900)=[{0x58, 0x111, 0x4, "9965a9ecacb04a07b7ead39d3664ca35ca3ac5ccd3df988eea97408e897461e7c151782a19f62e1ddda7b456dfa0f5a4df1c2e3471bb28bf308ea4b198f231e865"}, {0x60, 0x0, 0xa9d2, "fea6b512e2da52537aebbf91dae26edf2d51e55ebbc62701ff79e8887219c0e0ff479a4c470eae6268fd4e84d3daa350fe218a8fabc858533a1cc111390c573f2aca9c70d820d0938bae98ebbdd4c9"}, {0x10, 0x116, 0x2}, {0xc0, 0x196, 0x2, "138ffd25f4bad0ddd9990233ec06f2da4211036459d622ea90a617a375205d7e1627cec8f8dd176272d4885665d773146d96df8c4472a5dd38094e979130061bbccfb958a10b5eb1223deab769a51dd6430d87dfea280dc120e195b5b22d42c04b497b6971214cb48205a66b9f32c16d4f62db2fb9230910688bcf354ae27b6b6d3786131ba0d16537db4a4e33cc21f09549d665365fc63c0a09258cde86e1282578debccce160a72fe140b62756"}, {0x1010, 0x88, 0x1, "be5288c2bd6913ec22b254ffb75f7823249a5ca034527fed3365859c3dc275eceb009c06f422619eb47556e7228b98f6569fcffd79c37a98594d67d663037ad2bc2c6d30e7c4dd1998604b5bb0e601fdb276d827493fd9cd594394576bc43fa73f94a2df9f310601c352fe8f72d487580fa23d27b2069c9c07b59cedefb3b01213673cb7cc7e84ed6849981b5cb0b5d6845f0ad0f0b8e4629d74825cb3c6dbc73583bfeddb111759ebe7f261cde4bd12e8c9ebe197542213b1eed1736f39ce67647222c2b84bf123b3a64b322d041746243a817450ed4e574c6cfc67afefa59dec63c0011c7c1f6ff7496d3bbcf15a332d4d66254430cdd4d5c3e573b7b4fede94ac7681621b738c38b285dff18ad3ac9120394a1336942ce250d031a76cb657c41a3e3bbc6287f0a85c24b52ae1740ede1ce801bd909157414f9ad6d3b221d4465446840f5c9dcdebd33926673ee5e8b2e97d528fa38a041b97da33e322ffc2ddb1bd7373904d8830c240e2db3e9ee3f73db52d6f4bf95e55fe6ebfa1abe1de973a6dd9988b276c30936435d8ac87795c5876005d45fc0f2fec564b0b2299665866e95d539ecb7460c2683c2c909f75ca6870c6e0b653295d4f40c984b77564298c3e0b3e156a4ae17ae7af8bd1aca2efbbd7f935cdb8870340eabdd70b3c2195bbccb17a6ca91e11a50d07c56011e288a3cd651ef2c02cf7d63496487e113cc8e2ff9368047c17503f3507c06b370385ff4ba842cf6bd667676ca9e802f35f7bc76a1cc57fa3cbb3f56c70030ca492a2124d0b5dacf8d0c70e92847c67eb7d336bfb6fe2e5b50a35fe1c7b367ae20214fc7c9d2bc8b4b7c5e12d846b8a5aa43b3bab3bbca28fadb66f9792935c46245c3952f1c5f27d81eeb55e7da4502a8ae39444aa4fd1e9add3abe5914a39a2377d6637e69c132380ba9769c738537f43a6ca895ec43a5f95707a4806310d1f4bdc318d329c2d6c25b8f519d3016b38de096d4810f8e6b7177b5bdfb29e0b10840766b4f112dab172ff7e67d6623be4bf0a2c72a377babb21d19b5b466d8de1c081a08cbc695fce46929301c0cda12846664890a977364cab13ea38027b0690fa06b4c497e78a172e0622b2a4418ed29c76a7c204f333f31e7cb29a99ad0049179afc3bbb0914d7f037af5c1b5fa9aa90f662136a887c1cef1a35494f75d69b19ca99903fa0b0ba8bcd1b72d32f345977af8a7ddeb99e54ec694bc01f0e3f36ecc47585bf7150cf71fe87a13efe4ab30a3e9b750e544ce326dd126b895f185f09a6cc95013ae1282bfd6e81b8446b0ee88cc4eb47423ae10f54f4bdd0051e3c312c231d18014f3f7a2d4aae2b2931cffdfd9aa401c2eab69ce7f8d7f412a04e301cbf9ab75bf1450d15ea1a805e7feaa8bf743f4c7c3947e20564b34083eab54018802cd0e974c9ea0e27e7676807f33a276afde05b35d42f09fbcf2e516d17f3afd60f715fca5fa9fb54b4bdb9f06bba8645bf03ac52d5f9a8edd13d76ed31c2574da1f7d2acbbf65f667071a4ea21ded366aeb527b332e89545b7227c708b3233c3c8315d48a814c64ecb92cd871364fcca2cf9431cc70bca0223323e6738de77fb32c0ad2474bb54d5f4a821029fb2b32f924a3e141c82666af7a54aa2dc551c8ca6d2bb4c1dab347096e7f14b959274a23c78e7f0eb5e2a19e9b833266e22e50861160ff6f1a6f08178295b60c3776dd85fd9bb90fdf6eac4dc42876f552c374f8c6af3406ba45146757c453d2a32c46069ea88459f19b8fa7c65b901b6680ff65adc60a0b901796e2bec93022e5b0ba2def10b48093965562e18748752d06bb59d9a0dc75a8c2422cfd19a8a4c2060f8e6075716e1db04da0652c9ca7572213a36d1dd5ec4d4770fc434795aad3befcaf118b18dce8c91baaddeff86aba27e5f221815f6fac47b970684c4a5b7f17bc46c3f67a9f4bcfefe5047995e821918c06114835b4bcd2d7da665c11103af8639ff26f4a043f16eee6fa2a96a1939afeeea9b5e15045332c386564ef432d2b830f62e4fd83c37e17dc00cbe8c64602b05e1dc28a27bb87a9ced18ed8c9e1ead63e71bb564e35af2b0a18768924d88edf297d02a8a01fb7d8b02db8c3b7993c7ac5ee1b7d76649b7bccfd494a446d1fe5962a3cbb1709d873ab3c0d1c8e9432cfa3e9d1641af0df5373f310ad0345b7f28bbdf404ac336841382574a4384506b10b66084c4634285fc17e271e8ba69dffbaf41f99c24f7c61e5a65d1b37234e66187b30b2541c9382b50471f2e9bc5bb1b9bda8d7b78dcb4782215e5f3c0d20d7c3f7e4dea2503c04bc557f2db9967c88a36cb09c753ef10b3bb0a370419095ed8c30e665854f3bafebb1d52f3d45afc2731d1d3af97a257df5f148ccb49ec9f5da4114f91fd9a99e9e503c7da27669680615477f7ec0285ad108d94d1f0602b58fe25f9efad46bb9dcf2c80266b1519e023943f2a1f3730e659c289074401b77f3dd6e5470c686674314d7d6891961f6e7f192ed5839aba4ea4c01f2a37bb733ad24994b70f9ab770f2e6e73feacf4c8e114d9408e8a08f6e609a92ce47a133de02766f3d41adfa61550ac69f6fbba0f87baaa1f068b588fa785d1f9c1b7eca49e5388699b6dcf142841466881b812b413de853c427ba376417e4494d8aa667990ca62396b4dd33e291969d38c32c88ab164d45a8774926901d5fe13efbf95fae928de2eba258c9170584d4ac773a4494aaa16d2b2dcc037f323477002ec325ed40e25fa13c295d05bd5e9a386dc74cc276ba07495679319f6da9a87fcba22b02bfc9fe6bb4eb00d5f4a9ec17eb08218c6d828044bddac36202913e83d5f14f19071835831b8e25a089022da240f4f0a11b9cebea9b3e2ceccb7f41b03b49c6169ccef16a0c64187a5b624d848b62c15417faeb0f708937a489df72855e983233a9c6b17762da5030f5c92ce0563594cbaf2d007139be39fd3ce14540333767fed93382073a1f7258cf0d02666d1ad82cedb1e9f7363d16a40255dc50cb477b69df542903d21df2779621b47ea809cf22794df1e7cc39f1b53adcda21892f3d3e0c9b11a9ebfc453e728e489ba7dbf40ef08b2a06e26876247cd63746e15e9ccc48b5c6aef466f753c6516313c6eadfc0c8cd5dd77ef0a27f1aa2515a0b7b448c40c4a52d4d16c5f6f7608541e7942d61cec991515ac49ebce02bad052049e1e49bd3dbd53878d87e7f558412ded11980ebdac7cd25736d85b416cd768fe05295b26a2de985342712f093596917d1ca286a13c6de6c92122808ef343de5b6bbbf7a10ea98552b2706d00905de9b787856c8e9f0d1ae93c1aaf37fd171e10db4d1a195740cda9f326b4ab94ad7d652a5e618080805a2f46e1619ef373921e055aa758169f992edad098bea94c71f18d68cb6735c11a3618b531228effc1fdce8d199e98b3294c79a47c0017b4add2927b8e8ad8c7a5f74f7be9b912b631a7224da477624e0e3d4abfa38e25f52c70c9fd9b49b79ed692ccb0e37109fedba2e84ec67ec6412b5b2d33316b7db158693275ad9866d1c7773a6e256d89f803b4642bfefb1b533a923dca340b4d7243f65de8b8609fe08a23bf70bb3f756b2d503bf59634b7c04f683782ae44e4e3b3edca2c84fbab48363b6d395bb9813250c43d489f1687f7ac96d6806d2f4071f4606432841fa55a773198e2a970e8cdad0eb917f6efe6c0b60d4334aad20211265d1aecf6d8d800f4b068cfeeb8c6a85219c6842b50a72146abb6fc9796674c39ce2356ca56190d983c99136e9fe70f35f524b805368eabfecf492811c3f094631b3a897ff995bc4f1cec4d6280541ae81452801eb6ab4c79ad2ccc7cb9ef7987ef29e118c306e5b1dfa79ad5015322b9a43757e2edd9f4c0b5ca36130ec8e48f68951fd3959d3314ba6670e10f0d96445c3d133f6eb2f5819bdb119719e74475c3055324b1ab8979c2047587a78fab882db3126404db8f36f998fbd5d160a1c9db5c48827c022fbf5980392cd36a859b78268e28cf5e7019928adcbf540dafab939a5a25382b9d93f682948317ff9276827ebdffc1dd08d1f4b980d801b216aace96b7d5a36cb927fcd59e8617b96b1f2b766613a9a76054473187c9145f58156ebc4d3567be8dfa77ce377b8aea4597958a2af7d8ff9e605aad06240eedc0b6bd8a9146943399953ad9f8500eeb0ea53e585492d73a63563233a0f9073dd1701272c410af47057bb08e9e6b703d71979d39d1392f5290048cb030497e4dc524371d02cf18bef42ae96afb58a20e8ae25de5beae7c48c68f8e5ed270f8b3ab68d6d7cbae183668fcc117b4daa9c028fb9810b9ca970fb9b6c471b803bd9cbc2c522b5e5c2ba3b211f3aa8c7cefd03c54a21a12c748bd3d8adc8cc194aa84b2fecdedd4168fa125e75400b03a494c11640fcf9945408b663fd1b0b6afc09a4398c47b272e8fb2572c917574c04d6cef76e6c43cec8d73ac116f7f83d36afb6d48d9580b61cee1edabb1808d415a46a02c42a75b63bd5f5b24d0f82b56bbfcdea60bd80e4aad2366c0093d56871ccc9acf7fc581812d64f996d87f84ca6220016bc01b5f2d6ad83f23cef22259bfaf8feb46a69e14b7d09db122ad1624d2bc674fcae40427523cfaccada02ec0207d83ca58ff12394dc4adc374017ccf593661962cd765b8342887d37bdbc162d503abcfbb66f6825964a006199d846eba2358082579397cc18cb1895e5f56b956e0466063aa1e4c36107467ec39bd8b35d45fa4e9b1fda8547bc1e7e15d7dc0a230c91f3be12d32d98522c1b265a7ca218db1e46952f44af0ca05383457386e2f7c22715be6ef3bfa0ee950c58d5b5620ff36bac32f46a8febd22f59198ac673df096e57f5770dac03f0b80269e3fe15ef9e243b6acdc839f5ae341a7657b43564e736114b9c7d017b6056b899a1568492377695627ab24ede69ce67c76f59c73cd3f3ce2363ef8d4db2c765546bb36a907c4fea783dc05c345cb057f6a28a10f18440cc9e5ebed16e0ad5579b3d42dbdf1343144ea35b67ce769e89d6c617baa57db9ffe717a3ce2a77eca171cc4c890b683ce327f7795c95ed05094a808f49c2bbae541f6b268df61913e499ea8d5072c048d7d767936fb2a4b5dc2d7925f99c0b6bd8aa85069f12afb5046c3ce66844da9afe6f78f35793281f3d97730419a5a8949f5132d9b5aaa70c9b9fc5af60aeba8749caa330adfac20ecfb420a3b265d43d8d4d5e68f663c37ff82533d46fbf0ef64d3437e007be6265f80d6c8793d706df2135fe21d1f058ab5026e153bed99d747dc3bd857827ed296d10e5a62c538aa5e2d8314289899f7fc66005a5097e1161884eda7fdeab276ddf6e298158d592417a5f2f799552e6aabfdaac0d4adedbe5fd4d82099108db0a682d04ae0ea58b0a406c66b632b668e42582236d3abbbc3abbb4daee50521cb3dcc396674682091ca64d0943f66571ff30daadcdbb1037b75d9562e0495ca3e3eee686ec9528ae65d7c9fafc6fba8edbf6f4f96eb960b56e394f0509482890e672c0836a37a201d5506dd79e89a19489b916dd5ea74e262aec32e9fff180c33df2900a5b1d6514c0c2eaaf6692b44040d16a8dd300f86023d9ac28e4afb2814294cf013df87b5102b45f0864795aea7e8c528a0fa06ff54c75507aae2e7143dcf0c4adc44a8001b232ebb67d2666bcfa8142c647b620be36d8d643c12e5cb9f9995026798512ed6857005b8683cf632ad6c26c3e70f7f9ceab4828686e44870121168fe1723114ec319a"}], 0x1198}, 0x3}, {{&(0x7f0000003ac0)=@caif=@dgm={0x25, 0x100000001, 0x7}, 0x80, &(0x7f0000004c80)=[{&(0x7f0000003b40)="94dbeaaa0daf8a5d1ea4683c031a8108487700f8c3d1f395e40e65775316c8f6d265bebe40500356bc53344f5331fb7f2b2861cba96bc3b47b2461cae65818b2bd0cb4143719b55650f2d434c01531573f0c0c759fdfe5fd48e6343377a79dd439a6272163fd7a4a575976f50a93a7d6dc1e5bcedeaeec97297e1e19366a1d6e4b90876f0c6338cd5fb2c8f75f6785afd1b66982d2164f712d535ff8a17a2816ff57a3b44804959ea7292f", 0xab}, {&(0x7f0000003c00)="de7bb6730d7205084a7dd51c6477e9748baea2e578ad8a5d4c84373e3924f2dbb21ecc25953994083a9c8fe06344e5345c38434a001676d61a04aa69f958c7f0d72702694dbb0fa692b0ee1f42ab721acca588b0b0dbcbebfdfa9ffda93f341b4b30b13ae469bb6f38d8379d83136471faef31c9cfd68b044c53c45da4b8", 0x7e}, {&(0x7f0000003c80)="a3a2e0af9c99254e50d8c5e43c2a5e9a2883da370757b4ab301b32561833ca7d9ad52a4670d071d56a303f43265074f1f4eea6538f7fbc8633078bdd9aa576d87881076137581a5a10ad37a2d299ee828e5cc9b4837d4485b59226eed8a712601168b94ae7257a9d87d369fbf08745da46323cee0c83a867bd49cbdc008c2a333ef35efef2da73f0c887a61aaf1b12706f8612907387c5ca352c3cae19b82946f63c75e6710dae37f8ac1ceeeca6347082200a1d118a96bd9aa5f45abd2f64c1afc352ea700bc34b6b7f58976b9ca3e19bd4c7b4cdbcc2d87d676c46a9676c9c0e6bd067d09a02c3d43d612b05f92db49c562abff75624c73834bd2052778e48bd5c7039c7cf5ab0947b2ccce83f5f1eec328352e1b08656e81b5c4ad69bbf01a4ac0c1b7d237822654fd1c7f19e03761276c0d4541f5bcff30e987b4641d27c396cef9f166073516a416d0330b06e6cabdd3fc5a2885c711763e186f604946dadb7be955dee40f801d9f4f0d431c0c41d1e1cce8101dbd0ed7aa79dbb05b89d19523fb28dec69a5b0a37dff53a72afe6de51b8061ef55be4821fd9c2543c3e94d8ee1e06e21735df4b44b55e583d6989187c3e5f2d5467c96ab75134d542ce341398a8cef28da07eaed04ecfb37577ac10766073274a162f294afb06de97a1f970ee239bad50740ae9acce42f1ef31b3ff4e47ef22ee686fa1377851de1ab4c81c1ec63530091c0561998020686d4c78b075d86b09dea5f5afe758593d9168721567f3f6287423645085d07bcf167648a555de7e7692173c163f910fb0de933274d5b2a90c35734069191acdfb83bc1ae023cc52b1bacc615c8e525622e85110e8b8ddb5ec7d6ac49dc481eb1549ebdf187eec6ec129a711334300d249eaf5b9a48648c9ff3d645012cbeceed2ff7ad8bc0a6ce3149729cad3c8017a4ca7fa380744752d87c49656b80c4d03513c551461642645eb3a728f01aa224fdf7e4e8004bd1aa0b6d72ce4fffa7659a932e72157e279710978f9750b6ca0479266b966e1f0558e2a66569e999af5fcc8059eaa6aa9f55c07fa03d6dea48e59c5965ea57b4db558ca065df321601632b52512e6d8bdffdeee9bd2b654a7355326b47838adef1cd9274e956deb296e02136bab15be80a4dfb255fc09db14e076f298e76d05bbd2e82e92df5b1228efe0a28c1868a510d5280b48a9068c4b2e3246e00f81e1f3c039586cb40424294ce64c24d724492dd6e8ce51dbfc8a6271eb97155436afda36ce9653400c1e4fb22ab2714c2d15b1cb8acfac2ca539aa7050fbfac30197a60bd2fa59addde1a40b1c812372a81bf39e9db35ee61c94c06bad4ca81730805aba0539faba802e40b7656bdbc02061d1953abe63d6049f79c636b533148c55530b4837a3d3f3bceb51eaca325d87c8a9f67473764ae8be735d4a28f69a778878a0e7634dd95f1b93f2e6973f1f6711a9acd2ad21cfc8ba82a4fb758359367f718cf25c8f1a8186a376f8d89e6088af1e6244234d6dbea8d6303c99c5652c03d22c52303650e5b6a957d266344cd6bb4d9af5c696f280828a8ace0b575434776b561521275e1a900c7b96af8358cff7ca6eda080e5263fb7c728a87a496ec8c4d13ff5cf1b62c726aee40f21d6e099c7e58ad60ad8f563baf5f62f945b3c0f2d85ad7c042ec95ce54787bd4a815a3356408bd9db6cb0a6c43fa2df4e2446b60e9b98b0b1e1373e116ab80e728773faf7cb97b2ee10bfdd32f130150519574a6ba9b946822c3e8c08c689926301bc086b2362fef617ea7cbbe55ae92c47a54dc3dd78e4919dcf2e4fb76ae768e0b0bdbbece8c11d5dcdb093dd3d264e5bf14243c5a63a9da16cfb320dc5e3e6ca4b128e8f2967b55f425ee36fb095f82055289049c8caa89dc07499ec30832386fcfc5f92e345c440d3f8a45032d68b4d9b824609664fc248a23f0a8cd4fe32e4e2cf2673a44b103ddb2b1d56f924b27cbf6af04a386189d6c3d9d598e85f622ca557d211cd655590b914162d1e0d9d97a63b56f5687303ff8918f2b9ff1ff11be58e1c7f06610794968d0ec96bf5bd43a0797059d511a41caef23b92a3642cc068d9947c277dce70aade6530242964b6f2709d64b4fde6eed1a4d8559c572ac7eab2672356b3094c80d9340dd6493f931b376829520799d3f505bc6dae6c2057c86486adb8add2f3661c35098b3469dce9b5695c40876cc65fb1bc0934fae350620e5c97708d78fdea6497957918142e90a0424312a4a4f59a1014011c54bad19cdfc8f891002f5629a7aa6e8fbfedcaff84876d09172259318c38d2b9a6c782bfb51c1434386cbed44a6959442c34c64bdae8f6996c3cb85645628ce3830bbb06b051158c6d3865c0513cd86184b5b5ece2799834d0ca63eb23aa935381516b035a150552d1e32b08b1c19f99b59534625b447dd218d6e83e9755c734642a4a421c1f5df955f6cb5b66b9633a1eae9b882cabd372f7993138d08c493f4500444fb956283abfd5dc528b99cf8431b266d6173714a05ae1d2a86520bbcb21ca99c77177f4022e73497ab9445e4dfc91670ed6001f5d698f0a317887ed18febcdcd6e180010e2e982ca392a3ec1f39133a9acdb815ddf3b9b789f22a2128dc19d137fbc4a44108bb8f7156f66eea489b5f1e60bc41dd239dff84785e1456f8a09d88bb70702e2774f00ac46a76f80701b9c4037bc34ed1dad8b906582e3d2bf780d8d969115d4ecc7e1739b41321dca360e497fa19e0350bf8da5a3e6c5c850bb1b24b755dddf8109e5c8f73dd6adecfeded49647b54141a866b123e959ecb9a770389cfe8c8e355b2145bee4eece6e0eab4336658bf832bbaa431fea2c29d4a53f35b3e7839c78753454efdab57dddda680a5afbe9c3ebf5ef5444499ef764c98f5f3973e76a8ef7860b72f8bb089646b1337ca4d06a74b223cb54ce7c37abcf940a253289d2cda3ae996a8ab177cb4ae4d744535fef51d69d07ce73f434900feed02f10fc8e7403990be00016b67703509a02516acdbdcb0942dc4a4db0ba064c4a50d74efb016041bb982ea49bfd48a53f117b1f89bedd4a2c6ce9e70db5763c8219aec50c7cfc53d519bd247515987211b1d7cb50244668f2b3ad168dcae403fac8f8c190f8b349f84c8cd2c4a500b3539b87f74ff52422b95612d8332618fa2095d98b4c1d2eed0d46c82c2d392e551eb7f6854059cabf777e8d1d1f7a2e79b0648f3c6f7e9ec0ce1096027775236366cf37249042b7376efe2512da848e00096aa01907f6ac710b6e4de4f84aaaff339716a564c912d0fb57e63f0dbd3a6873394c4a2fd72a789f518870571154426eb76c51f365d120a75e0e8f117c10368a49c80f4d3d16ff56a4b6c71f6afd71625169169aabae99fb079cc22360137a6819427442025566ad98c11a06c73ae3ac4c56bde7fba487ca3a79ae8059cab6bd3f225e090c8916645b2edd88416f231813778df097e59b86873c4af60239183e6c05e847092b5bd859a2519033bcca0fbee6db0b70e0facfe981ec6cce8d8c6a6aae7a6e9ef5c07960b5a3584ec26921ecdac6a8e9a8cf42903a9adba536abfbbfddcb72084b3e4ac8b09ae7557867e951f2828d1f0c3474a4e66e532290582abcad06b5aa28803eacc4c30fc95352a6511ff16ab05d5d94e4c82aae9fbae38c3213a4dacffa589fe046b49d0c588d9ee8c5348ceb816d88798da2550c4099f6464af8da789a261072137c5cebd42a9176338beb332c7b439043ae3be8fa4cbae638c3a58221aa0ce3c2a5586a1156f70ce9bcf8f42610cb6c04f8b5d66b4508eec6297b8b9a3de254ebe179db4e920b109f01bfdfa980d4e85f636d98303f42290ff5f1f430e17b869de2b1f952c31a8fc6c3a612126e3812a7530ba670072ae6fdd1dc7bc2ac92fe9e2de9a563bc9de57a28293bd9222d5357c358de8b4472d0a1d733954d7de90fb4afb07417586dc37b3defc8713df1f7df3e55cb596330e223937b4058f470f187ab1353e5f3e3a2b3ecfbd9cce1d64184f7f918c383f88fdc6c0e999d6a946d10f553ccf4d9ab82c763fea58f61d71d0d562ecb8608e22e2524b31bac4f7e1e8bf527887fa7692d6adb3b91a009243594ee00eafbed85319f3b8297a427e991853bf8e6d83de3c18bad9cb8632d01f312c05282d2949033570984136cb57243ec6c1a1a18c9fc6540c99f4cbc319bf0d3fd6d8a01d8ebc31fdc4ed6def0359bbf7ede6b09a280bb4f9aa1908e2bf91848c142d573cadc6d0418c5fb88b006f92cae2a369a2c437194d5dd70f38cd70c9d2e87a46c20fbc0437334a2524d7d5c30d014b7f19357ea5e927f2920c3f5255aaab1e98c45b463bbc2471b245997a4497f721295592217bd3f146c4b28ee02ede47990d0506e922d128bf19a36429bf4dd46bb71f570c3468545a768effadf07fc9a9a78e089895e497c39e3da3a87a7e4bba7237f6ad4b0b233bf4010f4548cdf27b7d09a64063420755411deb5f90894b7644da23ea532f9fbefe5491cb1bc23dbb3da646ff766666d8710f30d58a7bfdcbb10718d5577d3f50580e53efff631785aa41f00475e1b323972ccb3af7d30e931a4935f1f5f0b0f6b4222908949fb57c8b7c488c97ee52cc34a8b1fbbbda13b542c7ad7c61a0d1cfc1c442c1bf1e274858b930b19ab106167bee5d1b2fe06f9c64667318ac1f352ee332735dccfae6854f743bc57e05096a01a9c5a93080ca414bca6d58b3761d459795c6c3f075525f219b0401fe989aad708de177c20d799ed5d7e35d8ca465e6513c7999a6f4dabd1fff4c612aa8a1a832541ffbf7eb860b1e2d6b3f4c74e01fd77d5c209c60db0050a54519e783bf29cb3c1127c0f90330dbbb44d17e32ffa4235f8203af0f1bd7af846221b013193895a89b62da70fe0c08d85f7276b650bfcf8e8000abed67b52c3f29fa28a3aef91450f03bae51db9e8020d4c7b1289ace242a702489d7e1be52f39d4ee5ae192b3832bb415c532d22ff69b8614671b9d8ff05c8e327c10340df8bcbe2edf9e2079a19e9808880bfc9d4f78085bd34a5d1da95ad6a5b05b910baf223a515700ca31de78b2f54b9e1971f787ff0bf281f114dc03b493545ae227df9903e9940d6d6d19805598ed219bb01e6d31d4f5c70a9e53dfeaa49aa87bf60e494e795bfef8a0a29123da7a7405ad6557ef24a519b34b571a674a6a20a1fd07a74a7fb70e5926470f8a1b893820456e2c6c1ecd8c984db591c400607921135e1a566a2a7f2194888884151837bd3f606909789056e8fc794558be2a41aa59b1170f4560d79eefc7237fb7ff6a7daec23ed75064cdfa3fa24963908a1cd58a72660370ab97edceb0f8901aed44e269876ddf07e846d1880c9fed703990e6ac946692fc7ad4a2ae82fda525e248cb448f761235f2c4a3a16ee08e9e39f06690ac5fcf66670573dfea5d0a43d6a99d45aefe31996c666c0c547ef20ce09366c13680417de11f554bafebbf62448fbf0e92a75f1de6a0f979b1359c477b51a717532976ece5572ec9843592d8bb947ec26d3fd4007cbeed3bc7e86de378e2d90ce121afcf753bc9cde7a1bd7f571e355e93dd2271d19b67d282a34e8160af2a4a05ae4c55a86853911bdd1de4d7fa568e9193f310b078d4456c2212f362b409bd24367bb3f2bada0e3e6904c7769af38d30651bc69372c516c5993d35c5af6f87f313cd4f8c676aadf0c4b56320cd1a914ecf8df6a095ea23b6e133811c9abfdaafb978d0497bd02c01b2cd84702a6174228b8", 0x1000}], 0x3, &(0x7f0000004cc0)=[{0x108, 0x1ff, 0x2, "72f18ac60e255f8a0729b73abf3e868ade8dae1f013e7c676eca597c1f28ecc7f83dc9c8aff29ff381894b73fc2c36d6ccc94b8997eaf45982e2e3b82789da7cb50c63ebc072aab08593e145377fee69f5b855a274274c8145aeb53344c901de497913b1136e0cba48aedb9819264c084e02d92516650a5c19c4501da394614f7a7c6c67f3f088152e84c2ba30c5f48a74773421ca306b7710671b89d53f064c7d01d5f0fa92986e68ffc9d6778617f05035b20ddb5f63128a5b36ef818880b347ae4d2d4eca91c264fa4b67df5f4cda45f329adc14a5104fb4c525ec51d078ab9529b865c23a62ac4b064bc8c9ca2043b9221"}, {0x90, 0x101, 0x3, "61a74128b31d0fed5f06688cf064af7ce7a0c6dce1e7f8d7a5b12083214032580818e5adea1697679dde2a8cf16f782dca45c162a4e8bc4d35c87269f1588ce58166f57c3ffb91f8d3c2d32334d5410745dbd1d2ded86c8f35fb8998b96e77804ba18ab465ec1ec5fab125f252eaec1fcd1824f1c2630fd918d43453aa"}, {0x78, 0x10c, 0x3, "e0eb1b6a1f091710e89919947e8bc46c5bd6768b8b9b6ef2fb78d5a13a2722e2468a93b7c8aed03ef3d4d1c166da49be08a0dfcd4e17f5463757030755290b4d2c05ca773edd2d6251a8d3d772bd856fcb67e4ccf2bbf64d11555a83ffa6bf0b4daf32fb5b"}, {0x38, 0x101, 0x5, "caea5da314a179684cf3e690fd276fe56cf6d24c40140a6b27631e772d9a7b487a"}, {0xd8, 0x102, 0x6, "c10972df20f819b6dfbe4d50902dcf77723e2ab12dd1a5ca80a1c64019999f2a8142d9c8f0bcfa32ed540b37888e95caa08e8b98a91e351fe0a965ed7b3c54ba1507e1fecf44c3699e7ab5958690c171a936bed12b6841130b2004761994bcac660b48b9df1c2e8c2bbfccb8c8b5dcf5db7911055c067e58ee78d60fc4a2ebfac90f23f311339728571c48213c102f503733f7c40b30df7784bbb1e0390e5c8571379ed3a0af535d6f1b0feb8897c5d0df507e5010a32ce573436bd4d357a17e7ff43c34"}, {0xf8, 0x84, 0x5, "2040b808411b4e0e731ef32c18e09d726c76f1646f11097a83229fdb5735ad0fe16715ca5d161518c01a1e03adaca32695c65e529f00ad4ec3f6c79ed510aa72d8bc6b2ca068bfba66eb4263a0089f558c7a21d5385b323ce6244150dcc46c6ade4903e70ddf7bcd2b4e1bc5617a8fce9f35a4480236cdc15c3b440c3fb0ce7a6ca00337fda8a7dbb02bbc40442cd618a7d1f3c9b24ea47e157ed97ba9fe2f020a0435da31510a1b8405ebda60873e21b90e69db5de007829c020f51c23aa933f8772c020eebf5c5ef0b04b78d17d1b9f57fa6d082d48178701cfe3d7e6dd6d28b"}], 0x418}, 0x4}, {{&(0x7f0000005100)=@in6={0xa, 0x4e20, 0x800, @mcast2, 0x9}, 0x80, &(0x7f0000005200)=[{&(0x7f0000005180)="8a189889babfeb5895c84d4ae30850133c30dde356763155657dc0cfa94c43aa6ac6353177e4c4412a40ba2584c404289f6dce656b3f230d4724cd24ea8154f718062576726bd432c22e83a103666925cdc1862368667a7138f2969c64ae2b6614f2d965625306d1", 0x68}], 0x1, &(0x7f0000005240)=[{0x70, 0x84, 0x0, "39212068067585fbf502531c759db2153bcdc28b26f024909a31610da9dcc89ff4660a7a8e95bd03e71f4432f4647b7624dffe7a42e918c8a2348577b3fa41c615b7f23fe59710cdb784aef867f68925b7bbe2b9b7b0b6e587b38d34e40dba39"}, {0xa0, 0x117, 0x3, "54ffeaba84271f42f5866b8e375f54edf82fdef3ef3e210241b8f91b28dbbbc6b432bf8376f685a79e722cc9e631993b8c9aed5713b0b2116e86f437a04b6f27a1ee8656a8da202fa108b7a9c91ca16509d1273721b14650a5ae1b89d407efeb1f750e6b08808a8fa2f84223d3760d425a9d5fa5c5098186ef8324a7212e0fdcd532db856e9e51d2340ed0241dca84"}, {0xc0, 0x11f, 0x4, "fa4d0e7b5725ce14aa9b1ac25354f31d23eb750b026b979cd163fc4c065d017669972f8b36caab822dea497d08f47c8d26a0629b6530db3eae54f611a51b92572fc76c15317d54ba7565af035cccb02e34b7e660fcc82269852a22868bea8adc8ce86b644599eeab433b45336e30da2b34d315699300d11d71f8916fc41291a6f714b4e4dec99fa9416272078403399bcd36cec192c8b9c051d16ba4f5e93f8531528af85cca3dc9e2277c"}, {0xa0, 0x117, 0x5, "067494b0f26e5bf127ce343a9a573a3693e4e01bcc89b6c5a324921778d90f381a80e4aaadeb0f96fc1a88b73b8e56cc69f8d337e3520bf2324c6331eaec5f207b80527b8ee300b57bc7a427a0e768ff9dd69247db3a6bf21639701cc27cf3f2fe2bf012da5a7a6a908ebfa7ce31ee38a038cc221ac7e425decf11a0c4286047e7db15af91fbcee2f079a7341c"}, {0xd8, 0x3a, 0x7ff, "a690008e369983c93f705bb15779424de049f2b32288ef128e16c554e7989467a52bdcd26fc027836846226477a0243ea7abf7f5680d42ba353a9ac5f43bc58ce7be296cd71eae36b90f1af6b57c6a2f25f2ee8aa44b7f697636591e312acd4d3f6adce3a2db37606745a2e29cba01224293d4e3ca73294e137103cc10475c542106c12379bb5a7bef8d0009f7874f6af863a7090efd81adab4749cbdc47279b31e9719b67ed9fc5525d2f7482527aade0b9a20c0b0a1b0128332a1c9830480a87a2fec5d9e6370e"}, {0x90, 0x10f, 0x32, "9d4d0b95eb414ec388e79cd507ef3485b04fb7debcc4dfed5129a4ba58ba557f3f15fa9456b700327a15ffb1c1d6ee4ee2f663a8e89abfd764cee5fb15b50b58b404ad2d655a32af064a9665395655f51fba25c1758a63cbb1e90ffefed4b7139c1a43546db1c42b59f32e4adf0a465d26444bf10e2c4c40e1"}, {0x80, 0x10f, 0xfff, "1276c366ab9ee60b53eb53c7b5059399bde409bb065935abcf227d90877b9bad78111376e635f558fc67e49b919b46a4e0c7dea1ed5468d6eaa0ec18659cde6194850c30231da1c62439d1c7bed27e16eb3fb51ccc58edbce2cd66a5b782edcfd10de5519623c7405c"}, {0x108, 0x119, 0x42, "2270d8bbdd981d141dcbf28ed42cf10690c9aefa3d1e53ad862515cfecfbaf977d98ef8fa77013071b21d68ffbc3405c1cd606bbec3f6b9f357614a9338f167bcb7b7865fe8e354af5017f7be29b11cfc1fc3586d1ced4a7f7ac59556c0c0980b427f4f8fd23260df3c5f942ad7d92960feece0f757b3bfc622a308361562727d51ec4863f63a6bc9ec77419f48d7ae24f388554e30af46df41893f81a69f006b48ce8d9bf767342d9431c58eda47d9d22ac85127d3ee2a514efc1be12f0b137b58ee1ed4d64752756c7d5e16ad502a42ed5139143c1be9b4f1eacf9574a017760480f8f51c88551303408d8351c6982690cc2"}, {0xa0, 0x0, 0x4, "b26dc8e773d9b69c23266a1cb3ac937888f464e74744779adf575478900c58f397ccb44170882c55034b1cd45a326c5f9bc843d633af82602a0e5eb2cc6e7f06047e16ba0afd90a8c8f84a86a05ea93ec5cbbf5e85521e772bd7756c58a2badfe33266375a2822da006f1ce03de2eea819f5f4a555bb16297dae73deebaf89d930fea7365067a9238fb4913690b8e1"}, {0xc8, 0x100, 0x4, "d521590a65876234f1595c5fdd65ed91ac970ea29a5972c6a720b4876cede23ecede3099044fcd7f239f8e8d9b21813d25195925fa82a186e96ce4e0829498284a73a8c11865f322214c5c9599812ae7ed2ced96beec87be6f1bb1ad164753637aa48f3a57c4cdc6bd3ed86fdc9eb792ec1d153019a1cc40a0c5e4ae1d6931b30308c2fbb7fa51733f6796513caf1a623acc6fb9146e6ded78a4fcd75e114f508fd413daa6d948589e50e40f2f216b642e91"}], 0x6c8}, 0x1}, {{&(0x7f0000005940)=@un=@file={0x1, './file0\x00'}, 0x80, &(0x7f0000005b40)=[{&(0x7f00000059c0)="5e0dfb1048ec92384b318f0cd438f70008225ff9531ca30552b2daa3c88d723e444bbd9a91b68effc23e859d705bc40d57239562fa53c7ada56114bfcb5737a252fdf3410a6b4e0be40245cf02281d5b12ecbf60803e064ef4afdfd2b0a168ae60e6e062f5ec235efe927bfcb6359e7b6931f6b86115bb4f2a0503dc1093bafe461bd78bf13047888d7ee8af9b2eacce1fd50df1e199e1ae52e4a2286021653aff2013d9eee7697d731dba6a3adcfb1c62b134d0cfc32a20db5fdf3052fd993cfe577f18793019c38ddbbb49410bc4", 0xcf}, {&(0x7f0000005ac0)="5d24f967bfd8c167c5377a1b5d1f6ea1a0191426430eafb17e7507d34d1bf2eb0ce9d82fb935fd4aefbedcd14386946d61120ad7108f3b8da481bf38062646f8ed", 0x41}], 0x2, &(0x7f0000005b80)=[{0x70, 0x0, 0x47, "25ab152776d572b24ea2e79ec021c1a575ccf84483fd7ec94304b32a65c19dffeb8ead81f42557e427df7f2add89c0c928cbb677c4f1c5c4e577363a83467eedec2f7c607ce83d9cc8d4c756f724c58a648fd5d3d8d2e8d7c279a4ed8605"}], 0x70}, 0x94}], 0x8, 0x0) write(r3, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r6 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r6, 0x0, 0x0) read$eventfd(r6, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r1, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r4}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r6, 0x0, 0x0) unshare(0x40000000) 18:18:33 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000080)={0x0, 'bcsh0\x00', 0x4}, 0x18) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:33 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x80000, 0x0) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080), 0x4) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) [ 807.006522] binder: BINDER_SET_CONTEXT_MGR already set [ 807.012349] binder: 23630:23644 ioctl 40046207 0 returned -16 [ 807.019781] binder: 23630:23644 BC_INCREFS_DONE u0000000000000000 no match [ 807.021641] PPPIOCDETACH file->f_count=2 [ 807.029591] binder: 23630:23644 Release 1 refcount change on invalid ref 1 ret -22 [ 807.048961] binder: 23630:23644 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040)='/dev/ppp\x00', 0x10000, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:34 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0xfffffffffffffe7a) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000040)='ns\x00') ioctl$TIOCLINUX5(r2, 0x541c, &(0x7f0000000080)={0x5, 0x8000, 0x9, 0x4, 0x84}) [ 807.271097] PPPIOCDETACH file->f_count=2 18:18:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) fcntl$getownex(r1, 0x10, &(0x7f0000000040)={0x0, 0x0}) ptrace$setopts(0x4206, r2, 0x3, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 807.330245] PPPIOCDETACH file->f_count=2 [ 807.400973] PPPIOCDETACH file->f_count=2 18:18:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000080)={0x7c4a, 0x7ff, 0x1}) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r2, 0x4004743c, 0x0) [ 807.440402] PPPIOCDETACH file->f_count=2 [ 807.510395] PPPIOCDETACH file->f_count=2 18:18:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000001000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000480)='coredump_filter\x00') openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000004c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000700)='/selinux/status\x00', 0x0, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000840)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCGPROP(r2, 0xc004743e, &(0x7f0000000740)=""/246) lookup_dcookie(0x6ac4955a, &(0x7f0000000040)=""/199, 0xc7) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) 18:18:34 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x2000011000008912, &(0x7f0000000100)="0000000000000000000000aba755300327c422903e6aede715eba535809bd8d72e8ef5346d69e490f3346a225b83c4fa88ef3781738c1b65b5d43afa8ef4cd8911ce65f91813b94e2f3f078907a18c0e6e80cda79821f9340f7ed2c3fd87fdb46de5c959f45624fc335ec49e6fa8a8ac13781ee31bf4a3685e252dd9bb2188a71ab92760a1b614ff8ab62a1b597557f9a49c94328a5d29dc2e9a233e001bfbac08bc3f7acf9b0ff497b601200e5a8549e4c68a1c935bbdf3894e13df573fe4b2cedf8b37eac06b996c10d100ba4a564a2ebaa752f1a6992ba6b58bd2eb795e3d8eddbb7146c68d") r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x0, 0x0) ioctl$EVIOCGPROP(r1, 0xc004743e, &(0x7f0000000280)=""/246) ioctl$PPPIOCSPASS(r1, 0x4004743c, 0x0) [ 807.686145] PPPIOCDETACH file->f_count=2 [ 807.715476] binder: release 23630:23644 transaction 885 out, still active [ 807.724910] binder: undelivered TRANSACTION_COMPLETE [ 807.750999] PPPIOCDETACH file->f_count=2 18:18:34 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) getsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f00000000c0), &(0x7f0000000100)=0x8) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r3 = fcntl$dupfd(r0, 0x406, r2) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e23, 0xaf5, @mcast2, 0xa7fd}, 0x1c) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:34 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r3, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r1, 0x10, &(0x7f00000001c0)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) getsockname$unix(r3, &(0x7f00000003c0), &(0x7f0000000040)=0x6e) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) bind$inet(r5, &(0x7f0000000180)={0x2, 0x4e24, @multicast1}, 0x10) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r4}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:34 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:34 executing program 5: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000140)={0x0, r0/1000+30000}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:34 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r0, 0x0, 0xfe) read$eventfd(r5, &(0x7f0000000280), 0x6) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1a, &(0x7f0000000180)=""/42, &(0x7f00000001c0)=0x2a) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000200)) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:34 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x1) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 807.975200] binder: BINDER_SET_CONTEXT_MGR already set [ 807.981329] binder: 23688:23698 ioctl 40046207 0 returned -16 [ 807.988575] binder: 23688:23698 BC_INCREFS_DONE u0000000000000000 no match [ 807.996524] binder: 23688:23698 Release 1 refcount change on invalid ref 1 ret -22 [ 808.013138] binder: 23688:23698 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:34 executing program 5: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) r1 = syz_genetlink_get_family_id$nbd(&(0x7f00000001c0)='nbd\x00') sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000380)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0e082abd7000fcdbdf25010000000c00020005000000000000000c000300ff7f00000000000008000100000000000c00060003000000000000006dfbb2be76227583699b53f03a2936f3f93c5baf02963c36aa081e54d9c3525b59f2ae3451835ede2d9f3d338e25b9522858d48e9875ef5d4520470b1d12115c8482aca80196f9825a7bf0161feaf7de5c082c817bb1bf23cac4059d9c5163282bc67e84634d205a1d62fab80d6e90c27fd0abd15e301b478f81889e3a660346abf7f9f0"], 0x40}, 0x1, 0x0, 0x0, 0x20008001}, 0x20040080) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000140)={0x0, r0/1000+30000}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) r2 = socket$inet6(0xa, 0x0, 0x8) setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000080), 0x4) r3 = openat$null(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/null\x00', 0x0, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) fcntl$setflags(0xffffffffffffffff, 0x2, 0x1) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000340)='IPVS\x00') sendmsg$IPVS_CMD_GET_CONFIG(r3, &(0x7f0000000540)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000500)={&(0x7f0000000480)={0x60, r4, 0x203, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DEST={0x44, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x800}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x6}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xf12}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e24}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x9d}]}, 0x60}, 0x1, 0x0, 0x0, 0x20000840}, 0x4000002) 18:18:34 executing program 3: r0 = syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0x1, 0x400) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000100)={0x3b, 0x31, 0x3, 0x15, 0x2, 0xffffffffffffffff, 0x6, 0x133, 0xffffffffffffffff}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r1, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000006, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000240)={0x8000, 0x0, 0x7, 0xfffffffffffffffc}, 0x14) setsockopt$inet_tcp_int(r1, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) r2 = add_key(&(0x7f00000001c0)='ceph\x00', &(0x7f0000000280)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffc) keyctl$get_security(0x11, r2, &(0x7f00000002c0)=""/204, 0xcc) sendto$inet(r1, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) prctl$PR_SET_SPECULATION_CTRL(0x35, 0x0) r3 = gettid() capset(&(0x7f0000000040)={0x20080522, r3}, &(0x7f0000000080)={0xffffffffffff22a5, 0xa55, 0xffff, 0x0, 0x3, 0xf3}) ioctl$int_in(r0, 0x5421, &(0x7f0000000140)) 18:18:35 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000040)={0x0, {{0x2, 0x4e22, @broadcast}}}, 0x88) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) fcntl$getownex(r0, 0x10, &(0x7f0000000100)={0x0, 0x0}) ptrace$getsig(0x4202, r1, 0xc534, &(0x7f0000000280)) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) unshare(0x10800) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:35 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)) setsockopt$inet_tcp_int(r0, 0x6, 0x2010200000014, &(0x7f0000000100)=0x400080000000000, 0xffffffffffffff71) write$binfmt_aout(r0, &(0x7f0000000940)=ANY=[@ANYBLOB="cc0007e0bf01000021000000050000004b0000002af5ffff000000000000000042f5f30908d42c55015b24fca453e952ae8ebc5df72acd47679b60aabd289ef663047e138f202bb2d498aadd1fa4022bf7ac062684b7277a2542991403d924cf4c363133e1f5e4bc42e37f29445c1d388d9249f177ae1734eba923abf730c33e1f16df31a47aaf2f1d2f4ad8a8b886821b15f900c430e402419c4da4d9541b4b4533f251a1b1d2dd2a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000045780000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ddaa3eec6da16f3e88dddee2d92979347d4b0a4c31453c3bdb4517952c88cc7c78afa058fced426fe3b65ca7846777fe29186163681c1f39d8f0ccebde41fb6d5281c4683d2d11b92dffff6825de1e56004425748bd73deab762c09b96e5c6784b4c76cb03cf637818b325ff69a4b6fa76708160da60e47c40aa10a4a2e67e4a41d1dd4b3edc8e17da54637e5ce0694a6cb2b2f30da2b3164e07c21b938e7b13f684cecd42e547e0d62a2edcecc4a9d2e58dc95df021979a39958822b9583ab749b3b15d1eb41351269904f3ede74c1a9c5775d006ea046623028504ff4280118e53ba430b5c3109cb224c9730daa60f3415f35289a515105012a1c9eebcafe6ba254ec15afd63e4889cb861a5f390053022631e6bd58ee901584aa895b17653ff376144dfaca4488d02066c945e0d72449a0f8844f57c9c1883bd99f300986002c61aae90f1101f94b33ffee2476cc37a15aee7b88724c25c75897725c5e0786a168d869652cddb97573cd15e"], 0x3a9) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000006680)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000400)) getsockopt$IP6T_SO_GET_ENTRIES(r1, 0x29, 0x41, &(0x7f0000000280)=ANY=[@ANYBLOB="66696c7465720000000000000000000000000000000000000000000000000000a1000000234f0e26ffba2d5a76f43b466860783eb72fea527ecc187f67e9502901c1d31a403f7441afe0eff010ecd6d8d1aae55efd7c9b5b863e0b37cd01618f2d3d0c4c1a7e75b4127efc4c1a2b06de5dccf403835a24543961c1f797060b2376717e1c7cf908f5eb2ffea371c903766cd9e4c7e195c3a441139a018698e6bcdc38327c026e48a062b29271b8382ec7c861bce7da1942b6ad70b9a6cef6d88e0d6398076f"], &(0x7f00000001c0)=0xc5) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000002d00)={0x800, {{0x2, 0x4e23, @empty}}, {{0x2, 0x4e24, @broadcast}}}, 0x108) sendmmsg(r1, &(0x7f0000006500)=[{{&(0x7f0000000480)=@pptp={0x18, 0x2, {0x3, @initdev={0xac, 0x1e, 0x1, 0x0}}}, 0x80, &(0x7f0000000680)=[{&(0x7f0000000500)="dd9588034be87ed53d68ade8a9e53a81cf8fad323d4ce932fe1b2c5353ac89139ff6e93ed4e39608379c278cebe79cf3b66001d5255eca6505aa30c8d4fde66e9c4f0b0155af34c32355c5d789ec6f9566079b86efbef570d02da9b052c862dc6a63081f24b9490d5d5928d074a3a84126", 0x71}, {&(0x7f0000000580)="1dcc8d592aab202428eb3eff60708fb1efc4c2bbd7ae01f882d5aa63e451deebda61474a9b0afcb7c805f38e0d8d21aa4de86c2ee51ec8a8fed4863dfac99ddb6813901baf6a65ce9556b5e1e2b99878e3ad105b320423510169821586b183c2b00f237a388537dcf46fefcf740cbf79563cf7ae10a9d6faaf5860ba706a51b069d9ee66ddb7c07518758478b6299d1122e22dee4f290e8f480740f4c3032e8df739d0caefdabf23b9b0cf3fe8f29233363c8f6a438c6fe7", 0xb8}, {&(0x7f0000000640)="bb1c6a1935d505be", 0x8}], 0x3}, 0xf69e}, {{&(0x7f00000006c0)=@ax25={{0x3, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x5}, [@bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null, @default, @null, @default]}, 0x80, &(0x7f0000001200)=[{&(0x7f0000000740)="28f5f5c2fe7f6860e62e856f6cc4cf640af432750624f7650e8cb9175680a2f33858b89924de3f311d5211cc25b92c713ad2b9dd4e1ef424cfb0d20c2e7f51c3b0df3a5dcf2540c76863ff2728c205208a3d5e57c16aa5e55d7baca66d5bc750fd6c899d8d194b6f6a3fa9dbd8d3b7731734a3e93a9252ae", 0x78}, {&(0x7f00000007c0)="c0561ffc753fcd797f6cce926c8e09b686b8eb171052181fbde15a3994", 0x1d}, {&(0x7f0000000800)="ab4a73e8443268392e2aeea71b6acb1406f9f14a689ae94f47996d488dffe1ac37e6d3c49c60370929731ba44af344bfc062f4281b19c481", 0x38}, {&(0x7f0000000840)="d3cdbc34607e6bff58f4e77027a19621082b203eaf19180d6bfce446bf917db98c079c7752abfbd529aab80a6aa0d8e0dc2937ace2cfe02e763c220e2f76928e2d9a9d3317b76e87f123b8b77e4514fc0e3639f222c14ef2a72edf20f4ab4f85df14567c1c76d1cfe9f5", 0x6a}, {&(0x7f0000000e80)="287a9d2af6797ee496308444284d9d4fd0c3d6c1c6b6265870f7556cb57352a03ac22472c50a17c5ba04c78497c5a014cbc43a79048c37cc020584f3db9c0272a349ab22049db3aad8970421f4f71478dc64bead7e46ef500021c2e8cfd8570caecb6f7ce4e218076690683c914307ef7728f48b82837d5b2fb5645619fdf09f30295306c170adf20869eaf7159dcab91fb0259e67fa03673af8e82b051088b350d7cd294c24f92b0f8e15d652a340d0e2110173b895f92d16", 0xb9}, {&(0x7f0000000f40)="e0145acb3848a6569e297fa541fa25e4b8f2bf4b5f63dc0e6921717dadbfbaee99f5d2dd6e5f842160d1dac382fbfbf6d8ba17c03a627f16440c3eb05fd9baa4c20d55ada6b057f881b2699897c2919f687e7433047b9f89ee5a7420aa5f84fc6d1d425f4d4f2c36a7f53b96c434c7b977aaa6c7a65fba898151c32e1b3aa6bbbcf07e3938a9036b97569d03f1bc32f52eae55e0c0c23ecff1b470c0d958e9c8d2d431714702a48515e1461778c327e3720d37afcd187055da608ebe75c157b939fdcca57c907464f6c22d5934", 0xcd}, {&(0x7f0000001040)="6d4da1dadac37c02f5aa8d6d4827665f37e3174a25ed42922d70b089202510f87d1d304695ab116159e75ca47582775908badd6efbd0b91cdd83a9ff2607413868ca64a165a69133567fd5b68b15bec145effbe9bf7b082602ade031dfa1e7d6075e77359ed83252dd9431592e8153f0de48e1b9565b6bab3683bc58c86c44b68809cde72a5f3c5f94f90414946deb3b5873e9140be458c9c19a3c4400d8d5c11e7b4db9f2dc7cc6d4db0df3054c25ea722e28ebdca36ef1c37373857d0de2d59bdce42a89bd8917c2137314d4c1a6273b66687d5a5eec35", 0xd8}, {&(0x7f0000001140)="06f05d9d11156f2302351ec36b3c3c39b70fcd2fdd57c5ad7171f18b365ff12548c23d45ef7fd9129869b70978f02d8e305eb8f5497470bf452485e5809fa85566054c495b574b5cf4aee39ac0d91cc0b1abe30edfd1d42ade110527f64371efc334debf089d10aa5497ef5c3ca05bdfd8b58b5e5b35596995cbb9ac53a40371dd20760dd45f0fa91a99e5196f2106151a2ac7cdece69011c8", 0x99}, {&(0x7f00000008c0)='~v', 0x2}], 0x9, &(0x7f00000012c0)=[{0x58, 0x18d, 0x100000001, "2fb0d34f983a25cbe3d5052fd1b5db88149e460fb951a42d18be4878e7f3c1ea3317e903bbc66fb7f058bb1877fedd98af9e8fee0143fea489ee624e5cb9b3fd02"}], 0x58}}, {{&(0x7f0000001340)=@generic={0xd, "0ad665610ea6b0996df9fae7da8fbd90436574590a2f58cf715161556b6078d3feecd687a687fd8c53d12b7b0c872320418368f802e0fd134a416c23a0cf8e3080ec91ae23f8c95080076354d73510682ebfee141b2f89bda4f65269b0a220343874d2c681ec0884f7f6825a0157d22f65848c98f80669b527e50c5453fe"}, 0x80, &(0x7f0000001480)=[{&(0x7f0000000900)="63cba8d733435847bba1fd3270ba0587d644b77659ce08dc7746dfd19035403abf4b0a", 0x23}, {&(0x7f00000013c0)="741ecd5b66d27b35c35f9d5f60718e15948474aca7ea2fd7db91d1a3ef2f843babc1050b5b5dcb2a5bcd7b979428017ec4800ef66fcb64f78beb91cecd2e25f7944ac9dc71c908cd1041f12247864245beb908f036ba5bed40a3ee3baeb0d7b4ea17404a04ce413f77c1a0b98190c5a55151c3a975cc02911b3b3578857c12c14dce282a476d6bd84b12c1f9d4afe969f7401c3e80fba99d4f653e93dec4279c08ca83e5b443a2", 0xa7}], 0x2, &(0x7f00000014c0)=[{0x28, 0x199, 0x80, "598b5c002a8b538bf2c2babda5ecdbd74305a3af1d46"}], 0x28}, 0x8000}, {{&(0x7f0000001500)=@in={0x2, 0x4e24, @multicast2}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000001580)="8544808dfe13ccd06dd73b681c58c93ec85b4a529976064ee32d8f136a07b2a29d51639f833b184e1a912034f5e7ac9b1510cc5695af1482683a700ac62605f0c0150886c3e56239ec06fc59c550f45714a90fcd3beca068a1daa63d439b63ddef2ffd85e58fbe58d8785edff6326297c940b23109f01067e6854261490e9d8ddd491fe78daa867bc8b91e84b60786a0f2c85fa31450f9c966cdd140d93d8d4513aedc8db5054ce2abec69de382b384cabc0d9e5fd5ada8f106682c31237c6b1f31a41a4ce08d5010a2283694f017ebed54d11604d786aa3a15f9a23cd3fa5c6ce285bd8127ccde5662f835ac4dd54", 0xef}, {&(0x7f0000001680)="1ebfdac31a8c4a361ad3ed4c20648e3fdd13be9e5a9bcc5c15e563438b01", 0x1e}, {&(0x7f00000016c0)="b10deaa57af465a18ce823bb1d16fd6bb38158641b6a13b74db7615a1b523f7198d8f70edfcf0799a42cec6a079d6ce3fbbb1a3cad7a6ea42531ac325943bfe4bd9a9e08c60495de309d1d97b0f911dc8087407377ac5951000c4b77db24ce018dbb26ca7ea4e28e34876a512ff230132e67cd4faec747f7d176dd92123a84334fbe693c571eb8e9a3bf61c88bac4d262acd701d7460faf6d3be9dbd9b3b8279418440f0deb0781b8ed5cd7602281d8ae2b20d9bcbb157ecc508d0f1cea12ad49c920eacc33cb9d25b1e3a18be09da1b529fc5", 0xd3}], 0x3, &(0x7f0000001800)=[{0x1010, 0x0, 0x8001, "692eb7035eebac951c12ab7c426c8c8a9825d5db851ee6033ce58c3ca30e3a86b10d04982eab213c826b0e0fe6449776b74f7d5e657dc6e837c71754bb5dcc820c0cb46445f56642407a1b18c13f1b48dbde9bbefd16a11399156d22c191e9ffed5ee5b8c44c86a644109bb79ec44ce2d0666f759e40fdfa88665c5f0b436475f68d8f57a53c6dbc07beee142c886e84c9d475e40fc417841c33066640bf86a9dd7c4fb7e83752bdf77bce5328420bf73421a2295e1a12aef3b4b9dd34bb1a62166ed9bf4f0737396e227baccb39085fd04399c8560e5811c137643f42db4f93d2c3758250f3b835d3a65ece17c1126247188a747d5a3e8963a4da0b87687d30a3998fa1d92f63c99d5664a4184bd0aa63b61062f0c7c9e5c0545e563d1c5289e472b4e64108e2f93b02968057e5b3098f860e0fbab214713e002ae45cf8a5e5ef21f31fbe00a09428dd8ee57d1735defedaf21a94c84f2a1f94924136dffef50cf66be5f418e98e5fba7afc619ea4a79e47f9b215da32eaead0112b0c71765acd76e163db3fcce61e4484735d77f7e5cd5aa8fa6a5c8a241e62da40549d21467bd8b345eca9684470863ba4d224ba42c31a29c9268d5d836a2ad512120c00a6963de7a7be3c4bafcc8a64b2ee113ba2a38ae68518a1074485e6fda07bccc6c3859ac13dabe543df7c126756705509b66021713dca47c52e1366b998534b11d0cc836fa82d66fdfeea2c2f8759ad934ba0c00ef09bcf0222665bf1a027918c55eb5494c1db0b569eb236568673c7fe0597803d663d2dceebc92cd138aa2c8145173b4a4bc98d0e32ab57be33be784b45ab2a2d5042ae6069b3b947fd2972759f0cb5dd5006415e6b3ccb11d5aec36a971ae2d1f103db1c2574ecf61d0a9c2555b4a2df285d3617b555f8dff870a4e82da94bd446e0a12803ae36983fd029f903f281bfeeefd19eca9f3a7a9b7f6fe6fd251696b05b8dbd0259dea8fc35bb23a7a1a9d3ee16ad33a29305e173d75fefd10d05b385e7bc37d31629ea70f65386322f32e18bc2855e0f0273fb2929ea509097fb7fd102c36960138379a816f7fee733b0d95a751c05bcaae2bae1db5e4346f26eaccdc33f15f1b3a4096443730fa9ba79805ef7d3097144e108bdd92ff15d98851debd0331d17d617769961c25bd0c80d038e5af663a29127fbe8fabc8fc85da2b0c7a6071772d68662459c3ca9eede3acb067fa677febf185d5f49fa1dd8551d18cd17cf261fc09b214ff1014c4e09cfc813f9e6d457280b6c4e02bea5b4dcc3b29adb72a755b57fdc3cf01589d74f9c6b9347813550e13c1b16570607f8dde49c54b73ffcbe5f327cb17b7e64f3f390fc8bc9441c1dbcd4da0a9ada63c1ef9b5be8c849971d72a531eee54eb9bc47ee688fc5b3a355179a9c47e7ed38538cd82d4ce74caa7c71dcb44fc74a31cc684b406c7b6a08dae64e284bccd139c2015c79ffe7d2a06fe680f4cceedb05d984d9156a0a0eefe17b1756f8757e16b234a0ff98fffe178f5741828389a0f276f85ac2c9d01313992a3e6ee7ee6a79bcf23a4acdd61f2577094ac04e340b8d5b4ccd4add2ea406019e060dbbf32f8749afec2a67d682c8de59b1b985f1d64f092deadff3d96d6ed95617219517f006e4cf47350641c8d19e84f943167a8403bdef260f7b28e9a553ad74b39bb53c5a34017dedad41a7ebe909283a4589cca614adbb34a29515ab398971072a74e5167fd6c4810066e56a9009b3f2e5a7c0301864cfc3b91fe0feec16519da192cd7b63071b354930edb6528bb0da6d70e1f12ad54cc71c1e86174ab6eb7834beae4756e3fefc9cf9386d62b88f4b5d07f079da6bd44b90ad1a743475c8f3cc2cddac12de385ffc2741e2050a66884d4cfbb045e5152bc21e5d0d1a02536bab6dda308a72772bc48d3a73271da3e784deed52ad6ccc94bfe9dbdbcf59c32c9cad77517fc9f89b0e1d4395b9a6a86a502f03d942c32f4a223ae0f30cc0616f93b4e233e78e4ad6af27f68544f0ccb0835872c0cff1d2d68ffca56b62c67fe23ed3094d615fa0eeb583405b7bd90fba4fd75e2a396fcd836c54b9a5ab026788833fa7a5fc32c6894c71bc346cd4abc0f92cc0341f4e9fd87ae63b3c939c7501f4a34c750cdb166a9e2bc635b46cf28e8eb71ba5cb0072ae7cca663d978ea7c7317378d9ce0e71a07e5c1a44777c329cf4b323a23ae6df89c5e016552936939ae6386ab16875c7bd14da4438e6d9a6b6d81ae599f40146c724afca96f9a0a7ad703b844f3d1e1262130fc8da7ef7b7a232f59fa799d5b2e4a62f95145a7645efb35517b05309e6cc7b928a4bc24f4e8f1a77b250d659df63a51c0c2411d1fca1dfcf45b60de3c3c74a20526f4b4e42e5f833a7592b415114a6c33b90af835eb49feed22eb3093ca0acae211c74ad86cd16496164992faa7d1c598942fa81e7cbae7f5fa8da259a345aee1d98ff5dbced79598fb1d2e611ba62b9e0958a83f641d7ea32a5036784a51943b7d9c18cdf8c7b79a70a6533eb929388d01ae229208d43ca1250a748ed20f024b65047c0c9ec51fd198d878a431435940754cee8845d10dac9a278ff67dff0aa4ba75fdc287841a6688216373980dcf4d9314e38774849a69649a110368ff811661c22aa7a141e512caf248ae62f80992612916a70eb61e13df58b97d14edddf9cf7cde9c1a3f6a4cef21b285577799606bec18a431bbcf724c42e0eb8dc8ae6fe122f77594aeddb808b9b220f85e6a82e6d719eb9ee53d36432cba36d16a1e03763ad536ae2928d407f9b7f9dfb8a888af17637da227b8e9be02e92cab89b5fef43e8a3ec38fab158a16c0970bc6f3ae2295860cc4fa15c8d76401dbcc0e1583e258557347a9a4aaa0296d63d14a2beae1a9f406f1e6084c609690521a016d3e34cf4f2e36f65a1f54bc074cc5975a9ca6153af484c2cf8a316bf4d138f86f1c974287aa97e89d10ee9f117d7e2c62be7de43d5de1d1c8e1b745e2ca1d7aca3298d9e41c60500654c614914beb35a5e4ffeabc972ac88962bfbbd962a648b9bde9e8fc307649e858377db6a21972ff434c62d6084a7db61563668e3e56951bdcfed9767411c35a29119c574d5dc8c557df8b3d624ca85722abeaaae852294ae83ad642941ece3f27bfd077e87144636f591d9f3421e38aa3d9489824b198d14d34c41c5c7f49a2dde723a0df56fd4a8840014e544cc08406765842fd1bbddc2a92d779b45c48349b6b8b8913163831de9eea8e40bd4686d795e0bd376e9c3c3da22c8260e8668c1e8603813833dfa9f15decedcbd91efc44acf715aa927489242c9be0f9cc1a6bba976fcd0077649668754f71fbc8168bc77125076bdf0257d05a86b23625996c49880a849bf345f7dbd0cb6becf0ad012b5f3aa3634afd810af97be74b6c3aaa223b38501ab60f993efad861421183e6827fc77424a11417b9b94a355d9c54e43e46c6ea163c25d2aee1d260fb08ac3cbeb3229fc04cdeef2729fa32eea421bb2214f4890dd06bcbbc11418d414a2cd21e70695d9cd65f3e32dc27b9b9639c2069c59bcdff9c5af94d294d784e083ebbff10d80f2e98056d3bbb4786e2f32a789cb038893b5b7640b2f1bcb31899998e77b825c25a8d244ba80964112c79e62a9ec14dda9ce00714db55159a249891404a217f202cc1e9de9e3fd81bb14b8434765b6d9e11718612abc9a2a8a5f3e1e3332e993b990e9cf888b0dac2c9956cb13bf0ee88e8a5faed498a5e8da41c2de5dcd0286c9ead50743c9b2ff9a2e34abc65d76687790aa59a272024606c1e3bc4db8e20099903152c20718283092abea4d5119144e25103c2859de698173f55469b843980f79106687b88d5fed14b0ef0f2d3446e8b05e2c3ef11e6915da73d947addfe673f469a19a5951d81f39b3275199c271b670fd5928aa5b22ff42729b183d053ca2484b827e826afc19a015257dd8b78255cf75d6d3cc6e8a9c38b5a4d24775b10db64a66e7b993440c1d6d8b13e58300e439ef09394c5a8a8430ff489f3d769729c25c15459af6162196e4b7f376dc24e872a1c721eaf7e2c6871df8aaaceae5aa9df5da0b583435704fe288d4ecea7bc51d1407b87634f1b80101c34571cae15e784d2389f660cbf761a984c7bd06160907e5751c21988ebc2c1df8f596ced1119ed93c9b6b3012e3c8679f66c4b5b2080fda98d917ff38e4b1fa67615fa290d13f4a8e42d0c501cbdb09baedea608c5744d98d24936f4b2ef7e5c3a502d86b7b97886fdbd5af9320d98515fcfa33e091d3eefc9148e065f937771b4f4e1005bbc7b278f4bc4db1fbc590b57f84aba6a065a576719ca979aca363e111af01b48623be684873709c75df5467c62190058e13720527fbd16859afeb8e72197a5dce492cd236fcc7f520bdf305e5f9fa5590ee72f1e8da727bf6a482a3a900f6cf0e68c97482d5626511f92ea6c3ae357d9b6101010a262465bf09e8ca0356480f249862cf874fb846b85663abb05a4f74af5fea9bd8db5003158175ad27deb009e228a4cf581aa353a2746f645eab6fb0e829ff04f83695bb7121e79bd150576e43f2de6223e6c32bd13b7d0e276f47301a31ee1f27e7b99f438eb96787ef702a772c4c1c57d693097963a2ac211b6a4ffc25f12ae1de1bb6540395d2cddffbcc71c325b004aa7011f7a421c56d69625f2acc04dad2d326ce24f11afa6ec21dbb20b0cb2c2efefc968e5d93730e45f5ea64e54ffc5967dc8577e8b99b14a50803faf7b50c5f78d3f0a10dd73c27358b30cecca3557d911fc73892580b43ea359d9edc71f17452d78b1b0ccaff7c60824c9e843f9c41f160ff9dc79d00ed385f4333e5c8e8ba9d6b31822c94fbb087572c4914a19c1be2d93c77b79e02e827f178360c753036cff1719af93869240302987b83efc6b94ffc6adabf6c1a1148911a4ddd040a5c2c6c050b54a9bb88bbcc1d8c58f997d857d77b2cd3ffc37ff151a6a86854781588b3b001ec1280258e067a315ca2693eef644f36975c9842f0ec7beed5618c9612f0ff7fbca2fb96829204dc4b5bfec803e254c3f20c83240ff9339e755b46ab97d4f1a92dab07e5ce4f7500f93defc09d4a2a8d74203975e7b17181ec542bd109fafd5ffcfdb696488699d6e8f4465540decd281928278a383b46f780459711ca431a8dc848d890ef91d6024352e38d1dcc832f7feddbaf7e14096f5cec8810b18dd6dff12e63227d3eee56a6ebefe48b06c4e06dbb07152ae4267676e6d898e3d7f9fa6abd83fbe27d8267a8fe5d0aa84ae8161d9de2691bd3110145f8729c1cb50e63096630c847c62c7b4fdf0e3180912b0ff31ead12d1cbf0b5ee2781e6919e90d18f7eb01dce66010693042d53668bc832779a3a5ed597e9a2d62bfa83e24307c4a5fcbb44b1a0d5a5eed95ac22ccd62216758734beef1d6f6baad7ee48b2fb390410033f36c3f14648d94822d64371780639533f756f9c6a24c1694c553a7c38e30204155e036ad9672173609edc04e00f4cfca959114f75dfc99f8f1c551d5724ade9590ec976613fb5b176b3799670ca7c3b69baeabb186ce7080e189b35be1c3f3fc21a56879eebf5946efed3705bf988d43092a8038e60cb24a68b87ca8d1b8aae33ca05bb3f219cb646ab7aa0f8c5376016e317f1b5ed89972b0e13366f4e11c1942ec67719540e13a63fd1c53d501095369288afa11443799ac9db21458a3efcf356afd1504578a4263bfcd1548709266d70e479c0d7bc33afc44d825c16be0be3e616d13"}, {0xd0, 0x199, 0x5, "0e04d6cbeeb3aaf936872e32d8b6cb23e02f170c7d2ef05186d6bc065b878f0480254413e87cb905aa0ae015380493e3bac1fdd02a2344b554842aa3dd5beac86232425c2482f8ffae48faec400ba3f0664d2895f043b8fa61fcd31a14c87fcd03a58a2036dc6e4207ae3f294394b7afa885ea23abaac4bd311e2bb440cf02fc68e3d216e96643eb2a50e9ea9601bc4f238b8fc45721da53088a4785a4c1fadf351b78e7533437b1dc2eadd238d8d52b07f0ff07825fb0bb278f7d6562e6e2bc"}, {0x18, 0x1ff, 0x7, "652cd1a7"}, {0x78, 0x1, 0x7, "928214aa05f91a90748beb2f23253bb9c78005f48e495490ae450bd9cde2472cef425e4d49d911726e5865043a01ff8eaf272d618955ca02473d92b92ab7195a41ccd57935b1fb08c26c55723817744dd8eb053f214e8b45197b80e7581196a848"}, {0x48, 0x107, 0xfffffffffffffc00, "37c731688357a50c14d21802125c53c1db165d0ea763173c553efe8cabf136dfec2b87aa55c9b3c06fe49e85c371f16f6ce657a9a629eba6"}], 0x11b8}, 0xdaf}, {{0x0, 0x0, &(0x7f0000002cc0)=[{&(0x7f00000029c0)="4452491a80ad5c7e79f5181138eb8bd187e4b4a0872153bad344cddc1cf8efa0906f22b3defb4f8f4e1c14c814dedf9b8bc6b69cb08e50d0319db143d84725d9dede71ffd1e39727c8b7df23f69294d2476e5652e0fced53479cd3a25a334a2cf7e7a555cd828d564f99dbd04a461af70762c0c970ee86df7d89af15ad21d05f779035418307af3a9f67371d5364b13180cbb1dfc5148b752c65c7692db2e5bba4ae9faf100d19f798d6f7e58a95497e6c1730962853953ebae39ce9bb6ab38f5e0ba3fd6c53059e3488b883e6f8994465a9e3dfc1cbac0b92daf00eef14d9ca43475461bb2d7cfd770d9cf3870e3a", 0xef}, {&(0x7f0000002ac0)="0482cd1b3fc81bfc4f821e5c3d8ae4aca3cfa9d40aad15ddad29a34a2e39517694a53f03a55b2dc1ef0551438e7b37d40d4a91cad94e1bcf17e8f1e577bca335fa42e9bb6a9197fd5c3e0ba9968e4411b0d9475b520e014fc86684a7492242c2b187e93726825218a1c9baf74fe3f6d3fe1ba901d7405bd2e359471c2e2a62135f8da801ba3f337e46ad08221b46fff762c84bcf9f41070d06147893038d2b0fe72b195189772c8b580a199868165d5272c8c06611bf91521829fbb0c690c09ec830239cf8481abd11b1ac0b9a3e0db56cc1446e5e6f0c9d2b", 0xd9}, {&(0x7f0000002bc0)="c900d9381c166bc4b90ad9368847330d25fbcdba74e527ff5e653649f34a4fbbe95200f4425c242883ef358f82e9cc72137a7b9865499c489c26202d92f8cacefb0acc73058a43aa2449e64da5df9126a1d3466549aca8525ff81d08d84d13f9a6a5b88c130cd63cbc102d08fa9f9246ae2a7c121a99c8ad2c5b0003e3b4e8b2d38134439062a03f1cab928615b8a9f5968e748bdc313545b69f776a2ad9b445c8d7c8ab74853cfcbbaa8529af005136bcbf9984c63e88f791085b48465a8ce7bea70cb59412569c9fd0deb950df5b9d6ce16b9d0eb90eb079522f0baf4e9dad6bb085b4a453c4aeba595c65f4735d46ddbe7766f495b3b1f348e2f58d5b", 0xfe}], 0x3, &(0x7f00000066c0)=ANY=[@ANYBLOB="c80000000000000099000000ffffffffd8eaa95e41900f799f1d1bfe59711053dbabe43fa6c77f9a3afab3758bcbfeb221fd35768e00a0a452693d1f1bc52d740c7e16f17f91ab2e8d9c3287570abd164e637d5d5916707071dd494958d29fd08bd72b6a077d29450a78545df1d20e16c761ecc4eaec0ceecf39533a331dcafc81adcda0f8048195e7b40775475750850210253cb72dd8133937abed32883fb0b903d82ee80409311b34daa1e361676f7b1d43c100acd5f60550164ad77a9d11a0e6000000000000c8000000000000001201000024000000865204227603b8bd8fdc6ea8aaa11fa71fd486a5c0aea31d25f7f03532cb6bd1d56946ec91618483cf4d549cef152b40bf3b8f8c703fd1d7f39c976df026c629a3967e120d02990396cbac4f0c55ea00d02a6bed368950783a92f1a7922be4ca1b6d7413fb9df939475ba00c7306dde427aed1c3c5372dc8d1c7ef62863ad9d6de21181955ff35fd6c72fcfba194f43587ef4c2c7e37923386dc369653228e5be60499fd2738c1f20f6c0ad7ba943bc65866834b3fc5df00e000000000000000ff00000001800000f4c1471c9069cb3130512d9675e9494fd00c2f092a336256e45bf5d47f2d1e41dfa4ab754e4db6d96d94d3bfeb3ab48375c4e9798cbfe2cc420c2678e0743ca4e795f46f720f2d8f5d254e8a2cea6b6e04d7a3ab46481f2f1b8a533c283560c9c91d333539804f5a3da6d5a93695aa8aae0fc3590df8090c4a1046753fda4110724c4b0ac398167c9428764c6f0d842f7e3dba1ab72d16ec674c1feb0e3adf2cc8d8cfa2265f3149436bf9c2369318b81bdfc480519d8d0c095b65cf6cd25785f5ae813c9d215e84790000000000000008010000000000000000000080000000ccb5da1c3d4ad89a4fa70d7199aa6d0e460bd3a3f734f0c533e23692e8d8a4eeb85c2d09207f638692eee7559cf9d93f658382d24f17d8089c37ac32e0e640d9c7bff76863b8a838548c38accd2d6646799aa440a02eb3c77350b8f66d4aac299e93582f2dcb85a6cd0201156f39aed6857a8e1c207c404442ddf6e971878df8f007f7e296d36da6dab1ec7c93418ed1835a8157db09bddc7cd8ee63a1f805383e6b9c8435df8a3710a611c8cd700f702f03fe5a2295e8c012507b28da65ac409e8a4910701d517c04f65f8851f44072d74609849512ee3f932e0f65d2898773c04c56227e753764930cfc5ea5ac41480421eae1a9f900002800000000000000090100000080000091bef6f16a097192d3fdb0e8f61c55fa6380876c00000000e000000000000000000000000300000034be87809ec44b8a60d48f4e4faba6e4769d2800b7ce169385416aba9cb81961310708364b7134d651b1de7b58c44b35e576d73432f363054c9d6ddb7c84d94c65f879ff77dbd7f35142235a5452f494836e1cae006206e860c16c26698460aeff8d05ee8d86d963ec03e4f6a6eaabb9a41e61bc382833c469e2902401bc88c34bb804e6b166b2d0de3c099b1ace084d6d5485f4440918089e7571c529868cb6e99b2f12d04066480dc8354ff462bdced41e4fcc19a735bea77e667064645ff59f87bbf775250fe94f1675f3f8d982051001000000000000ff000000030000003e96ab6e69064f410d2d35f2ef6eb06c523c80335c70b1ec2a0e531e67b6787f16037beda211d483104fe7d48b35affd7a4d9b512f735b1db8c9e130454c9768a7066a8a6a64c83ab50dc1297b62f113c14092679b9ece2867bac453df3f8218105141df062bb22bb1516f3e3ca09c457b4d152f465aab034ca36e0fc7b8842459ed3d2b98833bca49b820e16a6ef3af547c057e3aee651187c0dd9db16b893b902886d1eb926cdd59249ce1dcfdbd6fc8d0cfeaee09c453a92751946698518cc2928719b4770ce7de2371d59eaf6b7872db99c03a8c6f16bd2ef0bda78c50a52b3966ea4ac7c52547aeb07aa365823052ecf8a6edc623e13d4f00000000000010100000000000003a00000009000000d1883dfc2c9094db73538b30140b06641b7dd936523f674fcadab08100e77a16e5df9c0f3b353a7e7070e3ba6edf9e546f2d15e91a8d95e5fac2cbc8de0ddf1f24d8a333a774db485767a9e0a36506ac17ccb368e92597b6ba9a0d731d21a951f854efb25fe75dac2e5d50d15515c13938fc5b2515ab39bdb9dffe3bbd17f5ade56405e22ca211eff9709c48d274059321a136ab3b8117ceb367abd9ae4c0c9566cf41f79b5cf9f4b3ef624904945574bbb66269a10f4c88a22d7a6a99eb4da91b4fe783c4ca84fe45e5a8bbace114861c9c2293bae8402a5a365f1c92e1f73b48bfc8925da4430754a9ab71464c16e4208e6829815e6fe274e386f5a6310f75bcf1a5cb0a92a301210d09cf6809325ee83fdcc3f0709aade311c9fcf53e91921b05190848237fce97d8a2e5d0f54a37e5bafeecdc55dc703d18ee4a2bd343fd4a0fb5d0e190b2a5ce4ad840bbd6e66224e29997434d08a49c76d5a41e3a1174151e1bf476165b89a5294a79c559a2ddae6806dbdd6e3a7c13e4d5cfe75890aedc49d0df3665930d49ee8efcb50ab247dc59bf229af6844134460704f0d9df8ffe866971604843404a1659be9beede7331047e6a5e56204dd4f2717a5a55d6357be7688e1bf27e8bc442cabfe6e6007cf076fbebcf683994c6fe69cd159a1e3f1f9fd7ecdd73092294c9290f700ee676763724d91a1e81e1b8bf32e6026fd2e7d0b2fa4682a6fb50be72a1f5bd7701f964c6b6f97531e43768b95f9691fa904b135f4bc4a114e26f4b937d416fd0d752cda77430c676143d7524284811095c3482ac8023348a055714a29b1e9d18cbeaea1133960d30e1e2729416c7a41171b8eb62dfc627d8297bf827a7eaaf259e2cf2ee546e33dd66256356aa4b61406f88bd4b78411118ecaaedf79f44ae86ad00dcf233eb6ccb4a8ecf14b66c099529d6207f8c6796763edba9de26aa6af785f65cb1ef5397f8fefeda578a76e04440d6c820b7de51bc034faa24c4c7901b8f0f31d70c7d3a55b0386ac37e88d6db93e6e0f558278de057320462463c411a2d40e1554a136ef541bd893fa2d75b7ca44c26b72ec036131334d01b09367b57e38e9d321c9b55cf2e9d7e38dc3ae00b211d494b497ac3fa30291d11740c77a581ade735f306ade23e3ca5abaf0f22670c1f11953ad2d40a7d68e621956f9427ed7cc2ead50281a36d7a3b9b974250ac8d87db90dc3d29b03202f07b637ed1d67059f7c725d036c1850d8dc1249d2841b7b9320bf69c91b3acfefd063c7b41ab775542bb385497ee8929c3db41cb17f283f71091c2147b1f7018d8a8557143eff74eb9ba16d0b49f1adb527e8245e47b6c9a1578a6656af281a42725d150cf8322ee3ecefb954c8b3816347ff4ac2021ca6b5902b643e2ce62fa26f9bf33928922703fa018f31e11228b780b67361521aa2cc64ac7ab5cb1368bd3e2fe3ec539f0d551a4228d175760e7274195648b518d5f7506c1388ed45af3e049f8c321e1871293443618e3fd8ff62787de89a696e5a04cbf22d179b604d306cfbb1f1e09de8357366f54f055eb3628190897de670fbe2fbd3057a87cf42becdc9055b952a6f14d928a526f0de89abb4f12f479622183b9438cc7e41830d1a00a02946dff938561a73bbc12a5f02222264f4d849de0fa01c3de6cdf9c459dcb5efadfe3e3dc6e094328d0445c01e3adef70f983b5a7e3b098803ea8dd1a1203f968316a83a85e8869e6d943d018e5fbd27033903f0bdf39b7100dad3836250dd4c4a332cd21a65e8ced220e2d5c310fdc66c9c9bb6042f0cc07af695dedcb699fb6d22d9a1806deb69d5ea35baf11e35e59de82050fb9f5098373491aa60b0bec08267f1b60be368284fb8d3f0cc5b65ed1ce9eb4c76808ec6cc4f93a2f93596dc320a3d4d6c6f697d390c6bb738e12a9a6169cc255043a85f6a5680389bb51325083efc2f5adf04c598627d71a7264c9177160db6fef3d970d4e4c9f3706ab2f5c8a9afa0f09b9ac4a39a92355d67d4f1a25fb7a1fa51b9b790fc7900ed743b895e475721aa3e4d7c5600f4c17803862a14b8c706bb8fee6815181765ef25f106e41cff40e9faad668b6ff2eeaa8d427979073223dda697f05788df0ce15ec374db1df08944e9a710ba7fb3661fa014f9fdc96b6c5313820a069417f4635da644eaab9c10a19fc079dbc4e84384049ebe49b4d99352d7e841b075125ffd736b5ae2861a4f44e88f19ecfff8131da8b009828474986b9c1ecc567c9f03932be76926358c125070920df8bd61bc5a89fc0a4d8414d009d11be422f42fc47477011e76c508d97a7a95d120efdc9eab1fce796dcd57c216bb3b284e75a81cafabc5d8c3853e8ed033474aff04bdb965e8d8ab90221809b5bc8db7ec3efaef65ba5386f382ed9fd76db8af06a64b2c636f04b50744b85314a60152f6ddd0477035dc9b75a9d3262b94b8838f15f69101a417105e8a3f177c7e2379e4dce30ff8bb3d7bb049087a79e82a43c181d7d12f13b3b85d24fbf02961179ddea4441d42d59fc2f82bf7324ce7561f1e4c54363f3254a5ed25f60a4bab27c45469a69973b3ab21d4f1ff6f7bd96655e5fd8690afbaaa7e83f686d842d0698fe4b0735a63faf4fa3cbf668f0e546af0ed4942622490f253f5b1fb80415d410cf48e8c3e72f475692d1735954de53af1ce68af20d2aa5c9ef697260468cb02cd05c28a3d4f69d050d16f7363b57ed38ad1227664780588d2b2bed1a51f5efa138a92b7b6fefcc50aa5dd6f74692f29c6c447f633c09044c4f0cfb84de38fcd230596dee6d176840cf3f3741322296ba9b5644f777dccd743b18350d22a05058d685919670bc4a9efca0e3b2fa31742c70477023067cdbcefdb67fafacc23afbb403a82b5455a9d11ffb456a63e76dd7daed365bc10c90fa47bbf22a2c23b5f7b2725a2435c204948b2dc66d004f911a33447485116b63d14391715cd1613d9bddeb4fa67ff632f758c848fdbc1f9f1140fa81692fa88f4e2b3981bc9a2906e6184f54da5bfcad5ecff81c29d1011c71cd1dcd2104311b2cf2e06ba886d3636fb76e0b8aca44e054f2510e66afce7e4efbcfdd5a7e5ff6362e54607ef0fd44b39f7602619905f7eaf184ed12225a15ce2c0ec5f1230fb07029ecabd695575035ccaf41c6aaac1aebb99f99922c87950fe02d2258a06afeff1da4bc58ace6d41ba2f5d80ef133395aad8e00231056140049226127f5fd4603a01d207e0dc30cf2f060f5677eacb54a062b907d26884d2b6519b56e6245a0fa456b8076b4c4fc9c44b7f1ae5f1ed64854e5ed55e377acede812dc6b3e7634097c2e1e3e35e2862f6801747410c5431fd6d39819fa530679b3fb696297bb32b8caa8884a94cd997dfc853b559688a4bed0eaaca58b108af7cadd93b7cd81460b302e59c0e4847e62b86787645d3ee3397b11d763661d39c1cf8fd7168574ebc9935bbf9394b5677d9a030584992dae9a0124bd516336ac5287339c24aaa82a3745113cf127f76be51714d2ac206b6643429c46ffb5e8066d1b56a24ff150760a552b00e01fdcb4666b09d1f64f3d700b1514daf7b09a1e812dc95c1f8f4ac065859aa95118fff74ca9749dd017c14ef16077156611005f793770c3317083f9045602b06eb5225b7e84d3082385cb8670397cacb3984a7e98f389af698b2d9311608af210f533d083727aa84c27881530a95fe1196faa0ff777d8257bf1eb9340d6558345dc354fba7d5c27beb7418c51b30f12eb3201a4736b33e0fd622783eb79c315d9c840083d692502c879d115d239f69c590f769eb1a62ced99cfc01026caed6da8c4a4b816ad1f36570cb86c4491db597bb234c7a8771b6d342c287bdad482e1587a691cc4a2dc0ef8205806fa30623b0ef244683803e435d6dd3c985824ae45ccd31858bddc26e16c93d1a4695b6392afaf9d2baf3548634f5646739e607692cbf4f54dbdf8302af5258735b2e972acccab2ece235a6f65c1e0c73177de0b4eaabe62352b2878366ede8b6eb2a4f094dcf64b313caca62ca88d84caa314f6d559996c66208dcb98a19cc58740a060ad0366093319a5d4a19d496e8cb54dcadeeedc7b9d00576c40a428a6369a6c66d3a9ce2960b4d433ca8903583bd2bd3486c6af2f9ee92b5de1401b396fd7d16718f850742df04f4590413faedb91005834d23c96a506b31ba0fd5e12dfe6fa630768fbca1d6c111681cd123f7136ed1926ed494bb1c32db37104bdd1e64cc481276c690560e7a23594db796764372889231f9271a620a08a489215c1751469fb11ace90cda274db33c67e17f9a37c51bf72765161ac5b33bcdfc7d05e074c31ec7f601a147d5f19554d49e50be7bc32664d4c31713e5382d1b862c460a7414240b0393c5cf5082cbc827be5595c3dea4d0b3b9aab19d457e9d7be6fe8fe0b8efed86f3b8ee93eaeaea27eb5d2b0ddb49b2c6035e55dd8e42a5b95f9860ec2c6231efef3cf5d4701b9eb02721ab8c9c1cd589cc2aa8e588dc56505489c8754e69e81e112dc79172dbc66d6daf4acf62c4780e2c20f7a06bf892b8ca54de85f1e171a37c4c8d1cdfd89691e9f152b53c7da9e39d4a859bc938d5390f9e902446ff0458efeebe1df60eb0d42b40bd600fda5af0ac7142c90ca5fd0ead8e399d2dc5e3329631224d4d8d23185325e84001d6a3d650a2238846830b49204dc42b131e96a95b2cbe92e12070fa24f9dfb5f7a476425f1e65eab2ff8d752ca54aeeddfe3457192b4f16ca6e03f9c3c49e2e225af1de1ceb82ab7764375cf962bff12770547f51e459e7e5a9cef3c1599cf0564abae27b4175e6c414df0faf200f157f87155ef4d182b04cf4038580910f3ef87b0cef5124681e4da7897d3c95d44f7d30f9cbd4fe66558bb584e4d41f2ddd6b24c2828b784e555d0a7c6232f5f0eb3010c7de17603a9d750c96db2656092c4fcfd04e1f1a4de4891f7cbf381f8bbf1c0f27780dfeff59ce93c2d8924b714e59ccc6b3888ed7ea7ad84ecb0d9a188ec828d3ab65da62920f9ce63cbc89203af6629720c83b38d568ee8b812b320ce2a4083e9fa16e0f349ec8511d889183b144390cdff40df0eb4552242dcb0b45a4361f11df47bf05082046db07dc90dc7278001ec7c8c04cf0a1120119bb39d8072a3406daebf612cf5fb4cc19db939a840c1e98ba966ba90d22b3a64bf8a2ce5f0e1e40bc83c317667b18e97d5f6d9cd33be45cd87507b6badd687b30cc8b052462037e9fb42174eae916cf48d3d259b2f44de4b275869bacd329316ae264ffe5cc59aab63a790b383f473268c05d02cb34e2d6ca3d6d3dc9e01ac5f5748643368e81bebf8b14eebe0028d0a3e0e3ac27dbf198f3a2b5e3883524e316625bc1bfb742ebd8e14f1f4ac54045bc7b58697b524036ffcb5d7bcd8aa154b0919a0e111c6706136d565817aeff8074737ee848604eecdcea2609d86d730160bc19b6cab04992fbcdb32ae6f9f527506e886b557e910fbd508a8912ad1e548896162e0a375c33b4f8ea0e9a7dc52b543fa379dadecd0a577d0e7e59526afdec669fbfada3a3c8f3e654fe8a2d93aecb44d757c6048460a0dbe9aeca66098e1522a95c79d16f3b7604c51e8029e1623ef56bba287e53e29a8b37cdec4f2172c8aa92c3802349cd3597cf6e8155a11df3c47e545630873c26f8af60d04c1e56e189d07282534a40ca9cc01e8abde39f468783c43bb19b7010e4f3323c658aa50d39b5322958d5bc6df1080b6f3eba09b8368f382de47ac477502f100000000000000006000000030000002395a1df8b12cc28cef9c19b1ef2900baca11c7d6f2b8257c0e6bb8f255a37c698a7ac03ace2047de28ca45059a065bfd4cab0d157e0b894dc07ad18541ffe8597ed96e159f03cd10d902039b10f2b31cd9ab73a260a59a210e6c4ab55716c4a"], 0x15b0}, 0x8}, {{0x0, 0x0, &(0x7f0000006440)=[{&(0x7f00000042c0)="217d7b079ac65ee1edb6252eba3ae2372abeb894fe3d045887c6f9daea80d86c2f4c94ac2d67109677fc1a89a59ea4be48c135ea8717347d513c7598b21c99ae935b1012b650246cce7dfcf030c07688084756874b861ee31d6dabc68d421d22a488867dea5004e7af82bd00d64043dd52c17ad68a7c8ee51564a860e1f2ce1041106ba6ff1cd57af036033651b5c0932afb1d77cd73e45c852ecd919e072ca01b3a4d5b4517d09fbb0363a140dc9134fbed159593de63757044c0e91016dbe9359cb64f25a3ad66af23b5d2537bfcf338146cd28ca8273f30", 0xd9}, {&(0x7f00000043c0)="59de1c5234d278df926827773c8731f48cb4de986f24eb1c357405868f31fef05c67e3c487aa64d4b436787b62e55cbc9d", 0x31}, {&(0x7f0000004400)="9f17f1024ad155dfa0ac", 0xa}, {&(0x7f0000004440)="793b0b08ce9f9b412619f5f07b68afbe73b6fc5046aeef6ded1f528250dd6aa9ef63e503053c8d53036974b45108d21480a73b0344ecab20c86c8c72e2ea5249486e76087dbad47093e76ccff958d2cf65b091240444a034b4014d7aab50712abd3a3805a22f0242dffa20f5d3b532e9f39fec65caa681d4095431ada42fee44eb3285be7e3ac1f1a751b267ddacdb10f85a979e08a0ed1bf2ba7367afeab89fcb0924e3c632eded59e2e8d5111faa97da7ce5774bbf5fab9f751da226277af1d4a4de557709d78cb5267a21cbc65dfe452d3dc4fd7d0ba3128c7044711e00620d0980b662e96a718ca48cc3b52aae512cb3021b693334473689c2bc2c811cda288dbeaae69e75c78682f050b091346d59dec5b1150755ce6a7eeeb15e6c71ba2eb17005087c3e279ad29916f9a00d0e2644a5897bb7a8d1ed8e849302b10ecc0459c8b87f4b87717fa959429810a58d2b809935c112b91274eb6e33c8d44252a8d2e0deb8b17207444b784a9535f50fcf7c83fa3a8cb71a765d4b5c6a6b684e83a1334876dc5dd2f97523aea9955fafbb743bcd150685480f8b6e2012a3391e2e1afe1f25858b3e1fda6af625afc1f8e2a85ce55d9dbc6a7c3ff84c7d71009c66ebbef5e2f2be7c80196554a65d792fb167ced973eed64a7112aca9ee5c65652be649781258c22274b24874a7125fdcf442056dccf87c49d40115d0839f3ac42d15e99fd1b859d7f59d39e571ffd497d61bc6d216b82b1deec5b32c75e2ea1389ac13972af499bdf5e2ba76e352f92599c72095f125b2b22c2161cb14eafd74f2eacb50ed506bde4969f069f0be4fdea60ff9e0aa819658c75e490684d32d1ec8368867d55c53df2b6adcea9b7792b509a422278ca71e602796cdc828ffdee473b4808836c8e0ba84eb119c653c7fe8f5bea5783421fd253f85e80599fbdea81d327cb887ea76182f7c5a6878e5739fcebf3e0364c5ba3f3f6c54164696da7e331badff1560df9c649c34cb02af5af33c5351889b64c6c7d0b2c60a8395a2646237264d1334df7e9c23798955c96d5dc0c38451190074b4dde71af75e5fb22ae61825cb9fbae6d62cbdd726f02e371541128d355e3163f84d1240600decf1a83cb4703ddbee44e04469e67ef3d3e12f40c77010143597ac4966262c95e3b5072f197d837e5c973f57b9e417f5c23b2928f50634832197a2680c251deb0c99776b64b9df7e1f481cdbb8aefa97b84087fd8de79d6e2b2bbe5d191c3a570c32c06779aa2aa4cacfb932c1acc769350e0529193efb3fde99ce49087e144e73088442be7724c3bb937cce98c881163f890a28b7683eca40fceb049eaf223cba371b71af9df7b4d6cdfe8bb8b7e94b3ba6a9fab615e88bcd7a56f9b0f99e376afede95709bc765f836c03df360709fe3445ed99d053c54987def090a438c2d8ee79b77bee2a9d7a43e938e48dd3fa71f5894d343fe82695c24621524095497f1ca9d01000770271dade411b267e6bd861ca2100a8ee42bb239b5f3f012d5db58380d158a3f8369d6570b5e91dace3ff4c0a94a3487497bfba56c406d8a68b63087693f1194d7eddcf98d40a2f1971dc0a470923137d097aa3d36e18ee424dc82ccca331125129207e821a0188fff8d5032cb87880e9c50567dfbda938cc1b266a900f0f5692b4cabbde3373a726ed39d52af933b9f21a559145adb189f4c54445d5141b01e3e9b1e202855e0884b9acf7040c093d62a9fd337f4945981dfe82a20195e7b3e4cb06c87fe410b4d5edbb652f49c3ae8d0e8621e754625f9fa6c7d8c629056568d26cab1ad6c6473bb71a02db65bb6c2476f91e47d00e35e24d6819d8bb0814213e349f888ff4aef0b04f2e407f05288a3d4eee47d96d8bdeb7b5feb7fda3758a1180b31d5d96c7a679e48b6f8d09adb5883dd8b35f37989392df11fa6c26f00270362d1d12917947a96ee46c97bcd46f20851d4469f8002ff840e69e025036e13bfdc8b819fc80cd8f8beb10c91a421394729b33288c74425e2425861e5050b8df8e795d5b5bfab8283ed90d1f5f62aed4de44d26ef5c585d7b6c14bd134d1b1e41ed76ef128a12370594cc5bdf294e8c69c6dc7d41711be058cd90d7ba6bbe7af56e8c69b54020eb14f72f49339d767e2b493ad106c0209bd2e33b94b3135fac8c7cdfed0e0ea61039f588b519f99421ce23b6b64b1c87af76a9bb9f66f9ae771e3c8f6f36b7cca95f7c2b9841c569cde05da0f238f9e8277603d07a788c1aee9c0bae2171f7485ccfc0bdc41de073ac3a96fb3be01df8a7f686e32eb7b244b3fdc1701a7dd1b830588686f2e9c0f2698427c4e7f6336c2c6c618b48c9833d6e0fb635e6f90766c086a0b17aebb3e79ac5f8927e72b29de73131cbc797d1278b109f3512c462958419a2eba2966c4e87889e54d6433f2861b30b56d0e38ace17ca46718dc9e1f4751e1fdda7ef4b1eb2c87e24577ef6afefb9d15eff6c043be09351e77c96d171a8308a99185fc9070ed1736a67fc4201d251bef8203e9cc8c229e82c720b782ff3382492cecf52350406a0d6bb05ae5afb559746c96537372f40ee4b0b96d467227ee6ea7b323c234d4a553124c9b896b5d47f958a138011193a685be1fe8658c3ddc8f76db5605c0351ba80f4476af1b4da5b224e1a746d9a77ec43679f53d96947243d3fe47afab344e13f71fddbf58eb1f61136732bd3d5b27db0c431e63f711e51697c9a5226115cf434ccbeb6f2e21f711f8cb1445500a6f7cd6beaed193c30e7299b61732aab689cd4298b4d9cc3763949ad12969452e95a6f7dedd7babf50f9d4d29d2a7cd6689f8d110ecbe07883870002aa5e5edd8f53ffc4208acfa7ad6bdef0a38e3e820a47847044daf653eb89ec7e1d6b5600f667481f27a7c485c0e28fed16688916a7770f1ccf63d6aa604de2a61ceb7076f27c90e84518e5608f21f225f2b3c4a0f61c6b8d7db2b4c0ef0ebea4e7f0b719bbd7bee665eaa3aaac03c8c9278afe3c63753962a21e212ba7185caa81140de97f31a88e02ee7b2aa962103c48af953bbe2da28f842702501203c3a33892f118f0d4507628ca85550bdc8f53fcddf9b433526fe9be1a0db574efcbe109b540c21c0a16a5c30613c2a2dd363d6c25f08f96a133ad89e39410c31415e14ea626276dd9b652fb447df449fc2c326e0500187aae4266b15a032621db419d55da988c8d9d858618748c66193501ecb592f824d521d27276be7200d8783375c2cb194e21405948d2d95f10f6d72b82eb6cf3df9e4a3d8c5f5009779017b27378e47f545d1804d8fdc3d8f4ca3df4d1f13a9d38f417d30edff4089f31ee205f2a2d9458f2de99015eee5ae54a88261e6deeff898c253fbb2967bcf569a4240665f04d272590e744dad1125a503ae72cfdb619138a55ecad3d5de9d0c2f02c76747fded62909393963eb498137fc7ff5e05ce03b6d21f91a2ebe7f5ad4a067a3d30ef6341c8e346d6f17deeb7e6c5c804265b8927d9dff5d10b4bbed1ec52c51b1d9c0687bda09d300634cdc340053fa5b485a6b08ad4bb42ef0d32eeb5a33a05e41dbb3952a73734cf0cc22778a58dcef7becf581c169433d0b57acd839c1b3300a929f1ba38dbc5f90faa3e8021495e8ec7782ebf669e5956e9cd5493f843e187fbedc390ec82b63190f597165e94f9ef4bbe7f3ea2912a4de3b5c7cca409e3050182d8cf4dbf499ae9cb50b10dfc4ee68b09e9f764edddc5542466e37074489c4eff6f0d5456763edec7dd7f9923a6fef06f49f35acb6a8b17b73a733e103186d2c0c8f1a3e31c623be79f1b4161e2a3820d4f29596b6eb18ac388ff5a166e697759b132c085e04d2692c5d9d698e2dd24a59a956f0d78c91428504da17de954f4f37c3252c024c8bdf65502e01740047157e961e698dfa03b35fe0f7a38b8d4c604a405923737eb346de0b7aae2f7d58f60e060513318d5aa64111426c6191303e09ff97672d4a50cdf9890f762dd9219a29414e50169ff4a0bdb7fde3623b0f13e45ca14865291263e6d27572f3431998388b7b747a85663f3135b3023f2a3781488578714187304455927db6f5302874ee4e5e6752b20caf742e3e85a18f08b7d1def9bf20b73c65381d9ab9f2b07ca38d412d61a4b76c657d958a6c0a1fee43630ca40ea97981a645b19b04d33eb5a6212363291d26cec2f0681214404cbe9012b28c97f5a546fef7c1b6140f55e62101c153e731c5c1c7d2d182a4cf7e7bfa70e9909acba89eeb92c0eb071494af62d98cafd3695f365ca1557da575f4df1d3e88cf57cd794384ea5c5fed83e76d88ce6c39735232fe0d1a7f721d823d738c139d3a7383486c4524ad6ec3aec749c3bca7fef578e2053eebbeb6602707998916034a215179ecd1d4bd0af73faa957a1c91a7557656fc414e410515d1351fcc2d63feefc16a5289b7bc8e90f2ba172c030aefbcaf4ddedc1d8e5331e600c3c88f91db1bc6e2acaf977742d36e8e068ba2c848de548f5311af78a2d8d2726e59dd9b0a59c5bec7c6d7e27fda0bffdad6364e35b7b288b5dd2210f13a342356e23316ff57c3ccc284ce0048d602a9fc5d2f890069744ae78c6d2ec8fa9ed344dd11d707ba4a1fb23e9fcb64bc13bf856f99a69646427d241192c5a2ef1f82c1bbf1f3cae19a8c1eaf4d566c9cd0ad14b40fd41f8642e6257c14dffec5d41b5c099cfa749777259b2b6bb8e9014b5488cd35698e12ff148bf149ffc44c59fd168186e1d3004204c16b8f1ac02a616e1c1820346dd81c552d4cb1cc6196858c0be0bb75b51bd42a9cda4dc9ef3593292b2dd23377307d1b10939afa28ef2123f9212c9a721c06ff1ad8662c04810a089aec09dee2f2bbbb836a66955ba50e7ea1ebe84410ad0767f33ae425eb951ceb0aa7e5591084df2cfef9fc8ae5be054281235bafc0773ee3cc0a70a0c7e76b5d974531917d5109cf7c37b30c86ea660b60ce3b29482120b0b01fa907e7baaa1b76d11e3f38ab72b78530d42a386fdb0202e87c3db440c0c4236ac32dca752ed528e3df541de808684f0e185f6bade88e3e27679b6b142b88e41c3ecbf40d1bbb3c5ecaefe1a65d38ed6efded5cb880c64ef9b7c5045aba9e001eb23507d9e1085fef0d36b53d60786063c00cc0361f418c5ba1f08b3b525fd917a910bae57ef214d94cf4e9084dd238b759c0e7717307b53ecb0da6fa79e960354009bed6b76be6b5c82b90eafe0c3e06971d8c2c89a491b0f05400346ca88c5728718d9a50a4f8be7d909a870304a9427bea3bbcca3cb7380ae448d1ee31b5b5b58a1bd8791c6f842e4a6b6fc41dc0ea99c3d1aee72e2627d60cac4434b67f13aff5dff4786d96039683079db174c25f984be0b92d1974546d2898fe693a7e5c135304436fb6d83937b2f467c875a1457bb468ff9885b85bf9deace0b5cbed1d0e60366e56e5ec6eb16805e05f1214514b06c592e05f984e35d1a92cc510778d3a61aa70770536e89f4d0c47d7dfb092e45424275ba2c350e3d8174fc97e27adba2da990e434f59c2fc076cd2177dceef7a7d68e00dbfbb0d4c08c612de9fea46f42c133c6fcd4eba8591fa60f05dba934055617d3cdec6c979b2bd2efc077ce205747ee9ba5bcb2e45e2d1c8999f53d24890712275b84b33432ab6eb19fdef60b6a20cee6f5698a6b8114c6edffc44fafdd7a3cfb723d9b1fa167716fdff527169e45dbb6821b2f05b8ff6800b721e5a90a9bee7219587e47a7300e05a4aea68484e0fda537c059ad7ead782a68337be7f8120986", 0x1000}, {&(0x7f0000005440)="e8f72a334b948012e5429bd35d30caeaed7730b6af3102a02a944a9c79b7b42797fa8a26900f32be5932c170ad5731b68d6e7d1ce34b404bb772d186727aeeb325538dcc0bfb4973c0aec953fc8486a2a501c11fb8198c400d26da911f225b5d389bd4a25605941ab9ebb5f14a3d39c6a0b567e99a1b58fb92ccfb42fa14f68bb0acb3da440f238dde3bde372033bdfaa24cd98c4a4f2438dbe08d672f27005da270997f7c63b09e4ede6e85053b34d0a81d3bf841e95638b7f3dc93d59c343597127c8eaf4d3405596eb431a8e12806c6b08c657eaee58c44a3cace7f48330c8405ed6b108c0f495736a5eb926bd8d60ee12e3413aee72a90bf40ab395d70cb3df6509ba9df1de80502d08b26f575097f5466ee500c7e1ad5b7f183018357a0f79abc656d2f45b2960a89c30a0fba4bab9e973b9b536ecb093aecee8a21ab9edf266de75662a8539fbbb6403d4bb425651abb5542ad41c52728ae62d8b5df808151e176eba5379ba1439430770b900dc53d7b34b56a57df207e7d9551e28b6f984ae22df911a8925d3c3d734730fd95d9bcf38bbaf5a207e203623adae383a1d3ba9ba20b72fdde658470719b25c3301e193dbaf75851a846256d6f6000ec0891347e69e23f8dc67b7926a290a987dc8eb7b88c938af7690baf8587ff944ebfa2f2837b26f57c06e48c9166733cfa176ab122760505ca33d35e49cc46171f0c08ba50e0d3f1a5f294b08e27a1a3e7db4d52bd3d9b6e2fcdc6803fcbfe639095aae6c5d6ce463395b81a92a7051db35c59f602bd1c8e14eebc31f8fbdc638e01f2dbad9ce04af9f34fea3792264b7b591c8c9f974f89dd8f4cb1c53d31187f9d1d8f4d06eac2bf2707c3fb0c92a2a0cdf7b10791a8ee45612fece00de72b3227074f640c43e829b112e2ef2aed829919de1666c5783a5d5f052ec3afee36e322e96689fe86046863b6ac565fbe608629a294da53bc98b30b043f169094f683fbcbf2bb94c08c730a93fb17b8ac9ac78cbef81e18843a3a1f9276bb20b7863538894292fc9bb718d6a4e9e6a5babd8ff10b7b7ecdca4a2e57e672f3c18d749a9d8803309ed9b6a4181242e44e087be7c82944b291c92a2a5ce5704463c3d5d87fedc9e16c8ad073883b7ab2e8ad26695646364c4384b3d3783883e912f038293762466213492cd86c25611c8b67b5399de3210fc04bc7748ab3909671ef9616b9506c2848776d72e3921c3ceb32a721fff1847e9e1269dd94def946fd8fea439767b41674c0eea0db6bb8afea1da176ddc69e8bff5fb2b333ebffd1794c992079404bfdbc28208efc1bbc6f00fba35c493da4bccbabc7c9908b650f2f159ee0077a840bc5f8f333544f99708d9b24034939462670ff186c94891091689a380a5fd7a026182a2dcc975ccfea0351b41c0ff47ccd4cf23ebffbda0624c1893e5f62aba71e8a40c82993dc57e38fe751a4b8b6c6be28f72b5eea3e80b1454ff48478fca8ad95d157f0a5d50c12d50d4bb26636a65575f782397e38c101b17dfce60c49c9b1723900b9b705cae95c4eeb5093e984bd6718135faccb6e2e63a287c142573301e3b2f0ba083a41b73714d672630c0daac4b6a63a3863d2e83a4ec33dcbe5b75a4ce446fe95af70a04c1a43469c8d6a713303d5dc5c0c64b48c4eaca368b9733b6c4a58a5031e2291f7c5c8f23d06dfe34d4605b0daade0f9a0187a4079d98aaba78e6aeed0548771a2d1b56bd8b98216b4b33e5562402fa658b8ce4c0b989d536a5928c97e76793b7eea3452e8753d669e53878cd2c61f7fd83935d706767e7b53505aa175a73166e221106802f786fbda22f3d32ed3f2e777856b4d70ab715a7eb46a36f2e655385edf168143711bc132cf0b77821b902dca5c43833ba8c8a2f12c1059de681f67bc6f0ceef187c7977cbc6758a029f88c77d1e988d8971a23971ebd2c72eeafbc36de8a4fea8609c5cb0ddc4ca0797ea57b0dec55602ded7a35942a2f75b216ba9661b81a830132fbdeffb7be371998839184447aa9e3ef7dbb5fdb4102be29f01b418749878ac9348633bee25993b493808edb8143aa2e285abab8e843f6eacb2b48397a31fe5728bd116bffccc99a85018c154cd38dd0f6d6a25319c01bef1ac4fa2eab12aa249db21c0c5bb47e47f387170bad923473fa8ebfe184a88e35207a7b957e14ab3249271b19eb2ddbb6607b810218e286024bf4ce554823c7447f839c89b486b7d2e2599620ffc00377bdd296ea7658e49733eb5f9ca3d35206947e7e785278b87615942fec0b33e58de0f0fbce6f9a99a552d745e6fb34f80d8774c976a13e9e55421bc27ca76af2a0f50b2b63034b93349f9622fd8122ac8c54b3c6bf538c06826372b7cea96837b4c8389247c4634db3a434deb96ec30203f5d17cd4d7642ea05796cfbf870c70ec8c93a202c9a0bb8cade677eec71d9b4beba857003f8e5154f3df00f5f14c15df251aef86055fe958a30d031000af3d6ae69f44d2b2da3dfe03faac7eb02625cf7c69709e976586e590e70bc21079d70f3fb84f0a49b37217c141946fbb318887d638f5bb0f579f56dad79209ea3fb44c583230ecdad1659cb6fe3223b888526e9c3751e8954c230a3c3b81609f75393ef6a807e8d2ec964a368673ec6e69f3d2decdb3557fc8f633c965efd162b2644b6f020163d06620947f74cb1914ce27df850ddf16e64cb0f8d4f686f96e8ec02bfed522ada6756754666ea29a809db3d956b0f64afbfc55a974908210ac12879e70374480394b2be42f619c375998bc8e7bc6ba04ad6f7e51377553fc3276bc2d236b1df2ed50aa8057bac2c48e409c40c7f994ad616c7ccc898809306ba362d07586d2090a0691e436a3c4c2471a48c0fc6be4bf7c95cababa63d5ee816e5015ebbdf0b925212fba6cc4a5ee1ca42d6b90cd93d14ef3e29a727cfa7db2b11b53b31e726fed0dafc813eb4292d6b4da3a4de4477dbf67a25b7358524ce4d3786d329666fcfb3f71c1bd5948dd141dbd2dc60eb4b57b075f91d9f568f794fc9f134c5a63326a2afb3f5be57edbfe3d69c5c6f004194657696c884dc9133cdb12a7622197939c9d1e93526b1785b972067dfe95bf98068a0c9b40c60a456dd3a34758d52949c2b4726a3ea37c8d44919f688e6c05b31bd3f17dbb7547976c51a54402443c5c434bc5c06dfaf2fb662516b1394ece203d808449177ab844e63bcdf0f48eb8e83968eedf3e4156b398a2572a0808ce976c57ba3619155c3385491d3e927840bc23aa35225089225dfbf25bdca88ebfba59e0addca1e3b26c0bb7ef1913e8ced25fa048d6797372ebc9c890416da2a577cfd76552d517fb4341141fc1d991b7f957fd66a5561fd7027309a2f4d6a334fd62812402a8c81c5956ec2dfce51619fd68ed1f21d26e6523291c83754c4216728a0981d517edef691bb389c1f7f7dddfeaabf3206abb70829c8e49afdeb30a2ce0c0a75bcfd3cbb6fbf3b0fc26057e92849cd54322b4b378af60a582150c2ba812b9e83ccf2e75de40a9dc0e6a90cfd61a3b6770f1878e5b6693312a52e25a23a8f44499b7f3f36189275015865bfb7495a5d5ebb7b91438e29a1424a0ebd8b4e48f11626fc05203c52040c8614d8908e3983bea98b54cb6cb41d898044d7ded2ba1fc6d97a48554d3b71f7f47c680ac0a0361059664a741ada8f8b712a895303fdb6cd25e83a3dd8e2b9906c740abaf7e61bb9cf699d9425d8ad51b2cbe50338e22b720092b0e5871c31f8db2c75c591f913c91c64eb738fd8457beca79e767f14b87919ecceb18d545703794beb2048039d194c0597fc51df5edd7a63e759d478d076779bd07545515fc7c4545b0056c518165b518b0e0d4b821760bdabaf999e42dae398aac47754e73f1dc783e95d30df843214e09731ba96ea3ff6fa9162d83a7f0bebb9aca37793a944ce975f6c0c7879605ce79add38fa44eab46f402fea24015b2c2ff810b85e16df9c9349b6857f95006ec4d96946488cf356701a4dbd415f75fdf4db8087186dbdc41a9c038f06169688a9fec79ea6959ce15e6be2d8f4d787f4fa98e7c7b98ec45cb90cf982dbbaa13b4363c80e656a20e96d818063998d4b153cd5e8c7ac868936c7a74dec44408aa2c89094acd9fc71c7181b63acd6ede7479bbc2efed9e6aa6984c47073a21010410b7b4e16686ded9393681dbe68ca6acbc9dc0da3db7c7685e38cd9aad335d8751c07a5ef709d31f7a43138791542a2dd17107cc02b4078c24d723e7b905001d9fadd564f8c3c034f2ebc99f54e3103010b72427a56a659bdd4e94c121a312ab2f3d365980281948561655b76823576ad08574a1848ccb5329d8789ed3e662ca653aafe2b108f679247247545194c87e7bca8d3f7173f35f053e1bdf4345077eed3bb34c399cd8bd376452b57d8a195d5cec2813ca00f0b5c9897c63027a043193888b28919f39d71e80755eaa902a6a66b8fb5cc0afb8ef979ebbb04123308afe0a99a06413ccb5105aa515da32dcad30815dc06a4ce78e9c1e8cba9cd205421cba696be7a4b1123cc98b23730c8084a8ed46e07b6c4e1e85e8b5e39682834085fefa4baf58e485b991c7ef52ce3c8995a9313e7d85bc9b7bd462a5c4221a78e4096f8c23c07f80748bc96f6f4aa4cc08b7821ad42f587ee6f66b0370e9a469afd6d51a147c11a4117a9621c9891dcfb384934c55fc6e5ef95b82a739cdd8701bb15a2cc2fa97a50e23725ccc821fec76acaffd56a2e46fb7ba46544d94b51787efe637ae157362081b6c9f873304c219b7722d86cee8c2322d251a3d138fe7d709bfb8b818ab36a9cc881ea3172cc63115941009fe99030cb9e9cd57fa9617b8fc4c60e590e420f13c7a90c539820fd8b7120a273fef0e5fd1939677449a664c1cfb472ac41afc745a4b1b07145154ebaa36e403d4ea7da30c61b9de1e2035bae46d2d371d7be4f69deeee7b6b34d60de48b751318ec51ff2d708b345b7968129ef4ffdd45a12e1c320e2f13a2979433a7f85c2a8e6718cdbb930391704fb484bd99e8a1b20991b568d1518f1795600770b012d2dce56fdcde14435426106e8f2ee28a56291be8a10ce313fb63fba9e1227d5ce1c987bb7d310b2b62cc9fbe994b11a8c116d7d65a81599b385dc5c6cfac168ca213b150b19ddd8e4399df33005010f356a0163ed888e58e3d947e606d4bab4344836cd40f226b5b0406e29101e0f845180077be76530d3a61207812e1463cbed3d8f0e95e0d1bbdd5cdb7704b8b034ca6fffd2673b287102090a1f6527430c5471a79e486f0be4d950c46e5dc77d3c7843dab09fd196a0b49098886edb6412edcef0d1283b24e3012abf632e0a785f089e0cdfdaba5434abe1008a9e96f5f5f4bc5d33e4ca8ecaa0118e5b44e9c12e001dca1a4e159de070f11f5f7a2ca9d1454efd18e796b4b68d313581b5f02bc606ab6619f01a4ce661290afa618c16c601012c497bc04b1a73616dce0b351afa11d614afb4746a17a760699a7761b66e6d81995bdcdc584ca84dcc7759ca4c72b08b3b8c2cb47bea617606993b8939c66f0c4ff109a5b2f1e5b16049911c8786d3edc297af8817f37de24f2583eb1de4ee7fd6f2f78bca85acf16380002c87dead4473bf904caaca2f1da90d028beb98a1a8ec12f5498ccc424af787800122de8ddf25123b00f0f6165c2d277fa7088ddc61d40b8c2e7e7c205e02040833a1626bfc10ffe4efd43146995bbceeaf3b1ac3078ee2dce3e3bba8e597754c5e4b78a2366c2489998c3f4bf", 0x1000}], 0x5, &(0x7f00000064c0)=[{0x28, 0x109, 0x6, "bd253046afdc0ff8d531cfd4c82b685ac7d408"}], 0x28}, 0x3}], 0x6, 0x80) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) getpeername$packet(r1, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000003c0)=0x14) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0, 0x10, r0, 0x0) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$PPPIOCGNPMODE(r2, 0xc008744c, &(0x7f00000000c0)={0x57}) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) write$P9_RREADLINK(r2, &(0x7f0000000000)={0x10, 0x17, 0x2, {0x7, './file0'}}, 0x10) 18:18:35 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000080)={0x0, 0x5}, 0x8) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:35 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x82, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) setsockopt$inet_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x4) [ 808.648020] binder: release 23688:23698 transaction 886 out, still active [ 808.666376] binder: undelivered TRANSACTION_COMPLETE 18:18:35 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0xfffffffffffffe8c) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:35 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) fallocate(r0, 0x1, 0x5, 0xfc) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000180)=""/27) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) ioctl$SNDRV_TIMER_IOCTL_TREAD(r3, 0x40045402, &(0x7f0000000280)) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0xb3, 0x20000) unshare(0x40000000) openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) 18:18:35 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:35 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r0, 0x0, 0xfe) read$eventfd(r5, &(0x7f0000000280), 0x6) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) getsockopt$inet6_tcp_buf(r0, 0x6, 0x1a, &(0x7f0000000180)=""/42, &(0x7f00000001c0)=0x2a) ioctl$UI_GET_SYSNAME(r2, 0x8040552c, &(0x7f0000000200)) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:35 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x7, &(0x7f0000000180)=0x80000000002, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 809.104319] binder: BINDER_SET_CONTEXT_MGR already set [ 809.109683] binder: 23748:23753 ioctl 40046207 0 returned -16 [ 809.132794] binder: 23748:23753 BC_INCREFS_DONE node 888 has no pending increfs request [ 809.147017] binder: 23748:23753 Release 1 refcount change on invalid ref 1 ret -22 18:18:36 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$BLKZEROOUT(r1, 0x127f, &(0x7f0000000080)={0x4, 0x81}) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0xf66, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) write$selinux_load(r1, &(0x7f00000000c0)={0xf97cff8c, 0x8, 'SE Linux', "3ded0673cc2f0618162eb4b8d0885270cc737111e8b5e03419"}, 0x29) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:36 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) prctl$PR_SET_MM_MAP_SIZE(0x23, 0xf, &(0x7f0000000040)) r1 = dup3(r0, r0, 0x80000) ioctl$RNDCLEARPOOL(r1, 0x5206, &(0x7f0000000080)=0xa) [ 809.178989] binder: 23748:23753 BC_ACQUIRE_DONE node 888 has no pending acquire request 18:18:36 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f0000000080)={{0x2, 0x4e21, @remote}, {0x0, @broadcast}, 0x12, {0x2, 0x4e21, @remote}, 'netdevsim0\x00'}) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r2 = dup3(r0, r0, 0x80000) getsockopt$inet6_int(r2, 0x29, 0x4e, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x80000, 0x0) ioctl$TUNSETQUEUE(r3, 0x400454d9, &(0x7f00000001c0)={'\x00', 0x200}) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:36 executing program 5: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000140)={0x0, r0/1000+30000}, 0x10) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r1 = accept4$packet(0xffffffffffffffff, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f00000000c0)=0x14, 0x80800) ioctl$sock_inet_SIOCGIFADDR(r1, 0x8915, &(0x7f0000000100)={'syzkaller0\x00', {0x2, 0x4e24, @empty}}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:36 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) ioctl$IOC_PR_PREEMPT_ABORT(r2, 0x401870cc, &(0x7f00000000c0)={0x80000001, 0x6, 0x80000001, 0x354}) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) clone(0x4000003102041ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r3 = gettid() futex(&(0x7f0000000140)=0x2, 0x0, 0x2, 0x0, 0x0, 0x0) ptrace$setopts(0x4206, r3, 0x0, 0x0) tkill(r3, 0x2f) write$P9_RREAD(0xffffffffffffffff, &(0x7f0000000100)=ANY=[@ANYBLOB="054fcff8fcdf7b7759fe2e7c09333a8af236a6f1b02fc73cb00040efb7ee236bec5def00ffffffffffffffb960b1002c601ba3f1cc252c7cd1"], 0x39) ptrace$cont(0x18, r3, 0x0, 0x0) ptrace$setregs(0xd, r3, 0x0, &(0x7f00000000c0)) ptrace$cont(0x7, r3, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:36 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_MON_SET(r3, &(0x7f00000004c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20000100}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0x208, r4, 0x902, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_LINK={0x50, 0x4, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4253}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x101}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}]}, @TIPC_NLA_BEARER={0xc4, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_BEARER_PROP={0x44, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xab}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x1000, @empty, 0x5f9}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xffff, @dev={0xfe, 0x80, [], 0x1a}, 0x10001}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x2f}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7fffffff}]}, @TIPC_NLA_NET={0x20, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfffffffffffffc00}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x264e0daf}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x9}]}, @TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xda}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}]}, @TIPC_NLA_LINK={0x84, 0x4, [@TIPC_NLA_LINK_PROP={0x4c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xa1ca}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3393}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}]}]}, 0x208}, 0x1, 0x0, 0x0, 0x4800}, 0x4000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r5 = fcntl$dupfd(r2, 0x0, r2) write$eventfd(r5, &(0x7f0000000080), 0x8) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:36 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 809.783916] binder: release 23748:23753 transaction 887 out, still active [ 809.810315] binder: unexpected work type, 4, not freed [ 809.830973] binder: undelivered TRANSACTION_COMPLETE 18:18:36 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 809.903253] binder: BINDER_SET_CONTEXT_MGR already set [ 809.910595] binder: 23788:23792 ioctl 40046207 0 returned -16 [ 809.918512] binder: 23788:23792 BC_INCREFS_DONE node 891 has no pending increfs request [ 809.927597] binder: 23788:23792 Release 1 refcount change on invalid ref 1 ret -22 [ 809.956293] binder: 23788:23792 BC_ACQUIRE_DONE node 891 has no pending acquire request [ 810.035685] binder: BINDER_SET_CONTEXT_MGR already set [ 810.041392] binder: 23796:23799 ioctl 40046207 0 returned -16 [ 810.052327] binder: 23796:23799 got transaction with invalid offset (0, min 0 max 24) or object. [ 810.061536] binder: 23796:23799 transaction failed 29201/-22, size 24-8 line 3348 [ 810.077099] binder: 23796:23799 BC_INCREFS_DONE u0000000000000000 no match 18:18:37 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r4 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r4, 0x0, 0x0) read$eventfd(r4, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r4, 0x0, 0x0) unshare(0x40000000) 18:18:37 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setxattr$trusted_overlay_origin(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='trusted.overlay.origin\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x2) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 810.086208] binder: 23796:23799 Release 1 refcount change on invalid ref 1 ret -22 [ 810.108680] binder: 23796:23799 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:37 executing program 1: clock_gettime(0x0, &(0x7f0000000040)) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x200000015, &(0x7f0000000140)={0x77359400}, 0xbc) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) creat(&(0x7f00000003c0)='./file0\x00', 0x16) clone(0x40004000, &(0x7f0000000400)="43daea8dfcd010c55d8cd38a75a54038358e31", &(0x7f0000000440), &(0x7f0000000480), &(0x7f00000004c0)="eaac8ec70955c195758de3a2ea221ad7e641dd635623efb02ebef6a8cb6a87981a2acb32d53242cc8f6706b0ec8ab4e79a64ad4a296a3d") setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) prctl$PR_GET_NO_NEW_PRIVS(0x27) connect$inet(r0, &(0x7f00000000c0)={0x2, 0x4e24, @empty}, 0xfffffffffffffcac) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000100)='/dev/keychord\x00', 0x101, 0x0) ioctl$LOOP_SET_STATUS64(r1, 0x4c04, &(0x7f0000000280)={0x0, 0x0, 0x0, 0xffff, 0xffff, 0x0, 0xa, 0x20, 0x4, "e4d365aee83b653186cd10f254b85852437a6c07395398ea5175d853c0a871938bb17cda96ab69d38050abc60bb58817296681735719df98c5eac7ef1c1de63f", "d96c0232789058506467f611880da98423bf91b05491d4639500136be4269fc82e49518443a37f81d09eadb6c6c486d2c90f520150471faf4bd3a0ce99ccaf55", "a989656327b3ff059d25b0720627d55e44cdede6591b593d49faf4e09336b557", [0x44e869e, 0x5]}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000500)={0x0, 0x0, 0x8000000000005}, 0xfe) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000001c0)={@rand_addr, @rand_addr, 0x0}, &(0x7f0000000200)=0xc) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'bond_slave_0\x00', r2}) openat$urandom(0xffffffffffffff9c, &(0x7f00000005c0)='/dev/urandom\x00', 0x882, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:37 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 810.640560] binder: release 23788:23792 transaction 890 out, still active [ 810.649466] binder: unexpected work type, 4, not freed [ 810.670960] binder: undelivered TRANSACTION_COMPLETE 18:18:37 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 810.774645] binder: BINDER_SET_CONTEXT_MGR already set [ 810.779986] binder: 23821:23823 ioctl 40046207 0 returned -16 [ 810.788745] binder: 23821:23823 BC_INCREFS_DONE node 895 has no pending increfs request [ 810.798504] binder: 23821:23823 Release 1 refcount change on invalid ref 1 ret -22 [ 810.823303] binder: 23821:23823 BC_ACQUIRE_DONE node 895 has no pending acquire request [ 810.888655] binder: BINDER_SET_CONTEXT_MGR already set [ 810.894603] binder: 23825:23829 ioctl 40046207 0 returned -16 [ 810.905576] binder: 23825:23829 got transaction with invalid offset (0, min 0 max 24) or object. [ 810.914848] binder: 23825:23829 transaction failed 29201/-22, size 24-8 line 3348 18:18:37 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='vegas\x00', 0x6) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 810.934177] binder: 23825:23829 BC_INCREFS_DONE u0000000000000000 no match [ 810.947801] binder: 23825:23829 Release 1 refcount change on invalid ref 1 ret -22 [ 810.997728] binder: 23825:23829 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:38 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r3 = open(&(0x7f0000000300)='./file0\x00', 0x10000, 0x1a0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x2400, 0xaf) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f00000001c0)={&(0x7f0000000080), 0xc, &(0x7f0000000100)={&(0x7f0000000280)={0x68, r4, 0x0, 0x70bd25, 0x25dfdbfc, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x7, @link='syz0\x00'}}}, ["", "", "", ""]}, 0x68}, 0x1, 0x0, 0x0, 0x200000d4}, 0x800) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:38 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r4 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r4, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xfdfb) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r4, 0x0, 0x0) unshare(0x40000000) [ 811.499865] binder: release 23821:23823 transaction 894 out, still active [ 811.510396] binder: unexpected work type, 4, not freed [ 811.515775] binder: undelivered TRANSACTION_COMPLETE 18:18:39 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200800}, 0xc, &(0x7f0000000100)={&(0x7f0000000280)={0xdc, r1, 0x400, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x1c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x2000000000}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffffffffff80}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xffffffffffffff2d}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x100000001}]}, @TIPC_NLA_NODE={0xc, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_LINK={0x18, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xceb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}]}, @TIPC_NLA_NET={0x24, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9409}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_NET={0x2c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xbc}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4}, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r2/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:39 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x800, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r3, &(0x7f0000000340)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x1c, r4, 0x100, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x2b1e99deca38bb9c}, 0x40000) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) getsockopt$IPT_SO_GET_REVISION_MATCH(r0, 0x0, 0x42, &(0x7f0000000080)={'icmp6\x00'}, &(0x7f00000000c0)=0x1e) recvfrom$inet6(r3, &(0x7f0000000380)=""/173, 0xad, 0x10060, &(0x7f0000000440)={0xa, 0x4e21, 0x5, @mcast2, 0x100000000}, 0x1c) 18:18:39 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:39 executing program 3: pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000340)={0x4, 0x0, 0x9, 0x5e1, 0x1}, 0x14) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x18, &(0x7f0000d06000)=0x1, 0xfffffeb3) ioctl$TIOCGSID(r0, 0x5429, &(0x7f0000000380)=0x0) syz_open_procfs$namespace(r3, &(0x7f00000003c0)='ns/mnt\x00') connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r2, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r4 = add_key$user(&(0x7f0000000040)='user\x00', &(0x7f0000000080)={'syz', 0x2}, &(0x7f00000000c0)="7b6da4bfea57304d6a234944956da464e480ebadcb90c131c819be97da190f6f52cc3a2a02f1515bc3", 0xffffffffffffffe6, 0xfffffffffffffffd) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000100)={r4, 0x5, 0x7f}, &(0x7f0000000280)=ANY=[@ANYBLOB="656e633d706b63733120686173683d7368613235362d617677ffde00000000000000000000000000000000000000000000000000000000000000000000000000000000000000af0a00000000000000"], &(0x7f0000000140)="e8f15c70fcdf6ede4f858631eef79396a0b97cb622e6923c79f02b62d229b54c113e891d1d8be0801243c605479f364c88a69ea99b3e4984ae661ce955", &(0x7f00000001c0)=""/46) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r2, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r2, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:39 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:39 executing program 4: dup2(0xffffffffffffffff, 0xffffffffffffff9c) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x218040, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x3) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r3, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r6 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r6, 0x0, 0x0) read$eventfd(r6, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r1, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r4}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r6, 0x0, 0x0) unshare(0x40000000) 18:18:39 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000180)=0x80000000002, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='attr/fscreate\x00') setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000080)=0x5, 0x4) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f00000000c0)=@broute={'broute\x00', 0x20, 0x3, 0x518, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000280], 0x0, &(0x7f0000000000), &(0x7f0000000280)=[{0x0, '\x00', 0x0, 0xffffffffffffffff}, {0x0, '\x00', 0x0, 0xfffffffffffffffc, 0x1, [{{{0x3, 0x10, 0x88ef, 'veth1_to_hsr\x00', 'veth0\x00', 'rose0\x00', 'ip6gretap0\x00', @broadcast, [0x0, 0x0, 0x0, 0xff, 0xff, 0xff], @broadcast, [0xff, 0xff, 0x0, 0xff], 0x118, 0x190, 0x1c0, [@cpu={'cpu\x00', 0x8, {{0x32, 0x1}}}, @ip6={'ip6\x00', 0x50, {{@empty, @local, [0xffffffff, 0xffffff00, 0x0, 0xffffffff], [0xff, 0xffffffff], 0x3f, 0x3e, 0x1, 0x11, 0x4e21, 0x4e20, 0x4e20, 0x4e20}}}]}, [@common=@nflog={'nflog\x00', 0x50, {{0x6, 0x3, 0x0, 0x0, 0x0, "e9fdfb2cf222a6b0ad1785bc2d86bce51f88ad7984da63e682a6eb2a937c7183f031a505026d377a5b4796910e576bcec961f044923853ccb102c864c9307e94"}}}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0xffffffff}}}}]}, {0x0, '\x00', 0x1, 0xffffffffffffffff, 0x1, [{{{0x9, 0x2, 0x88b5, 'veth1\x00', '\x00', 'bond_slave_1\x00', 'veth1_to_hsr\x00', @empty, [0xff, 0xff, 0xff, 0x0, 0xff], @dev={[], 0x16}, [0x0, 0xff, 0xff, 0x0, 0xff], 0x70, 0xa0, 0xd0}, [@common=@AUDIT={'AUDIT\x00', 0x8}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x6}}}}]}, {0x0, '\x00', 0x2, 0xffffffffffffffff, 0x1, [{{{0x9, 0x11, 0x8ebf, 'nlmon0\x00', 'rose0\x00', 'syzkaller1\x00', 'veth1_to_team\x00', @remote, [0x0, 0x0, 0x0, 0x0, 0xff], @random="4a88fdaeebf4", [0xff, 0xff, 0x0, 0x0, 0xff, 0xff], 0x120, 0x198, 0x1c8, [@mac={'mac\x00', 0x10, {{@broadcast}}}, @ip6={'ip6\x00', 0x50, {{@mcast1, @rand_addr="9b9e1d92abfdb6f2e6a2ba695d6f0d83", [0x0, 0x0, 0x0, 0xffffff00], [0x0, 0xffffffff, 0xffffffff, 0xffffffff], 0x3, 0x7f, 0x4, 0x24, 0x4e24, 0x4e24, 0x4e22, 0x4e22}}}]}, [@common=@nflog={'nflog\x00', 0x50, {{0x7, 0x9, 0x6d, 0x0, 0x0, "e5bb2742d2b01f93183117de232854ecdb4e42b8c54f3b56c84d4eec954f69b3c2e93a684d7f92d5336171c1918353b47558323701682bbc8300327ca271b6cd"}}}]}, @common=@CLASSIFY={'CLASSIFY\x00', 0x8, {{0x4}}}}]}]}, 0x590) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:39 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x2, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f00000000c0)=0x2c, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) sendto$inet(r0, &(0x7f0000000440)="4b25f4e97b554e9b3f9e4d895f8ec0d331e875fb666743ad4142499c0fd76f240734f213fe17dc3919005379419e167b9753e8f012cb3205a190677507000000b441bcf6b7abb69c930b22ae15257caba685d35e65209d20083cc772c4d3b1627e70b96187891bd2d2c124aa0e709ef4e41a59ab94fc32f18f0c0f9d91c349a501a48d8c050a3a8389fc14499270b72d961d9174855eb4d81a8659895f0bd1680659545c72b38550e9712c090a533911547c62e11651d21cc62bbf40b18ff7ec748e4f19108fa2d914a752c2a752628eb5cea1527bf660992c5c941903f9efe1c626d00618f6dcce1bfdfb88a50000d62afd7e36d19d508462a595810dabf338cae22a9b6f282fe6b251aa3d1eb407cac68493e361461ac99523f5d135a0bbeb34258a1abb8c0d3054e6e0d2054a911452e7187790db3f568db31bd98643134d850d316698fab73a8ed7c916aeb24d19", 0xffffffe1, 0xbf, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000080)={0x0, r0, 0x80, 0x100000000, 0x9, 0x6}) sendto$inet(r0, &(0x7f0000000380)="50eedb5227b279a632997d56f07b02a9bbcae01635f9068b59fe4a950efcfe93b4aada25e72fdecff7dbcbeeb972439a57c47eb6f34c1a21df559abb49a5bbd14120ffa37c2a74fba94c70d13d776ca3287ed83e539a6bec6ec2bfe1f0fd13369da00ff2594559e8f1f95adc5cf70fcfdf96b99fd563480aec2f0c49ca2c9163a41b4cd93f6e8565e12ed56d1e160d4c25858156631e65029bffb67f32b0f0cb9289a70f7cfad4cefd53f8bcbe1d4ac0777d3ea7", 0xb4, 0x4, &(0x7f0000000100)={0x2, 0x4e23, @remote}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:39 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x1f, &(0x7f0000000040)=0x8c, 0xffffffffffffff70) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:39 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = fcntl$dupfd(r0, 0x0, r0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00') sendmsg$TIPC_CMD_GET_NODES(r2, &(0x7f0000000280)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x1c, r3, 0x30, 0x70bd27, 0x25dfdbff, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0xc001) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 812.726967] binder: BINDER_SET_CONTEXT_MGR already set [ 812.738148] binder: 23863:23868 ioctl 40046207 0 returned -16 [ 812.761961] binder: 23863:23868 got transaction with invalid offset (0, min 0 max 24) or object. [ 812.782437] binder: 23863:23868 transaction failed 29201/-22, size 24-8 line 3348 [ 812.783227] binder: BINDER_SET_CONTEXT_MGR already set [ 812.798753] binder: 23863:23868 BC_INCREFS_DONE u0000000000000000 no match [ 812.811446] binder: 23863:23868 Release 1 refcount change on invalid ref 1 ret -22 [ 812.822451] binder: 23862:23877 ioctl 40046207 0 returned -16 18:18:39 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/policy\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_ZERO(r1, &(0x7f0000000480)={&(0x7f00000002c0), 0xc, &(0x7f0000000440)={&(0x7f0000000340)={0xe4, r2, 0x500, 0x70bd28, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xff}, @IPVS_CMD_ATTR_DAEMON={0x78, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xfffffffffffffec1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @multicast2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @local}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @dev={0xfe, 0x80, [], 0xf}}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ifb0\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, [@IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x1}, @IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x1c}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0xb, 'sip\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x8001}, @IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x2, 0x1}}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x10d}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x1f}]}, 0xe4}, 0x1, 0x0, 0x0, 0x4010}, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0)='SEG6\x00') sendmsg$SEG6_CMD_DUMPHMAC(r3, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x30, r4, 0x300, 0x7, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0xe9}, @SEG6_ATTR_DST={0x14, 0x1, @dev={0xfe, 0x80, [], 0x10}}]}, 0x30}, 0x1, 0x0, 0x0, 0x40000}, 0x4) getsockopt$EBT_SO_GET_INIT_INFO(r0, 0x0, 0x82, &(0x7f00000004c0)={'nat\x00'}, &(0x7f0000000540)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) socket$inet6(0xa, 0x5, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) bind$inet(r0, &(0x7f0000000580)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) [ 812.829801] binder: 23862:23884 Release 1 refcount change on invalid ref 1 ret -22 [ 812.898311] binder: 23863:23868 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:40 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:40 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 813.400354] binder: release 23862:23884 transaction 899 out, still active 18:18:40 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) pipe2(&(0x7f0000000080)={0xffffffffffffffff}, 0x4000) r4 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000100)='IPVS\x00') sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000008}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="7b29f665b81b91f62e61c277d85a30eb5a8bbdd2793d419bb4fae536319940337c8cdf2a4469b2dbcc1420d2c28ff0932799d097c66590d49e8f3da81efa7adc0323cd292e4440af91cfbb38412c442bc932e5025af7edf7fee4273ee09cf179bfd53a02a8f4199acfe6534a364b22fd964b9a23712dcae9903c3ea824a02b3d4872c6c72615cc81aadda102b3254785fdf7331f7d77bb7f1b48a8b100000000000000000000000000000000823e42b3d66368baa5a9b450e1b8825566344c757c0ffcb7956b84e1afef4d584a275affcdf82018a0c441182c8146574651a4bd2a472913b84ceadd7f35adcdaf002db9f3ff169bda90f98d12e226601764fb29158726dc3a522b847570aff3b6b938e23c2383da38e7656270a21e82e479427197a70ad1afafcc8c70709f47226550396f8efe098d705b36e18dce6f2f4cb136148a489688a8e576a32d67075f2e39fbff8c6e5c1dd321f50b8e79b7e0ef03460272f209746bfc2baf06cc0aedf9037dd9b8e71d8f", @ANYRES16=r4, @ANYBLOB="000729bd7000fddbdf25010000000800040002000000240002000800090004000000080002004e240000080005000900000008000600010000000c000300080004007400000008000500090000001800010014000300e0000002000000000000000000000000"], 0x6c}, 0x1, 0x0, 0x0, 0x4040001}, 0x80) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:40 executing program 4: r0 = openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x1, 0x0) write$P9_RREAD(r0, &(0x7f00000003c0)={0x9e, 0x75, 0x1, {0x93, "129d0854a7ed292923b9e16e3db23bc7ed053760ea9aeec91ce69cf80e17dc39c4f89ecd2c2082f79652d2b63087b5b7e35c7098032002fe7d029c405771d411c0cd990fac363a4376872a8eb9fe18e69ca5609ca97efc1e6697e666ffb0a5874034840f3f3133e8414deab091d158ae68ea8e88fb67c2f5d981e9b9272f225a56e1e54f1d39c86152645572295c3a2a98dd13"}}, 0x9e) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='attr/prev\x00') write(r3, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000040)) r6 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000000, 0x10010, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000480)={r6}) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) ioctl$int_out(r1, 0x5460, &(0x7f0000000280)) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f0000000200)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r1, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x2000002, r1}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r0, 0x0, 0x0) accept4$inet6(r3, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x800) unshare(0x40000000) [ 813.533526] binder: BINDER_SET_CONTEXT_MGR already set [ 813.539090] binder: 23911:23921 ioctl 40046207 0 returned -16 [ 813.546942] binder: BINDER_SET_CONTEXT_MGR already set [ 813.552539] binder: 23905:23914 ioctl 40046207 0 returned -16 [ 813.563974] binder: 23905:23914 got transaction with invalid offset (0, min 0 max 24) or object. [ 813.572263] binder: 23911:23921 Release 1 refcount change on invalid ref 1 ret -22 18:18:40 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000180)=0x80000000002, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) timer_create(0x2, &(0x7f0000000080)={0x0, 0x23, 0x4, @thr={&(0x7f0000000340)="a6a5ba8755386c66799a921dc375bdac7e2e1d82420df364bb0637f2f181133debbc33fdf35d283e1f93b918ad1e880e71e81ad75b7bf8d14b9804090dd1aa4909187a905a947cfcd83444f2c2887346766f88d86408d00a07f86f0aef71e2eabdbf65d4a0e86057416cda1d4d54b1f582c28db2a8efeab648860a340b26b0be9a420908c2104fcb7ea2dd694a6e4190c694f3dcc4668d4e2f0233118cb6c3d3d1b623a78a06af4f801aba2a812f2c79d57d551a81ea9f455f80f65312201aa4d3e5af072512356f36032b29e840619cbded48c87ad00fabe25cfdcf27147f5ea1fd202509adbd6f22b9727ad9", &(0x7f0000000440)="e1ceb1b3294244f164f208805d499a1d674b24320215e699971e5c719230209ac91f2f291f2b626ae5b06c2f6e47d86242003cc8767bd8d68e57766021d83365e728dae804bd24acd102f4003376b3ab03421ebb9247b01e5b655391173d259129db1dc4216fe6641550c42031191626624ff6ccebb18ede3c6e90f1d3964ea21f26fd1722b920c4328a211dda6d0c27cdbfc6442cc2"}}, &(0x7f0000000100)=0x0) timer_gettime(r2, &(0x7f00000001c0)) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x0) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0xc2, 0x0) ioctl$SNDRV_TIMER_IOCTL_INFO(r3, 0x80e85411, &(0x7f0000000280)=""/183) [ 813.583484] binder: 23905:23914 transaction failed 29201/-22, size 24-8 line 3348 [ 813.609655] binder: 23905:23930 BC_INCREFS_DONE u0000000000000000 no match [ 813.625403] binder: 23905:23914 Release 1 refcount change on invalid ref 1 ret -22 18:18:40 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = fcntl$getown(r0, 0x9) wait4(r1, &(0x7f0000000080), 0x1000001, &(0x7f0000000280)) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r2/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r3 = accept4$inet6(0xffffffffffffff9c, &(0x7f00000000c0)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000100)=0x1c, 0x80800) setsockopt$inet6_int(r3, 0x29, 0x0, &(0x7f00000001c0)=0x2, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8800000000019, &(0x7f0000000340)=0x200080, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r4 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x0, 0x2) write$P9_RSYMLINK(r4, &(0x7f0000000380)={0x14, 0x11, 0x1, {0x20, 0x3, 0x4}}, 0x14) [ 813.659754] binder: 23905:23914 BC_ACQUIRE_DONE u0000000000000000 no match 18:18:40 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) open(&(0x7f0000000040)='./file0\x00', 0x6388c2, 0x40) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:41 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000280)={r1, r2/1000+30000}, 0xe) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:41 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() 18:18:41 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 814.243462] binder: release 23911:23921 transaction 903 out, still active [ 814.360822] binder: BINDER_SET_CONTEXT_MGR already set [ 814.366583] binder: 23953:23960 ioctl 40046207 0 returned -16 [ 814.375186] binder: 23953:23960 got transaction with invalid offset (0, min 0 max 24) or object. [ 814.377045] binder: BINDER_SET_CONTEXT_MGR already set [ 814.384843] binder: 23953:23960 transaction failed 29201/-22, size 24-8 line 3348 [ 814.398024] binder: 23957:23961 ioctl 40046207 0 returned -16 [ 814.403685] binder: 23953:23960 BC_INCREFS_DONE u0000000000000000 no match [ 814.413604] binder: 23957:23961 Release 1 refcount change on invalid ref 1 ret -22 [ 814.414446] binder: 23953:23960 Release 1 refcount change on invalid ref 1 ret -22 18:18:41 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) sendto$inet(r0, &(0x7f0000000280)="30d5c208c48060f0c967e86feee71b2e5f2bcc36e36273fc8ed660fea86d8795eec694547fd238d9df164ae473608272e7d3395e5323f0754af73f57eba3ce3b637c7d0fe89621c0259492cfa439c357efe3ef3bf6eab6110118468de0677fa2df061ea934d33586a59a21e3c0587254168040448944595559472e42a9d3c36a338fd7ba846aee9e354da54a12bdaa13a7458c712781c7b559e3d00da5a4b7d9d69bad747529519061bfccf6ad02da6ba04d853cb6267fa3dd9832f711a9be7cdb103973f6555909b30c32d17c62d56c2e3a59e31836edb06a2d0b10b58806b840e130a5ddbfd532fac7729f33d460cd427e08658592a5fa2bc8b72351", 0xfd, 0x0, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x7fffffffffe, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:41 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f0000000000)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(r0, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000180)={0x0, 0x7, 0x1, 0x4, 0x0, 0x1, 0x10000}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:41 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0xd2) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000280)={0x11, 0x0, 0x0}, &(0x7f00000002c0)=0x14) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000300)={@initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x1c, r3}) r4 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/policy\x00', 0x0, 0x0) ioctl$UI_END_FF_UPLOAD(r4, 0x406855c9, &(0x7f00000000c0)={0x9, 0x76, {0x53, 0x10000, 0x1, {0x3, 0x6}, {0x7, 0x1ff}, @cond=[{0x1000, 0x8001, 0x81, 0x8f, 0x5, 0x9}, {0x0, 0x7fffffff, 0xfffffffffffffc01, 0x4, 0x401, 0x5}]}, {0x57, 0xaf0000000, 0x0, {0x7}, {0x1ff, 0x466}, @const={0x8001, {0x8001, 0x80, 0x0, 0x9}}}}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='stat\t\xc0\xd2\xfe\xbc\xf9\xdf-\xea\xc8\xc1w\xff\x17\x12H\xe9\x11\x93Q0I\xf81U\ro}\xe6l\xf67\xbd\xbf\x13\x11\x92\f\x8a&\xed\xa4\xdc\xc3x?\x9d\xb5\x11k4\xd3\x1b\x05\x12\xa5`\x8a\xaf\xf0\x1eyR4\f\xd6\xfd\x00\x00\x00\x00', 0x275a, 0x0) r6 = creat(&(0x7f0000000140)='./file0\x00', 0x0) fallocate(r6, 0x0, 0x0, 0x2000002) fallocate(r5, 0x0, 0x0, 0x10ffff) ioctl$EXT4_IOC_MOVE_EXT(r5, 0xc028660f, &(0x7f0000000040)={0x0, r6, 0x0, 0xfffffffffffffffb}) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:41 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000300)={{0x0, @rand_addr=0x2, 0x4e23, 0x1, 'wlc\x00', 0x1, 0x1, 0x6c}, {@local, 0x4e24, 0x2, 0x5, 0x9, 0x5}}, 0x44) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) getsockopt$EBT_SO_GET_INIT_ENTRIES(r0, 0x0, 0x83, &(0x7f0000000100)={'broute\x00', 0x0, 0x3, 0x94, [], 0x9, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000240)=""/148}, &(0x7f00000001c0)=0x78) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:41 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:42 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) [ 815.079946] binder: release 23957:23961 transaction 907 out, still active 18:18:42 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000080)=0x0) ptrace$getenv(0x4201, r3, 0x0, &(0x7f00000000c0)) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_ifreq(r0, 0x89bf, &(0x7f0000000100)={'gretap0\x00', @ifru_flags=0x2}) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000280)="9d9b9e9f3602713216d7833aa4400e76382d7d85aab9cf47b066d65763b45c7f9a3105d764be5bb6c19f5f47ac71e76631f9c17930c8dc62037906a2ffececf620a7014e86623cd3d1d7a3998aa37ff3da290bc3a1f47d5adddcb446be008af96a27849f687440fb04d012a45c4b1b7cf76b06f6c9a6a3da158af34dcae178efba7fde77f66040cfa50ce7ed1be49b00ea6cde7a40902f488e7fc5ba6ae82fac0e81038e7b0fb318ae8d45a2b7eab28845bde4a97279b2381a19c016eedd0deaabb8a74642ec8f9483d0ac342e74e9ec9cba7f2eeb6833871efada3aa0d61d70740a7ba137fe354c1aa66466cb1bfd1a06a79c043f8572289da6232eb0ea282d46cc2f2d5b89bae12dc40dde6c5a727c18690fdc4987bdb33e63781a9db45c2eca8b48fe38be614135d295974e7d62338558906d4f7fb0cde0685d4b6e98e8ff77aca79afded57d6fccb5b4d51bc5c38ce2919ac813a36ebc4ac76f05a8713cd14179be5fabb726dc740fda094b86f0345630c59e66925a2f4e217c8d956d0509e89cb439a59bb8ad3ee49e4ffca342fc4a62f4971a7c66fbfed07697260ce", 0x19f, 0x3, 0x0, 0xfffffffffffffd77) 18:18:42 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x2481, 0x0) ioctl$TCSETSW(r3, 0x5403, &(0x7f00000000c0)={0x1f, 0x1f, 0x40, 0x7fff, 0xb, 0x7, 0x6, 0xffffffffffffffc0, 0x7f, 0x9, 0x3f, 0x10005}) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f00000001c0)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:42 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x101000, 0x0) ioctl$TUNSETLINK(r2, 0x400454cd, 0xf) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 815.212684] binder: BINDER_SET_CONTEXT_MGR already set [ 815.226160] binder: 23985:23995 ioctl 40046207 0 returned -16 [ 815.229266] binder: BINDER_SET_CONTEXT_MGR already set [ 815.240396] binder: 23987:23997 ioctl 40046207 0 returned -16 [ 815.241010] binder: 23985:23995 ioctl c0306201 0 returned -14 18:18:42 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f00000003c0)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x40000, 0x0) timerfd_gettime(r3, &(0x7f0000000400)) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r4 = creat(&(0x7f0000000080)='./file0\x00', 0x100) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r4, &(0x7f0000000380)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000280)={0xdc, r5, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_LINK={0x70, 0x4, [@TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x600}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}]}, @TIPC_NLA_LINK_PROP={0x3c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fffffff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x400}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xccce}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1ead}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}]}, @TIPC_NLA_BEARER={0x20, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_PROP={0x4}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1c84057a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x40}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffffffffff7f}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x918}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x4080}, 0x8000) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 815.254724] binder: 23987:23997 got transaction with invalid offset (0, min 0 max 24) or object. [ 815.257883] binder: 23985:23995 Release 1 refcount change on invalid ref 1 ret -22 [ 815.264909] binder: 23987:23997 transaction failed 29201/-22, size 24-8 line 3348 [ 815.293509] binder: 23987:23997 BC_INCREFS_DONE u0000000000000000 no match [ 815.301142] binder: 23987:23997 Release 1 refcount change on invalid ref 1 ret -22 18:18:42 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000000080)={{0x1, 0x3, 0x7f, 0x0, 0x7fff}, 0x7fff, 0x800, 0x7}) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:42 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f0000000180)={0x10000, 0x101, 0x1}) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0xb, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:42 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000080)={0x0, 0x40000000000000, 0x100005}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:42 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000000080)=0x8ff9, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:42 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:42 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) [ 815.915413] binder: release 23985:23995 transaction 910 out, still active [ 816.044833] binder: BINDER_SET_CONTEXT_MGR already set [ 816.050774] binder: 24030:24033 ioctl 40046207 0 returned -16 [ 816.050874] binder: BINDER_SET_CONTEXT_MGR already set [ 816.062421] binder: 24027:24034 ioctl 40046207 0 returned -16 [ 816.062688] binder: 24030:24033 got transaction with invalid offset (0, min 0 max 24) or object. [ 816.071295] binder: 24027:24034 ioctl c0306201 0 returned -14 [ 816.078127] binder: 24030:24033 transaction failed 29201/-22, size 24-8 line 3348 18:18:43 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x1a, &(0x7f0000000000)=0x7f, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 816.086386] binder: 24027:24034 Release 1 refcount change on invalid ref 1 ret -22 [ 816.110727] binder: 24030:24033 BC_INCREFS_DONE u0000000000000000 no match [ 816.119823] binder: 24030:24033 Release 1 refcount change on invalid ref 1 ret -22 18:18:43 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000100)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r2 = dup(r0) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r2, 0x6, 0x21, &(0x7f0000000140)="bc44773c930ec3f0f127ea06b9d083b6", 0xfffffffffffffff7) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) getsockopt$packet_buf(r0, 0x107, 0x0, &(0x7f0000000080)=""/4, &(0x7f00000000c0)=0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x800000000001d, &(0x7f0000000300)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) perf_event_open(&(0x7f0000000280)={0x3, 0x70, 0x686, 0x4, 0xfff, 0x1ff, 0x0, 0x8218, 0x10000, 0x8, 0x5, 0x7, 0x1, 0xfffffffffffff015, 0xfff, 0x6, 0x3, 0x1, 0x401, 0x7, 0x3, 0x10001, 0x89, 0x4, 0x400, 0x80000000, 0x29, 0x0, 0x8, 0x1, 0x8001, 0x2, 0x8, 0x20048cdc, 0x1000, 0x8001, 0x100000001, 0x587, 0x0, 0x9, 0x6, @perf_bp={&(0x7f00000001c0), 0x5}, 0x12001, 0x0, 0x9, 0x5, 0xff, 0x6, 0x4}, 0xffffffffffffffff, 0x8, r2, 0x2) 18:18:43 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) connect$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @rand_addr=0x80000000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:43 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x4, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:43 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000080)=0x80000000002, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:43 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x4000000, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:43 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:43 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') [ 816.751954] binder: release 24027:24034 transaction 915 out, still active [ 816.856644] binder: BINDER_SET_CONTEXT_MGR already set [ 816.862239] binder: 24064:24069 ioctl 40046207 0 returned -16 [ 816.869797] binder: 24064:24069 ioctl c0306201 0 returned -14 [ 816.876585] binder: 24064:24069 Release 1 refcount change on invalid ref 1 ret -22 [ 816.882850] binder: BINDER_SET_CONTEXT_MGR already set [ 816.895572] binder: 24067:24070 ioctl 40046207 0 returned -16 [ 816.903317] binder: 24067:24070 got transaction with invalid offset (0, min 0 max 24) or object. [ 816.912867] binder: 24067:24070 transaction failed 29201/-22, size 24-8 line 3348 [ 816.921749] binder: 24067:24070 BC_INCREFS_DONE u0000000000000000 no match [ 816.929501] binder: 24067:24070 Release 1 refcount change on invalid ref 1 ret -22 18:18:43 executing program 3: chmod(&(0x7f0000000040)='\x00', 0x100) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080)="a94e3c3fcc2796c8b5eff238c6287b287825ce9a42741fab98d8be712db7c9145eb5923ff0345c887b582fdb1ef68e852c", 0x31, 0x0, 0x0, 0x0) 18:18:43 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r3 = socket$inet6(0xa, 0x4, 0x4) getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000000080)={@loopback, @local, 0x0}, &(0x7f00000000c0)=0xc) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000280)={{{@in=@broadcast, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@mcast2}}, &(0x7f0000000100)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000380)={{{@in6=@remote, @in6=@ipv4={[], [], @empty}, 0x4e23, 0x0, 0x4e21, 0x0, 0xa, 0x80, 0x20, 0x88, r4, r5}, {0x8, 0x0, 0x100, 0x100, 0x1, 0x7, 0x4, 0xfffffffffffffffe}, {0x8062, 0x1, 0x1}, 0x1, 0x6e6bba, 0x0, 0x1, 0x0, 0x3}, {{@in=@loopback, 0x4d3, 0x6c}, 0xa, @in6=@dev={0xfe, 0x80, [], 0x27}, 0x0, 0x5, 0x1, 0x9, 0x9, 0x1, 0x2}}, 0xe8) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:44 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000040)="f7bcbcb08ea8b6ecd9e7e7", 0x0, 0x1ffffffd, 0x0, 0xfffffffffffffc67) 18:18:44 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000040)="c7f6e285402fb4a79e8a7a728da95027f82e074503252ff684328d75f29eee0caaed28a2f61000c0258d08997926b815dd6e4341cfcb", 0xa103209d483eb899, 0x0, 0x0, 0xfffffffffffffeae) 18:18:44 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000000180)={0x1ff}, &(0x7f00000001c0), &(0x7f0000000300)={r5, r6+30000000}, 0x8) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r7, 0x0, 0x0) unshare(0x40000000) 18:18:44 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) getsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000080)={@empty, @initdev}, &(0x7f00000000c0)=0x8) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:44 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000340)='/dev/zero\x00', 0x20000, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r3, &(0x7f0000000600)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x40000400}, 0xc, &(0x7f00000005c0)={&(0x7f0000000400)={0x1a0, r4, 0x0, 0x70bd28, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x38, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xc07b}, @TIPC_NLA_NET_ADDR={0x8}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xf2}]}, @TIPC_NLA_MON={0x24, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xff6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x100}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}]}, @TIPC_NLA_NET={0x20, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x100}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}]}, @TIPC_NLA_NET={0x20, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffffffffffd}]}, @TIPC_NLA_LINK={0x64, 0x4, [@TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x18}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf634}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}]}]}, @TIPC_NLA_SOCK={0x8, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0x2c, 0x4, [@TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_BEARER={0x58, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e21, 0x10000, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x5}}, {0x14, 0x2, @in={0x2, 0x4e21, @rand_addr=0x7}}}}, @TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc5ed}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz2\x00'}]}]}, 0x1a0}, 0x1, 0x0, 0x0, 0x11d9088d5e529b61}, 0x4008000) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000300)=0x2, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) pselect6(0x40, &(0x7f0000000080)={0x5, 0x40, 0x2, 0x9, 0x6, 0x4, 0xfffffffffffeffff, 0x101}, &(0x7f00000000c0)={0xd2ff, 0x10000, 0x2, 0x7, 0x101, 0x400, 0x4, 0x7fff}, &(0x7f0000000100)={0x7, 0x4, 0x3, 0x9, 0xfffffffffffffffd, 0x6, 0x0, 0x22c}, &(0x7f00000001c0)={0x77359400}, &(0x7f00000002c0)={&(0x7f0000000280)={0xfffffffffffffff9}, 0x8}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:44 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:44 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) creat(&(0x7f00000000c0)='./file0\x00', 0x0) [ 817.583798] binder: release 24064:24069 transaction 918 out, still active [ 817.673565] binder: BINDER_SET_CONTEXT_MGR already set [ 817.678980] binder: 24108:24113 ioctl 40046207 0 returned -16 [ 817.686310] binder: 24108:24113 Release 1 refcount change on invalid ref 1 ret -22 [ 817.709458] binder: BINDER_SET_CONTEXT_MGR already set [ 817.715177] binder: 24111:24116 ioctl 40046207 0 returned -16 18:18:44 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0xffffffffffffffd6) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/enforce\x00', 0x301000, 0x0) perf_event_open(&(0x7f0000000080)={0x4, 0x70, 0x2, 0x8, 0x6, 0x3, 0x0, 0x7, 0x80008, 0xd, 0x2, 0xad2d, 0xffff, 0x3, 0xffffffffffffffe1, 0x6, 0x11, 0x0, 0x9efe, 0xce, 0x4, 0xf0, 0x2, 0x2, 0x400, 0xfff, 0x80, 0x7fff, 0x80000, 0xffffffffffffffff, 0x0, 0x7, 0x1, 0x3ff, 0x8, 0xdba, 0xffff, 0x10000, 0x0, 0x5, 0x4, @perf_config_ext={0x7f, 0x3800000000000000}, 0x24244, 0x4, 0x100, 0x9, 0x1800000000000000, 0xec83, 0x8}, 0xffffffffffffffff, 0x6, r2, 0x1) ioctl$FICLONE(r0, 0x40049409, r0) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) setsockopt$netlink_NETLINK_LISTEN_ALL_NSID(r2, 0x10e, 0x8, &(0x7f0000000100)=0xffffffff, 0x4) 18:18:44 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0xfffffffffffffffd, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x408000, 0x0) r3 = getpgid(0x0) perf_event_open(&(0x7f0000000280)={0x3, 0x70, 0x376, 0x0, 0x5, 0x28, 0x0, 0xc679, 0x21, 0xe, 0x5, 0x3ff, 0x0, 0x1, 0xd6, 0xfffffffffffffcfd, 0x1000, 0xfffffffffffffff9, 0x6, 0x8, 0x1ff, 0x5, 0x10, 0x200, 0x2, 0x6, 0x80, 0xfffffffffffffff8, 0x800, 0x1f, 0x4, 0x9, 0x20, 0x9236, 0x10001, 0x1, 0xf0, 0x5, 0x0, 0x4, 0x4, @perf_config_ext={0x100000001, 0x9}, 0x2804, 0x1ff, 0x7f, 0x4, 0x5, 0x6ce, 0xc6}, r3, 0xd, r2, 0x1) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f00000000c0)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 817.723026] binder: 24111:24116 got transaction with invalid offset (0, min 0 max 24) or object. [ 817.732783] binder: 24111:24116 transaction failed 29201/-22, size 24-8 line 3348 [ 817.742557] binder: 24111:24116 BC_INCREFS_DONE u0000000000000000 no match [ 817.758004] binder: 24111:24116 Release 1 refcount change on invalid ref 1 ret -22 18:18:44 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) accept4$inet(r0, &(0x7f0000000080)={0x2, 0x0, @loopback}, &(0x7f00000000c0)=0x10, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:44 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) fcntl$getownex(r0, 0x10, &(0x7f0000000040)={0x0, 0x0}) ptrace(0xffffffffffffffff, r1) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="3b0500000000000001020000050200010620dd00000009060002000600000051870000000009000000000000000500000000000000010100000000"], 0x38) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:45 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r1, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:45 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:45 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) [ 818.404195] binder: release 24108:24113 transaction 922 out, still active [ 818.485252] binder: BINDER_SET_CONTEXT_MGR already set [ 818.499133] binder: 24140:24146 ioctl 40046207 0 returned -16 [ 818.507532] binder: 24140:24146 Release 1 refcount change on invalid ref 1 ret -22 [ 818.544594] binder: BINDER_SET_CONTEXT_MGR already set [ 818.549927] binder: 24143:24149 ioctl 40046207 0 returned -16 [ 818.557306] binder: 24143:24149 got transaction with invalid offset (0, min 0 max 24) or object. [ 818.566632] binder: 24143:24149 transaction failed 29201/-22, size 24-8 line 3348 [ 818.575748] binder: 24143:24149 BC_INCREFS_DONE u0000000000000000 no match [ 818.583600] binder: 24143:24149 Release 1 refcount change on invalid ref 1 ret -22 18:18:45 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) fcntl$dupfd(r0, 0x406, r0) setsockopt$inet_tcp_int(r0, 0x6, 0x8, &(0x7f00000000c0)=0x80000000002, 0xfffffead) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) socket$inet6_udp(0xa, 0x2, 0x0) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) write$binfmt_elf64(r0, &(0x7f0000000280)={{0x7f, 0x45, 0x4c, 0x46, 0x5, 0x0, 0x20, 0x5, 0x4, 0x2, 0x0, 0x100000000, 0x194, 0x40, 0x25f, 0x98, 0x101, 0x38, 0x2, 0x2000, 0x1, 0x7}, [{0x6, 0xff, 0x5, 0x9, 0x800, 0x0, 0x20, 0x100}, {0x5, 0x4, 0x459, 0x8, 0x8, 0x6, 0x81, 0x7}], "f19f83bf8efa36a7f1fa879622c1e74a0a26144b67a35a0dfdf1d22f73133288066bccd156b4d5c85e6710d447cb9fb9aa2328690e94f1b01f09ef8cd57a31551e4a10f38799d61f4bf059385048138c3b242b799f06baf9776b08fcbb657e1951130c33217cc4f0e5b7c97dac0396d8000f059870f4ebe37b7d1f1710e9016f42a7ac98667be1d3952c0a3bb2de39b62e78d91c542360079bf4d8da83d24b566010d7a544de973604a6", [[], [], []]}, 0x45a) socket(0x0, 0x807, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000080), &(0x7f0000000100)=0x8) 18:18:45 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) statfs(&(0x7f0000000080)='./file0\x00', &(0x7f0000000280)=""/4096) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) statfs(&(0x7f00000000c0)='./file0\x00', &(0x7f0000001280)=""/225) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:45 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x3, &(0x7f0000000680)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0x0, &(0x7f0000000100)=0x7, 0xff43) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) sendto$inet6(r3, &(0x7f0000000280)="2582970ae5ad85e33a84f0b4af88df9871e41372e78fc884c9e0cc1b2e4768d98a4dd346308a08a859c9bd095a2fad4a36cd2a63c273528c85215c305faf53914adcb0cd3ada6e48d0a6830701ab48ccc99a981b8379549aa8f2b14242e237508c4036bd5998db61a2a479b34bfe41d92d977301d5a08e9d6254ed", 0x7b, 0x0, &(0x7f0000000300)={0xa, 0x4e21, 0x6, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x7}, 0x1c) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r4 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x400000, 0x0) r5 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r3, &(0x7f00000005c0)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000580)={&(0x7f00000003c0)={0x1b4, r5, 0x600, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x40, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3ff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffff0e4}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xdefd}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}]}]}, @TIPC_NLA_BEARER={0x148, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x100000000}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x2, @dev={0xfe, 0x80, [], 0x16}, 0x5}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7ff, @ipv4={[], [], @multicast2}, 0x3}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x4, @dev={0xfe, 0x80, [], 0x1d}, 0x7}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x2, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x3}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'ib', 0x3a, 'dummy0\x00'}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0xd1, @loopback, 0x6}}, {0x14, 0x2, @in={0x2, 0x4e23, @empty}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0xff}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e24, 0x5, @mcast2, 0x8}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0x1, @mcast2, 0x2}}}}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @l2={'eth', 0x3a, 'teql0\x00'}}]}, @TIPC_NLA_LINK={0x18, 0x4, [@TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}]}, 0x1b4}, 0x1, 0x0, 0x0, 0x10}, 0xc000) ioctl$PERF_EVENT_IOC_PERIOD(r4, 0x40082404, &(0x7f00000000c0)=0x4956) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:45 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r1 = fcntl$dupfd(r0, 0x406, r0) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r1, &(0x7f0000000140)={&(0x7f0000000040), 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r2, 0x0, 0x70bd2c, 0x25dfdbfc, {}, ["", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000800}, 0x1) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x8400, 0x0) 18:18:46 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) write$binfmt_script(r0, &(0x7f0000000180)={'#! ', './file0', [{0x20, '%wlan0:,cgroup'}, {}, {0x20, 'fd\x00'}], 0xa, "7157f5e879d8b3f229f6aec92f8b27"}, 0x2e) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:46 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:46 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) [ 819.228794] binder: release 24140:24146 transaction 926 out, still active [ 819.302581] binder: BINDER_SET_CONTEXT_MGR already set [ 819.308342] binder: 24178:24183 ioctl 40046207 0 returned -16 [ 819.316680] binder: 24178:24183 Release 1 refcount change on invalid ref 1 ret -22 [ 819.343920] binder: BINDER_SET_CONTEXT_MGR already set [ 819.350010] binder: 24180:24185 ioctl 40046207 0 returned -16 [ 819.358397] binder: 24180:24185 got transaction with invalid offset (0, min 0 max 24) or object. [ 819.368076] binder: 24180:24185 transaction failed 29201/-22, size 24-8 line 3348 [ 819.376841] binder: 24180:24185 BC_INCREFS_DONE u0000000000000000 no match 18:18:46 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f00000001c0)={0x0, r1/1000+30000}, 0x1000001ba) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x234) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r2 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f00000000c0)={'syz', 0x0}, &(0x7f0000000100)="6e93dbc2c42aaeede63e827c2d106774022b558c8fad939ef3c1f54e1b2cd75ae9", 0x21, 0xffffffffffffffff) r3 = add_key(&(0x7f00000002c0)='blacklist\x00', &(0x7f0000000300)={'syz', 0x2}, &(0x7f0000000340)="57395ad8eef7f396291bedcc5db5710832ba79405e5340f3e8fd72c593d8902d8f2de9acaa7b33cbd5671f8b0e851f158e04c51a35056f247d1f742afdc09b20d95dac8ee7bb53e073c1589cbbc7eb3abbb046c48100ce26117d83581e3f4c63b1cbb9ccedcaef49e7930afd4ae8896c8e5e7a0882e7eca2418a6af31e97a09bfc1c1aec207f6bfd2181892d8270a279b3fe80c7b5ee4579eef8a2bae84ab984c9bff2f9ddf06c376792461486ffc7172ad3a412b1577dd36f5c76dc97edc5efa43db630fac9ff7e37377519c98660672b80aba137f2b3f6130e179a51be6156dfe1c6189eeff8b17f283fa1f33308a09be59324c12f5e60615433437027e02c91d51aa55c2dde0bf4d2f667c966e5643d6129e7ae692948b4742be154f68b90542214b291a766cd2f0c29eb659a938aa4fa36e6670ff94c1ce97352ad8a4a0ffa45ce42c7399b48258d240c9bf2ab7e9b567dc39ed1bdc3221a6df00237a8bfcfe8bb82775f3a855589579fac419f53fea6a4944fbf1645a9f86ab042297fc07135f88e573f37f132398d63bb1fda068598309eb6a5ed47502bac3d4732be26ee52920d48a96832711d42bf177a0267f6fd3dec3e7ff31039cdb1cbb996116e35f883841d5838484df5ea6dc52d62c82d722204bd7d9f3a814ff9e7f08d87426edee68dac8c72c474b200788c6f5a6ee6cdce6f5596ac4623c0af0b4a3bd8474360053d6b95e1b7af0c55ca2c30d70d76447827578505277e66429456f020ec1d8a4a29bcfa8b97dc9037f00c02e472cfd69e41c3f91b68f98599b999f838864b994852123f6ae3b38f03e65e11beb818cc5930811a834a162348f6004f1003b8f62f6cba9167e7df0fe7cba6743fda7948291ad5b7522282c74eea783c6e2f81e8524f0f838aecacc9837935613e0dc437502d93c764b510a6648a23563fb3643126185a0a856008a8c76705326c7ad63517130e16cf79aff47560fe63deb432b0ca2ab72ec8dba443cafcb44203a0cdaf00056c0afb79d2b8e8090566c85ee5475e4384287ac1bb0b7c7b5792063a41efa59c7bf20561bd166ce8c346f4232dd8c7ab5fc1cd13d86ad5360a1152021ae772b795e968501426e8ecb8f21f7b4a2d7473f156043d5ff37f0c1bb6574c6dc92b821b6ff09ea6f32b88ae6d59c35395ef3d31bbab9b9139268deca199d36cdebe0a8271a0cc37e6d2740d3f3d508d3272b55e5f25771c0d8a115de6b34e65e2ddddd5e3d91c5b0bf13bc2320594fc8dfbbac13c85822facb3b4840bc71329b8cfba5f09d0a7d6201c310480713952927918672f10894235b3007dcfd5da0ae1f5c4e918cda87b7699ca9fadf13c6292b78e73489b2502079422a19eb7dc5bd7441ae9ce7372d30ff30c25330274d5c53e5844a3fb2eb35f1ba328df6d4ef615e615e9726fcbec6748c4ad16b8f48dd3fcee45e324777effd58462c6adeb216ac5052a53d207e08a358ecc1c8087fa9e6c9010cd31b645fe94ad1a1aba4dee6d3131f19091868c58db7099a2f9c52a5456d80e8e346451a66cb8f809db4091220544d3dd01ce5c414470c8c5e9dc33721c2aa0632950d88cb1fea4e54cb494065ac93b6386a4dd5ea1e1017ed2d1d8af0b9ad8617bb5ad92fbfd3ea6a5d46a9bcfbeb3dda57e07c8654cacbc9212ad710ae1f9c9ec8336d9067a43c2388a05acc3fb32ea7926ac8b2bb34f8dd38ed0394eaf5650ffadb86241403edf886b858bac8d46c56b1eec51f10c5f10cd39c5ad26549d74bb203b5788296e6340c7ac26f3d11fa8580cd418ea3ffa6793d17f1d2d401f6ed37874b4cf4df61a908f29a4e70b05155dd46bf45fd4e8407ae09bec947d33f32e774bab86e9d0d0bc4d36fba3d89a0b47046f2e079914e2789f944db0b65a6c524c9109d333039fdd3ab5d0f1d1cb14eff17abd8e2fffec2c091858ce6506a1f1da3831774e821ac703c4a629b11308b33d76c07969f1c46197e108794c1f40a1e6985d6abc9759ca409a04312709c8ff21a9d81baa6a976af96a5ad8007a5e7836b82d5551ee4690fef16b7c8c539995246a094d14ba8012c5bd7762215a58619533379c899a03db3970ae172392306d5bb8a99d0473437385f980466dcacb489aca9f0576172624f7f19467855d6d1c914058888ca9df9c935a263e5a012f329b418818670fd0429db375e21658ed174eee0e7f6ffbe856f322e1335a53a13b60dbff1601739f1dd5b7df067e4ca76502863fb8ab1dd34592127453e87b963afa638bd22f7981306fb57a629928ca373eb4dacd814abc936b0eb1be37b5ef8b6ef15042f1f5add74e73de5ef8b8d9a8d2646ec0446b02a2c2a23037397e44bff93b0b6e9383ab115004133a6addb0c62e3e74ce045e901ff594f0dd40b63e2d50c7169113b346d7fb1b6f9facde7c2dd578fc9d1e16d722c4700d951cf07cea6db01b08f1fa0634a7cb18409d85e1fc3ff4d5189e076cd5b4e87c48ef840ee61aeeb3a6dbaa1818dd21c83efa4b6f4a4f6230ecb233a938d169fc76614e4af1536a47d3cb4fe16aa2401d2170447a56df266d3c68f5e35f13d701243867589acfb0304fbd4e8453db7ece6f7920bfc027b1cd0c761241d9e383dd33a4f307c7a1590e68260f5e9af1b806467391d3a30f134ecacd960c52b08de2bb8208fc42acf38428c49cdb4cbd10f5bdc44d13c3f66350252a32708d733a085c91ebe750f37deb5891142850d8bd4509d245c6482e2842a48276fc4ba59db4c994d62ffd583712a7d1a33ccad4c585c2a854a630a70e55459000df4ff054e9d5a64dd0566607ef4b2039dedbe76b99bfa825a3ba602e2a85f9b65c9d16af456460de26c7949d5f91b0f7d2ac6fb81aa452b7842f8ff3095d117314128238f9c9b859c4a6027cb881dbf8c4a8293ce589c9fbe46e5c5cb85c8d4c61a72719a23e7bc8a6108a16c2f6d66bd01cd0c2ee25b768d4b352784e34c201c1094c5bc43c394568598bc7b743239c3638ca77eb639111109808f9e29a1206abf1f517f66047a2c36fe4972cb6da9ed9aa05256ff9136f1f4a31bb72f323acf2ce6e9e434f116588739ff67a5298ca504645524187a83951e9d632369676645aba634d112e85687fc0acb9fa721d03a66c0020004ef25e0e6db2320594f28d37a7d88684bd7897df1421f850473b3dd72ec3cfb2e28e7ff6a2bbd5c733b623dba07d18a2d33eede49df56b9dbe08a5c7ada129e9af4111a45506086b63f04017c74160965a5a91e4d5f6a5841d10574a102df2d7a5a83486991efe1ad798b31b881837d2017946e5521f7865aa57948108733f5a40c45dc5e6045f2f61fe424085054c0bddaac54eeea2051f29dfdb1a9f2a159abe88a88fb7bbbbb46a77cdd507a1c6ee4cb1dc03630350cdaeeaf4704e31123867a5c1f9a29552d394abbefdec81074aa8616b0aeefb610b3041a800ce4c3d0dbc6fd026af256c02f065d9a333ca2386e57bb001f243e49b5ca5d4ff4b73699484bf590c8ed4fb84c8082a5657f9e3db8256eea1bb61375ac930cdd9f4b7ce43480a8b5bd677721d7b79accb4b69cc2c44ce75cfe920a62d5848de73b45ec3217418043613c538101f3404f06d4a56f27e86700ffd8c18b03c072c0beb8cc7233eaf01c28ce34ceb151df0a63b6417c77df3788beca10d493a10778f03f4b2f77b261c0046814afd5e60b33197b8b8a3bb1eeb24598364f1df59d0efb03e20f15d952ef4dee1ac62309cf4ed9dd724de53184c4f9134743d90633b75ff44874fb847964a5fc0bcac5afa4b9b9767d451b4304cd283b95849a9ff7cdaceae6f2c0111361f5c674996ce3203b14c2a117a4701d829b177ddb0268d9b126eabb58718f78b490aec257fad6251c6f5636acadb2783c8f02500b15f67e1d45b7c68dceff27539d277d32a7e76229c4793fb1d54ae92fefacdf1c5b645c9f3119eaa54d47d1f5fa61c563da4bda399d6026ff2a7dd98c5e2cdc0aa2e23db70f08d4ba4e5dd94dec22f92ada2ca3ed4e47110849bd68e15e48534932752f51e690b16f955fde91b47c26841005deb170c1b978535680bbaf6b21e0805042760d3c0a268e4cdc3402a62efc8e11f70973110d47a4cef7a03eb8466c97387e7041b8fafca87889ee66d904f4bd5437fc48d371688c9fe2ce86ad7256603ef7c540ed7c2141511f533d6e3e8b947ec4001df1ab94dd6c76024c262877375a94ca2dc62c4d002ef918fe56c2c4827f362a3b335990138f4faef4d5ab9d369a1d29ff8079cd26f9d20265d43f9945d1d65ce5662c6113e5bfc64343482036c2676f1e985a1b88d25d4422467cfe22a8fe9fcbd35258fcf857e12a28ab8b3e378bdef0d3f96f4b100e92699de5188b35879326ad469cefad47e503ff98a5cdd70a3338cb2b5598f2632658d56a2af0cd31e408836375bc8cbcdd33beeefc18adfd1a076d03d0b9e3a9f1f7f2ec23d3c0af495ab29b320ee55ddc0cc43122ccf0e2b5b24f934132a4db107e738707be6632e236932572dbdff148b877bda895b4dd282b8402e92afe6ff7369b4d584c6b720140dc77b7e3200364fb63bd5c71217dcf040000b17e304bc3e066ec5b80f6997e97a014118e84f3e23c45aa9bcab626862e73a855149cf3f5aaf090714ceb53d6a07cc595002bc6fa4dfb58ca294d9f8337cc68ec822747a59cc7eca503570d8c31bfaffe8ba654e85ba0117f56fc6a257a872bc3d865bce88fec70a6515343eb2527709721b35c8da4c9a8fb1f0952dd5afd2b158c0700d51c7122408d2000cebc687d00a0721252d327f1c58f5d6c630de328a0cd8e82a73ef922b937e2d78a7a2e6c2e4e937ff82ec40d8f061177be522f7ce98fd83339fef5ff0b4f60ee30fcd347dcfe9b863958c1ccb97cedb82982e802cad2aa71a5b4defbddae74765df9e4fc663fbbba0f52587bcdb88ee18f4d5af2f5f4bf64060b1a603b7e782af0d01147a58065d08a7c36d373840f76eb37929cbc8a08735acb313a57fff2b27f699fec34e5076b7aa32d56f0b034b0a4c42cae06e62f7ef4688c86fd38fd4dbd84d3614658f82993dbb54f140fa8212b425e0cb01d74bf534f2e6493ee9d269568c4174f532814b1ce3b79b7407e8d436baef4979103b5b251d452eedce5563833776e4efb3bdd542854916912f49f1f570683f5d2fdb644a94016247e8ded2836503c2599157facdfea8450f0c3c1c85e739da74e5d25d99603ec88c49da4ae5b98bc5c86c7cd372987abbcd2599416fc1828e0df61c1df1ec2ecbd86bed1b0ace65dbf579f77a564a3db147bab9e8dbb0dc5b649d9ada2023e7c5f9e57d83c41e88cf1db529b60da4c3d2d3c512ded3063527a5a5b864f0e034e81e9c6e1bd8e6d15789c7b512bc278e9d01ccd2aee036c79073344fe9215e075a36c2245f1713bd48136f9846a6825d8f81eb6bc51bd8594df7694bc1a0ab800c00aa926c8cb566f8b351166eb98e9ba2f5a1513450901293bdc472dbfb25eacc69294553dc0313404c357fe03bdbaae8c3c6c788e04ac63e06632e16a1c0509a4c01070c0cf07050f9c37e611e4bacf7d10d8b357af6224149b560e0f895080e5a434aee6ffdf0abf5aaadadaa33f0efb92176aff9b86ae385397ace9a85bd828ece318508f6928c952f1b4950710987c0ae321dfa3d5871b4dda36a6ae875d1307433608ac172c1459b9d1cc660fcd827116063a6bbec21cda0e8c8a66c9478c8e1a822ab088405115d084ef00cabcbb7f91e074958137e8130e21060ace469854931b14c30fc", 0x1000, 0xfffffffffffffffd) r4 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000001380)='/selinux/mls\x00', 0x0, 0x0) ioctl$EVIOCGABS3F(r4, 0x8018457f, &(0x7f00000013c0)=""/71) r5 = dup2(r0, r0) ioctl$BLKFRASET(r5, 0x1264, &(0x7f0000001340)=0x5) keyctl$search(0xa, r2, &(0x7f0000000140)='rxrpc\x00', &(0x7f0000000280)={'syz', 0x1}, r3) 18:18:46 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:46 executing program 5: clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) socket$inet6(0xa, 0x0, 0x0) 18:18:46 executing program 5: r0 = socket(0x20000000000000a, 0x2, 0x0) getsockopt$sock_buf(r0, 0x1, 0x1a, 0x0, &(0x7f0000000240)) 18:18:46 executing program 5: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x68, &(0x7f0000000100)={&(0x7f0000000000)={0x14, 0x23, 0x829, 0x11e, 0x0, {0x2804}}, 0x14}}, 0x0) 18:18:46 executing program 5: r0 = syz_open_procfs(0x0, &(0x7f0000000100)='cmdline\x00') pread64(0xffffffffffffffff, 0x0, 0x0, 0x0) close(r0) setsockopt$inet6_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x168) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x0, 0x0, 0x0) setsockopt$inet6_MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x0, 0x0, @rand_addr="6c2e008438321b7a775aa02fe29dbeda"}, {0xa, 0x4e20, 0x0, @local}, 0x3, [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x5c) setsockopt$IP_VS_SO_SET_EDITDEST(0xffffffffffffffff, 0x0, 0x489, 0x0, 0x0) 18:18:46 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/status\x00', 0x0, 0x0) openat(r1, &(0x7f0000000300)='./file0\x00', 0x800, 0x80) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000280)={0x4, &(0x7f00000001c0)=[{0x80000000, 0x3, 0xf5c5, 0x2}, {0x1f, 0x22, 0x80, 0x3}, {0x3, 0x1f, 0x80, 0x8}, {0x10001, 0x200, 0x9, 0xfb}]}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) ioctl$FIGETBSZ(r1, 0x2, &(0x7f0000000340)) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000040)="de1f6ea8803b4224e1da6b034fff5fdc8a3e229a95eb2dce30c14bbaae18188516b5087ff454ff0e3f6c3b93d5b5a3be7bfb0e6fb92943b8121bd82a34431d2fd8a22b87cf8029388d042869365528654b72a2ce01b8e90c7fe36b872b88f2555dda520c46c0cc188f443c23dcc10110e455b4ef45f2fe6bfc8f", 0x7a, 0x0, &(0x7f00000000c0)={0x2, 0x0, @local}, 0x10) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r2 = syz_open_procfs(0x0, &(0x7f0000000100)='net/tcp\x00') write$P9_RSETATTR(r2, &(0x7f0000000140)={0x7, 0x1b, 0x2}, 0x7) 18:18:46 executing program 5: 18:18:46 executing program 5: [ 820.050273] binder: release 24178:24183 transaction 930 out, still active 18:18:47 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) setsockopt$inet6_tcp_buf(r5, 0x6, 0x1f, &(0x7f00000003c0)="f2c5235ec93eb215572fbd5ef2db066a0b710cfc330bca9632a7de27e04a95eb6060de859fe92e678219617c5729cbb47edc7d0e9856e3780119ded25d8071b5f4b4c50aacbb64e09386b0c25b0b52a1f9b149c63a4d2ae8b86a1f2b7cdaef8c7f3deb23384ed2fbbfbd59bf62b5eebaea1eb16082e2551e8e2f71d21af4d863345eed994cb037dea14e2622af916b0bdacbd545016461792bed9b0e73095a49ea5567b7955e54569d71c77534dfbde02a70ee7edca949e9b215b0e429fa152fbed2818c63220a6f298dc6b0fb815f70011689bf2638304bcd935ee86e266b", 0xdf) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:47 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r1, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/syz1\x00', 0x200002, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:47 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:47 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 820.229747] binder: BINDER_SET_CONTEXT_MGR already set [ 820.235445] binder: 24233:24240 ioctl 40046207 0 returned -16 [ 820.244219] binder: 24233:24240 Release 1 refcount change on invalid ref 1 ret -22 [ 820.244993] binder: BINDER_SET_CONTEXT_MGR already set [ 820.257745] binder: 24232:24241 ioctl 40046207 0 returned -16 [ 820.267362] binder: 24232:24241 got transaction with invalid offset (0, min 0 max 24) or object. [ 820.276545] binder: 24232:24241 transaction failed 29201/-22, size 24-8 line 3348 18:18:47 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r3 = creat(&(0x7f0000000080)='./file0\x00', 0x100) ioctl$TCSETSF(r3, 0x5404, &(0x7f00000000c0)={0x400000000, 0x5, 0x1ff, 0xfffffffffffff801, 0x14, 0x3, 0x5, 0x0, 0x8, 0x7, 0x0, 0x60}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:47 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PPPIOCATTACH(r1, 0x4004743d, &(0x7f0000000080)=0x2) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:47 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ptmx\x00', 0x4200, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:47 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:47 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 820.961324] binder: release 24233:24240 transaction 934 out, still active 18:18:47 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) rt_sigtimedwait(&(0x7f0000000180)={0x1ff}, &(0x7f00000001c0), &(0x7f0000000300)={r5, r6+30000000}, 0x8) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r7, 0x0, 0x0) unshare(0x40000000) [ 821.089604] binder: BINDER_SET_CONTEXT_MGR already set [ 821.095216] binder: 24256:24264 ioctl 40046207 0 returned -16 [ 821.102512] binder: BINDER_SET_CONTEXT_MGR already set [ 821.108583] binder: 24258:24265 ioctl 40046207 0 returned -16 [ 821.120902] binder: 24256:24264 Release 1 refcount change on invalid ref 1 ret -22 [ 821.131433] binder: 24258:24265 got transaction with invalid offset (0, min 0 max 24) or object. [ 821.141713] binder: 24258:24265 transaction failed 29201/-22, size 24-8 line 3348 18:18:48 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) setsockopt$netlink_NETLINK_NO_ENOBUFS(r3, 0x10e, 0x5, &(0x7f0000000180)=0x80000000, 0x4) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:48 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) r1 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x80, 0x0) connect$unix(r1, &(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x501440, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:48 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000800)='/selinux/policy\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000880)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r3, &(0x7f0000000980)={&(0x7f0000000840), 0xc, &(0x7f0000000940)={&(0x7f00000008c0)={0x68, r4, 0x0, 0x70bd29, 0x25dfdbfb, {{}, 0x0, 0x4108, 0x0, {0x4c, 0x18, {0x6, @link='syz1\x00'}}}, [""]}, 0x68}, 0x1, 0x0, 0x0, 0x4040}, 0x801) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) prctl$PR_SET_FP_MODE(0x2d, 0x2) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000080)=0x2000080, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x14402, 0x0) openat$cgroup_subtree(r5, &(0x7f00000000c0)='cgroup.subtree_control\x00', 0x2, 0x0) 18:18:48 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280), 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:48 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 821.800471] binder: release 24256:24264 transaction 938 out, still active 18:18:48 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) [ 821.913753] binder: BINDER_SET_CONTEXT_MGR already set [ 821.919299] binder: 24283:24288 ioctl 40046207 0 returned -16 [ 821.925853] binder: BINDER_SET_CONTEXT_MGR already set [ 821.937862] binder: 24286:24289 ioctl 40046207 0 returned -16 [ 821.947415] binder: 24286:24289 got transaction with invalid offset (0, min 0 max 24) or object. [ 821.951139] binder: 24283:24288 Release 1 refcount change on invalid ref 1 ret -22 [ 821.964382] binder: 24286:24289 transaction failed 29201/-22, size 24-8 line 3348 [ 822.041581] binder: BINDER_SET_CONTEXT_MGR already set [ 822.047100] binder: 24291:24295 ioctl 40046207 0 returned -16 [ 822.057600] binder: 24291:24295 got transaction with invalid offset (0, min 0 max 24) or object. [ 822.067274] binder: 24291:24295 transaction failed 29201/-22, size 24-8 line 3348 [ 822.083536] binder: 24291:24295 BC_INCREFS_DONE u0000000000000000 no match [ 822.093781] binder: 24291:24295 Release 1 refcount change on invalid ref 1 ret -22 18:18:49 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000040)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:49 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) write$P9_RXATTRWALK(r2, &(0x7f0000000180)={0xf, 0x1f, 0x1, 0x4e3e}, 0xf) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:49 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) ioctl$sock_inet_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080)) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x5, &(0x7f0000000000)=0x80, 0x126) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) socket$inet_tcp(0x2, 0x1, 0x0) 18:18:49 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:49 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 822.625582] binder: release 24283:24288 transaction 942 out, still active 18:18:49 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x200000, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x0, &(0x7f00000000c0)=0x2, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 822.720659] binder: BINDER_SET_CONTEXT_MGR already set [ 822.726043] binder: 24313:24318 ioctl 40046207 0 returned -16 [ 822.733585] binder: 24313:24318 Release 1 refcount change on invalid ref 1 ret -22 18:18:49 executing program 5: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0xc, &(0x7f0000000080)=0x8ff9, 0x4) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 822.765683] binder: 24315:24323 got transaction with invalid offset (0, min 0 max 24) or object. [ 822.774843] binder: 24315:24323 transaction failed 29201/-22, size 24-8 line 3348 18:18:50 executing program 3: setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(0xffffffffffffffff, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:50 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = accept4(r0, &(0x7f0000000080), &(0x7f0000000100)=0x80, 0x80000) setsockopt$packet_buf(r1, 0x107, 0x1, &(0x7f0000000280)="a8277e32bf1a7ce057d8037522023bdf4e0d8312ea5a6428a3d7e72cf2da1ba305cc71fbfedd4768f72dedb182c9206f431908f533e99056689a7f22bfbb638375b35fdb4e298fad2c6eabb4909844853a97cc8a1f43bde6f7f2eb5ad8465ad5d7f8815400fc71bf0ba13c9314ecc04f2066cec57bdf20ee0d304b17d32a332798e6d7cf5941bca43e2fc37939bd3e2560399cb02b2a748ec2226849a7b6841e4d456ddb7a84f699a6be114d4e4a", 0xae) ioctl$FIBMAP(r0, 0x1, &(0x7f0000000040)=0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000340)={{0x33, @multicast2, 0x4e23, 0x3, 'wrr\x00', 0x22, 0x3, 0x4c}, {@multicast2, 0x4e22, 0x0, 0x3ff, 0x7, 0x1}}, 0x44) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:50 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r3, 0x0, 0x0) ioctl$BLKROGET(r3, 0x125e, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/create\x00', 0x2, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r1, 0x800c6613, &(0x7f00000001c0)={0x0, @aes128, 0x2, "30505663e5d3b61d"}) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r4}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) fcntl$getownex(r6, 0x10, &(0x7f0000000200)) write$P9_RREADLINK(r7, 0x0, 0x0) write$binfmt_elf64(r5, &(0x7f0000000940)=ANY=[@ANYBLOB="7f454c4602040955070000000000000003003f004f0a0000f1000000000000004000000000000000d7030000000000000800000006003800020002009700030006000000010100001f0000000000000005000000000000009fc40000000000000010000000000000000000000000040001040000000000009652a581adb39b7a148d99170bdfe8a3c02e4753c3a5860b73f81cd5140278449b18a09fb4ddffa6e03f6e250ee52d5331d646384ae3f851667f4bc74ad5ee64390221bb18228a89dbcb89c420363df083dac6ccb74882fd214a715f2efb30abfde67fa1d700f6eaf6e901c24f9a4c93a1286d2e6133f7a2a9f24e41b25cf8d32829c86d368581cfdde475b1de755f74000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0xa08) unshare(0x40000000) 18:18:50 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:50 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 823.445393] binder: release 24313:24318 transaction 947 out, still active 18:18:50 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) ioctl$sock_inet_udp_SIOCOUTQ(r2, 0x5411, &(0x7f0000000080)) r3 = dup3(r2, r2, 0x80000) mmap$binder(&(0x7f0000ff0000/0xf000)=nil, 0xf000, 0x2, 0x10010, r3, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:50 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 823.535958] binder: BINDER_SET_CONTEXT_MGR already set [ 823.541820] binder: 24338:24346 ioctl 40046207 0 returned -16 [ 823.543887] binder: 24344:24345 got transaction with invalid offset (0, min 0 max 24) or object. [ 823.549975] binder: 24338:24346 Release 1 refcount change on invalid ref 1 ret -22 [ 823.559211] binder: 24344:24345 transaction failed 29201/-22, size 24-8 line 3348 18:18:50 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) ioctl$IOC_PR_RESERVE(r2, 0x401070c9, &(0x7f0000000180)={0x10000, 0x101, 0x1}) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0xb, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:50 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 823.612646] binder: 24351:24353 got transaction with invalid offset (0, min 0 max 24) or object. [ 823.634532] binder: 24351:24353 transaction failed 29201/-22, size 24-8 line 3348 18:18:50 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 823.717422] binder: 24358:24359 got transaction with invalid offset (0, min 0 max 24) or object. [ 823.728743] binder: 24358:24359 transaction failed 29201/-22, size 24-8 line 3348 18:18:50 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 823.769665] binder: 24361:24362 got transaction with invalid offset (0, min 0 max 24) or object. [ 823.779346] binder: 24361:24362 transaction failed 29201/-22, size 24-8 line 3348 18:18:50 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:50 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:50 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) open$dir(&(0x7f0000000040)='./file0\x00', 0x400000, 0x8) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x0, &(0x7f0000000000)=0x7c, 0xfffffffffffffee1) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 824.268485] binder: release 24338:24346 transaction 952 out, still active 18:18:51 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0xffffffffffffffff, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:51 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:51 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0x1622b416590d0fa, 0x0, 0x0, 0x240) write$binfmt_misc(r2, &(0x7f00000003c0)=ANY=[@ANYBLOB="73797a31efbbb6408ae0002da65f89e992de1bd4fa99bae9d5d4a9eae82c9efe111715fb0bdbf8cdbd2baeb0862692853b7aa3b88582891c8f9b33010eb3c804a83d00b068833739bd792091be12bf783f84d0e781b5e6232ba6024291ae0c63a0394cd90c94f77daac519cebfb1088cecc3e8fcf5dfbdb69fdd3a1fe56e2405f81bd831fddc5d424c8d6e134c3426bbd8ad8e528df78f9025629a9ff57eec891449751339a4c38a49cc5c878d3f3cbcb56a1ec3cd30159443b106756e423d79308d00eaca372e0ade888ceead4c40e89a734c6f0d0bd1de987e844258c573cc0fc62e067e9e000000000000009440fabe634bc2ad111df8e0c76e350c733f1d2d7a7940192c84331840042312043aa9a181132854aac2de42d5821288efb087fbfdc60d7f8ae78210c0a9022cf5d53bde1d8978"], 0xed) 18:18:51 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:51 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) creat(&(0x7f0000000640)='./file0\x00', 0x100) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 824.423773] binder: 24381:24383 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.436597] binder: 24381:24383 transaction failed 29201/-22, size 24-8 line 3348 [ 824.493465] binder: BINDER_SET_CONTEXT_MGR already set [ 824.525091] binder: 24384:24399 ioctl 40046207 0 returned -16 [ 824.525613] binder: 24391:24392 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.539642] binder: 24384:24399 Release 1 refcount change on invalid ref 1 ret -22 [ 824.552450] binder: 24391:24392 transaction failed 29201/-22, size 24-8 line 3348 18:18:51 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:51 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:51 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:51 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 824.635550] binder: 24404:24406 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.643974] binder: 24407:24408 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.652280] binder: 24404:24406 transaction failed 29201/-22, size 24-8 line 3348 [ 824.654555] binder: 24407:24408 transaction failed 29201/-22, size 24-8 line 3348 18:18:51 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 824.712983] binder: 24410:24411 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.723393] binder: 24410:24411 transaction failed 29201/-22, size 24-8 line 3348 [ 824.745668] binder: 24412:24413 got transaction with invalid offset (0, min 0 max 24) or object. 18:18:51 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 824.757704] binder: 24412:24413 transaction failed 29201/-22, size 24-8 line 3348 [ 824.805130] binder: 24416:24417 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.818636] binder: 24416:24417 transaction failed 29201/-22, size 24-8 line 3348 [ 824.842260] binder: 24418:24420 got transaction with invalid offset (0, min 0 max 24) or object. [ 824.852355] binder: 24418:24420 transaction failed 29201/-22, size 24-8 line 3348 18:18:51 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2f, &(0x7f0000000040)={0x5, {{0xa, 0x4e22, 0x1f, @loopback, 0x800}}, {{0xa, 0x4e22, 0x1000, @local, 0x3}}}, 0x108) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 825.215030] binder: release 24384:24399 transaction 960 out, still active 18:18:52 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.swap.current\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x8000000064a1) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r3, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$setflags(r3, 0x2, 0x1) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) ioctl$TIOCMBIC(r4, 0x5417, &(0x7f0000000200)) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r6 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r6, 0x0, 0x0) read$eventfd(r6, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r1, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r4}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r6, 0x0, 0x0) ioctl$BLKFRASET(r4, 0x1264, &(0x7f00000001c0)=0x7) unshare(0x40000000) 18:18:52 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:52 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) preadv(r0, &(0x7f0000000480)=[{&(0x7f00000003c0)=""/167, 0xa7}], 0x1, 0x0) fcntl$F_SET_RW_HINT(r2, 0x40c, &(0x7f0000000080)=0x5) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r3 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/member\x00', 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r4 = fcntl$dupfd(r0, 0x0, r3) write$UHID_CREATE(r4, &(0x7f0000000280)={0x0, 'syz0\x00', 'syz0\x00', 'syz0\x00', &(0x7f00000001c0)=""/10, 0xa, 0x6, 0x6, 0x3, 0x1, 0x7}, 0x120) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/hash_stats\x00', 0x0, 0x0) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) r5 = fcntl$dupfd(r2, 0x0, r2) mmap$binder(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x1000000, 0x810, r5, 0x0) 18:18:52 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:52 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:52 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:52 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 825.508119] binder: 24430:24436 got transaction with invalid offset (0, min 0 max 24) or object. [ 825.535137] binder: 24430:24436 transaction failed 29201/-22, size 24-8 line 3348 18:18:52 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 825.599073] binder: 24444:24446 got transaction with invalid offset (0, min 0 max 24) or object. [ 825.609873] audit: type=1400 audit(1553710732.511:54): avc: denied { map } for pid=24431 comm="syz-executor.1" path="socket:[83329]" dev="sockfs" ino=83329 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=udp_socket permissive=1 [ 825.622598] binder: 24444:24446 transaction failed 29201/-22, size 24-8 line 3348 18:18:52 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 825.652893] binder: BINDER_SET_CONTEXT_MGR already set [ 825.660963] binder: 24432:24448 ioctl 40046207 0 returned -16 18:18:52 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) creat(&(0x7f0000000640)='./file0\x00', 0x100) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:52 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 825.697231] binder: 24453:24455 got transaction with invalid offset (0, min 0 max 24) or object. [ 825.715974] binder: 24453:24455 transaction failed 29201/-22, size 24-8 line 3348 18:18:52 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000100)={0x2, 0x4e20, @loopback}, 0x10) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x393) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000280)={{0x4, @multicast2, 0x4e21, 0x2, 'nq\x00', 0x21, 0x4, 0x58}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e24, 0x0, 0x8, 0x54f077ac, 0x400}}, 0x44) getsockopt$IPT_SO_GET_INFO(r0, 0x0, 0x40, &(0x7f0000000040)={'nat\x00'}, &(0x7f00000000c0)=0x54) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000140)={0x800000000, 0x0, 0x5, 0x0, 0x2763}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) socket$inet(0x2, 0x4, 0x6) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x2) mlock2(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x1) [ 825.743518] binder: 24459:24461 got transaction with invalid offset (0, min 0 max 24) or object. [ 825.756973] binder: 24462:24463 got transaction with invalid offset (0, min 0 max 24) or object. [ 825.759335] binder: 24459:24461 transaction failed 29201/-22, size 24-8 line 3348 [ 825.767273] binder: 24462:24463 transaction failed 29201/-22, size 24-8 line 3348 [ 826.311062] binder: release 24432:24448 transaction 971 out, still active 18:18:53 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x0, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:53 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:53 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000080)={0x1, 'veth1_to_hsr\x00', 0x2}, 0x18) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:53 executing program 2: socket$unix(0x1, 0x2, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:53 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000011, &(0x7f0000000480)=0x200000000001, 0x3) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) ioctl$sock_SIOCDELDLCI(r0, 0x8981, &(0x7f00000002c0)={'ip6tnl0\x00', 0x81}) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_stats\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000080)={{{@in6=@ipv4={[], [], @remote}, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@broadcast}}, &(0x7f00000001c0)=0xe8) connect$packet(r1, &(0x7f0000000280)={0x11, 0x6, r2, 0x1, 0x3, 0x6, @broadcast}, 0x14) r3 = add_key$keyring(&(0x7f00000003c0)='keyring\x00', &(0x7f0000000400)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffc) request_key(&(0x7f0000000300)='syzkaller\x00', &(0x7f0000000340)={'syz', 0x1}, &(0x7f0000000380)='/selinux/avc/cache_stats\x00', r3) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x8, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000040), &(0x7f0000000080)=0xc) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 826.680919] binder: 24479:24483 got transaction with invalid offset (0, min 0 max 24) or object. [ 826.689324] binder: 24482:24488 got transaction with invalid offset (0, min 0 max 24) or object. [ 826.706963] binder: 24482:24488 transaction failed 29201/-22, size 24-8 line 3348 [ 826.710275] binder: 24479:24483 transaction failed 29201/-22, size 24-8 line 3348 18:18:53 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:53 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:53 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5, 0xffffffffffffffff}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 826.789500] binder: 24494:24499 got transaction with invalid offset (0, min 0 max 24) or object. [ 826.804863] binder: 24494:24499 transaction failed 29201/-22, size 24-8 line 3348 18:18:53 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:53 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 826.834253] binder: BINDER_SET_CONTEXT_MGR already set [ 826.846463] binder: 24480:24495 ioctl 40046207 0 returned -16 [ 826.863664] binder: 24501:24503 got transaction with invalid offset (0, min 0 max 24) or object. [ 826.892033] binder: 24501:24503 transaction failed 29201/-22, size 24-8 line 3348 18:18:54 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:54 executing program 2: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 827.486999] binder: release 24480:24495 transaction 981 out, still active 18:18:54 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:54 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:54 executing program 1: clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(0xffffffffffffffff, 0x1, 0x15, &(0x7f0000000140)={0x0, r0/1000+30000}, 0x10) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='cpuset.memory_pressure\x00', 0x0, 0x0) ioctl$ASHMEM_GET_PROT_MASK(r1, 0x7706, &(0x7f00000001c0)) r2 = creat(&(0x7f0000000080)='./file0\x00', 0x8) ioctl$IOC_PR_RELEASE(r2, 0x401070ca, &(0x7f00000000c0)={0x8, 0x2, 0x1}) r3 = socket$inet_udp(0x2, 0x2, 0x0) lstat(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0}) getresuid(&(0x7f0000002800), &(0x7f0000002840), &(0x7f0000002880)=0x0) r6 = getpgid(0x0) r7 = getpgid(0xffffffffffffffff) r8 = getpid() getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000002e40)={{{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@local}}, &(0x7f0000002f40)=0xe8) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000002f80)={0x0, 0x0, 0x0}, &(0x7f0000002fc0)=0xc) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000003000)={0x0}, &(0x7f0000003040)=0xc) r12 = getuid() getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000003080)={0x0, 0x0, 0x0}, &(0x7f00000030c0)=0xc) r14 = getpid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000003100)={{{@in6, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@broadcast}, 0x0, @in=@local}}, &(0x7f0000003200)=0xe8) lstat(&(0x7f0000003240)='./file0\x00', &(0x7f0000003280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000003300)=0x0) r18 = getuid() fstat(r3, &(0x7f0000003340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) fcntl$getownex(r3, 0x10, &(0x7f00000033c0)={0x0, 0x0}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000003400)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000003500)=0xe8) r22 = getegid() sendmsg$netlink(r2, &(0x7f0000003600)={&(0x7f0000000280)=@proc={0x10, 0x0, 0x25dfdbff, 0x400000}, 0xc, &(0x7f0000002dc0)=[{&(0x7f00000003c0)={0x2300, 0x14, 0x704, 0x70bd25, 0x25dfdbfc, "", [@nested={0x1134, 0x37, [@typed={0x4, 0x6}, @generic="c9e22eefe93d41c17657b19465408249fac7091ab35471f0ed00aff9df88ed3c794ba5f15326fc2667fa87b9db918cc8e37b80f9addc0966982b77fb749dd0af9a9b20f4929d5467e5f2fceccaa1394aa7033557c6639b51989ddfe8dc492a019cd244e3c24115b30873d41bb3cc21ecd9fd44aa70153540012bbe359440b357", @typed={0x8, 0x60, @ipv4=@local}, @generic="d825d3b1420dd611fac027afb50138dbac5968aad0b58a516f36a22539bd66d60c8846824e547d82c3c4199fa4db3337a76c7dc587a6ccc7513d5344688974bccbba3c03c3e7999e235136eb196013b0a7a1b113d434b9254afba14fc35bf90501088500093dffe8e165c2b13f711ea96f6a2c600a", @typed={0xc, 0x1a, @u64}, @generic="b6e1071594cd7050e91a159ce0c004bd9b", @typed={0x4, 0x1b}, @generic="a96badb65c97c0f6bd3631b6bdca6f78dd2ac95cc3f278c15e6451f730c10d6abdffcccdbe5819f4c6aa555245533b6b047765753e3b483d4fcd6ac290288b70e8affe96457d4e0a19bbd6c5515e069c63c80f20d7e77a26d379c0e3a69b2518814600ef1742f41a1c670a05db2222e20caf6bc85b24bf6a17435df5e6db4fd33326bf4b581ab3320a2877d8b473b7087f522cb4cb8afe47a720234f32c3bc04303e6d772513b820c64d01866694165b0fbd190c8490641d5d8fb412aeb506afb88c08aa0fff01fe52425b4a53d10916c05007ceaac27ce58be03b6ee9a521c97e8210ae8533365b3f41d6a90cf0bf1fbd206d82488bd6e4a46ec486d72f691c786070ab7f87a6abb0c377dcb4adc75771e750c84440032f090ff507d6941450383b22a7bab1b05c747313114fd54a8e34a02ebbb6fb9adb6b1e5be9b786d68566cb807f2892ad392a507d64a21815c8e93354f0ea6c79747114428fa1e3ebcf7fdf4909cdb3f0e0bffff1bc58436bd4b31c67f581b5975bff0f64f7d07c5b6d8a10e5c38ebebf1002b52246d230055170066ba30d9a30663b7efd928c8194a4e17d97d724e0bf3f48d2de59e47277132622fb0c0acfad667b7ab7765e8c67c79e1c932b0644b814d35fc78fbe071db17f6d17591946a2263710a83157db188c6514cd8a926edb1b89671472155522e651244fd700c2867bc3c8b59374c72dc3e2a5b90ca59ac2c2fe0582742d78e17cf0ad1995f67a29f66f0cbd7dddbd32c760afe739a9aa02b56e7a2d9e7640c0755b74c6d81cc0ef6c27dac1c594b92a5c4416a74350846beac48533f8c9778a93209d52ea24484de8e430ef0c825522bf3497eab187aa6236aaa2ca0059115bc9fa493c0dfc46754f4510f6217e66ae29d37fe9254e9baa5e065461a94a0ce85fe5ef8523ffd7fc0fde6d77b36f5da1ee006e9db0205ca4492211444ff1931df76df19d6ebe9f0793b808b685f4098bf85a2711134fffeacacd85809298816e74760ae5ef50c5aecf573154ae6a0edb51d83fb97074cd79ac4faee95da40ee498df91c9991490b5833cadb64636d25a5325be9b74ebb8e24cc8c44e1c278b223c81fcb13d9c0ab81f51b218302a34289909f9572994f7797c38ca56104ee7d3f218687e91fb268f8e95aae9174397093ff76b224b0b531c2eadfe83ceb654d9e77cb298f0ce27681059880c0a28329303f39049d272caf3fdac5b0ca4b949ac94a6845f2ef18bd96c46a0a9a0946e6194041cf1f6bfaca3e9c3582245f6c8f4e3c9023ba021e876157c623d182f21914e2b666faeb5ac1027605bd119cc84258a21555e871d9ad0165d65a1e532dd629cd7b6fb6b21af7fc792aac50fc860de3e15c11d93c8e75ae9d9327c500ff4eff8845bce74ad10d6b1857a7727df70604c5843e2c60ba434b42b4d4175de39b2c6157669ee7ad4cffd551b069ab9aee6807521cba644981e5dc77f3bada88f52c1591428b781541f8c7f1941d73848e6a7072153716f371eb18ce1fcaeec67743807e6f21000d74119f5aa1dfe6c657e5a634742220e92cee0f76392f895e318bc8c36be3d8b90e96615dcfd3a8309af84b00d25404c9bc1630a69d8ea61ec110d448dbd09d8f44048e6733e20e155e3bc08caf40db7ae18cac3841eb7fe202438f970458c248dd33b9baf5a0690bab4b2ec7e5093f60295f5574f68536fee4459220b06e6317fd17bb92866fbf78da65ce613c4f7b196fec5d888cb43757789b2bdffe76b2e7346613d3adbc75df754d4e80a7ecd4ca91fb41efd2de684805e60baf5f40323afee56c66f9c3308fc311fb7b3e4288d826788060ca0fba444a740a886341ba52e62ece34711d42f1603c9cb3f04787d302477bdd3c8ace6149abee7c091c73ee9e46e5f763fa1bcd1ff53cad07f07a1b65a7ec6abf153d1c6b9a319febb2edbf0df97a4467fba83b82099b83d745b4844b03b192d0c286faca3b97d0837ba37c617fa2e617a27d234df2a75c21fb92f6883d6f2cf8a82b8ea94da272b160061d3ddc6c94753d40cd708a1eb926114b38d9d2dc3a7ba823924bda8433650c25eea00415064f3219d1c82eade823af8720beb171c62c9fa695821ab79d70a83a35480c11dfbcdc20b6a5a52b4f99f0854a588c2c37b530be8ee467f3a57b934795cd18010f017f96baa0b80b6197c119df3c54cbc6855ce116b9908d6b21e06d70d49fa32cc1b685b8283bc02c519fd0300173b1e5f9821c81e0f882599b4b18853e1aaf134faa71d4660f302ca879c6c729d0fbca1eb1eda6f9715c934bef9db71b4b099cc45aa02b7472ec5e5a500c7f94ea717e0f42849d67979aee0f5f6b067d02f545a0545715554abdad179a7f15677a4db2a0f678e466de61068d22090718178810fcef7e73645f7216a4d24932fb3d4295b3fe9b8249394d7aad0eda59df4b209c1e23e8ce8a86eb669769d5e1f4e0bab294e540eaf29c7789c8b13edb253d28b5a83aa4f4d152a766de5c132bc1f44463bb2cce330a254c3fa85c49527e024721e82e3c59ca133fe8aeaaf370e5228cf794386e8af042d8cbcffae916e6f7f7422634c5cb8c87f1b9baad09dd5d22182fe0f91e0e53540bbea31487149615576fa27f6181df2f793a466005ba808ffa71f1b7f277ca71ae8f6cdaa4c5bc9647e58d5f41a0b8f4ec8ae5c4b7b43f9bbbc39c7eaefa9f8f0b5fa004a2e29e631ef29b4233e4ca045b9b2597226d4de8d031c07eb5a0b133b6c6b99b890d5c5d61a1bcccc398e9938b68f6f73d6ebef482472639fbea0da5ff6dd99281572c6581ba915c3a1d8be4cd24b05183155d80de016ea51ea30a12676ed23ae6376197c6c26502089edd99e899755bb7b708945a216dc3b95e4283d558d6e46950f83e88b9a10bfa4ecd18ee6250e39523255a4cc2ca1bb088345e4694e4d489a3850a28cc29ae1a26b9ae2afc7b571b97d868ce13d1dcda57d634157261e4e241d97f01c50c11bfb3a38ea395bf385eefa0c25d1c9050fe45f9d2d4f4cd9e05d2c2819efbe19872933fd5d3465076b9e12a786ccd327e660b4146601e6b53359c53d2c87d8a2236c7265fbb5cff8034b46650491884a7d414ed5c5df6d64e2c5087ed0c2fec42431bafe1505f308052a2ee581780639a63bd0a3636c75894be48b9b89156a1c655705cf9f449bdd6022631add390fd15e991b526c2dc842b57f02852d68e55c5ba63edb7bf8f0941505da1af5a77c8edf66f7d3e9065bb7e62dfde80a55710dc472dadb49a8a2b1027549e4ad43cb83c9e43781a938b612b3d647e55e66ae6b2da3b1f2fb4ddfebab68e844fccbda17a890cb32127f3bdaa2240d4f11e665e86d1abaa8daaf3ce8500b4462de2ccf1ca44b9e8ffbe4bf2088adcf1e7e4353adcbac86929bb839fc11eeaf55f892334501372e60891a341398d90e911ca8301f839e28332f01acb652092be6c02a97698208a2b321e5e618694dac9cdcfeb87e629b34466869466dbf8bce0726efde7deba0d8d5e70cd39e5460f49263da4dfb54b2ca1f6b12c8c1058fde4657c2dd540c0f4ff5849a45e60c8a08950907ee3210ab39610c1f863a688a5e90884a70d1b666ba7947e791a824ebcab135107348c76e002f8a7976cf8ed11d460c7cb910cc654d39d22741cbc7753ca2ff56598e25a1a28453f53dcf4409ae54c6755000555d45d769e8718e4e228164b1221cfba095696abbaad4f75612ae52f227c3a17d5142f8fd671e827d608e2cee783c8ec1911d2c7621f2f872bb0274ebabe40eb54ff16afbe9058296493f51e1ba2d14e76dd2101051cfa5cd16609a735ac5fec401016a8b561ffadb70a11c0310ecb264bd408ced7cd86c066359d26da504c863c1386195b44326caecb4e7f7e40966a71e9d36094c143e3d66087a5f3701335b08c6302152c7fb1acacc0bce2f6400c17f754bab5392493152ef0c2791516b745f81ff417983690070082e53870e94027065d07f3bef96d352d04b293b4a19849812639bff02c2b4196da65b76991f68d235ed7e6e05a1ed2b8f1adb0f28b82840f40eb11c37f34f468edcbdacd1aca69339c1cf597c8693283c770c2db1fc62986953711762bb2454fbb9a863358814582c8ca0a01920f8c7443b70bafb0572f912c6642d33a5ceb9a161da991612b26642edb8dbd5b1ea7f8d3b1dbcd2d6a5b39fe4904b2c71cada657181d84232197fa9dc19c73e700520d37f48d32d91fe024c3c71ac9d6119d681d715c053d075e953d419cfb154157a41ac7a2b290b9dd57f27503d60ac184cf82422905785d2843cf632cd091a0446b18d356599e70963339630926bfb96deeecc0be00fb407a8a5e96887e743f4cf782f1e3104fa35db464cdc53da44f7c8e5342677369fcc4fb77d7664c008519260c56938caa62eb8c8b987c354112bf6c09821c941396462a2002d3856a07dadd617262d7d8812610d80a96102a1725dd971877f76786a62c7f3cce7e6f08d429a0735617401ed6191ffb4e26be09535694492c94820a7157d66bca2fc77ae7d0e67d62b9a6b70f73eabd5296923d36ce43e5d39b8736c0e1e5b8f65428283792d58994579bf835b78a743384abbd0934cc1f78461ee221b2fc25d63a50f1d1b4a6d82face082067544fbe1e51479d54cb2367a74011786fe68f781fe32ec278e76b7ee88e1c86d4eec74c51c8e58aa562b49d2218fda44af0201309fe725eefb05c7110a973753f093a9eabaeb22fa9b670132797ac18d2125099f09217abff42456c28ab92a79380d8d03d5fdbd21e9d2ef4cd388b25a303730d1a0c86631b02e82a7335b698e561e37ab1a2571186db299e34c27ff878318dbb98f8d6f442a903add298fa117cc663f3cfa99b0afae8f57ecf80dcd3224f106db984590b24504453ba8171619c242f82f3954bbe3d59cc13a8d740ffa9b90e0552b0fc4c10e3f06c0f361a0bd5628f72f12067d77f32d6bbcfcd8e17b0e819475d58438214cfbc7bf38ad4e734e294ef910973c9be7c2507990d816f62540c2a93d03cc62b8fe9df397de5c5185476dba490ae0828ea6843c11ba79c30b0088e8ac1ce055d25aa87cbb31700f18661cdb06b1748e0c7c61cc4e01e5cc914220a5000c42c7156319c3d32358298fa628df99daa64a32465d5c3ad7d16e389b2a6d957642284abd3948db542ef583a34057915a36552e70ec83a273c5e3dcfca6b62f497268ab5f95ba32ef75b3fc40ee095ddef9eda77cf7ae471654ac8fa3cc7b3d7fa2e6abf512e4976af959bdcd7d4c2cab04fccbd710e95f3e5d3039d5167d99412f8945580f99130eaa10c29626f07f4225a26826a6fe288a07dd3c92e7759e2aea97287683730d1bbefa9b09cfbb33ded78ec586186c41332ea659a9e36ec09b8f1d7265350a1047d78ad0d2a3693b7a3a8ab6aed2397ace9f4e373e3db1e271427368184adbd819f0314d7f440d9469161511f1c2fe9bad5322fb4e4c472c08833934d4ac1ebcd0086b019d2415b979d19f895bdd8dc4faba468277282712860234b0ea34e63e0345105abd6036ebfe20a843848f5ac8b598cdf794e3e04eb739316ae591e71ad9d7c68786e761a142440ddfac821f24f47ca6d8f5dfe72ad88efe01fe3f8257618f8caa1ca7a278faa18cb98b41f66d59b53980fe9f1e0492ecc52b4e7e4434b8ccb35e718030a30a598d4bef3b5bb102962d399e5fb67dee96503292f3d08dd991d4336bcfe20f4eca892680537b80da4de3fba1d56800d4911c830ab1b073675cf0e941c92", @typed={0xc, 0x1c, @u64}]}, @nested={0xc, 0x9, [@typed={0x8, 0x24, @u32=0x3}]}, @nested={0xfc, 0x8f, [@typed={0x8, 0x0, @ipv4=@dev={0xac, 0x14, 0x14, 0x1a}}, @typed={0x14, 0x3c, @ipv6=@ipv4={[], [], @multicast1}}, @generic="62dabd436511975ec9a9e175f756c215c3f9df0317131f30890eb45264690a7c65020d3a61c53cc4402f2fc014a9c38c4a134046ffa91b34545addcb", @generic="0966908a82be76de4196960e97065328d1e0c4d01d579c1d112c1346f4a6a5a38cfc827c48a4d28cb12ec39f2c42d4a9c5f48dcd15630684ae81b3617d210c80aaca9aff527af7a1572f4dce1997e3b36c6927e17a7bd8577cc3dcd3a413ae6d27621780fe70d61b225668e4964fae67a240ba168ee020305c15ce3a3f400fed09796c60fcf526de305c4bcb9dcb2d12", @typed={0x8, 0x28, @uid=r4}, @typed={0x8, 0x31, @str='\x00'}]}, @typed={0x8, 0x17, @pid}, @typed={0x8, 0x6d, @u32}, @generic="040ca440b6f937ddbb213e2747670a926110e6090e903cf64e13a7579e165f4c5faace7ef6bbfff805b9c0314ec7a1a59eb6ecff16ba8063ccde5614f8392b54e77356fecd3a0837528e7ffc415d3ab6945787daf491a85880b664b59635670c95d9cd2e35a46edc0b194e7a17c52f0d7fefcea9fd124309766c8f1be2342a16ef0ce72b7ddaf884dfed2961465de2bfcbca89c765f104", @generic="ff8034eeef1d03fd2549bb3b50a4086f294ffcafcab61f828c9cb93f6084630626cb77041b3e8059dc567556aa369093f85a6eed53653312961e1673c244840b35a353c1d921fafd7bc9157bfd1edfa9dfd8985de6aaae9c9599bcb79bc046c6c7477c2304a7ff31d7eb7317a78382da67216acba50a945ebf5c000c6c1eb2b7a63dbba17347e5dd5c7f5afabe5b48e63070fdcf25fa5c196970870c7fa36ed49f4978fe7ff6896d222962f177c3c9de76b5dda11aa04b3e366bc2c61a0b4e65aeb0864f118d1bfe62033ff69fe2b946f328f5c66528213e9c597949e5b5dcb53583cf72a2fa2b7e7fd7108e9dc5c7ec4bd0b27843c11d4334b90b42aa15dc7c0b3a8d5aa3d666716d16c4e86e4c87ceb2b0aff88e1c5fd8a6ea3e490965070ff3d7d0b01048d72b033666543fb3ff5aa87dfbc4d234d6640c48c09c3724b168ea751e4ac1f879e280be802ef4c1b45a2758fabca57070a8641d0acf928bfe00da3cee679825ebbe8a9f12281797b56da4f7a3c7efa1722d445afbc4acd39ef4e3524ba0c2b0c41957eee88892575f6a62d5afd664b8b50a1497c25a83e72dd76dc526fc62ba59800712782bc07933ed5a77aae50288ec71b90713d3f76b9be694b6bf11381fadf07fec65f9a3d52c8d8df61890e2739d010770947cededf6619d923f5513c4d3efbd93157841eb6e9ce6844a711841b1187e969290f169a41e014309ddcd2b35734201f31379fca45c794d97c711372eed4b62a86c40ee03eb8348e6170524f52d06dc8ead25147f56890b9d00bd9037a5d40048a95db51f8e768ab225dbc141bd908a23b8211712dac931d2010a8cc202a9e6b08410efe7b4db5c47e9d9a96e95f220595a749afa274fd6ebb91db7a8775a43de72ad7a9edb381bfcbe0670fa4f84b9b0a6fa3c66974f51409f05f6c25b376e62abcd1663940db59789f75eb530d32912bf7962910db005230ca61156ee19c3c913eb0740fb35d79bae8d02b9c35d2d1fbb5679450307fe81641ccc7d6c4d7ff9d218568dd3cb49988bd8c850f981616a52d835d426d29b6264506fde3c60449f951bafbf0ee65f83ca67a1afd341e0880a54ba481ad3dee5247e196a6bdf04c80d1fc862520cff9ca8552c3691f08b58474ffa35f613790f4c3f266392878025746202cab4da597d3ffbe90fb77de58ee66f25a26b5e2802f5e7f80576769ccccdcdfd931d15578b76d870fe2f196ece1ed097bd99658a54d6053882147f316962bf7ca9edff2087fc01f4e3abadc1981d25acd4465833e0cef3ddd407974456e8caaca5510c6e9c01977fd84319b79d566c82718aed08713dfa68061a4eddf9a54a77626b499f6cbb3192cfe18d2cece0aba174e4f3d99f8a50ff2ffe1e59f1cb8ef56e2855539f4414e0e5d55b35088c2977c0efa97b1ffc438ed2649143bcee3a060d41ecf897c41ea9f0e54ed870600f4f9d1a8690448553531269db55b47f75efa1dcd092f01d432b09e95844fe6be24b56ef4925907e1bf22e3d0184084634455cd28953ce2211121620259df86660d09eb03924ca9581ac018d4e0f7580501343a3af6706d0211c6c47776ab046ca72590c6bad1f9dae065e4a91c1db0f0dd48340e24ba15afafb6689f10ede8e773fd333f99c20448d389ab8acf66af5d3453b4bd00a59bc90349a6591bafc77ffdd876f83df6fa68e59818229c93cad4553364ce634f14ae768fdf93aa8386d3f459fb24235588a73d9092a256c9e995a4a7cac00ef97a6fa4b4eb3b7ceffec08f58cbe7995f2a53ad73c1d44bde1d5a28c0bcda54004175af8bfa68da4023550cc13be470f043ed575980aa918ec5b674f4bd2f2213fd1870c176f96fa100bf9baf2a9db52f70deac1985669511616c2701e2138e1b069466cecaf9f6cd7e07c096c2e6eebb71e92ef4e7765c532141620df840fbcef3236307f436ed61ac93a982d1781948c84e98c884c4c4077cf0e2cc4660c075674cae4974fd5ea092a0a42cb96baf298e1815d8ded091683409041f4ad8c77dc1b2e9cf0179d3adcda1a75b19974d30040b595aa11015e88ca7493fb9dc60f5647178c889bf0f8e80d4503ed9bd73b0af783697d7d2aa30af8eae9339ed3c932597e5685b7ebbd8ac4462f90d5e0e1be8b83cf53e6f70db7ca98ae46992c16968924121a55d5e1134d581317f9d6177dfe8061120e8487494dadb3385c5db3ca36d1a556263695f898fcdb343eab92ac90d1b70b35c887c69e0068e247fc7a960cedd096f48c71dd408d825fc79c58ddf4f719d17ef35b5a11e68a4a582606b0d5c882d59d50d5254264b43b65155442428549995a9822568fb8dc75feaa72b2cfb0f276e0914aac5a1a641c0d8b9c867267f82299d4de303e70661554ea8814a9f3987db38a017de3112ff22dd2570c5ec7302a3e2712ba2ced5e1860017aa4225d22dd227bb1a4523ccea0664be5ac044d75d61a5dcb07f5e1c844d0e7799504f2e9f26e8c08318237bd1c2c3bf30ebf92180f31ae56b25d0a817a61e03a9d4ec01e35e5a1f485b7a7201dca799bbc25e3a594441f118f59a18e60fd2dc86264677e5a4cb6bcf488934c667a92b53e3d10dacf7c92d52f53e27988352e4338a7db206ac204c773cf948d265cddee1fd0e329eedbb16d4780cd99500408a17038edb7bf5e22f691abddf94891682b45864a608c7fb53d318c91af862d875426ca4f9db83055a92d4f49ab855051a17f9c914949df32a7616eca398655ef3c06cddf53a8c106abbead47dc958340a1a7a699420fe378bd169304f0b302eac189438f4773981541dcf5c51b759af48dff8dafe56e2963f380b37f0134ac6ea15976e8e5c5ac0466f61238ac5ffec2805a176280d7fc840f48c2c42b6aa9a3180f3d5c8330ac6c8b30cdd2bb1bee35e17a53e46a3037432abef94aa2bde4d9cfe2d4b16c41853c071fd45c8e2a373937bfe5cee4fb85efc1b4df72c6eb3944c40fbc949592bb391d997682734e6816eccfbc772f0762d0bb910c7ddb275272747843e3fe7fc3bcc5bb9f94e492261c86a0f19a00c543e66b433e5e1656a5453261162ba187c315aed52e67c6ee32bf34e4f8815ad281b81c482eb72cf381cbe7ad6d6d273dd65110e8eff02a0123adcc30fee7b0d29b1d60bda5379235bc8af0776f296ee060b89eff7a473f56c9562c030f8d28a20cbb6bd195d13a1a200ca65db08025c6ff730f4e9b179c0fc049f414c16f0a7f998a35a466784e014987d6294dafe03362fd02f359f1b6593c00b076d76e87c158bf27b71d2cea1b1d69d903d775c18dabe8e77cfac7ea0908c985d4304a88869e5144fd009da05f12b0ce3cb2cfc152888d2144ec9c8ef3272d5384a2d5a3c74011ec7aa4f8fdd52fa3b43b8fdbac14a9565572392c9ba5a1ee2f995be978429fd54c1e5d2ef4e1c0ee7eeb076ff54d7c00dbf4d78bc490e95b837071f0fb1d1a984401b8a7f0fb1d76f8dbc018ec1dd6482cebdcbbde89d06febb891975b03ef449891b588402f09c41e051eb5a60ff491af0b9b9f80249de7cf77c2d0b6ee959de92a912ace6ddd1d7df753ac4559f7b5e9ba1b40568b6bc18c43eef9c905f8a7d57d19d59df1fefc4fc2f31518cc854449e3ec430ed241ea2e7dc290bec3ac201495f74aa5b943fe89f4051ee120d7999b1c7d39a28410aa6966b2bce3eaf09f699afcfcfc9777aa23fcbc160f348b04475736adfd9f21930ae59f32a6bdd797d5e408180638963f3c91e126065033cb41ba4c5f14eb0a101d071ffa0be357d3144fbddbe97f7e70d0044bc72afe7fa7f4217bec592c1af8ae63b9ec6b7a3d3db5ba669e77fed5ad6b40050783b7573731bb832cf658110a45b552ef204eee92da3869b7e231fc44e82e9c8f161fbfb4003825991b664b8f650f9f1e7beaf560d5ee6ab1f62569d049e5a363587903447317925818012d11027578ae7ec71113fd17724734d757536ff9b11637a056088fc46d44d6c19fcb2d4da9a3e7b3eae501ef1a7f78ca5c32629ea731701f7c4a208fdd37a06e0f700298812ec0eedb426a31eeb753c291b60819e7d883e35e00ee05b2990bbce06cbee46cc795a8bfc0a9add085ae4626f8bc5895806609bbd98b2fd6bf71433847b614ff68e85e0f5b835fe6367b3155e414f57ce187b7cc3f500f17a8e4f2490445014ed34dc94fc4a5f5be1c4b6cdce93560337a3ef3075e81a156f5919e2b29320e16a9cec3c843b1d5b3800125fcc645d490ff03c9a444051364045c831f2cde431815d2b5f40cd35d671a7bdb54c97a6d7e946bf7ead055ac792f42df81ed41bbd69e81721248452bbf8253357726edc38d65cb54103dffd9d250d10447420c00910c1926e4ef99444dae73e086bdd04b0250b2db4599f19d8f9aa316b12ba9246f5e1f06bd6575b1b9aba47d8c8d675544c788b8a3c4fd85724543bf841dfaf713b0dd7b8a337d07da508a09b92f2eb1f984941aed09a496f0de57f03154767fe953431229cf6f83797b78b441c23bbc33e188bff8ab78009988bb8cdcbe4bc7b260cb785736da4c0b13405b9c6c0102175e08d8ce961bdba2bbbb6cffe7cfd493da37168bdd438ab95d2d28de68ba13341cf9028f0afdfd35c76c0c3519cd65cf9ce35b9cb994c2ef4e83dbf4f030290a4313525de92d4f49c04696d3022d3459ea0fa9359f8abc4af12d178ded2e47c25955d8aa4303c957b5db6540bddb40b3aeb3bae6ea756891b582cd492f71a98fa72cd9dbe428bfdd6814be6febcd706a7d3aa73c1b875c4e85c00de7fb114c88c7d8234a307d070ad1add28f8f02e003c38e99cca1dc6fcda61d9a12f317ab0d4a50348419f8eb4cb01129d4e67cd855e0377e00eff8be1569a8b32293f31db05a73bf5d495e4cba19ea8825445abdebf3cf640162dc66b8ec4b4d42e4d8329f35432a78453b8ce517d020c75a516dc9ac07c7997744eb605102e164bb406454fae3f3f0160d19492aa0666f957cba7b1c7b095e1369e434b1f9c1f04a0e4a465753af9becc9ab6bd441cde039f27efc580c621602deeb6b942d237f086360af98dd1607b641e0b2dc8f5941bffc44f0911d1e1c5b19b74959dad72b85926c3fb77758feebfeda6ced39a1f9287389be625d20e5af418fd958446988ea584c05d675257791c7018b906442fa28b6e7eb093aea6b905c3c8a5d0724f87d529045cf179fd6cb7bafc09fab64dc1ff3a8b8277035241e5e4599bf9097e7a5327f2807bc7d17f28c8759b87f5adfccb8627cd0603025d2fb17f85f9776158d999f8473ac7329fee84eabfbaccf6a3ddbebe37db0ce5ef64d16dd70208950f60c4bf15ec7f4d03e0e35cab8423436db3b29b8980d0dc25f998794c2dfe228ab51af9b04db73b4d613036df03dd5803c11c0ab12cfaae67539d5bfab30dd3ae13b09dc0431daf932dd81a727012c0a4fddf73be7ae68f44a41fa3ddf046ec1fcd23061e994ad2819594f7fb66510f1f9eb61082313141292aeed29f0c92e922a517ecdd1b4ba0912fe8a5020ee176cb51fb236147faac4014e12f2b9a8f1302970794140e2e42d6e59b3f166c347e1d3bd063ef989fe894c340c64426df4944ec88350e4014c1a4dde3badae7e0083b4159dfd63aff8989f4eda0d1ac56656f018402a54f4ab60a2da05e9a5312706176d9d62130c7915056eb6f5c895bfc282e8e93534b235e756e199c7ef9af570cccf612c29dcc7e4c9fc239e726c65c729f8ec832b586a5621ac54a17f4a052683683da36b69ddd5913ccbf0b83d80b9", @typed={0xc, 0x3a, @u64}]}, 0x2300}, {&(0x7f0000002a00)=ANY=[@ANYBLOB="18000000320000032bbd7000fbdbdf2508007a007f6dad01bc7b0879d91332e2581b82232ec82f56da7de26b478e096c433b2c70f2fe6932368bac58d6e564b2e52a3f380746d5a8c8c16d360657dfda0640b03ca138887f24a7a42036d860ab529146bbb69573e0c9dc174fd0f6a5717f81fc85f8da990f"], 0x18}, {&(0x7f0000002700)={0xf0, 0x25, 0x410, 0x70bd2d, 0x25dfdbfd, "", [@nested={0xe0, 0x53, [@generic="1f7d436e20d016ce4a142b876105e200ef8212e9b02c6e600b5e5ffe404726a30dcc3deecd733ffdbdb65187ea8827a1fa9ee4661d08d786e6ae05e7fb5bdcb794f11706ebdc011a737288268a60a1d96b715dc08f0cd8034a653e5f3bbcdf6563f1ca29a459a8b36c7a", @generic="90b42e55a02d72deb62aa111a669d653459b7b595787819aa24cf769e8a7f4b9705156dc1ecd4b31808c74bde45c7d3d5139a5b438f66092c023edb050df92dbbedfe7c69c", @typed={0x14, 0x88, @ipv6=@initdev={0xfe, 0x88, [], 0x1, 0x0}}, @typed={0x8, 0x53, @ipv4=@empty}, @typed={0xc, 0x10, @u64=0x9}, @generic="c16e1f55ee"]}]}, 0xf0}, {&(0x7f00000028c0)={0x128, 0x3e, 0x200, 0x70bd25, 0x25dfdbfb, "", [@typed={0x8, 0xa, @uid=r5}, @typed={0x8, 0x6c, @fd=r1}, @nested={0xf4, 0x6f, [@typed={0xe4, 0x63, @binary="2fe8b9d54820d0ca641a99765192c3cc77916e86a5579a690ff9fae62dd8830984bc0a8e372ef31c4d28d873939213638deaff8619442c4a6cce9470d0cb2639acfd615fe6adf6783c30799d1971c295c2c0a6397a8612f2832331814929d7580a36af40495a18e13f94074b5e71a284233c49c0b7c8b18fbc201857224ae560fc78005d8501bdc9f4974975d5b05c5b4a2aa67f7885e0dba5f120d7ffce2a028ae9bda7026a4045bc670685125b637aa5683a10f998226982beab6e2977980ae7f2889292bdbc052538059f8523bcbf0751001cb6df82d0f7db255a9d"}, @typed={0xc, 0x6c, @u64=0x400}]}, @typed={0x14, 0x1f, @ipv6=@mcast2}]}, 0x128}, {&(0x7f0000003640)=ANY=[@ANYBLOB="a80300001c00000127bd7000ffdbdf251800530014006e00fe8800000000000000000000000001010c007d0001000080000000006c017c0008000a00", @ANYRES32=r3, @ANYBLOB="14003e00fe800000000000000000000035000000080012000f5c5179d4088b2019402f7efcd8bdd0546ff3463b12d0f0d09be6f1b6cf68298541a88bad94ee3d8d9a131a83952a0fd3bdabee844f104dd84ef3d6dbabbbaa4fcdb1d0aba7a18b4839c2082be1c6c03d0dc127d325bfe0f24a89858665f98f3c3ba2d8ed4e1a067bef211acb1f2d1d1bcf3bcf0a639c96f13ade186f8137e9e626fc01e327754a18da06506ce6ade299d93b9c67a228fc20cbd185d22064a4fd1f2403dd5e725043a5e457b6eba03e3a84a1b1471263cdf58e7f83954314b8605f3d9860218e26ada289f5b326d022b19bdb8277d35b679cde571046bb26f34c679df0", @ANYRES32=r6, @ANYBLOB="0c008e000800000000000000ff7dba14150f045520b4caffb3a10e844c78ca75ddcf3a005448901fefb72fea8d9b305755ab9c2d35b510eb1135fe2db85d613028aeab25f4afcdddf49fa6d4f75122626df89da8157542e39d4ee1e418ed6622ab647c9c95524b5d9c1d0f351305eaaaa7add8c75a1b0dc141bddd68df05d0522dd9c7b70f9d2c9716aa2e7a2bc095874802ef25d3fce45b9fb081a7d76bcb5ba4f01d3015abaca206f056782a0448f9d889bf116533b964c1619ef726556ab0271c258ed2c9794c1f532bb856067ae3981628aa31832b44244b9991f07a38fdc0f5857fee676398fc3ba8ad5b83cdba21513d85ba929af3e8c62ec19944c59a4f756ff8a6d730674313c974ca335c4e13b62e91376673de5fead049e04dc10d66b40661c078f0d1882165ea8d0a9f8fe13acfcea31173db606cd6c408003e00", @ANYRES32=r7, @ANYBLOB="9c08c26a709d069b7600ad91e62b59ed9dc27ef58e231c0ed8e0016c005d854e06fe24e3edf16033cdd34201c708771b2020eb4384d4a61335a7870fda94ade1d9221d603e36a56396721c5cc1a7fcb2e5a288c8608de30a1486ccd381cd2832393a25819a9eee92ace9042257d5971e6ac59b824d792adebefa8d806ac1d5e8c34f455a4de3b763b9b368080013007f000001b7c9f4deaebc1121b892ec4dccd9dd8b6e1a6e284fbb53215483731c76df19c74815a67447a63463f126d297686d52f654e14ac5d2a3603edcb528a2b91d41b6bc6a280e5af9599dff52dc4a821105e5f4481a162139f36837f0ffe730e79d68c97b0042f0c87f8e382bbf3ce62eb117c7bf9051d09b2aa1bb1633a324627b92b8f6e36bac2dc7e2682c9ccb3d6a2ac0495fcc4b7f499684052cdd404e2288e279f937b094e56bbbc7f5e294a636140bd2509d841d784a30ba07364da45850c8130fb2ae0c0498cfcd4a378bb8ed4d27ee8f8f6aef16a204866bf01c6c74a01300508d344b02dc45b1c8a4ea7345428f6f9094d2cc1eeef6dcf4ba222e14575848dc97d51f0f389246289e6946c29053b3f014f0ca8679f38a44f32f483b953693b72184cd6d74d69ed4cce594aae02ccf1e782960a715726c2858e88bf415d6d045c00ac3d7d8f1d15014a00f71ddbb6594158bf491e7190a0c1b55cb8043be890fc71100000c001d000500000000000000000000"], 0x3a8}], 0x5, &(0x7f0000003540)=[@cred={0x20, 0x1, 0x2, r8, r9, r10}, @cred={0x20, 0x1, 0x2, r11, r12, r13}, @rights={0x18, 0x1, 0x1, [r2, r1]}, @cred={0x20, 0x1, 0x2, r14, r15, r16}, @cred={0x20, 0x1, 0x2, r17, r18, r19}, @cred={0x20, 0x1, 0x2, r20, r21, r22}], 0xb8, 0x40000}, 0x20000000) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(0xffffffffffffffff, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) 18:18:54 executing program 2: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:54 executing program 2: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:54 executing program 2: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 827.611088] binder: 24525:24528 got transaction with invalid offset (0, min 0 max 24) or object. [ 827.646016] binder: 24525:24528 transaction failed 29201/-22, size 24-8 line 3348 18:18:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 18:18:54 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x63) ioctl$VT_SETMODE(r1, 0x5602, &(0x7f00000000c0)={0x8, 0x1000000000, 0x49, 0x100, 0x8}) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) write$P9_ROPEN(r1, &(0x7f0000000100)={0x18, 0x71, 0x2, {{0x40, 0x1, 0x3}, 0x7}}, 0x18) ioctl$sock_inet_tcp_SIOCINQ(r0, 0x541b, &(0x7f0000000040)) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:54 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 827.703034] binder: BINDER_SET_CONTEXT_MGR already set [ 827.708775] binder: 24526:24543 ioctl 40046207 0 returned -16 18:18:54 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 827.744137] binder: 24544:24546 ioctl c0306201 0 returned -14 [ 827.764915] binder: 24549:24551 got transaction with invalid offset (0, min 0 max 24) or object. [ 827.776333] binder: 24549:24551 transaction failed 29201/-22, size 24-8 line 3348 [ 827.809688] binder: 24554:24555 ioctl c0306201 0 returned -14 18:18:55 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:55 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f00000002c0)=0x0) r4 = syz_open_procfs(r3, &(0x7f0000000300)='net/ip_mr_vif\x00') connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x82) remap_file_pages(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000000, 0x2, 0x80000) setxattr$security_capability(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)='security.capability\x00', &(0x7f0000000280)=@v2={0x2000000, [{0x6, 0x81}, {0x4, 0x7fffffff}]}, 0x14, 0x2) ioctl$TIOCGETD(r5, 0x5424, &(0x7f00000003c0)) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) write$uinput_user_dev(r4, &(0x7f0000000400)={'syz1\x00', {0x2, 0x9, 0x1, 0x401}, 0x3d, [0x3, 0x10000, 0x2, 0x9, 0x4, 0xd89, 0x60000000, 0x8, 0x7f, 0x9, 0x2, 0x3ff, 0x3, 0x20, 0x1, 0x81, 0x7fff, 0x800, 0x1, 0x1, 0x100000000, 0xa81, 0xd63, 0xe6d1, 0x3ff, 0x0, 0x6003, 0x875, 0x4, 0x0, 0x80000001, 0x9, 0xff, 0x80000001, 0x0, 0x3, 0xeb37, 0x81, 0x20, 0x7, 0x0, 0x1, 0x1, 0x7888, 0x101, 0x0, 0xfff, 0x9, 0x0, 0x6, 0x5, 0x7, 0x7, 0x4, 0x8, 0x1f, 0x80000000, 0x5, 0x0, 0x6, 0xd3, 0x3, 0x80000000, 0x1], [0x3, 0x49f05d57, 0x6, 0x7, 0x8, 0x8001, 0x5, 0x8d8, 0xf9, 0x62c9, 0x180000000000, 0x5, 0x7, 0x8, 0xffffffffffffff81, 0x4, 0xffffffffffff9673, 0x40, 0x20, 0x6, 0x79d, 0x100, 0x8, 0x89, 0x1, 0x2, 0xffffffffffffffff, 0x7fffffff, 0x3, 0x3, 0xb0, 0x1, 0x7d5, 0x9, 0x6, 0x3, 0x5, 0x8, 0x5, 0x0, 0x7, 0x100000000, 0x7, 0x3, 0x4, 0x7ff8, 0x9, 0x401, 0x27a, 0x6, 0x1, 0x2, 0xffffffff00000, 0x10000, 0x100000001, 0xfffffffffffff5e6, 0x1, 0x7fff, 0x100000000, 0xffffffffffffff01, 0x9, 0xfb, 0xc6b, 0x100], [0x1000, 0x0, 0x0, 0x3, 0x0, 0x3a, 0x1, 0x9, 0x5, 0xffffffffffff8001, 0xa7fe, 0x7, 0xfffffffffffffff9, 0x9, 0x1e, 0x55b840cd, 0x9, 0x2, 0x3, 0x1, 0x5, 0x0, 0x4, 0xdd, 0x0, 0x3, 0x119, 0x4, 0x1ff, 0x1f, 0x3ff63857, 0x173, 0x7f, 0x0, 0xc0a, 0x8, 0x81, 0xe2b2, 0xe78, 0x736, 0x80, 0x8, 0x3, 0x9, 0x100000000, 0x8, 0x7, 0x7fffffff, 0x4, 0x61e6ea6f, 0x4eb, 0x2, 0x7, 0x9, 0xfffffffffffffff8, 0x5, 0x1, 0x400, 0x100, 0x27d, 0xffff, 0x9, 0x5], [0x100000001, 0x2, 0x2e2, 0xf8f, 0x1f, 0xffffffff, 0x2, 0xfff, 0x9, 0x4882, 0x9, 0x1, 0x10000, 0xdbd5, 0x1, 0x9, 0x7ff80000000000, 0x744, 0x4, 0xf3d, 0x6, 0x401, 0x3, 0x6, 0x1, 0x43, 0x1000, 0x1, 0x35f, 0xffff, 0x1000, 0x800, 0x8, 0x2, 0x6, 0x1f, 0x400, 0x80000001, 0xae, 0x800, 0x8, 0xfffffffffffffff8, 0x10001, 0x20, 0x80000001, 0x8, 0xff, 0x1, 0x92000, 0x1, 0x8, 0x43a7, 0x0, 0x0, 0x7, 0x5, 0x0, 0x3, 0x9, 0xfffffffffffffbe2, 0xffffffffffffffff, 0x9, 0x4, 0x7fffffff]}, 0x45c) 18:18:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 18:18:55 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = add_key(&(0x7f0000000180)='ceph\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)="753ac7d8c39ceec54c2cf3685823128d87c51546", 0x14, 0xfffffffffffffffc) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f0000000280)='pkcs7_test\x00', &(0x7f0000000300)=@secondary='builtin_and_secondary_trusted\x00') r6 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r6, 0x0, 0x0) read$eventfd(r6, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r6, 0x0, 0x0) unshare(0x40000000) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000003c0)='/selinux/enforce\x00', 0xa05400a4fa7ffe93, 0x0) 18:18:55 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 828.408078] binder: release 24526:24543 transaction 985 out, still active 18:18:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 18:18:55 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 828.478066] binder: 24565:24566 ioctl c0306201 0 returned -14 [ 828.489738] binder: 24561:24567 got transaction with invalid offset (0, min 0 max 24) or object. [ 828.503162] binder: 24561:24567 transaction failed 29201/-22, size 24-8 line 3348 18:18:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 18:18:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 18:18:55 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x1f, &(0x7f0000000040)=0x80000000002, 0x43b) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) fstat(r0, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = getegid() fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setresgid(r1, r2, r3) r4 = dup3(r0, r0, 0x80000) bind$netlink(r4, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x400008}, 0xc) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 828.581647] binder: BINDER_SET_CONTEXT_MGR already set [ 828.587396] binder: 24562:24584 ioctl 40046207 0 returned -16 [ 828.587482] binder: 24576:24582 got transaction with invalid offset (0, min 0 max 24) or object. [ 828.595884] binder: 24562:24584 ioctl c0306201 0 returned -14 [ 828.606282] binder: 24576:24582 transaction failed 29201/-22, size 24-8 line 3348 18:18:55 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 18:18:55 executing program 5: socket$unix(0x1, 0x2, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 828.678001] binder: 24594:24596 got transaction with invalid offset (0, min 0 max 24) or object. [ 828.712098] binder: 24594:24596 transaction failed 29201/-22, size 24-8 line 3348 [ 828.778648] binder: 24604:24607 got transaction with invalid offset (0, min 0 max 24) or object. [ 828.788917] binder: 24604:24607 transaction failed 29201/-22, size 24-8 line 3348 18:18:56 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r2, 0x660c) 18:18:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 829.275482] binder: release 24562:24584 transaction 991 out, still active 18:18:56 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) pwritev(r0, &(0x7f0000000080)=[{&(0x7f0000000040)="efa814d5df1c9c01cfbd8f807bed0a81f9901cb11951de857707e7fb6595c3b761f8770a7a261519351b8da571f0cf9a48b3631beb", 0x35}], 0x1, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000008000014, &(0x7f0000000180)=0x80000000002, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x7d, 0x4) sendto$inet(r0, &(0x7f00000000c0)="63e16a81fa165bbf178ea994edee6cd7a83e223cc5bc56ef8aa63a6054c31b00b8e1f15adcd8620e9f3ac8e1a3182f6d59d3b16045a27178da56ee68072ec1f2aa4a6638f6f6eab621bcdd52c405065fd3634560a6084e665a55d9d909367de35dabf84257cab00be1fe58dd09a267e2d2", 0x71, 0x4001, 0x0, 0x0) syz_genetlink_get_family_id$SEG6(&(0x7f0000000140)='SEG6\x00') 18:18:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 18:18:56 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:56 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r2, &(0x7f0000000340), 0xffffffffffffff7a) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:56 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x8000a, &(0x7f00000000c0)={0x0, 0x0}) r2 = dup3(r0, r0, 0x80000) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_PORTS(r2, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x82}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0x1c, r3, 0x111, 0x70bd2a, 0x25dfdbff, {}, ["", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20040000) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r4, 0x8912, 0x4001fe) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0xfffffffffffffdb7) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:56 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000040)={0x2f, @empty, 0x4e21, 0x4, 'fo\x00', 0x20, 0x2, 0x18}, 0x2c) 18:18:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:18:56 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 829.504451] binder: 24618:24627 got transaction with invalid offset (0, min 0 max 24) or object. [ 829.521151] binder: 24618:24627 transaction failed 29201/-22, size 24-8 line 3348 [ 829.553712] binder: 24634:24635 got transaction with invalid offset (0, min 0 max 0) or object. [ 829.586003] binder: 24634:24635 transaction failed 29201/-22, size 0-8 line 3348 18:18:56 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:56 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:18:56 executing program 5: r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 829.616954] binder: undelivered TRANSACTION_ERROR: 29201 18:18:56 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'tunl0\x00', 0x1}) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r2, &(0x7f0000000200)={0x2, 0xfffffffffffffffd, @broadcast}, 0xffffffffffffffd5) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000280)={{{@in=@multicast2, @in6=@ipv4={[], [], @loopback}}}, {{@in6=@mcast1}, 0x0, @in=@broadcast}}, &(0x7f0000000080)=0xe8) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:56 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 829.670336] binder: BINDER_SET_CONTEXT_MGR already set [ 829.676817] binder: 24621:24642 ioctl 40046207 0 returned -16 [ 829.677024] binder: 24648:24650 got transaction with invalid offset (0, min 0 max 0) or object. [ 829.692356] binder: 24621:24642 ioctl c0306201 0 returned -14 18:18:56 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 829.724279] binder: 24648:24650 transaction failed 29201/-22, size 0-8 line 3348 [ 829.757095] binder: undelivered TRANSACTION_ERROR: 29201 18:18:57 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, 0x0) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 830.305825] binder: release 24621:24642 transaction 999 out, still active 18:18:57 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = gettid() ioctl$BLKPG(r0, 0x1269, &(0x7f0000000200)={0x0, 0x800, 0xdd, &(0x7f00000003c0)="07e6557f803884471896242d068af0380645b4ae52e0c0683f2ea5cffc21f43763e49256fe614869f6259fc5203e9d1c9a4224d5690f0772c859ad4c02b0b7921cb27448e11f871e6873a0a5140c8e32abf423ac6ea709852e449131d97b68e8062c8b49130abe1eba1182e515dcbf10b53dfc9f1081644f7ef233ee9b52a8fc52363428cc051cb8ad1ca2c3f7298f8bc57817365a186ebb094a2b430547d834a54050e6ffa2a8799cbea120d96113b8f0a3bace8d9c4c492bd8d84bba3312334871d64e4a9e424bbefa64182be854334ff79d4698ebd558b9ca6a0b58"}) r3 = syz_open_procfs(r2, &(0x7f0000000900)='attr/prev\x00') ioctl$int_out(r0, 0x2, &(0x7f00000001c0)) write(r3, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000180)='/selinux/mls\x00', 0x0, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r6 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r6, 0x0, 0x0) read$eventfd(r6, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r4}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r6, 0x0, 0x0) unshare(0x40000000) 18:18:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:18:57 executing program 3: r0 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040), &(0x7f0000000080)=0x8) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r1, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r1, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r1, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) ioctl$sock_inet_SIOCGARP(r1, 0x8954, &(0x7f00000000c0)={{0x2, 0x4e22, @broadcast}, {0x7, @remote}, 0x2, {0x2, 0x4e20, @local}, 'veth1\x00'}) 18:18:57 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:18:57 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) ioctl$int_out(r2, 0x2, &(0x7f0000000080)) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 830.385593] binder: BINDER_SET_CONTEXT_MGR already set [ 830.391045] binder: 24668:24671 ioctl 40046207 0 returned -16 [ 830.415247] binder: 24668:24671 ioctl c0306201 0 returned -14 18:18:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 830.429315] binder: 24673:24675 got transaction with invalid offset (0, min 0 max 0) or object. 18:18:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:18:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) [ 830.464707] binder: 24673:24675 transaction failed 29201/-22, size 0-8 line 3348 [ 830.481191] binder: 24683:24686 ioctl c0306201 0 returned -14 [ 830.492537] binder: undelivered TRANSACTION_ERROR: 29201 18:18:57 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) 18:18:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 830.531766] binder: 24688:24691 got transaction with invalid offset (0, min 0 max 0) or object. [ 830.549246] binder: 24688:24691 transaction failed 29201/-22, size 0-8 line 3348 [ 830.563315] binder: 24694:24695 ioctl c0306201 0 returned -14 [ 830.571168] binder: undelivered TRANSACTION_ERROR: 29201 18:18:57 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 830.599744] binder: 24696:24698 got transaction with invalid offset (0, min 0 max 0) or object. [ 830.622777] binder: 24696:24698 transaction failed 29201/-22, size 0-8 line 3348 [ 830.632064] binder: undelivered TRANSACTION_ERROR: 29201 [ 830.641714] binder: 24700:24701 ioctl c0306201 0 returned -14 [ 830.684074] binder: 24703:24705 got transaction with invalid offset (0, min 0 max 0) or object. [ 830.693730] binder: 24703:24705 transaction failed 29201/-22, size 0-8 line 3348 [ 830.703627] binder: undelivered TRANSACTION_ERROR: 29201 18:18:58 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 831.129619] binder: release 24668:24671 transaction 1002 out, still active [ 831.202718] binder: BINDER_SET_CONTEXT_MGR already set [ 831.208219] binder: 24708:24712 ioctl 40046207 0 returned -16 18:18:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:18:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 18:18:58 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) prctl$PR_GET_NAME(0x10, &(0x7f0000000080)=""/143) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x1) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:58 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') r1 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) pread64(r1, &(0x7f0000000180)=""/110, 0x6e, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r3, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) ioctl$sock_SIOCOUTQNSD(r3, 0x894b, &(0x7f0000000200)) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r6 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r4, 0x0, 0x0) read$eventfd(r6, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) ioctl$TCXONC(r3, 0x540a, 0x0) io_submit(r2, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r4}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r6, 0x0, 0x0) unshare(0x40000000) 18:18:58 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x2f7) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) getresgid(&(0x7f0000000080), &(0x7f00000000c0), &(0x7f0000000100)=0x0) stat(&(0x7f0000000140)='./file0\x00', &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setregid(r1, r2) 18:18:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 18:18:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 831.352492] binder: release 24717:24724 transaction 1012 out, still active [ 831.375611] binder: undelivered TRANSACTION_COMPLETE 18:18:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) 18:18:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 831.412446] binder: release 24731:24732 transaction 1013 out, still active [ 831.422103] binder: undelivered TRANSACTION_COMPLETE 18:18:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:18:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 831.476659] binder: release 24739:24741 transaction 1014 out, still active [ 831.487796] binder: undelivered TRANSACTION_COMPLETE [ 831.552343] binder: release 24743:24746 transaction 1015 out, still active [ 831.564004] binder: undelivered TRANSACTION_COMPLETE 18:18:58 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:18:58 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 18:18:58 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:58 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) openat$null(0xffffffffffffff9c, &(0x7f0000000100)='/dev/null\x00', 0x400, 0x0) fsetxattr$security_capability(r2, &(0x7f0000000080)='security.capability\x00', &(0x7f00000000c0)=@v2={0x2000000, [{0xff, 0x3}, {0x1, 0xfffffffffffffff9}]}, 0x14, 0x1) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 831.950190] binder: release 24708:24712 transaction 1009 out, still active [ 831.974108] binder: release 24754:24757 transaction 1016 out, still active [ 831.987598] binder: undelivered TRANSACTION_COMPLETE [ 832.075677] binder: BINDER_SET_CONTEXT_MGR already set [ 832.081676] binder: 24755:24763 ioctl 40046207 0 returned -16 18:18:59 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r2, 0x29, 0xd3, &(0x7f0000000180)={{0xa, 0x4e22, 0x9, @loopback, 0x1}, {0xa, 0x4e22, 0x40, @rand_addr="9a4e86b7b06ccf00ec45e684e55914d9", 0xff}, 0xd0, [0x8, 0x8, 0x0, 0x8000, 0x7fffffff, 0x6, 0x9, 0x9]}, 0x5c) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(r2, &(0x7f0000000280)=ANY=[], 0x25) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:18:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 18:18:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:18:59 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000040)=0x80000000002, 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:18:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 832.254511] binder: release 24768:24773 transaction 1020 out, still active [ 832.265484] binder: undelivered TRANSACTION_COMPLETE 18:18:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 832.299425] binder: 24777:24779 got transaction with invalid offset (0, min 0 max 24) or object. [ 832.315427] binder: 24777:24779 transaction failed 29201/-22, size 24-8 line 3348 [ 832.325517] binder: 24780:24782 got transaction with invalid offset (0, min 0 max 0) or object. [ 832.340625] binder: undelivered TRANSACTION_ERROR: 29201 18:18:59 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 832.355255] binder: 24780:24782 transaction failed 29201/-22, size 0-8 line 3348 [ 832.381017] binder: undelivered TRANSACTION_ERROR: 29201 18:18:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 832.408445] binder: 24784:24785 got transaction with invalid offset (0, min 0 max 0) or object. [ 832.426607] binder: 24784:24785 transaction failed 29201/-22, size 0-8 line 3348 [ 832.439044] binder: 24786:24788 got transaction with invalid offset (0, min 0 max 0) or object. [ 832.439105] binder: undelivered TRANSACTION_ERROR: 29201 18:18:59 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 832.449319] binder: 24786:24788 transaction failed 29201/-22, size 0-8 line 3348 [ 832.464320] binder: undelivered TRANSACTION_ERROR: 29201 [ 832.491844] binder: 24790:24792 got transaction with invalid offset (0, min 0 max 24) or object. [ 832.504583] binder: 24790:24792 transaction failed 29201/-22, size 24-8 line 3348 18:18:59 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:18:59 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 832.781395] binder: release 24755:24763 transaction 1017 out, still active [ 832.806629] binder: 24795:24797 got transaction with invalid offset (0, min 0 max 0) or object. [ 832.816425] binder: 24795:24797 transaction failed 29201/-22, size 0-8 line 3348 [ 832.831132] binder: undelivered TRANSACTION_ERROR: 29201 18:18:59 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$IP_VS_SO_SET_ZERO(r0, 0x0, 0x48f, &(0x7f0000000080)={0xff, @remote, 0x4e23, 0x4, 'nq\x00', 0x0, 0x51cccf42, 0x18}, 0x2c) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 832.900574] binder: BINDER_SET_CONTEXT_MGR already set [ 832.906120] binder: 24796:24804 ioctl 40046207 0 returned -16 18:19:00 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r0, 0x0, 0xfffffffffffffe22) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r3, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r4 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r4, 0x0, 0x0) read$eventfd(r4, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r2}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r4, 0x0, 0x0) unshare(0x2000000) 18:19:00 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:19:00 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/mls\x00', 0x0, 0x0) write$P9_RLERRORu(r1, &(0x7f0000000080)=ANY=[@ANYBLOB="15030000070100080076626f786e65743006000000"], 0x15) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) getsockopt$IPT_SO_GET_INFO(r1, 0x0, 0x40, &(0x7f00000000c0)={'filter\x00'}, &(0x7f0000000140)=0x54) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r1, 0x0, 0x485, 0x0, 0x0) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 833.227252] binder: 24811:24816 got transaction with invalid offset (0, min 0 max 0) or object. [ 833.241250] binder: 24812:24817 got transaction with invalid offset (0, min 0 max 24) or object. [ 833.252000] binder: 24811:24816 transaction failed 29201/-22, size 0-8 line 3348 [ 833.259755] binder: 24812:24817 transaction failed 29201/-22, size 24-8 line 3348 [ 833.269420] binder: undelivered TRANSACTION_ERROR: 29201 18:19:00 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r2, 0x29, 0xd3, &(0x7f0000000180)={{0xa, 0x4e22, 0x9, @loopback, 0x1}, {0xa, 0x4e22, 0x40, @rand_addr="9a4e86b7b06ccf00ec45e684e55914d9", 0xff}, 0xd0, [0x8, 0x8, 0x0, 0x8000, 0x7fffffff, 0x6, 0x9, 0x9]}, 0x5c) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(r2, &(0x7f0000000280)=ANY=[], 0x25) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:19:00 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) write$UHID_DESTROY(r2, &(0x7f0000000180), 0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000200)={r0, &(0x7f00000003c0)="8d0f7ad2a8f8ce8567349d45fe451562ed5a2806bac31afeba53ba367975f29e47d682203cd76318d4132aae78ff715acf31a58ce380e2ee27caafea8c834b6894b4c20f6a980041779d958a5d7c51e1a36a25b4b02073634ff785fe29e5cb5908333605b4c695877650fd2c8ffd06f027dd19621f2e19581e7a17e89c925524de2a772ca2017f090ea7d53d85b87c7b9b8e18be4315cf73767c6dfb7758"}, 0x10) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x3ffffffc) ioctl$EVIOCGMTSLOTS(r5, 0x8040450a, &(0x7f00000001c0)=""/23) [ 833.298815] binder: 24824:24825 got transaction with invalid offset (0, min 0 max 0) or object. [ 833.315337] binder: 24824:24825 transaction failed 29201/-22, size 0-8 line 3348 [ 833.325473] binder: undelivered TRANSACTION_ERROR: 29201 [ 833.387456] binder: 24828:24833 got transaction with invalid offset (0, min 0 max 0) or object. [ 833.422953] binder: 24828:24833 transaction failed 29201/-22, size 0-8 line 3348 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 833.442705] binder: undelivered TRANSACTION_ERROR: 29201 [ 833.488767] binder: release 24837:24839 transaction 1034 out, still active [ 833.504748] binder: undelivered TRANSACTION_COMPLETE 18:19:00 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 833.610192] binder: release 24796:24804 transaction 1027 out, still active [ 833.634514] binder: release 24843:24846 transaction 1035 out, still active [ 833.648562] binder: undelivered TRANSACTION_COMPLETE 18:19:00 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/mls\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000010, &(0x7f0000d06000)=0x1, 0xffffff56) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @local}, &(0x7f00000000c0)=0xc) 18:19:00 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(r2, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$P9_RXATTRWALK(r5, &(0x7f0000000180)={0xf, 0x1f, 0x2, 0xc2}, 0xf) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) lookup_dcookie(0x8, &(0x7f00000001c0)=""/46, 0x2e) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x80003, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], 0x0}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 833.732763] binder: release 24851:24853 transaction 1036 out, still active [ 833.742653] binder: undelivered TRANSACTION_COMPLETE [ 833.750346] binder: BINDER_SET_CONTEXT_MGR already set [ 833.760987] binder: 24845:24855 ioctl 40046207 0 returned -16 [ 833.786462] binder: release 24859:24861 transaction 1040 out, still active [ 833.797645] binder: undelivered TRANSACTION_COMPLETE 18:19:00 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) r1 = openat$selinux_member(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/member\x00', 0x2, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) symlinkat(&(0x7f0000000080)='./file0\x00', r1, &(0x7f00000000c0)='./file0\x00') setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:00 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0xfffffffffffffd9a) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000080)='/dev/null\x00', 0x8000, 0x0) ioctl$TIOCSTI(r3, 0x5412, 0x8) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:19:00 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000200), &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, &(0x7f00000003c0)}) 18:19:00 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)=[@flat], &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 834.059273] binder: release 24869:24870 transaction 1041 out, still active [ 834.069470] binder: undelivered TRANSACTION_COMPLETE [ 834.073209] binder: 24866:24872 got transaction with invalid offset (0, min 0 max 0) or object. [ 834.088700] binder: 24866:24872 transaction failed 29201/-22, size 0-8 line 3348 [ 834.094309] binder: release 24874:24875 transaction 1043 out, still active 18:19:01 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 834.110137] binder: undelivered TRANSACTION_COMPLETE [ 834.119952] binder: undelivered TRANSACTION_ERROR: 29201 [ 834.141412] binder: 24877:24879 got transaction with invalid offset (0, min 0 max 24) or object. [ 834.150500] binder: 24877:24879 transaction failed 29201/-22, size 24-8 line 3348 [ 834.159601] binder: undelivered TRANSACTION_ERROR: 29201 18:19:01 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:19:01 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:19:01 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:19:01 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(r0, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) write$evdev(r3, &(0x7f00000004c0)=[{{r5, r6/1000+10000}, 0x5, 0xede, 0x40ee}, {{0x77359400}, 0x7, 0x100000000, 0x3f}, {{0x77359400}, 0x17, 0x100000001, 0xd94}, {{0x77359400}, 0x5, 0xa1f, 0x7ff}, {{0x77359400}, 0x17, 0x9, 0x2}, {{0x0, 0x2710}, 0x15, 0x0, 0x4336}, {{r7, r8/1000+30000}, 0x16, 0x6001, 0x4}, {{0x0, 0x2710}, 0x17, 0x1, 0x3c6a}], 0xc0) ioctl$TUNGETFEATURES(r0, 0x800454cf, &(0x7f0000000180)) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r9 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r9, 0x0, 0x0) read$eventfd(r9, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) getsockopt$inet_IP_XFRM_POLICY(r9, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@multicast1, @in=@loopback}}, {{@in=@multicast1}, 0x0, @in=@remote}}, &(0x7f00000001c0)=0xe8) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r9, 0x0, 0x0) unshare(0x40000000) [ 834.445370] binder: release 24845:24855 transaction 1037 out, still active [ 834.489155] binder: 24885:24891 got transaction with invalid offset (0, min 0 max 24) or object. [ 834.489188] binder: 24888:24890 got transaction with invalid offset (0, min 0 max 24) or object. [ 834.516681] binder: 24885:24891 transaction failed 29201/-22, size 24-8 line 3348 [ 834.527100] binder: 24888:24890 transaction failed 29201/-22, size 24-8 line 3348 18:19:01 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:19:01 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 834.634083] binder: BINDER_SET_CONTEXT_MGR already set [ 834.639610] binder: 24886:24893 ioctl 40046207 0 returned -16 [ 834.664825] binder: 24901:24904 got transaction with invalid offset (0, min 0 max 24) or object. [ 834.671460] binder: 24903:24905 got transaction with invalid offset (0, min 0 max 24) or object. [ 834.686079] binder: 24901:24904 transaction failed 29201/-22, size 24-8 line 3348 [ 834.700616] binder: 24903:24905 transaction failed 29201/-22, size 24-8 line 3348 18:19:01 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) prctl$PR_SET_FPEMU(0xa, 0x1) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000040)={0x9, 0x6, 0x13c8}, 0xc) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:01 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:19:01 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:19:01 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000080)) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:01 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 834.986834] binder: 24915:24920 got transaction with invalid offset (0, min 0 max 24) or object. [ 834.999044] binder: 24915:24920 transaction failed 29201/-22, size 24-8 line 3348 [ 835.025483] binder: 24917:24918 got transaction with invalid offset (0, min 0 max 24) or object. 18:19:02 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) [ 835.053685] binder: 24917:24918 transaction failed 29201/-22, size 24-8 line 3348 [ 835.089611] binder: 24925:24926 got transaction with invalid offset (0, min 0 max 24) or object. [ 835.105590] binder: 24925:24926 transaction failed 29201/-22, size 24-8 line 3348 [ 835.161541] binder: 24928:24929 got transaction with invalid offset (0, min 0 max 24) or object. [ 835.172232] binder: 24928:24929 transaction failed 29201/-22, size 24-8 line 3348 18:19:02 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:19:02 executing program 5: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) 18:19:02 executing program 2: r0 = openat(0xffffffffffffffff, &(0x7f0000000300)='./file0\x00', 0x1, 0x0) write$P9_RREAD(r0, &(0x7f00000003c0)={0x9e, 0x75, 0x1, {0x93, "129d0854a7ed292923b9e16e3db23bc7ed053760ea9aeec91ce69cf80e17dc39c4f89ecd2c2082f79652d2b63087b5b7e35c7098032002fe7d029c405771d411c0cd990fac363a4376872a8eb9fe18e69ca5609ca97efc1e6697e666ffb0a5874034840f3f3133e8414deab091d158ae68ea8e88fb67c2f5d981e9b9272f225a56e1e54f1d39c86152645572295c3a2a98dd13"}}, 0x9e) ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000004c0)='attr/prev\x00') write(r3, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r4 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r5 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r5, 0x10, &(0x7f0000000040)) r6 = mmap$binder(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000000, 0x10010, r4, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000480)={r6}) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) ioctl$int_out(r1, 0x5460, &(0x7f0000000280)) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r2, 0x1, &(0x7f0000000200)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r1, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x2000002, r1}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r0, 0x0, 0x0) accept4$inet6(r3, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x800) unshare(0x40000000) [ 835.264847] binder: release 24886:24893 transaction 1047 out, still active [ 835.363684] binder: 24933:24942 got transaction with invalid offset (0, min 0 max 24) or object. [ 835.378940] binder: 24933:24942 transaction failed 29201/-22, size 24-8 line 3348 18:19:02 executing program 4: openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x101000, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/full\x00', 0x22040, 0x0) openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0xc0, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x7fffffc) r2 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r4, 0x0, 0x0) ioctl$BLKROGET(r2, 0x125e, 0x0) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000003c0)={{{@in6=@mcast1, @in=@loopback}}, {{@in=@local}, 0x0, @in6=@loopback}}, &(0x7f0000000300)=0xe8) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r6 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r6, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0x1}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r3, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r2, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r5}]) openat$full(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/full\x00', 0x80000, 0x0) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r7, 0x0, 0x0) unshare(0x40000000) 18:19:02 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r4 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r4, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0xfdfb) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r4, 0x0, 0x0) unshare(0x40000000) [ 835.436184] binder: BINDER_SET_CONTEXT_MGR already set [ 835.441647] binder: 24934:24945 ioctl 40046207 0 returned -16 18:19:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000d06000)=0x8, 0xffa4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r1, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x12000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="100108008a2f857728be6f3e534d72888e77fa83bf7a6d440c81de0a23177c9bde4c03289248c976b0ecb706678ace7b8784c751c78316dbed05f11dbaf677df25f05272f991422629f08a24de7d6d438115c88626397016e3d52a6812734c722ee8324d627078b2f27638b01bc9053987b3a735cfe29ca3e6d2941cf9fc75e9070c56133d6a4aa95661c0e9ed9925f6e2a3db59314dca5e67f76698702160375144db74764e24cbf6472f145a27000000000000000000", @ANYRES16=r2, @ANYBLOB="020025bd7000ffdbdf25130000000c00060004000200040002000c0002000800020007000000a40004003c00070008000300ffff0000080002004000000008000200010000000800010015000000080001001c00000008000300feffffff080002007e0100000c00010073797a31000000000c00010073797a300000000014000700080001000500000008000200250000000c00010073797a30000000000c00010073797a30000000000c00010073797a30000000001400010062726f6164636173742d6c696e6b0000240004001400010062726f6164636173742d6c696e6b00000c00010073797a30000000001c000200080002006200000008000100000200000800020000000000"], 0x110}, 0x1, 0x0, 0x0, 0x40}, 0x81) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) pipe(&(0x7f0000000140)) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:02 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000080)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:02 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000040)='/proc/self/net/pfkey\x00', 0x2, 0x0) write$P9_RXATTRWALK(r1, &(0x7f0000000080)={0xf, 0x1f, 0x2, 0x10}, 0xf) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:03 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 836.105531] binder: release 24934:24945 transaction 1057 out, still active 18:19:03 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0x25b, 0x6, 0x0, 0x1, r3}]) ioctl$RTC_WIE_ON(r0, 0x700f) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) [ 836.183545] binder: BINDER_SET_CONTEXT_MGR already set [ 836.197268] binder: 24966:24968 ioctl 40046207 0 returned -16 [ 836.205498] binder: 24966:24968 Release 1 refcount change on invalid ref 0 ret -22 18:19:03 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0x25b, 0x6, 0x0, 0x1, r3}]) ioctl$RTC_WIE_ON(r0, 0x700f) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:19:03 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)={0x0, 0x0}) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r6 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r6, 0x0, 0x0) fcntl$setownex(r3, 0xf, &(0x7f0000000180)={0x2, r5}) read$eventfd(r6, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) r7 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000200)='SEG6\x00') sendmsg$SEG6_CMD_SET_TUNSRC(r3, &(0x7f00000003c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000280)={0x40, r7, 0x10, 0x70bd26, 0x25dfdbfc, {}, [@SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x2}, @SEG6_ATTR_DST={0x14, 0x1, @initdev={0xfe, 0x88, [], 0x1, 0x0}}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0xc3}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1ff}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000}, 0x890) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r6, 0x0, 0x0) unshare(0x40000000) ptrace$setopts(0x4206, r5, 0x7ff, 0x100002) 18:19:03 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$IP_VS_SO_SET_TIMEOUT(r0, 0x0, 0x48a, &(0x7f0000000080)={0x9, 0x401, 0x3}, 0xc) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:03 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180), 0x4) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000017, &(0x7f0000000080)=0x80, 0xfffffe24) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) prctl$PR_SVE_SET_VL(0x32, 0x13184) syz_execute_func(&(0x7f0000000040)="410f0fa6cebb9ec60cc4c1fc77c4a2452b5c1b000f1b590f0f5181ffefffff40dbe2c461cb5933460ffb1de3000000c4c231a7f9676444d17cdba9") sigaltstack(&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000000)) 18:19:03 executing program 3: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000005740)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xd0, 0xe8, 0x2, {"0faf4f247715c9df6fc1148f4f6b2f31255fb80a4a7e6c4e093e191ff555416612ccbbce0087bf57a8778cf720824078841990c2705049b3543ad1ab5bcfe2eadba754a20dd63a5f04723fc0daf08d0d185df098fb0655a23779134fc20d26e60cb03e4b4e0e1ef577aac8aa7d4aba1e90305f6966b479a1e6422a50df2075936c4cbe4927a1e020da03175ef9628bb7a99ddfb0658029196810964ce1391d94f2bc5702ee7044314718febfcb949877f93334f5fe5b84e9b40020ca74e6517a374d81e7aa71db9c0547928acf6f"}}, {0x0, "6bdcc5f18f85de33495b12c810b5142a40cf7f7f48dfdbd7fb93ffa3697220ed1f6d6ba83678a96821790a056e06e49b68611fa6ee3ac3d4a28a57644742f4589a57f840a8"}}, &(0x7f0000005880)=""/156, 0x12f, 0x9c, 0x1}, 0x20) fsetxattr$trusted_overlay_redirect(r0, &(0x7f0000005640)='trusted.overlay.redirect\x00', &(0x7f0000005680)='./file0\x00', 0x8, 0x2) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000056c0)={'team0\x00', 0x0}) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f0000005700)={@multicast2, @local, r2}, 0xc) setsockopt$inet_tcp_int(r1, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r1, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r1, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r1, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r3 = dup3(r1, r1, 0x80000) accept4$packet(r3, 0x0, &(0x7f0000007c80), 0x0) sendto$inet(r1, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) recvmmsg(r1, &(0x7f0000005440)=[{{&(0x7f0000000040)=@nfc_llcp, 0x80, &(0x7f0000000140)=[{&(0x7f00000000c0)=""/68, 0x44}, {&(0x7f0000000280)=""/79, 0x4f}, {&(0x7f0000000300)=""/227, 0xe3}], 0x3, &(0x7f0000000400)=""/142, 0x8e}, 0x81}, {{&(0x7f00000004c0)=@caif=@rfm, 0x80, &(0x7f00000001c0), 0x0, &(0x7f0000000540)=""/245, 0xf5}, 0xfffffffffffffffa}, {{&(0x7f0000000640)=@sco, 0x80, &(0x7f0000000740)=[{&(0x7f00000006c0)=""/107, 0x6b}], 0x1}, 0x100}, {{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000780)=""/89, 0x59}, {&(0x7f0000000800)=""/43, 0x2b}, {&(0x7f0000000840)=""/206, 0xce}, {&(0x7f0000000940)=""/21, 0x15}, {&(0x7f0000000980)=""/4096, 0x1000}], 0x5, &(0x7f0000001a00)=""/130, 0x82}}, {{&(0x7f0000001ac0)=@ipx, 0x80, &(0x7f0000002d80)=[{&(0x7f0000001b40)=""/111, 0x6f}, {&(0x7f0000001bc0)=""/228, 0xe4}, {&(0x7f0000001cc0)=""/4096, 0x1000}, {&(0x7f0000002cc0)=""/154, 0x9a}], 0x4, &(0x7f0000002dc0)=""/43, 0x2b}, 0xffff}, {{&(0x7f0000002e00)=@generic, 0x80, &(0x7f00000030c0)=[{&(0x7f0000002e80)=""/250, 0xfa}, {&(0x7f0000002f80)=""/36, 0x24}, {&(0x7f0000002fc0)=""/152, 0x98}, {&(0x7f0000003080)=""/62, 0x3e}], 0x4}, 0xcaf}, {{&(0x7f0000003100)=@ax25={{0x3, @default}, [@null, @bcast, @netrom, @netrom, @bcast, @remote, @null, @bcast]}, 0x80, &(0x7f0000005380)=[{&(0x7f0000003180)=""/4096, 0x1000}, {&(0x7f0000004180)=""/40, 0x28}, {&(0x7f00000041c0)=""/33, 0x21}, {&(0x7f0000004200)=""/4096, 0x1000}, {&(0x7f0000005200)=""/147, 0x93}, {&(0x7f00000052c0)=""/143, 0x8f}], 0x6, &(0x7f0000005400)=""/51, 0x33}, 0x1000}], 0x7, 0x2002, &(0x7f0000005600)) timerfd_gettime(r3, &(0x7f0000005940)) 18:19:03 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 836.923548] binder: release 24966:24968 transaction 1060 out, still active 18:19:03 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000140)=0x66) read(r5, &(0x7f0000000000)=""/11, 0xb) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000280)) r6 = syz_open_pts(r5, 0x0) ioctl$TCXONC(r6, 0x540a, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RATTACH(r2, &(0x7f0000000180)={0x14, 0x69, 0x2, {0x2, 0x1, 0x4}}, 0x14) [ 836.998058] binder: BINDER_SET_CONTEXT_MGR already set [ 837.004094] binder: 24998:25002 ioctl 40046207 0 returned -16 [ 837.012489] binder: 24998:25002 Release 1 refcount change on invalid ref 0 ret -22 18:19:04 executing program 2: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000140)=0x66) read(r5, &(0x7f0000000000)=""/11, 0xb) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000280)) r6 = syz_open_pts(r5, 0x0) ioctl$TCXONC(r6, 0x540a, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RATTACH(r2, &(0x7f0000000180)={0x14, 0x69, 0x2, {0x2, 0x1, 0x4}}, 0x14) 18:19:04 executing program 5: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r5, 0x40045431, &(0x7f00003b9fdc)) ioctl$TIOCPKT(r5, 0x5420, &(0x7f0000000140)=0x66) read(r5, &(0x7f0000000000)=""/11, 0xb) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000280)) r6 = syz_open_pts(r5, 0x0) ioctl$TCXONC(r6, 0x540a, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r7 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r7, 0x0, 0x0) read$eventfd(r7, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RATTACH(r2, &(0x7f0000000180)={0x14, 0x69, 0x2, {0x2, 0x1, 0x4}}, 0x14) 18:19:04 executing program 2: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:19:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000e4000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB="000000986da2c5bc3077f10600000000000000b2530495c49ce7a618f9367c0429eae1feffffffbc4a1773cb00392d9792fb2d7bf93b1fd88437a41529d5ae3408f779aa385b9d5e12083e310d61298b60c92509f568f66f15"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 837.526495] binder: BINDER_SET_CONTEXT_MGR already set [ 837.535099] binder: 25019:25022 ioctl 40046207 0 returned -16 [ 837.537757] binder: 25024:25025 got transaction with invalid offset (0, min 0 max 24) or object. [ 837.547213] binder: 25019:25022 BC_INCREFS_DONE u0000000000000000 no match [ 837.551429] binder: 25024:25025 transaction failed 29201/-22, size 24-8 line 3348 [ 837.567807] binder: 25019:25022 Release 1 refcount change on invalid ref 1 ret -22 18:19:04 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast1, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000100)=0xe8) getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f00000001c0)={0x0, 0x0}, &(0x7f0000000380)=0xc) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000003c0)={{{@in=@loopback, @in=@multicast1, 0x4e23, 0x9a, 0x4e24, 0x0, 0xa, 0xa0, 0xa0, 0x0, r3, r4}, {0xd9, 0x5, 0xc7a0, 0x401, 0x8, 0xc0e, 0xffffffffffffff01, 0x9}, {0x5, 0x6, 0x200000000, 0x2f9ad92}, 0xab, 0x6e6bbb, 0x1, 0x1, 0x1, 0x2}, {{@in=@loopback, 0x4d3, 0x6c}, 0x2, @in6=@dev={0xfe, 0x80, [], 0x19}, 0x3505, 0x2, 0x3, 0x1, 0x3, 0x101, 0x2}}, 0xe8) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/vga_arbiter\x00', 0x8100, 0x0) write$P9_RSTAT(r5, &(0x7f0000000500)={0x4f, 0x7d, 0x1, {0x0, 0x48, 0x28b, 0x0, {0x11, 0x0, 0x3}, 0x24100000, 0x3, 0x6c8b7c19, 0x6, 0xa, '/dev/zero\x00', 0x1, ')', 0xa, '/dev/zero\x00'}}, 0x4f) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r6 = openat$zero(0xffffffffffffff9c, &(0x7f0000000080)='/dev/zero\x00', 0x400, 0x0) ioctl$IOC_PR_PREEMPT(r6, 0x401870cb, &(0x7f00000000c0)={0x9, 0x80, 0xcc2, 0x800}) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:04 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') fcntl$F_GET_RW_HINT(r0, 0x40b, &(0x7f0000000400)) perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') ioctl$KDGKBSENT(r2, 0x4b48, &(0x7f00000001c0)={0x10001, 0xff, 0x3ff}) write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f0000000480)=ANY=[@ANYBLOB="01000000000000000000000053dcb82f40d2b703126b3676921108b5a038988c970b25524512ef533e009f6c92f3c94340f1000302273949346bcff13eca798a2063d25b4c0531374478fb5191b3f6837794b55acc4d89ba5a"]) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x20000081, &(0x7f0000001c80)=[&(0x7f0000000280)={0x0, 0x0, 0x0, 0x9, 0x40, r4, &(0x7f00000005c0)="cad1f2c35879d5fef942be31f284dbd17bc65fc05154d581e6ad28378661c27753c7cf92051d0262196d5a1dee192e9a3fbe8499ff413cae3e30d25d52f8bbe2782698af10c739a62215b0ef4ef2355a34d5260d9293721a18cc905e8d24d6d53bb89a63d912e467c842f488d0452b1bd451d6bd6f944bee0288a3925c76857d8307af61409d569671d26d4619e33d0df603", 0x0, 0x234c, 0x0, 0x3, r7}, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x6, 0x17, r2, &(0x7f0000000800)="0d2880aebf769af21fa80e952ba165726e5eb2f3bafe85a99f47dcf683315dea51fdc9ec4d076eb2a55d124dc26ef9fac772c408affe12d7099c3afca5e79759cf5cc666092cae7682ee9b82351e88cfbd244b66fa13ef70ffdf2703c9150361c42bf88438b265d7f5b8eea2e6937262c712e9728c931240c7c829229f1439f568eae6639d9edc833bdd40c5fc954e26e0638ffe1db1b218f37b367294558189791e78ed27909bc412153b49e7", 0x0, 0x400, 0x0, 0x1, r6}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x2, 0x3, r7, &(0x7f0000000740)="2baed3f3ad0633d6a390c35f087fe821c0b03b453d822a2692fd78499b18145933e49aa7dcd3018d67c48681189e7e84a679", 0x0, 0x7, 0x0, 0x0, 0xffffffffffffff9c}, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x8, 0x81, r0, &(0x7f0000000940), 0x0, 0x5, 0x0, 0x1, r7}, &(0x7f0000000a40)={0x0, 0x0, 0x0, 0x2, 0x0, r5, &(0x7f00000009c0)="f9bca6bc03dc1213fb24558173c505231152644ad5413f2cf79d67b1de1e65da8e35793ac28495ba3ed928800c316a0c3c1604f88e51a46528b15437f83bcc211cf3fa6f7885e37a9b294f33c71f034c81f85827829749802ee5b09250983f8e2670eaca79", 0x0, 0x800, 0x0, 0x2, r7}, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x3, 0x210, r3, &(0x7f0000000a80)="9b3b310f489ff8a7f802c201463edec69e23413cbfe7bbe4f571026872eb15cf316ceb8131ddd990289c4ca6d72f18983187e9e268533319748533d27e713f21ecc656b4bfa9635f1b8c9a5bbcd139e15eb95df8dd776a891bb683ddda6fb4c262ed4bb7eaaaf2031a0de451bf489c92eda5f417cab7028ba207ef09187e8e8789d2272a0adbb64467a214baeda338ba32bddb35dac45eecc39d1526a0dd9e86a1faa4aa8f318ddedc748054214858af361fb1488633ffec6892e5b64cd485d4d5c212025101e589d390cf995881c647527396f0c2f8cfcf025f5801f4617f3d301787b40d58b6a16b3d9df3d966fbb3d3bcaacc450a79f6dbae0572250ac9370fce70f0ac7c3f155d468361252e7b5b8f0d9ef9213211843a0a4289ca70617edbd719a927a54a5883d2f43d45b3b111647f93cce4c0dcf642dbb540210ea1aceeb3116300e1415baa0f4a45e8b9bb267d7a2847852f1a0460a47f126af06a3f20385ed859a47ec15de9e9b06e0fa2e07135e0f8be1d809594dd6cedd0a8695c4329eb3199f4de95891b518b212cd8c26c247904fd0b681e08ed232d596b28df34c3d210abdb0fcf4385a33404a5d0f7866be1c6f900ef243dafb0c24152f55f4db77797ddccbc239e64b3603e260dcdde9413b96c20a94b8290368b9c3493d94376c9176388fef3e154c4a2d736a1ab34cd7f39932bbe9130a0b7d7b55efbb6f2ace42ad877758633f1b3fd0176af2e5fc023a7e9e84861325040f2daaa12f5f7b85dd1c141365e053263690c61b9e2acc187abf9bfe4d97ff4bdbfb6c367e4ec73a153dfe1879b8cb52098058f086cba1934941edd8b2107167d8a1e5eb55662af8971e77dd6120723a6c55149b7086361751dbf158874335f515b9b83ded34c5cb711d698aea932e183441ce8409be42c0b5385cc0e521bbceecffc604ec588c2d938ad616b84aaa349e0fe924d869892bbaf8715642b85c7627ea4b96732e4d122cb70eb0409312201700bdee5e30441ce424ee0575e2a8d6eccdecdae979f06bf1d94226410ee974b242ed5efc6971eaba4dbc274c190f67b648075bc43a5d9770f6b21099a06b1f5d9200e0e32d5a4f56b5dd763dd1818a8ffd2864b84f072c374a9ce711cf101e99874a0f264698da91fca901038bd5d3458cb8b9fe9fa34769504b06150171de89626b2773aa1963fe65d59d8634a922845a3cec7173b2b09e0105ef3e8678a77a2b999b9456401a9aba3f801111d49ad7035b2c792e07c0b9dc30a6e0c46279c970e4d954353e0299bd1b28ff084e721a552bd952f4ef5900b35c627b9626501d689b887cb3fb00a5e67c766cb2929b5b3d069d16ebff66a155405d7c2146f77d08e4699d868c4cae1e9f18098e79e0fd118743b280cef7367372d76e1797b1990f9b68f1abc180abd29fd406cfe12c4a48f57b423896a2e577fea92b746332b800a506d43ae879f71105a45474ab673372c166d5be94d3bd33819fa0142cc78e626e0532919032c2f94521af3ad288c86cd077a35da33a50da7c883f18d81000b8e6d36d4b7796d0ac0c24191f1cff49ef5226869e786c1185dd3df0b55fd902abc52fd27d85ed2f2c859bf2639a77d524dcb8fb1fec1d36aecda56074381b3b9d2ee9473546828055da7e4ee0003e7535a763281b7f433087d594d1ca6a57f27355a2a5049838aaee9c1e72fcfdff01f343e0eea7bc822f1db3eda6defcfef06fc887235cf3514292adc790a2165cb13546d19e6351fd6a079979ab27a6be22bba59101f551743f834457f919d674b15f0477b17dd9550b71e9581eb0f47f2c236dddd4cb6441ab56de315187ea9b1d03972835214d153105c146477694b277e1612f9729cb78f8ab39078248fb19957b3d578f330d820c152f962088bf94cbb5bbcce125386d780d01b8913e809e681814bb1dcad2f88d92bca5c4742e7a814ac04543d0edcf21eefc1b1f824fdfd63b107d7ed9a9bd37bc13a76b1272340f1f2402ff83fa7e19dfbfd13136577d97f4471d88ea8cbfd2cb5bef8fb0be89a0d05d1b1d317f6da916155bd98aeceeb23f6fd71657b52649b0dddaa4fb94782a9b9ee8373eb2473c6e9dd4ff8b79c3f24b9c41b52b2dbd2d73499e9c032befcda60e9b06cc65ebba75309871f9a9b1034e950885f14e52379bf5cfee2f79e3ed4cd7813bbc8e8f4b87f8560ab15c5fbc32b084b9c4220596ebb44a62a87f6793f16d34beb16deb23c01ddad4c15791d3ff3513b0662101fc6b72a71f2a0a841920d42f0340b3a954abe9365611b4f9ddc120fe0577c82dd566b62d3d0471489f0d1ee8e60634da099337111a6feb61fd52a195f3e8b49af2a38e9c3f3c49ce424440531f1f0c6cb68cedc2e23d9b3a90df96d750a2be4b589657fefa095658368ec7b46900816d5beeef650e9cb00868f306e3b9859d80e3864416112953ef9a775f32449c44e452df4cc03e3f73799d07548a08235be8e60a040e592796a5511134d376fbadae0307f1887e9c31a115750936a6861f9673801a1252dc41ac2468f14a0d1e29e940d3aa68bcec2e8be7312dc638e83ead9d0f659f2507a04cbf84b9d3e1bd2574a844b354fc790520acead30b9800aec7f2cd39c9027b7f7a5d7980370901ea608540c37bb0e59ebbe32da895aceca5bf1b4df407e75a90e11d4b9ef5b969c97384b3a817a5279f9e4c3625540a331b65dfdae98e97bf2253535e7248cfcf61ad363bab10e53a55df398fabcf861c911871e6131e4b91d256f05c9c77fc991026585a4ef93d7aa7be704b49e58f4bf91ef01884b3e93d17314329384ab49754bf7fef91539851093a1aaaf4de0bfe597ca07676a7d2a0737288c10a540df29165b8a5db3534a0a52e99a83ebdce03ab80695ef781492d25e2817290167825e3b8ac98ebe39d3fcb03db943017a1c24463aa1eae4f645154491776196504eb3f7b0c3ae4552a9ecb92884bc66f0f0f7a42f7e1d34f682868d2c6ab75e9d80dfc694d2355abc2ac3c82c8f2721638576411fc7b00b19b3ad98c08cabed4422b6be14713940eb943ba4d13ddd058c9eb7f605f48fe0ac0249f339fb96ae405782e4f35fda5be4fff40f652886222aee0c16e18a8d2ba3affbe6f001daebf0039c5f5b46b1c7920008ba018114aa1ffc4c6f59d1e878bfdaec346cb8f243febb41602a237399f23c49f0483f4cf3c33793247530e8bd09fe22f4b8e5afe13ed185b1ff98e3958e57deb14521f986af6cc4df9fc1094c54e9b08dbad615c97ce5f60f76f58c3f62df9259ee5885659ac05b6d74ef0befd0ce12f558b3ac684a3e6b6a732e6eeec8ed7caf1506c00118850d4257500393d8cb1441cb3bd2f3d6abcad7d5af97a41eb99c98e47dfe22c6fe7a47fe95735a888145860ebba3c8f245240b4f596e3cd9db9b6b0bd3690e7cc80d908f0acb2c906698069d1ddb1b215ef5017a512adfa83c5453c1e62b502e4b440111c6fc6b839bf799e7fd2cf7b34894156aeec24939fd9bba18ca8b35b9bb5f8e133a87303d3c0e1a8fbb716f41bb9384ba935363cb38d3d0f7cf0e33e630729e5dd8bb5c14e4627f253063d9f0ba51668830e1f710ae5b158cb2a2a74308e30dcf60c9c84eab7c4eb60fe9784f416e296444b09c24fe6597916f746ebe3b76e511fe40cbd33353a78c82dd31af0f0c526c6e044475e062b49f08018d2730d63571da99eb19cf25a53b26ab01e1429c68ccb50457dde31dfddb4f27afd41063d16dc427ac37f118c4af0e7f65a5243a04118d53ac2e8431823f52bd1ee5178c5eac3a3d6582ef202de36c69b95c2fc0be533d501dd67c1fc18b5983cb0b18032580978520612ec981be7844c9d10e11d9d34621b895476323290f1e907c298ab3dd1bf9dbfce6955b47c4b7d058707a73ff4d7a73c478e1df586dc1fe0ef8b298794a74ff65142c0dcb8e7d4e8b681566fe38349f5c09f3c7a7ac528ec7fdd033f1165b84a60c944c17679d93aadf673f5481285cc857667ed0cab908749cb0c8fb4dbd70771032d15084b2722aff9ca008849833071c239ce7d975a06842348282542b0d4297d51a994ee93f5fade2d5ce54702842f7806ac634ac5b6da5223c2ad50258418d70d8d3f119a394ca20dac6f903898bca4a061d357319260092aff41c7d247b40798936ecba085d5081ff8d1b280553ff9e3533a46e823f6971180f57d028e8eabdebfd5e4d5a76d6f0d9d4183ca4dafec6aeffbc9b0ac74b56106f46a1a939dbcd72dfcdd711d5a135da0d4c58d3b79852a02eb0d234986500097ecb790bda5d7f7efd3389e35d03fa2ceaa3291c3cba67edf3f7dfac99d069262cfaa3b83b53a3dac5d4a305d75c123a21b360958242c6ad16a29c574e0a6d7b7adcb16599d671f63a423afac408206a5b4eb088a94ae12aa15eb898a39c9efa79c4e1ad176a9c48cc4ab2665abaa9bcb2644b3bbc9ead62cc3cf62c4742bab136981cbfd4bf46367ab0adfc9cdccf8780db712656a62502474860d7df0ab031d907c4d6bcdf71d788fa6723283252fe1df860f205ddf419923779e1383386f3da260741d578a4d95cdfa54fc5dbd23dcd13afae0b06e8993a240e216adaa75d9dfbc47495f2c376bd7e22402f0250679dc2f2d02d6a5e0dc49cebbd2962ffe2144ab1dac2d7c5350d98692e6359245446cee85087f91e0ad781ff95fc61297ac36fc38b4b053c266537c0b0bbabaa3c6c4db239ff9e77cceae364202f6210f0561b8f5d7b179d0d71ce72f4c7c87e6cc9f55076dd7ab6c964fc4048f376a099b4d04e159dd558acb81eac4400b8039c32ad633db60b3243f51fd979632bee9bd30ee9f24851eac4c96acfa10caf820f325ef5e5163b3e160033b922984ca4cad43e4be83788777587f9ba8ad67babb9b6723bccf3df7b58b0fe9bd0655cb5d5534906a389daf88e677b77d98f1a0955474b4f4a3955e36b0e083b13f4e717fd13d06bf03c7cdfbc8b53c8a2ec8bb56e57a185503ee0f8e0ab31984840c1b144831be76d11a7f494f97fa4480eab618dfd3d5004d9600df9d97b1ba898d57133ac16f6d13a45e51b6924db766bec3afd9300149e8911b43be2014288fc11bb19830ef6eb14cc115799c1f53ac2643c1d3caeee46f5ceb7ccbd43020b5ac7d1fc3842002ad35cf8b3fdeddf9e4ceda38b3ddeed8ad005c24ba398cb46156ade2f97d6659e905ae6f7189924b0d676650f4f33a36b340efe016766c11dab792bfcebe4c38ebc883179583a2e7e2ab9b7001984c6f43318b318d440925d277476257e971f52378f2848a36264f68a0f19683a9e85c241363dc5cb5da8be1b49cc3fee640a23097f8b5e1bbc04d8efc46e98d885f6c197617f2604eb2aa8ad9dbd8e761c78412fb0b781da1254c17a93c0cf3de40dec4b05c086cc7361dd7c959e3cb4047e257d7d3a69d87fcbe1846b133f475bc502d722de204077454651134ad7f95774a9904d8772ba0441718a4c7959dc75de245672d9d6f3857f1e9cc2475068ee88b01eba04c564277266647e1b17ca20938724f266d034fc82dcff756867fa016938900c2b2883644986f2bfa74b7d4910653d0726d0db7cb95412e666bc2ade901f82d11c70cfd95a88e629e6f4f13b5aa00972529575998322f5cb526bd0679a64ca8bc46c37808592152a11a8d2e1d4d65e69d31e677ddcc72179aaed762390cd142cfb062f9affb46e9d59ff9ee34a205e48958c92d5df9d25948e43d6236e2d4a0ed70620be75012359577300b1e96c21ab09677f76e2ba1e30"}, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, 0x25, r6, &(0x7f0000001ac0)="92c0c99b68260fb24c017eb6de6a73091a32d106", 0x0, 0x4, 0x0, 0x1, r7}, &(0x7f0000001c40)={0x0, 0x0, 0x0, 0x0, 0x40, r0, &(0x7f0000001b40)="62102cb3dd4180d00a3cd5b2c72ec1f1cdcc090ed0f41073eec83a72fb670f9ff34a45480d29c5ec4598aed92a59743524324f5ec092d0b77cb94e04a36a182586ed3a9edab4d2e5b550b7261e37f1662efd02264f835537cf0f9856904abef26b698dd7680403c79afdf459a87f388065304560ecb78c2db23d8788fa201a8fc5dc122d626cf1b8aa2e999a45e3617206a990c1eec7c0530956dc94a8c89d18a146fe27ab46b21c9c769a7ed50b200420fb4af4adc9e46c6dca3898a3b29d06c9ce04085f86ab02673ac4c4d84b9227583806bf040676ec8284383440ab0574e362fddde2569eb1c7cf8f94f8bef1c0d86341", 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff9c}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) ioctl$sock_SIOCOUTQNSD(r7, 0x894b, &(0x7f0000000440)) unshare(0x40000000) ioctl$UI_SET_PHYS(r5, 0x4008556c, &(0x7f0000000200)='syz1\x00') 18:19:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="e45dbe772f64559519499c175201b23b273ba17298e56ec33fb37240efa78b8c32d7c672d45028dce5a6fba1ae7d9aa65a96f484bc9e939f3b1241ae75d825a485966544adada2bdc559af7ca47fe850bae3cc16180e226da4b630cee82b0e75ba2cc166c12eb239d3b1b18a49a55dfbd4fcaca63f4a6763ecd006712088c928a7993269c10f672e20e9e55b00b6386f929153c5a46a6df3e2a997b154ff87"], 0x0, 0x0, 0x0}) [ 837.577492] binder: 25024:25029 got transaction with invalid offset (0, min 0 max 24) or object. [ 837.599768] binder: 25024:25029 transaction failed 29201/-22, size 24-8 line 3348 [ 837.622372] binder: undelivered TRANSACTION_ERROR: 29201 18:19:04 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) ftruncate(r0, 0x8) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0x6, 0x10, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x44, 0x0, &(0x7f0000000600)=[@request_death={0x400c630e, 0x0, 0x3}, @free_buffer={0x40086303, r1}, @clear_death={0x400c630f, 0x2, 0x4}, @decrefs={0x40046307, 0x2}, @reply_sg={0x40486312, {{0x4, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@fda={0x66646185, 0x1, 0x2, 0x18}], &(0x7f0000000080)=[0x28]}, 0xffffffffffff7fff}}, @acquire_done={0x40106309, r1, 0x2}], 0xfffffffffffffd6e, 0x0, 0x0}) r2 = openat$full(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/full\x00', 0x400400, 0x0) ioctl$LOOP_CLR_FD(r2, 0x4c01) [ 837.636923] binder: undelivered TRANSACTION_ERROR: 29201 [ 837.653829] binder: 25019:25036 BC_ACQUIRE_DONE u0000000000000000 no match [ 837.669143] binder: 25037:25043 unknown command 2008964580 18:19:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x802) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x101000, 0x0) execveat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000180)=[&(0x7f0000000080)='^+wlan1}@mime_type$\x00', &(0x7f00000000c0)=':em0em0,\x00', &(0x7f0000000100)='-eth1trustedwlan1\x00', &(0x7f0000000140)='/dev/binder#\x00'], &(0x7f0000000540)=[&(0x7f00000001c0)='/dev/binder#\x00', &(0x7f0000000280)='/dev/binder#\x00', &(0x7f00000002c0)=':+cgroup.@\x00', &(0x7f0000000380)='/dev/binder#\x00', &(0x7f00000003c0)='/dev/binder#\x00', &(0x7f0000000480)='/dev/binder#\x00', &(0x7f00000004c0)='posix_acl_access{\x00', &(0x7f0000000500)='\x00'], 0x1500) syncfs(r0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 837.686396] binder: 25037:25043 ioctl c0306201 20000440 returned -22 [ 837.698710] binder: 25045:25046 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 837.707591] binder: 25045:25046 BC_FREE_BUFFER u0000000000000000 no match [ 837.725088] binder: 25045:25046 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 18:19:04 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 837.733345] binder: 25045:25046 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 837.749781] binder: release 24998:25002 transaction 1063 out, still active [ 837.752124] binder: 25049:25051 transaction failed 29189/-22, size 24-8 line 3117 [ 837.758846] binder: 25045:25046 got reply transaction with no transaction stack [ 837.773615] binder: 25045:25046 transaction failed 29201/-71, size 0-0 line 3025 18:19:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffe22, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0}) signalfd(r0, &(0x7f0000000000)={0x3f000000000000}, 0x8) [ 837.783313] binder: 25045:25046 ioctl c0306201 20000000 returned -14 [ 837.791162] binder: 25049:25057 transaction failed 29189/-22, size 24-8 line 3117 [ 837.799410] binder: 25045:25053 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0 [ 837.799719] binder: undelivered TRANSACTION_ERROR: 29189 [ 837.810363] binder: 25045:25053 BC_FREE_BUFFER u0000000000000000 no match [ 837.821583] binder: undelivered TRANSACTION_ERROR: 29189 18:19:04 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) fcntl$addseals(r0, 0x409, 0x0) [ 837.839076] binder: 25045:25053 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 837.848628] binder: 25045:25053 DecRefs 0 refcount change on invalid ref 2 ret -22 [ 837.851205] binder: undelivered TRANSACTION_ERROR: 29201 [ 837.860011] binder: 25045:25053 got reply transaction with no transaction stack [ 837.869680] binder: 25045:25053 transaction failed 29201/-71, size 0-0 line 3025 18:19:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b70000000800bb693965a5eef6040000"], 0x0, 0x0, 0x0}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) getsockopt$inet_mreq(r1, 0x0, 0x24, &(0x7f0000000040)={@multicast1, @dev}, &(0x7f0000000080)=0x8) [ 837.884904] binder: 25045:25053 ioctl c0306201 20000000 returned -14 [ 837.893084] binder: undelivered TRANSACTION_ERROR: 29201 [ 837.894012] binder: BINDER_SET_CONTEXT_MGR already set [ 837.905244] binder: 25055:25064 ioctl 40046207 0 returned -16 [ 837.914361] binder: 25055:25064 Release 1 refcount change on invalid ref 0 ret -22 [ 837.931715] binder: 25063:25065 got transaction with invalid offset (0, min 0 max 24) or object. [ 837.940076] binder: 25068:25070 unknown command 183 [ 837.946122] binder: 25068:25070 ioctl c0306201 20000440 returned -22 [ 837.951749] binder: 25063:25065 transaction failed 29201/-22, size 24-8 line 3348 [ 837.956485] binder: 25068:25070 unknown command 183 [ 837.965960] binder: 25068:25070 ioctl c0306201 20000440 returned -22 [ 837.974391] binder: 25063:25065 got transaction with invalid offset (0, min 0 max 24) or object. 18:19:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x31, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 18:19:04 executing program 5: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getpeername$unix(r0, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x6e) openat$cgroup_ro(r0, &(0x7f0000000140)='cpu.stat\x00', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpu.stat\x00', 0x0, 0x0) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="0033000000f4ff0c4942c161d23e3628b395b474de2246c338c6636be087a0fc6109be4699d865febdcdf78ded86a9a9f3bd7bfef83af38eca6879f67dc9f8015d426326917f8a5f307c628f4b3fd9c55d341b049c9ce0f86f947557477ca7df71f4cc2e4fd79c63a62826dd2c165ed2015d20994e6b082c9a98bc64815efdd3949162d62fc0fc914366d5d9d4066cf3ee378693d646713e9f72a2ac40117265be1071bc0c445d7217af71062ee067e2f1", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) munlock(&(0x7f0000ffb000/0x4000)=nil, 0x4000) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0xc8a4) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x3) [ 837.984345] binder: 25063:25065 transaction failed 29201/-22, size 24-8 line 3348 [ 837.992317] binder: undelivered TRANSACTION_ERROR: 29201 [ 837.999343] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.009801] binder: 25074:25075 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.018859] binder: 25074:25075 transaction failed 29201/-22, size 24-8 line 3348 [ 838.030582] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.054921] binder: 25077:25078 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.064264] binder: 25077:25078 transaction failed 29201/-22, size 24-8 line 3348 [ 838.074430] binder: 25077:25080 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.084183] binder: 25077:25080 transaction failed 29201/-22, size 24-8 line 3348 [ 838.092854] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.098338] binder: undelivered TRANSACTION_ERROR: 29201 18:19:05 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f0000000080)=0x9) sendto$inet(r0, &(0x7f0000000280)="64d1b72821c7322ee16433b8000000002f3900bde3515eefab58e69a53e35dd6448407f8c52359b1ff6d51853ba1ed0dfca15358bd190515b3c6d17948ca819498cef5e14db5a6fe87879497a47ecf786027d642204374d5aa81229a6463e93dee2c194bd6c050b77df0fa15c5476778e1c9c13a0010e1ab59e8ebdaaaa6d44f289d8a93e235680f4adf0000000000000000", 0xa103209d483eb713, 0x20000000, 0x0, 0xffffff49) 18:19:05 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) ioctl$PIO_FONTX(r5, 0x4b6c, &(0x7f0000000180)="391197f883fd3cc7799ed4148d8b803e027b79fb2636874ae248d5a94865106201e32d0a6a5f2ccb4532c7884250b6e0f6638acf685c2aa5ab8de674250ec6436b1af6ca0b38fa855f700593c462bc95b286a0ce9351d9e5141216137b0a641933bff23a04fda1cca0d520260395aaa75de1846ca88a7e29b232f87e082312691a77728ab4d51792a76fce0d4ec20797c559d2c89408a1efcd2af0de7624ac70f54380cf169d58616d28ca83b48beafb8f") write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) ioctl$BLKROGET(r0, 0x125e, &(0x7f0000000440)) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) select(0x40, &(0x7f0000000280)={0x20, 0x9, 0x7, 0x4, 0x6, 0x1000000000000000, 0x4, 0xb}, &(0x7f0000000300)={0x5, 0x6, 0x7, 0x4, 0x4, 0x1f, 0x64a, 0x1}, &(0x7f00000003c0)={0xff, 0x20, 0x0, 0xfffffffffffff001, 0x5b, 0xfff, 0x5, 0x7f}, &(0x7f0000000400)={0x77359400}) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:19:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/self/net/pfkey\x00', 0x1ffc, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00', 0x1001}) 18:19:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffffd2, 0x0, &(0x7f0000000300), 0x228, 0x0, 0x0}) fcntl$getown(r0, 0x9) r1 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/policy\x00', 0x0, 0x0) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r1, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000100)={0x228, r2, 0x900, 0x70bd2a, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x28, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xb8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x100000000}]}, @TIPC_NLA_NODE={0x18, 0x6, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}]}, @TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x20}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x95}]}, @TIPC_NLA_BEARER={0x104, 0x1, [@TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'eth', 0x3a, 'veth0_to_hsr\x00'}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0xffffffff, @empty}}, {0x20, 0x2, @in6={0xa, 0x4e22, 0x7f, @mcast2, 0x451}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x14, 0x1, @in={0x2, 0x4e20, @multicast2}}, {0x20, 0x2, @in6={0xa, 0x4e20, 0x9, @remote, 0x4}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x5, @local, 0x8000}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0xfffffffffffffff9, @dev={0xfe, 0x80, [], 0x1e}, 0x7}}}}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x94}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}]}]}, @TIPC_NLA_BEARER={0x14, 0x1, [@TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}]}, @TIPC_NLA_NET={0x34, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x100000001}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x59}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6e}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6003}]}, @TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x9}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xe8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x100000000}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1f}]}]}, 0x228}, 0x1, 0x0, 0x0, 0x4008001}, 0x20000081) r3 = dup(r0) ioctl$EVIOCSKEYCODE_V2(r3, 0x40284504, &(0x7f0000000000)={0xffffffff, 0x7, 0x7, 0x8, "b1e5a71a19e596629240f3677e98a277a143014288f58ac5a9145ddd741deae5"}) 18:19:05 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$ashmem(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ashmem\x00', 0x200, 0x0) ioctl$ASHMEM_GET_SIZE(r1, 0x7704, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000040)=[@timestamp, @sack_perm, @mss], 0x3) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000001c0)='hybla\x00', 0x6) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r2, 0x0, 0x48b, &(0x7f0000000100)={0x2, 'team0\x00', 0x4}, 0x18) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f00000002c0)={0x7, &(0x7f0000000280)=[{0xa59, 0x5, 0x100000000, 0x5}, {0x4, 0xffffffffffff8001, 0x3, 0x400}, {0x1, 0x7ff, 0xfa5, 0x6000}, {0x8000, 0x5be, 0xfffffffffffffffd, 0xf8a}, {0x200, 0xa75, 0xbe99, 0x4}, {0x5, 0x5, 0x9, 0xa00000000000}, {0x8, 0x1f, 0x81, 0x8}]}, 0x10) epoll_ctl$EPOLL_CTL_MOD(r2, 0x3, r0, &(0x7f00000000c0)={0x2000}) ioctl$PPPIOCCONNECT(r2, 0x4004743a, &(0x7f0000000300)) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:05 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 838.575605] binder: 25090:25092 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.584348] binder: release 25055:25064 transaction 1072 out, still active [ 838.589444] binder: 25090:25092 transaction failed 29201/-22, size 24-8 line 3348 [ 838.613735] binder: 25090:25092 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.613957] binder: 25091:25099 ioctl c0306201 20000440 returned -14 [ 838.641222] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.654817] binder: 25090:25092 transaction failed 29201/-22, size 24-8 line 3348 [ 838.666624] binder: 25091:25099 ioctl 40284504 20000000 returned -22 18:19:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x20) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff58, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) mknod$loop(&(0x7f0000000000)='./file0\x00', 0x100, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@initdev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f00000000c0)=0xe8) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'ipddp0\x00', r2}) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x1, 0x0) unlinkat(r3, &(0x7f0000000080)='./file0\x00', 0x0) 18:19:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) [ 838.671349] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.679119] binder: 25091:25099 ioctl c0306201 20000440 returned -14 [ 838.714573] binder: 25091:25105 ioctl 40284504 20000000 returned -22 18:19:05 executing program 2: r0 = accept4$inet(0xffffffffffffff9c, &(0x7f0000000200)={0x2, 0x0, @dev}, &(0x7f0000000240)=0x10, 0x80800) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)=[@exit_looper, @exit_looper, @exit_looper], 0x16a, 0x0, 0x0}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000380)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x24, r3, 0x200, 0x70bd27, 0x25dfdbfd, {{}, 0x0, 0x800b, 0x0, {0x8}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x40) sendmsg$TIPC_CMD_SET_LINK_TOL(r2, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x68, r3, 0x200, 0x70bd2c, 0x25dfdbfb, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x2, @link='syz0\x00'}}}, ["", ""]}, 0x68}}, 0x0) [ 838.752647] binder: BINDER_SET_CONTEXT_MGR already set [ 838.758967] binder: 25117:25119 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.772454] binder: 25101:25118 ioctl 40046207 0 returned -16 [ 838.778917] binder: 25117:25119 transaction failed 29201/-22, size 24-8 line 3348 [ 838.792442] binder: 25101:25118 Release 1 refcount change on invalid ref 1 ret -22 18:19:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000000180000000000000008002e29c67e025162e5994c79d77637d5385789b5934a0498eeb027772953774c07ee1adb72aba95529c80c742574bd544a07b8409269", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\b\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='net/route\x00') r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x20, r2, 0x300, 0x70bd2b, 0x25dfdbfe, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x15}, 0x4081) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000300)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000400)={&(0x7f0000000340)={0x98, r3, 0x100, 0x70bd2a, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'bcsh0\x00'}]}, @IPVS_CMD_ATTR_DEST={0x60, 0x2, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x3}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x100000000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1000}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0xe1}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x100000000}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x401}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7ff}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x800}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@local}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x4000000000000000}]}]}, 0x98}, 0x1, 0x0, 0x0, 0x8000}, 0x0) [ 838.801401] binder: 25121:25122 ioctl c0306201 20000280 returned -14 [ 838.801686] binder: 25117:25119 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.818137] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.824252] binder: 25117:25119 transaction failed 29201/-22, size 24-8 line 3348 [ 838.832449] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.832621] binder: 25121:25122 ioctl c0306201 20000280 returned -14 18:19:05 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x2000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) personality(0x2000000) [ 838.863527] binder: 25129:25131 transaction failed 29189/-22, size 24-5837367456585089032 line 3117 [ 838.902714] binder: 25129:25131 transaction failed 29189/-22, size 24-5837367456585089032 line 3117 18:19:05 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="04634040000000000000000000000000000033000000000000000000004d00000000000000080000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) fcntl$dupfd(r0, 0x406, r0) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000180)='/dev/null\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000840)='rdma.current\x00', 0x0, 0x0) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000080)='NET_DM\x00') sendmsg$NET_DM_CMD_STOP(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x30000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x14, r3, 0x400, 0x70bd2b, 0x25dfdbfb, {}, ["", "", "", ""]}, 0x14}}, 0x0) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000001c0)='TIPC\x00') sendmsg$TIPC_CMD_SET_NETID(r2, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x110}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x24, r4, 0x315, 0x70bd2b, 0x25dfdbfe, {{}, 0x0, 0x800b, 0x0, {0x8, 0x2, 0xfffffffffffffffe}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x4) [ 838.913608] binder: 25135:25137 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.928366] binder: undelivered TRANSACTION_ERROR: 29189 [ 838.934394] binder: undelivered TRANSACTION_ERROR: 29189 [ 838.955636] binder: 25135:25137 transaction failed 29201/-22, size 24-8 line 3348 [ 838.973955] binder: 25135:25137 got transaction with invalid offset (0, min 0 max 24) or object. [ 838.984620] binder: undelivered TRANSACTION_ERROR: 29201 [ 838.992840] binder: 25135:25137 transaction failed 29201/-22, size 24-8 line 3348 [ 839.001838] binder: undelivered TRANSACTION_ERROR: 29201 [ 839.007667] binder: 25143:25144 unknown command 1077961476 [ 839.019900] binder: 25143:25144 ioctl c0306201 20000440 returned -22 [ 839.059055] binder: 25143:25144 unknown command 1077961476 [ 839.064997] binder: 25143:25144 ioctl c0306201 20000440 returned -22 18:19:06 executing program 2: r0 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$LOOP_SET_DIRECT_IO(r0, 0x4c08, 0x80000000) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xffffffffffffffb8, 0x0, &(0x7f00000006c0)=ANY=[@ANYRES32=r0, @ANYPTR=&(0x7f0000000540)=ANY=[@ANYRESDEC=r1, @ANYPTR64=&(0x7f0000000480)=ANY=[@ANYRES32=r1, @ANYBLOB="0276dfd3326e23760c914f4ce6a9f57845b57c57d14e4f61c8dd5317df1f7f8ffd0920eac635d65b23b138ccbc3ff55de0166a41bd15b470e9dc3622da340fdc7968cb7c17d902581a2d506ab1be2284402caefdf59b13a609fb02ec633ff78b8bad05d96c10e0a804ed26472ee186de79d50bcb77c10d446ccd952b8295", @ANYPTR], @ANYRESOCT=r1, @ANYRESOCT=r0, @ANYBLOB="950083ae4510836c5ee579c253d27c5c13eede6930d2bf2c2f933960ef23f4cc5917772a891925e852707693023306a837d6fb850a4025bd3d3a269fffcbc64940a60153c1ed4f1fe387f7967330d8cde8133b0c975c82ed14d75171d1d49772093c92363c6634f9d1b5497cf2af8bfd166d52db7b3345edea0ac92ae7ec50f6cfad4da14f2ac8d4e05121a986dc064b1227e2feb46dda158719ad60d3e0f8bf627287e7381a025362286b2dfb6bd08f7008018bdcfdaebafddfc1797b968df38f854e273cbb59622958825f2fde30b33ad3becca1d102bc0d07d850", @ANYPTR64=&(0x7f00000001c0)=ANY=[@ANYRESOCT=r1, @ANYRESHEX=r1, @ANYRES16], @ANYPTR=&(0x7f0000000280)=ANY=[@ANYRESOCT, @ANYRES64=r1], @ANYRESHEX=r0, @ANYRES64, @ANYRES16], @ANYBLOB="ef9e306a59f0a382763d8f3a04358b28a7e4c0aa4bdf4d863728fb0ce8c3aceeebcc3553ca03a6c671da3beefa4d618eeda5b039f0236b86304fb306254899cc615fa394cde841dd73d6ee45311a8582b527bb6276153b5596e85fba579b4bd63127d1a0c55f50d3ff6b80", @ANYPTR64=&(0x7f00000002c0)=ANY=[@ANYRESDEC=r1, @ANYPTR=&(0x7f0000000380)=ANY=[@ANYPTR64, @ANYRES16=r1, @ANYRESOCT=r0, @ANYRES16=r0, @ANYRESOCT=r0, @ANYRES64=r0, @ANYRES64=r1, @ANYRESDEC=r1]], @ANYRESHEX=r0, @ANYRESDEC=r0, @ANYRES16=r0], 0x237, 0x0, 0x0}) 18:19:06 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f0000000180)='\x00') write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0xfffffffffffffd0c) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:19:06 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140), 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) socket$inet(0x2, 0x3, 0x59e7) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5, 0xffffffffffffffff}, 0x14) r2 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/policy\x00', 0x0, 0x0) pwrite64(r1, &(0x7f0000000480)="8fb07cd3d9941a5e68285c3f18d2921d6b4febdc4338ff91794132a62d0f8632c0bbf7012a68ce7b04b310194804208751fa0b64b01a1d63136b89afe04da98c5bdd9cfd0d938e0ae4d26826fe7b065662925a869436123c62158a1b6a4bb458a3d8745ad196534978833d0e7047", 0x6e, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x2400, 0x3) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) sendto$inet(r3, &(0x7f0000000380)="5a31ee7ee3a0374a62cef118dab14c716be59f85768d58d5ddeca1e7474b26910208a7ebfe6a25aa09a96eabea903eec39780086d15f2a25304f5786173739927cd13c73b0191a474b6d0873142d2cf126affc73afbfbc8db57e2c677b61b0a7e6bfb361fc0a855f99eb698fccbfbf9cd646a94e66485c768649bd295a5790d7a4297cc5a545f3158ede3f0f7feabe6a58484e3c5d6daf176d7a6ab6c38d70d90d7c53b5a2afd8acb340cd87bd49a509f241301f10ae7f00548699577fc2d3706c50d8a05afd34000000000000000000000000000000", 0xd6, 0x0, 0x0, 0x0) sendto(r1, &(0x7f0000000500)="ab96d17b361f27cbd9410e00945f4df1371291ade6c45da193d1881712fae567f3f4dce550d9963f4c4a2525d384e9f3fd508151f3e648c76cca55ca0d243808d4996a43bc", 0x45, 0x4000000, &(0x7f0000000580)=@rc={0x1f, {0x4, 0x7fffffff, 0x101, 0x100000001, 0x800}, 0xa942}, 0x80) r4 = add_key(&(0x7f00000000c0)='.request_key_auth\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000280)="f55a5ac4d2a6cf5069c2c642ee59ff076a47d239f7ab9b990061e263c42569254f57bb3ecbca3806bdfba0acb47d1c415bcf476328a928573ea8cc6053760d6fcb5f980e22453e66c236d2bcb184e477782f48c4f883b154854dbdfeae126ab506208341c0124ebadcf67e9a3d766a1d7e05ef1e0d612c487462", 0x7a, 0xffffffffffffffff) add_key(&(0x7f0000000040)='.dead\x00', &(0x7f0000000080)={'syz', 0x1}, 0x0, 0x0, r4) ioctl$sock_inet_SIOCGIFPFLAGS(r0, 0x8935, &(0x7f0000000300)={'veth0_to_team\x00', 0x2}) 18:19:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) ioctl$EVIOCGSND(r1, 0x8040451a, &(0x7f0000000040)=""/70) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB="0000000000800000"], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 839.374858] binder: 25161:25162 got transaction with invalid offset (0, min 0 max 24) or object. [ 839.401740] binder: 25161:25162 transaction failed 29201/-22, size 24-8 line 3348 18:19:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000000040)=0x1, 0x0) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:06 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:19:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="006340400000e3ff1e0b000000000100000000000000f8ff00050067dd30cc010100000000000000000000000000180000000000767a3a1d3613876f75c76236292fe86d667abb0568e578ca9d1d4831a8de5df7bdfb6f62c21080bc7e7bcbdb319e34c7c6ae28c1", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="8d80230000000000dff0dd1b380500000072afd9f50debde4535db4315be29c8f82ecc2ab2ba2d95987bf9", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000000), 0x4) [ 839.434566] binder: release 25101:25118 transaction 1083 out, still active [ 839.461447] binder: 25161:25162 got transaction with invalid offset (0, min 0 max 24) or object. [ 839.463466] binder: 25179:25180 got transaction to invalid handle 18:19:06 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x0, &(0x7f0000000040)={0x0, 0x0}) setsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000140)={0x0, r1/1000+30000}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200) r3 = dup3(r2, r0, 0x80000) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r3, 0x40042409, 0x1) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) 18:19:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x800) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) write$selinux_access(r1, &(0x7f0000000040)={'system_u:object_r:passwd_exec_t:s0', 0x20, '/usr/sbin/ntpd', 0x20, 0x800}, 0x47) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) 18:19:06 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x88000000000019, &(0x7f0000000000)=0x800, 0x4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 839.482414] binder: undelivered TRANSACTION_ERROR: 29201 [ 839.485576] binder: 25179:25180 transaction failed 29201/-22, size 0-1572864 line 3117 [ 839.493555] binder: 25161:25162 transaction failed 29201/-22, size 24-8 line 3348 [ 839.506516] binder: undelivered TRANSACTION_ERROR: 29201 [ 839.539599] binder: 25179:25180 got transaction to invalid handle [ 839.541457] binder: undelivered TRANSACTION_ERROR: 29201 [ 839.563064] binder: 25179:25180 transaction failed 29201/-22, size 0-1572864 line 3117 [ 839.565052] binder: 25187:25189 transaction failed 29189/-22, size 24-8 line 3117 [ 839.582219] binder: undelivered TRANSACTION_ERROR: 29201 18:19:06 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) lremovexattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@random={'security.', '/dev/binder#\x00'}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) futimesat(r1, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)={{0x0, 0x2710}, {0x0, 0x2710}}) 18:19:06 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r1 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0/file0\x00', 0x8801, 0x2) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0x50, &(0x7f0000000180)}, 0x10) syz_mount_image$msdos(&(0x7f0000000000)='msdos\x00', &(0x7f0000000040)='./file0\x00', 0x9, 0x0, &(0x7f0000000080), 0x800000, &(0x7f00000000c0)={[{@fat=@nfs='nfs'}, {@fat=@fmask={'fmask', 0x3d, 0x6}}, {@dots='dots'}, {@dots='dots'}, {@fat=@tz_utc='tz=UTC'}, {@nodots='nodots'}, {@nodots='nodots'}], [{@defcontext={'defcontext', 0x3d, 'user_u'}}, {@measure='measure'}, {@audit='audit'}, {@smackfsfloor={'smackfsfloor', 0x3d, '\\em1'}}, {@smackfsfloor={'smackfsfloor', 0x3d, '@+'}}]}) [ 839.587749] binder: undelivered TRANSACTION_ERROR: 29189 [ 839.596653] binder: BINDER_SET_CONTEXT_MGR already set [ 839.619028] binder: 25181:25192 ioctl 40046207 0 returned -16 [ 839.631179] binder: 25181:25192 Release 1 refcount change on invalid ref 1 ret -22 [ 839.632403] binder: 25193:25197 got transaction with invalid offset (0, min 0 max 24) or object. [ 839.643873] binder: 25196:25198 got transaction with invalid offset (0, min 0 max 24) or object. [ 839.663915] binder: 25193:25197 transaction failed 29201/-22, size 24-8 line 3348 [ 839.670120] binder: 25196:25198 transaction failed 29201/-22, size 24-8 line 3348 18:19:06 executing program 1: r0 = gettid() r1 = fcntl$dupfd(0xffffffffffffffff, 0x406, 0xffffffffffffff9c) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f00000000c0)=r0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$inet(0x2, 0x4, 0x5) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000080)={'erspan0\x00', 0x1}) r4 = fcntl$dupfd(r2, 0x0, r2) ioctl$TIOCEXCL(r4, 0x540c) ioctl$RTC_PIE_ON(r4, 0x7005) r5 = dup2(r2, r2) ioctl$KDENABIO(r5, 0x4b36) ioctl$TIOCLINUX6(r5, 0x541c, &(0x7f0000000000)={0x6, 0x80000000}) ioctl$PPPIOCGIDLE(r5, 0x8010743f, &(0x7f0000000100)) r6 = openat(r1, &(0x7f0000000140)='./file0\x00', 0x2a4000, 0x20) unlinkat(r6, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$RTC_WIE_ON(r1, 0x700f) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') close(r7) [ 839.684860] binder: 25193:25201 got transaction with invalid offset (0, min 0 max 24) or object. [ 839.694171] binder: 25193:25201 transaction failed 29201/-22, size 24-8 line 3348 [ 839.697152] FAT-fs (loop2): Unrecognized mount option "measure" or missing value [ 839.704082] binder: undelivered TRANSACTION_ERROR: 29201 [ 839.731667] binder: undelivered TRANSACTION_ERROR: 29201 [ 839.755334] binder: 25196:25198 got transaction with invalid offset (0, min 0 max 24) or object. [ 839.772146] binder: 25196:25198 transaction failed 29201/-22, size 24-8 line 3348 [ 839.783567] FAT-fs (loop2): Unrecognized mount option "measure" or missing value [ 839.818744] binder: undelivered TRANSACTION_ERROR: 29201 [ 839.824494] binder: undelivered TRANSACTION_ERROR: 29201 18:19:07 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(r4, 0x3, 0x40, 0x105) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:19:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r1 = socket$packet(0x11, 0x3, 0x300) recvmsg(0xffffffffffffff9c, &(0x7f0000000380)={&(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, 0x80, &(0x7f00000002c0)=[{&(0x7f0000000080)=""/232, 0xe8}, {&(0x7f0000000180)=""/105, 0x69}, {&(0x7f0000000280)=""/21, 0x15}, {&(0x7f0000000480)=""/4096, 0x1000}], 0x4, &(0x7f0000001480)=""/180, 0xb4}, 0x40000002) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f00000003c0)={r2, 0x1, 0x6}, 0x10) 18:19:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x2, 0x0) r2 = openat$cgroup_ro(r1, &(0x7f0000000140)='cpuacct.usage_user\x00', 0x0, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$PPPIOCGUNIT(r3, 0x80047456, &(0x7f00000000c0)) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000380)=0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0xffffffffffffffff, r3, 0x0, 0x15, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x0}, 0x30) openat$ppp(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/ppp\x00', 0x16000, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000280)={r4, r3, 0x0, 0x16, &(0x7f00000001c0)='\'cpusetuser]&keyring:\x00', r6}, 0x30) fsetxattr$security_smack_entry(r1, &(0x7f00000003c0)='security.SMACK64IPIN\x00', &(0x7f0000000440)='mime_type/\x00', 0x682, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r0, 0xc028660f, &(0x7f0000000000)={0x0, r0, 0x5, 0x9, 0x5, 0x8c89}) getsockopt$inet6_int(r2, 0x29, 0x12, &(0x7f0000000300), &(0x7f0000000340)=0x4) r7 = syz_open_procfs(r5, &(0x7f0000000040)='smaps\x00') close(r7) 18:19:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x110, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000040)={0x2d9, 0x0, &(0x7f0000000000)=[@increfs_done={0x40106308, r1, 0x1}], 0xd6, 0x0, 0x0}) 18:19:07 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, 0x0}) r4 = creat(&(0x7f00000000c0)='./file0\x00', 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) [ 840.286319] binder: release 25181:25192 transaction 1096 out, still active [ 840.359994] binder: 25227:25233 BC_INCREFS_DONE u0000000000000000 no match [ 840.368499] binder: 25226:25232 got transaction with invalid offset (0, min 0 max 24) or object. [ 840.383212] binder: 25227:25233 unknown command 0 [ 840.388346] binder: 25226:25232 transaction failed 29201/-22, size 24-8 line 3348 [ 840.396386] binder: 25227:25233 ioctl c0306201 20000040 returned -22 18:19:07 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000080)='/dev/keychord\x00', 0x0, 0x0) close(r1) r3 = syz_genetlink_get_family_id$nbd(&(0x7f0000000100)='nbd\x00') sendmsg$NBD_CMD_CONNECT(r2, &(0x7f0000000200)={&(0x7f00000000c0), 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x70, r3, 0x8, 0x70bd26, 0x25dfdbfe, {}, [@NBD_ATTR_SOCKETS={0x2c, 0x7, [{0x8, 0x1, r1}, {0x8, 0x1, r2}, {0x8, 0x1, r2}, {0x8, 0x1, r1}, {0x8, 0x1, r1}]}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x4}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_BLOCK_SIZE_BYTES={0xc, 0x3, 0x8}]}, 0x70}, 0x1, 0x0, 0x0, 0x40}, 0x40) ioctl$TIOCPKT(r1, 0x5420, &(0x7f0000000000)=0x4) 18:19:07 executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) fstatfs(r0, &(0x7f0000000000)=""/27) r1 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x2000000, 0x110, r1, 0x3d) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffff6, 0x0, &(0x7f0000000000), 0x251, 0x0, 0x0}) 18:19:07 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000040)={{{@in6=@initdev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@initdev}}, &(0x7f0000000140)=0xe8) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f00000001c0)={@broadcast, @loopback, r1}, 0xc) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) fremovexattr(r0, &(0x7f0000000280)=@random={'security.', '\'\x84\x00'}) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 840.406555] binder: 25226:25232 got transaction with invalid offset (0, min 0 max 24) or object. [ 840.414119] binder: undelivered TRANSACTION_ERROR: 29201 [ 840.416908] binder: 25226:25232 transaction failed 29201/-22, size 24-8 line 3348 [ 840.430822] binder: 25227:25243 BC_INCREFS_DONE u0000000000000000 no match [ 840.438072] binder: 25227:25243 unknown command 0 [ 840.443174] binder: 25227:25243 ioctl c0306201 20000040 returned -22 [ 840.452650] binder: undelivered TRANSACTION_ERROR: 29201 18:19:07 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) r2 = mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x1000004, 0x4010, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x24, 0x0, &(0x7f0000000040)=[@exit_looper, @acquire_done={0x40106309, r1, 0x3}, @free_buffer={0x40086303, r2}], 0xba, 0x0, &(0x7f0000000080)="d8068e02620f8dd1d5772f5073cb010b7a3ef0b09d22290676d79b07980bc6880eba4e6c556fa3f20e49543eecf48d8764c760a40e29f91d8500e2a440821f8247d46e7050c0e78d98f250aa5269cb2e1278765a7c1b371127e53812bbbdc5412f3871c2654382f14faf6f1d4c5246ee7f05e00d97c84654e961e0e092f1415c5139d208b90931ae9545ff40d7b1e84c5e0a386c347de781aa460a1a48899e37d61099108c619f8bf08539764ba6e464d2ba15a734828f39317a"}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 840.487175] binder: BINDER_SET_CONTEXT_MGR already set [ 840.503605] binder: 25245:25252 ioctl c0306201 20000440 returned -14 [ 840.521797] binder: 25245:25254 ioctl c0306201 20000440 returned -14 [ 840.529300] binder: 25229:25246 ioctl 40046207 0 returned -16 18:19:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) [ 840.535002] binder: 25229:25256 Release 1 refcount change on invalid ref 1 ret -22 [ 840.551816] binder: 25255:25258 BC_ACQUIRE_DONE u0000000000000000 no match 18:19:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="1300000000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r1 = gettid() fcntl$setownex(r0, 0xf, &(0x7f0000000000)={0x1, r1}) [ 840.580463] binder: 25263:25264 transaction failed 29189/-22, size 24-8 line 3117 [ 840.588728] binder: 25255:25258 BC_FREE_BUFFER u0000000000000000 no match [ 840.589775] binder: undelivered TRANSACTION_ERROR: 29189 [ 840.606119] binder: 25255:25265 got transaction with invalid offset (0, min 0 max 24) or object. [ 840.623056] binder: 25255:25265 transaction failed 29201/-22, size 24-8 line 3348 18:19:07 executing program 1: r0 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x20000, 0x0) write$selinux_user(r0, &(0x7f0000000080)={'system_u:object_r:auditd_initrc_exec_t:s0', 0x20, 'staff_u\x00'}, 0x32) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') close(r2) [ 840.638672] binder: 25266:25268 got transaction with invalid offset (0, min 0 max 24) or object. [ 840.648643] binder: 25266:25268 transaction failed 29201/-22, size 24-8 line 3348 [ 840.661462] binder: 25266:25268 got transaction with invalid offset (0, min 0 max 24) or object. [ 840.670721] binder: 25266:25268 transaction failed 29201/-22, size 24-8 line 3348 [ 840.673227] binder: undelivered TRANSACTION_ERROR: 29201 [ 840.685526] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.154175] binder: release 25229:25256 transaction 1105 out, still active 18:19:08 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_QUERY_BPF(r0, 0xc008240a, &(0x7f00000001c0)=ANY=[@ANYBLOB="0500000000000000008a7f8e0000000000000000000000000000222a205457"]) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r0, &(0x7f0000000180), 0x3e5) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:19:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xd, &(0x7f0000000000)='/dev/binder#\x00'}, 0x30) syz_open_procfs$namespace(r1, &(0x7f0000000080)='ns/net\x00') r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$EVIOCSABS20(r2, 0x401845e0, &(0x7f0000000100)={0x296e, 0x800, 0x2, 0x2, 0x80000000, 0x10000}) 18:19:08 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') close(r0) 18:19:08 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:19:08 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) personality(0x510001f) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 841.284448] binder: 25277:25284 transaction failed 29189/-22, size 24-8 line 3117 [ 841.306857] binder: 25277:25284 transaction failed 29189/-22, size 24-8 line 3117 [ 841.317467] binder: undelivered TRANSACTION_ERROR: 29189 18:19:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="52614784c937e32ebe7926d0002a24f7f75db892481a9bfe0b452bce8ae1d7997aac272e702ace3ac03e05fd19e85e560a14e6573ae5c6f6b0f20ff9f6ee7621991fdcc10067c9d01d5236a5d61dbd84dd7e9e7ef9991ce79e54e35f0caaded4404268f78716cce9a14771283f60fb40df80b5335475555f188969d41aff481d393eba3f4ac3bae64add4516481cb82269ecf5eda34fae7c671cdfc10dc71afd37e86cbd642e4e01dbcd186db6ffbdc008a329e334e3c04ebf11a2b79594306df7fefd5038f4ba297a6138e603a1d6add1222c84c75854628ef23dc04ed1b42b164647555cff615cf96e474eb75581dad84747d6aa"]], 0x0, 0x0, 0x0}) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000002c0)='/selinux/enforce\x00', 0x0, 0x0) r2 = syz_open_pts(r1, 0x0) ioctl$TCSETA(r1, 0x5406, &(0x7f0000000240)={0x80000001, 0x1, 0xb9, 0xffff, 0x13, 0xfff, 0xffffffff, 0xffffffff, 0x6, 0x100000000}) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000000)) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000280)={0x2, &(0x7f0000000040)=[{0x588, 0x2}, {0x2, 0x6}]}) ioctl$KDGKBMETA(r2, 0x4b62, &(0x7f0000000080)) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380)='TIPC\x00') sendmsg$TIPC_CMD_GET_MAX_PORTS(r1, &(0x7f00000004c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)={0x1c, r3, 0x200, 0x70bd29, 0x25dfdbff, {}, ["", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4c000) write$binfmt_elf32(r1, &(0x7f0000000500)={{0x7f, 0x45, 0x4c, 0x46, 0x4000000000000, 0x2, 0x7, 0xffffffffffffff56, 0x200, 0x2, 0x0, 0x101, 0x1db, 0x38, 0x83, 0x3533, 0x7c8a, 0x20, 0x2, 0x9, 0x0, 0x9}, [{0x6474e551, 0x79, 0x3, 0x7, 0x9, 0x2, 0xcae00000000, 0x4}, {0x2, 0x100000000, 0xb2b1, 0x8, 0xf, 0xa1a, 0x7fffffff, 0x2}], "3eaeb2dc95fe3cd23be9d464ecc30287690cc25ff530d113933c8fff78f43e4ec424e88e0a8ad77ce75ea139acfa56466834cdf31b6cd9039846848b736a5238d8348847d4f475fce98d41792e760a1b7c19ab3c1573bbce79d9e9ab84f3dd08aa2a1a655dd983ac7a76baf90a7467c27412562405c663f3bbebfa332bd9a2461cf413e5dffd102b3081607680258a7a27150d4a918bb1d688ac2aeaaa5617863364f5584864899c60b896a547605d45892d83dc265e0d000f9886db550914f963be8d3e1860c301b6dfd0066f0cbda05d6e2d2f114197f2113d6ba7cb3816328106dda7986be7b71836f500478d", [[], []]}, 0x366) [ 841.338619] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.343024] binder: 25255:25265 BC_ACQUIRE_DONE u0000000000000000 no match [ 841.355125] binder: 25255:25291 got transaction with invalid offset (0, min 0 max 24) or object. [ 841.360489] binder: BINDER_SET_CONTEXT_MGR already set [ 841.366571] binder: 25255:25265 BC_FREE_BUFFER u0000000000000000 no match 18:19:08 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') ioctl$RTC_WKALM_SET(r1, 0x4028700f, &(0x7f0000000580)={0x1, 0x1, {0x24, 0x21, 0x15, 0xe, 0xa, 0x8000, 0x3, 0x81}}) setsockopt$inet6_MRT6_ADD_MFC(r1, 0x29, 0xcc, &(0x7f0000000080)={{0xa, 0x4e24, 0xcc6, @local, 0x4}, {0xa, 0x4e23, 0x5, @local, 0x2}, 0x0, [0xffffffff, 0x200, 0x2, 0x0, 0x5d25, 0x1f, 0x21eb, 0x98]}, 0x5c) close(r1) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000200)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@empty}}, &(0x7f0000000000)=0xe8) sendto$packet(r1, &(0x7f0000000100)="1af25af2866e5fc11b98b9a3e29e19eedf8f10dcdaa142392710e19250828bb988d00fdcf2e6a59ce45a141576d69e61cffc57b5706b81c38d473dc9cd01a334c7a0b485d594fb7c63033cd5131f7a3d0407d4e88859e16f23407ccc8e4e098bc21ecbbd517a528be2aa1c219964b95671a8310ba7329bb8f938b92f0cef7405512cc294da53b000d60b0a13d7c46656dfe39488c92788968077612347d0f4a939579a5f90ed6afe8a1761dcae277425d7f9e9567462884b437896fdcd0c499130abd504787c682bb6f65dc13c2321501521ab8c68523d24e64ba916d689e4144e7fd6b76dc4b60c9e35c17763f75711c923e9aaacca9a128e662a", 0xfb, 0x4000800, &(0x7f0000000300)={0x11, 0xff, r2, 0x1, 0xffffffffc44a94ee, 0x6, @random="200f1e544458"}, 0x14) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000380)='TIPCv2\x00') sendmsg$TIPC_NL_NET_GET(r1, &(0x7f0000000540)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000010}, 0xc, &(0x7f0000000500)={&(0x7f00000003c0)={0x120, r3, 0x0, 0x70bd2d, 0x25dfdbff, {}, [@TIPC_NLA_NET={0x54, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xf846}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x81}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xf66}]}, @TIPC_NLA_SOCK={0x2c, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xb054}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xfffffffffffff000}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA={0x8c, 0x5, [@TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x48}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fff}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2d}]}]}]}, 0x120}, 0x1, 0x0, 0x0, 0x840}, 0x24000000) 18:19:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) fadvise64(r0, 0x0, 0x411, 0x5) [ 841.382042] binder: 25255:25291 transaction failed 29201/-22, size 24-8 line 3348 [ 841.382445] binder: 25279:25293 ioctl 40046207 0 returned -16 [ 841.391853] binder: 25296:25297 got transaction with invalid offset (3378605484105228626, min 0 max 24) or object. [ 841.397651] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.413470] binder: 25279:25298 Release 1 refcount change on invalid ref 1 ret -22 [ 841.417731] binder: 25296:25297 transaction failed 29201/-22, size 24-8 line 3348 [ 841.422884] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.457672] binder: 25303:25305 got transaction with invalid offset (0, min 0 max 24) or object. [ 841.458157] binder: 25296:25297 got transaction with invalid offset (3378605484105228626, min 0 max 24) or object. [ 841.469174] binder: 25303:25305 transaction failed 29201/-22, size 24-8 line 3348 [ 841.486617] binder: 25296:25297 transaction failed 29201/-22, size 24-8 line 3348 [ 841.489854] binder: 25303:25305 got transaction with invalid offset (0, min 0 max 24) or object. 18:19:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f0000000300)=[@clear_death={0x400c630f, 0x0, 0x2}], 0x0, 0x0, 0x0}) [ 841.506393] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.520231] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.528428] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.537310] binder: 25303:25305 transaction failed 29201/-22, size 24-8 line 3348 [ 841.548059] binder: undelivered TRANSACTION_ERROR: 29201 18:19:08 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x301000, 0x0) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000040)='trusted.overlay.origin\x00', &(0x7f0000000080)='y\x00', 0x2, 0x0) ioctl$TIOCNXCL(r1, 0x540d) ioctl$TIOCSTI(r1, 0x5412, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB="e90000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) [ 841.559966] binder: 25312:25313 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 [ 841.587941] binder: 25315:25317 got transaction with invalid offset (0, min 0 max 24) or object. [ 841.597396] binder: 25312:25313 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0 18:19:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000200)='/dev/binder#\x00', 0x0, 0x6) lgetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)=@known='trusted.overlay.origin\x00', &(0x7f0000000140)=""/13, 0xd) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000080000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000480)=ANY=[@ANYBLOB="c10134641e922b8bc654997e78572c0c3dc9fb289907a1a82b6728ccc7be29dff544f2e90f274b276dfa48c8c03da2a8e32d5fed1c9a50c45e0f1b0ec8e2f61895d390e1704b4be462de8bf9b4ddbdf69499f594bc0c2f07572ef8328c7f1176cf170ee09f2fdc146555b3095be14d924712f56b3b686fd29ac7a45ee23416a81899338f6c5cc3783c668b7d8d50f90000f8617ff40194b0659439aeeabf928bc5c450bb90831e3a6fa89231b383b3abe389512c1666d6f865b8e3bd5413220a9992335d2938b7715fdd80ea4177782700080000614407e4b9dc31a135ae0f6f72d41dcc72ec8cb478d7b7692481476c6b", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00']], 0x0, 0x0, 0x0}) lsetxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.opaque\x00', &(0x7f0000000080)='y\x00', 0x2, 0x2) r1 = openat$zero(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/zero\x00', 0x101000, 0x0) symlinkat(&(0x7f0000000280)='./file0\x00', r1, &(0x7f0000000380)='./file0\x00') epoll_wait(r1, &(0x7f00000003c0)=[{}, {}, {}, {}, {}, {}, {}, {}], 0x8, 0x4) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180)='/dev/zero\x00', 0x80, 0x0) ioctl$BLKDISCARD(r2, 0x1277, &(0x7f00000001c0)=0x9) 18:19:08 executing program 5: syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x84000, 0x0) syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x100200000) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f00000000c0)=0x4) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f00000003c0)='TIPCv2\x00') sendmsg$TIPC_NL_MON_PEER_GET(r0, &(0x7f00000004c0)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000480)={&(0x7f0000000680)={0x354, r1, 0x16, 0x70bd29, 0x25dfdbfd, {}, [@TIPC_NLA_SOCK={0x18, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x40}]}, @TIPC_NLA_MON={0x34, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x10001}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xb}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xaaa1}, @TIPC_NLA_MON_REF={0x8}]}, @TIPC_NLA_NET={0x18, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}]}, @TIPC_NLA_LINK={0x100, 0x4, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200000000000000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe77b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffffc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xe8}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffffffffff8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}]}, @TIPC_NLA_MEDIA={0xbc, 0x5, [@TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1178400000000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9a56}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf0}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_SOCK={0x3c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5b8b}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffffffff24b}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0xff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_MON={0x54, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xb870}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x4}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x401}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xfffffffffffffc01}]}, @TIPC_NLA_NET={0x50, 0x7, [@TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100000000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x77c}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xc4}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}]}, @TIPC_NLA_SOCK={0x40, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xff}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x1}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}]}, 0x354}, 0x1, 0x0, 0x0, 0x800}, 0x800) syz_open_dev$binder(&(0x7f00000002c0)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000180)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_SET(r0, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40400800}, 0x4, &(0x7f00000001c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="bce3ec9ab0295e46422c881b000000d544d38d4c9c470b695d36cd02", @ANYRES16=r2, @ANYBLOB="00022bbd7000fcdbdf2505000000280004000c00010073797a31000000000c00010073797a30000000000c00010073797a30000000006c0004000c00010073797a31000000002c00070008000300f42400000800040008000000080003008ede000008000100010000000800040001800000240007000800020001ffffff0800040004000000080003000000000008000400050000000c00010073797a310000000014000100100001007564703a73797a3100000000"], 0xbc}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) getdents64(r0, &(0x7f0000000040)=""/124, 0x7c) [ 841.606825] binder: 25315:25317 transaction failed 29201/-22, size 24-8 line 3348 [ 841.617882] binder: undelivered TRANSACTION_ERROR: 29201 [ 841.663878] binder: 25323:25326 transaction failed 29189/-22, size 24-8 line 3117 [ 841.687897] binder: 25323:25329 transaction failed 29189/-22, size 24-8 line 3117 [ 841.709080] binder: undelivered TRANSACTION_ERROR: 29189 [ 841.722873] binder: undelivered TRANSACTION_ERROR: 29189 [ 842.079280] binder: release 25279:25298 transaction 1116 out, still active 18:19:09 executing program 4: ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000140)='fd\x00') perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xee6a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) io_setup(0x3, &(0x7f00000002c0)=0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000900)='attr/prev\x00') write(r2, 0x0, 0x0) ioctl$BLKROGET(0xffffffffffffffff, 0x125e, 0x0) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, 0x0, 0x1, 0x0) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000100)) fcntl$getownex(0xffffffffffffffff, 0x10, &(0x7f0000000240)) r4 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x0, 0x7, 0x1, 0x4, 0x0, 0x4, 0xffff}, 0x0) fcntl$getownex(r4, 0x10, &(0x7f0000000040)) ioctl$RTC_ALM_SET(0xffffffffffffffff, 0x40247007, &(0x7f00000000c0)={0x36, 0x11, 0x1, 0x1e, 0xa, 0x1, 0x0, 0x77, 0xffffffffffffffff}) openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8000, 0x8) r5 = creat(&(0x7f0000000380)='./file0\x00', 0x0) fdatasync(r0) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000bc0)=ANY=[], 0x0) write$P9_RREAD(r5, 0x0, 0x0) read$eventfd(r5, &(0x7f0000000340), 0x8) write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000180)=ANY=[], 0x0) io_submit(r1, 0x1, &(0x7f00000007c0)=[&(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0xd93, r0, &(0x7f0000000680)="ddba9f545cdc4582a5006e250653ed915964677e991aabd8204bdf73df7120190212c6903bd6ac9dde3c3da3648483f74d61d3196e00670e87b42371fd214ea648306b9ca377e362144781c8b5924057b5d7a1dbe9ee62e40d9cdb8e3666fb4b6bdb73b86c7abf3ceb8ee12f2047abd670e98888c8eb864f32b4b63362d1beddc2ef2bf88dfd7da0c8739dc430949a8e90b8b1289626d95880a1f2c7b04889d93d10ad77b4b8e8dbea43ca324dc76ae5ef3024da0f8f", 0xb6, 0x6, 0x0, 0x1, r3}]) fallocate(0xffffffffffffffff, 0x3, 0x5e89, 0xfff9) write$P9_RREADLINK(r5, 0x0, 0x0) unshare(0x40000000) 18:19:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB="229fce265fdeb78c"]], 0x0, 0x0, 0x0}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x301100, 0x120) ioctl$SNDRV_TIMER_IOCTL_STATUS(r1, 0x80605414, &(0x7f0000002480)=""/4096) 18:19:09 executing program 1: r0 = dup(0xffffffffffffff9c) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000080)={r0, 0x28}, 0x10) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000100)='TIPC\x00') sendmsg$TIPC_CMD_SHOW_STATS(r0, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x20200}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x1c, r3, 0x28, 0x70bd25, 0x25dfdbfe, {}, ["", "", "", "", ""]}, 0x1c}}, 0x10) close(r2) ioctl$UI_SET_SWBIT(r0, 0x4004556d, 0xa) 18:19:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000000)=ANY=[@ANYBLOB="00000000000000000064c180d13e6a76551a91ca235aa378c0e3488b00000000000000000000000000", @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00']], 0x0, 0x0, 0x0}) 18:19:09 executing program 0: socket$unix(0x1, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) socket$inet6(0xa, 0x1, 0x0) openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400002, 0x0) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x8, 0x2, 0x9, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x4000000, 0x0, @perf_config_ext, 0x0, 0x3}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x8) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x10b, 0x6, 0x209e1e, 0x3, 0x1}, 0x2c) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000b40)={r0, &(0x7f0000000040), 0x0, 0x1}, 0x20) r1 = creat(&(0x7f0000000640)='./file0\x00', 0x100) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000980), 0x4) unlink(&(0x7f0000000940)='./file0\x00') r2 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r2, 0xc018620b, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x4, 0x0, &(0x7f00000000c0)=[@enter_looper], 0x48, 0x0, &(0x7f0000000700)="2ba063fb309ec7fdbfb08e6e91baee7d7d4599fe14129a4d426834556ae420e087d59c0c7be7fcad1abb7e1f8f446f373f611ca1ee9c2231708e18a47bc68a2a79a0b48931f6ff6d"}) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) shutdown(0xffffffffffffffff, 0x1) prctl$PR_SET_NAME(0xf, &(0x7f0000000380)='/group.stat\x00') ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat={0x73622a85}], &(0x7f0000000240)=[0x0]}}], 0xfffffffffffffe43, 0x0, &(0x7f00000003c0)}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0x0, 0x0, &(0x7f0000000780)}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x8, 0x0, &(0x7f0000000500)=[@release={0x40046306, 0x1}], 0x0, 0x0, &(0x7f00000009c0)}) r4 = creat(0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000a80)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r4, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000600)={&(0x7f0000000840)=ANY=[@ANYBLOB="00022bbd7000fedbdf253e4bb61228000200040004000800020001000000080001000300000008000100c581000008000200ffffffff68000100080003000000000044000400200001000a0067240000000fff020007000000000000360000000001bc0700003000020000000000000000aa020000001000010075004000000000000000000000000000000000003062364d920c315c56369b1813689658b6d477be092fa81e1ba7560dcdb3bc5b6e8979f7"], 0x1}, 0x1, 0x0, 0x0, 0x20000044}, 0x10) clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, &(0x7f0000000080), 0xffffffffffffffff) getpid() ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0xe, 0x0, &(0x7f0000000680)=[@acquire_done], 0xfffffffffffffeb3, 0x0, &(0x7f00000007c0)}) 18:19:09 executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) socket$packet(0x11, 0x2, 0x300) setsockopt$inet_tcp_int(r0, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) connect$inet(r0, &(0x7f0000000200)={0x2, 0x0, @empty}, 0x5d) setsockopt$inet_tcp_int(r0, 0x6, 0x4000000000014, &(0x7f0000000180)=0x80000000002, 0x93) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000100)={0x0, {0x2, 0x4e23, @broadcast}, {0x2, 0x4e24, @multicast2}, {0x2, 0x4e20, @multicast1}, 0x200, 0x0, 0x0, 0x0, 0x5, 0x0, 0x8001, 0x0, 0x7}) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000240)={0x0, 0x0, 0x5}, 0x14) setsockopt$inet_tcp_int(r0, 0x6, 0x8000000000019, &(0x7f0000000000)=0x80, 0x4) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x89) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f00000001c0)=0x4) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000080)=""/82) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000280)={0xe, 0x0, 0x7ff, 0x0, 0x98, "4e569ccf1d9aabe7dd2757e69d897e7e47befe32c2d3c8cf41178677b5afbf65f8152799ad5ef5ed4bcffdc8064d16ae0567f9a2c0cabf0f6772120ee4a8be666e8639b53b2366a5d6339bebf50760220fc642ffb53d5d8329209b748e7bf27c6409284341e753764abc5ffedb573c3fe2cd542a5f8c6c2f88bd824c311e6d4f96dd96f3b779a0f13d8306e125081cefdfa60f0bd6d85b7c"}, 0xa4) sendto$inet(r0, &(0x7f0000000080), 0xa103209d483eb54c, 0x0, 0x0, 0x240) [ 842.319035] binder: 25340:25346 got transaction with invalid offset (-8306926487407255774, min 0 max 24) or object. [ 842.342703] binder: 25342:25348 got transaction with invalid offset (0, min 0 max 24) or object. [ 842.358368] binder: 25342:25348 transaction failed 29201/-22, size 24-8 line 3348 [ 842.366928] binder: 25340:25346 transaction failed 29201/-22, size 24-8 line 3348 [ 842.376943] binder: 25342:25348 got transaction with invalid offset (0, min 0 max 24) or object. [ 842.377720] binder: undelivered TRANSACTION_ERROR: 29201 [ 842.386188] binder: 25340:25346 got transaction with invalid offset (-8306926487407255774, min 0 max 24) or object. [ 842.403198] binder: 25342:25348 transaction failed 29201/-22, size 24-8 line 3348 [ 842.409339] binder: undelivered TRANSACTION_ERROR: 29201 18:19:09 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200)=[@flat], &(0x7f0000000240)=[0x0]}}], 0x0, 0x0, 0x0}) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101, 0x0) write$P9_RCREATE(r1, &(0x7f0000000040)={0x18, 0x73, 0x1, {{0x80, 0x4, 0x3}, 0x100000000}}, 0x18) 18:19:09 executing program 5: r0 = syz_open_dev$binder(&(0x7f0000000400)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000018000000000000000800000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES64=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], @ANYPTR=&(0x7f0000000240)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00@']], 0x0, 0x0, 0x0}) [ 842.418956] binder: 25340:25346 transaction failed 29201/-22, size 24-8 line 3348 [ 842.421960] binder: undelivered TRANSACTION_ERROR: 29201 [ 842.446363] binder: BINDER_SET_CONTEXT_MGR already set [ 842.455859] binder: 25341:25347 ioctl 40046207 0 returned -16 [ 842.475794] binder: 25358:25359 got transaction with invalid offset (0, min 0 max 24) or object. [ 842.483351] binder: undelivered TRANSACTION_ERROR: 29201 [ 842.492239] binder: 25341:25347 Release 1 refcount change on invalid ref 1 ret -22 [ 842.504822] ------------[ cut here ]------------ [ 842.509620] kernel BUG at drivers/android/binder_alloc.c:1130! [ 842.524889] binder: 25358:25359 transaction failed 29201/-22, size 24-8 line 3348 [ 842.537556] invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 842.543477] Modules linked in: [ 842.546717] CPU: 1 PID: 25360 Comm: syz-executor.5 Not tainted 4.14.108+ #39 [ 842.553912] task: ffff8881c7ec5e00 task.stack: ffff8881a5de0000 [ 842.560066] RIP: 0010:binder_alloc_do_buffer_copy+0xc7/0x500 [ 842.563413] binder: undelivered TRANSACTION_ERROR: 29201 18:19:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000080)={0x0}, &(0x7f00000000c0)=0xc) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000100)=r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) fcntl$setsig(r2, 0xa, 0x41) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') close(r3) 18:19:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r0, 0x1002008912, &(0x7f0000000000)="0e96ca23ff6e253161000000") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') close(r1) [ 842.565862] RSP: 0018:ffff8881a5de75d0 EFLAGS: 00010216 [ 842.565873] RAX: 0000000000040000 RBX: 0000000020003990 RCX: 00000000000002f7 [ 842.565880] RDX: ffffffff82237477 RSI: ffffc90001521000 RDI: ffff8881c66f00d8 [ 842.565886] RBP: 0000000000000020 R08: ffff8881a5de78b0 R09: 0000000000000028 [ 842.565892] R10: ffffed1034bbcf06 R11: ffff8881a5de7837 R12: ffff8881d7061918 [ 842.565898] R13: 0000000000000028 R14: 4000000000000000 R15: ffff8881a5de78b0 [ 842.565909] FS: 00007f52f4faa700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000 18:19:09 executing program 1: r0 = accept4(0xffffffffffffff9c, &(0x7f0000000080)=@hci, &(0x7f0000000000)=0x80, 0x800) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000140)='TIPCv2\x00') sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000340)={&(0x7f0000000100), 0xc, &(0x7f0000000300)={&(0x7f0000000640)=ANY=[@ANYBLOB="780100008d6524de1ccd6284da75ba14f4101f102a788a8056e7a34330a47710f467c0ead4e019dfbd27db12d0eab70d54706771b9fc3c0a3ba4564568472679a453979f847470c4510e4709a18eab298dc68ae4cde2fb6e1154fabdf23a1e1af3bcb5442519eb26e4f5a04ec9c9fbe4889cc4619cda43c642d4e56cd4f0b55b06072bd10efb22ef3ad81fca7e9f0b142042a693a533fcc956dfae6f4eaab17fc411bbb105587c076ac03dd98fa232a26d7694cc83b30deec7b901cd716c130d02dffdbb805a5fd0f23089c1d941dc0d28509d3a289f1162a44ba303beda871a15a40bba8c347275bff6b8c14c7e80d04fe522112904653b009088f1b3bd7cf32dca", @ANYRES16=r1, @ANYBLOB="00032abd7000fbdbdf25030000000c00090008000100090000000c00050008000100657468002c000200080001001f00000008000200ff0f000008000200c1ffffff08000100ff00000008000100000000009c0005000800010069620000080001007564700034000200080001001500000008000100200000000800010001000000080001000300000008000200124400000800020003000000080001006574680044000200080003000500000008000200800000000800030040000000080001000d00000008000400d901000008000200ff01000008000300d200000008000100200000000800010065746800400004000c00010073797a310000000014000700080003000101000008000200000000001c000700080004000000008008000400040000000800030008000000380007000c000400ff000000000000000c0004000300000000000000080002000180ffff0800010001f8ffff0c00040001040000000000000c0009000800010001000000"], 0x178}, 0x1, 0x0, 0x0, 0x20000800}, 0x850) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000580)={r3, &(0x7f0000000440)="be19a2ec3eb7", &(0x7f0000000480)=""/228}, 0x18) sendto$inet(r0, &(0x7f00000005c0)="b015081dd2ba6ab271737d5ddd704aee8c0ef50b8e6dbd9228e16747079543546ffc803cbe61a6fa774b2f901f961f6b046b90379aced94e0bc3513db1813c0cd3c2a7e97fbed86d2e7b5c390c2dba85641338bd320cc9f856", 0x59, 0x8000, 0x0, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f00000003c0)={'ah\x00'}, &(0x7f0000000400)=0x1e) fcntl$getownex(r0, 0x10, &(0x7f0000000380)) close(r3) 18:19:09 executing program 1: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070") r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='smaps\x00') close(r0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'ip6erspan0\x00', 0x0}) write$selinux_access(r1, &(0x7f00000000c0)={'system_u:object_r:hald_var_lib_t:s0', 0x20, 'unconfined', 0x20, 0xc28}, 0x44) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000080)={@remote, r2}, 0x14) [ 842.621604] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 842.627494] CR2: 000000000073c000 CR3: 00000001d6ff2004 CR4: 00000000001606a0 [ 842.634799] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 842.642075] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 842.649357] Call Trace: [ 842.651979] ? binder_alloc_do_buffer_copy+0x1ef/0x500 [ 842.657278] binder_get_object+0x90/0x190 [ 842.661448] binder_transaction+0x1e2d/0x5640 [ 842.666016] ? check_preemption_disabled+0x35/0x1f0 [ 842.671052] ? binder_inc_ref_for_node+0xba0/0xba0 [ 842.676023] ? perf_trace_lock+0x11e/0x4e0 [ 842.680279] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 842.685233] ? __save_stack_trace+0x7a/0xf0 [ 842.689597] ? __might_fault+0x104/0x1b0 [ 842.693697] ? lock_downgrade+0x5d0/0x5d0 [ 842.697852] ? lock_acquire+0x10f/0x380 [ 842.701832] ? __might_fault+0xd4/0x1b0 [ 842.705819] ? __might_fault+0x177/0x1b0 [ 842.709876] ? binder_thread_write+0x512/0x1f90 [ 842.714559] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 842.719520] ? drop_futex_key_refs.isra.0+0x17/0xa0 [ 842.724527] ? binder_transaction+0x5640/0x5640 [ 842.729189] ? lock_downgrade+0x5d0/0x5d0 [ 842.733329] ? lock_acquire+0x10f/0x380 [ 842.737318] ? __might_fault+0xd4/0x1b0 [ 842.741283] ? __might_fault+0x177/0x1b0 [ 842.745335] ? binder_ioctl+0xd48/0x14ea [ 842.749383] ? binder_poll+0x230/0x230 [ 842.753255] ? __lock_acquire+0x56a/0x3fa0 [ 842.757474] ? perf_trace_lock+0x11e/0x4e0 [ 842.761706] ? check_preemption_disabled+0x35/0x1f0 [ 842.766743] ? perf_trace_lock_acquire+0x4e0/0x4e0 [ 842.771664] ? check_preemption_disabled+0x35/0x1f0 [ 842.776672] ? binder_poll+0x230/0x230 [ 842.780557] ? do_vfs_ioctl+0xabe/0x1040 [ 842.784612] ? selinux_file_ioctl+0x426/0x590 [ 842.789092] ? selinux_file_ioctl+0x116/0x590 [ 842.793588] ? ioctl_preallocate+0x1e0/0x1e0 [ 842.798000] ? selinux_parse_skb.constprop.0+0x16b0/0x16b0 [ 842.803646] ? __fget+0x1ff/0x360 [ 842.807089] ? lock_downgrade+0x5d0/0x5d0 [ 842.811219] ? lock_acquire+0x10f/0x380 [ 842.815207] ? __fget+0x44/0x360 [ 842.818574] ? check_preemption_disabled+0x35/0x1f0 [ 842.823597] ? security_file_ioctl+0x7c/0xb0 [ 842.828001] ? SyS_ioctl+0x7f/0xb0 [ 842.831552] ? do_vfs_ioctl+0x1040/0x1040 [ 842.835694] ? do_syscall_64+0x19b/0x4b0 [ 842.839766] ? entry_SYSCALL_64_after_hwframe+0x42/0xb7 [ 842.845138] Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 0d 04 00 00 48 8b 6d 58 48 29 dd e8 33 33 0d ff 49 39 ed 76 07 e8 29 33 0d ff <0f> 0b e8 22 33 0d ff 4c 29 ed 49 39 ee 77 ec e8 15 33 0d ff 41 [ 842.864464] RIP: binder_alloc_do_buffer_copy+0xc7/0x500 RSP: ffff8881a5de75d0 [ 842.877335] ---[ end trace 6c2a1828be1b7a2e ]--- [ 842.882214] Kernel panic - not syncing: Fatal exception [ 842.887979] Kernel Offset: 0x11000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 842.899007] Rebooting in 86400 seconds..